Version dated 10 October 2026 · Effective from 10 October 2026
1.1. This Policy explains what personal data Watchering (the Platform, we) processes when you use https://watchering.com and the Watchering services (the Service), why, on what legal basis, where it is stored, with whom it is shared and what rights you (the User) have.
1.2. This Policy has been prepared in light of the data protection laws in force in 2026, in particular:
(a) Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR);
(b) the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG), as the Service's servers are located in Germany;
(c) other data protection laws of the countries where Users are located, to the extent they apply to the Platform, including the UK GDPR, the California Consumer Privacy Act as amended by the CPRA, and the Brazilian LGPD.
1.3. The Platform is the controller of your personal data. Contact for all data protection matters: info@watchering.com. Contact details of our representative in the EU, where one is required under Article 27 GDPR, are available on request at the same address.
1.4. Where applicable law requires your consent, it is obtained through a separate document — the Consent to Personal Data Processing — and is not bundled with the User Agreement or other documents.
1.5. The Service does not accept payments and does not process payment or financial data.
1.6. This Policy applies only to the Service. The Platform does not control third-party websites you visit via links in search results.
2.1. Data you provide when creating an Account or contacting us:
(a) full name;
(b) phone number or email address (one of them, at your choice);
(c) country of residence — to select the language of the interface and notifications.
2.2. If you publish a review: the review text, rating and displayed first name.
2.3. We do not collect identity document data, date or place of birth, home address, financial or family status, payment data, special categories of data (health, beliefs, etc.) or biometric data. Please do not include such information in requests or reviews.
2.4. Technical data strictly necessary to operate and protect the Service, processed to a minimal extent:
(a) IP address, browser and device type, date and time of the request, requested page URL and error codes — in server logs;
(b) strictly necessary and functional cookies — as described in the Cookie Policy.
2.5. Analytics data — only with your consent. If you accept analytics cookies, Google Analytics 4 and Yandex Metrica collect pseudonymous data about your visit: cookie identifiers, pages viewed, referring source, time on page, clicks and scrolling, device, operating system, browser, screen resolution, and approximate location (country and city) derived from the IP address. If Yandex Metrica Webvisor is enabled, your actions on the page are recorded with form fields masked. Your name, phone number and email address are not passed to these services.
2.6. Search queries are processed to deliver results and are not linked to your name or contact details. They are not used for advertising, profiling or assessment of Users. They are excluded from page addresses sent to Google Analytics and Yandex Metrica. They are kept in server logs for the period stated in section 3 and thereafter only in anonymised, aggregated form to improve search quality.
| Purpose | Data | Legal basis (GDPR) | Retention period |
|---|---|---|---|
| Creating and maintaining your Account; identifying you | Name, phone or email, country | Art. 6(1)(b) — performance of a contract | While the Account exists + up to 30 days after deletion |
| Performing contracts with you (User Agreement, Terms of Use, License), including publishing reviews | Name, contact, country, reviews | Art. 6(1)(b) | Term of the contract + up to 30 days |
| Informing you: service notices, changes to documents, security, replies to requests | Name, phone or email | Art. 6(1)(b); Art. 6(1)(c) | Term of the contract; requests — 1 year after the reply |
| Selecting the language of the interface and notifications | Country of residence | Art. 6(1)(b) | While the Account exists |
| Operating and securing the Service, preventing abuse | Technical data, search queries in logs | Art. 6(1)(f) — legitimate interest in a secure service | Up to 30 days |
| Web analytics: measuring visits and improving the Website (Google Analytics 4, Yandex Metrica) | Cookie identifiers, usage and device data, approximate location | Art. 6(1)(a) — consent; Section 25(1) TDDDG | Google Analytics — 14 months; Yandex Metrica — [per counter settings]; cookies — see Cookie Policy |
| Complying with legal obligations (requests from data subjects and authorities) | As necessary | Art. 6(1)(c) | As required by law |
3.1. We do not use personal data for advertising or marketing messages (Google Analytics advertising features and Google Signals are disabled), do not sell it, do not share it for cross-context behavioural advertising (including "sale" and "sharing" within the meaning of the CCPA/CPRA) and do not make decisions producing legal effects based solely on automated processing.
3.2. Personal data is not made public, except for the first name and review text you choose to publish yourself.
4.1. The Service's servers are located in the Federal Republic of Germany (European Union). Our hosting provider processes data on our behalf under a data processing agreement (Article 28 GDPR).
4.2. Analytics data (only if you consent) is processed by Google and Yandex on their own infrastructure, as described in section 5.
5.1. As the Service is international, personal data may be transferred across borders:
(a) to Germany — for storage and operation of the Service, from any country where Users are located;
(b) to the Platform's authorised personnel and service providers outside the European Economic Area (EEA) — to administer Accounts, perform contracts and inform Users;
(c) to providers of email and SMS delivery services — to send notifications;
(d) to Google Ireland Limited and Google LLC (USA) — Google Analytics, only with your consent;
(e) to YANDEX LLC (Russian Federation) — Yandex Metrica, only with your consent.
5.2. The purposes of international transfers are the performance of contracts with the User (User Agreement, Terms of Use, License) and informing the User. Only the name, phone number or email address, country of residence and, where necessary, technical data are transferred for these purposes. In addition, with your consent, analytics data is transferred to Google and Yandex for web analytics.
5.3. Transfers outside the EEA take place only on the basis of:
(a) a European Commission adequacy decision for the recipient country; or
(b) the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) concluded with the recipient, together with supplementary measures where needed; or
(c) for occasional transfers necessary for the performance of a contract with you, Article 49(1)(b) GDPR, and where applicable your explicit consent under Article 49(1)(a) GDPR.
5.4. Transfers of Google Analytics data to Google LLC in the USA are based on the EU-US Data Privacy Framework adequacy decision (Google LLC is certified under it) and, in addition, on the Standard Contractual Clauses included in Google's data processing terms.
5.5. There is no EU adequacy decision for the Russian Federation, and the Standard Contractual Clauses may not ensure equivalent protection there. Transfers of Yandex Metrica data are therefore based on your explicit consent under Article 49(1)(a) GDPR, given in the cookie notice after you have been informed of the following risks: the data may be accessible to public authorities without safeguards and remedies equivalent to EU law, and enforcement of your rights may be more difficult. You may refuse or withdraw this consent at any time without affecting your use of the Service.
5.6. Please note that the recipient country may not provide a level of data protection equivalent to that of the EU. A copy of the safeguards applied may be requested at info@watchering.com.
5.7. For transfers subject to other legal systems, the mechanisms provided by those laws are used (for example, the UK International Data Transfer Addendum or the transfer mechanisms of the LGPD).
6.1. We use only the processors necessary to run the Service (hosting, notification delivery and, with your consent, web analytics by Google and Yandex), under contracts requiring them to keep the data confidential and secure and to process it only on our instructions. An up-to-date list of processors is available on request.
6.2. Data may be disclosed to public authorities only upon a lawful request and to the extent required by law.
6.3. If the Service is reorganised or transferred to another entity, the obligations under this Policy pass to the successor, and Users are notified in advance.
7.1. When you delete your Account, withdraw consent (where processing is based on it) or the purposes of processing are achieved, we stop processing and delete the data within 30 days, unless retention is required by law. Backups are overwritten within 30 days.
8.1. You have the right to:
(a) obtain information about the processing of your data and a copy of it;
(b) have inaccurate or incomplete data corrected;
(c) have your data erased or its processing restricted;
(d) receive your data in a structured, machine-readable format (data portability);
(e) object to processing based on legitimate interests;
(f) withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
(g) not be subject to decisions based solely on automated processing;
(h) if you are a California resident — know what data is collected, request its deletion and correction, and not be discriminated against for exercising your rights (the Platform does not sell or share data for behavioural advertising);
(i) lodge a complaint with a supervisory authority — in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement — or with the competent authority of your country, or bring legal proceedings.
8.2. You can withdraw consent to analytics cookies at any time via the "Cookie settings" link at the bottom of every page.
8.3. Requests may be sent to info@watchering.com or made through your Account settings. We may ask you to verify your identity using only data we already hold.
8.4. We respond within one month (extendable by two further months where necessary, with notice to you) under the GDPR, within 45 days under the CCPA, and otherwise within the time limits set by the law applicable to you. Responses are free of charge.
9.1. We implement appropriate technical and organisational measures under Article 32 GDPR, including encrypted connections (TLS), encryption of data at rest, access control and logging, backups, regular software updates and confidentiality obligations for persons with access to data.
9.2. In the event of a personal data breach, we notify the competent supervisory authority within 72 hours of becoming aware of it (Article 33 GDPR) and notify affected Users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
10.1. The Service is not intended for persons under 16 (or a higher age where required by the law of their country). We do not knowingly collect children's data. If such data is collected, it is deleted upon discovery; parents and guardians may contact us at info@watchering.com.
11.1. We may update this Policy. Registered Users are notified of material changes at least 15 days in advance by email or phone and in the Service interface. If changes require new consent, it is requested separately.
11.2. The current version is available at https://watchering.com/documents.
Watchering — https://watchering.com
Data protection contact: info@watchering.com