2HOT 2PAY · App

PRIVACY NOTICE FOR 2HOT 2PAY

Updated 16 September 2026

This notice explains how information is processed when you register for and use 2HOT 2PAY. It covers Creator accounts, Partner access, offers, check-ins and platform operation. It explains what a venue receives and what happens when you delete an account. This notice is not blanket consent.

1 Who is responsible for your information

2H2P UG (haftungsbeschränkt) is the controller for the processing described in this notice. Our address is Marienstraße 10, 40212 Düsseldorf, Germany. The company is represented by managing director Michael Huss and registered with the Local Court of Düsseldorf under HRB 78654.

For privacy questions and requests to exercise your rights, contact info@2hot2pay.com or write to the address above.

2 Your account and creator profile

For a Creator account, we process your first and last name, date of birth, mobile number, profile photograph, selected city and Instagram details. An email address is needed in particular where it serves as a login or account-recovery channel. Other available profile details, such as another social media handle, are optional and can be removed. We also keep an account ID, settings, review and approval status, and the date and version of your contractual declarations. Required fields are identified when you enter them.

Your date of birth allows us to check the minimum age of 18. Your phone number and profile details support a personal review of whether an account is genuine and belongs to one identifiable person, and help resolve access or booking problems. This may involve contacting you on your mobile number. A private social media profile and private use of 2HOT 2PAY are possible; working as a commercial influencer is not a general requirement. For Partner accounts, we process business and contact-person details, access rights and information about agreements and billing.

The mobile number you provide is confirmed in a separate step. To do this we send a one-time confirmation code to that number through the WhatsApp Business Platform operated by Meta Platforms Ireland Limited. Only the phone number and the code are transmitted. We store the number, the confirmation status and the time of confirmation; the code itself is kept only for its short validity period. The legal basis is Art. 6(1)(b) GDPR for the access you requested and Art. 6(1)(f) GDPR for checking duplicate or false registrations. Meta Platforms Ireland Limited processes the delivery of the message as its own controller under its own notices; for recipients outside Europe see section 10. If WhatsApp is not available to you, the number can be confirmed another way after contacting support; we record the reason.

Requested registration and performance of the user relationship rely on Article 6(1)(b) GDPR. Necessary misuse checks rely on Article 6(1)(f) GDPR and our interest in preventing false identities and duplicate use. These checks must be necessary and proportionate. Without the information required for a particular purpose, we cannot provide the account or affected feature. Legally required contract and billing records are processed under Article 6(1)(c) GDPR. Information about a Partner business's contacts who are not themselves parties to the contract is processed for business communication under Article 6(1)(f) GDPR.

3 Instagram and other social media details

Signing in through Instagram establishes a connection with Meta. We process the account ID, Instagram handle, account type, follower count and technical authorisation data needed for that connection. The information comes from the connection or is checked manually against your details and evidence you make available. A private or technically unsupported Instagram account may require manual review.

We do not receive your Instagram password or retrieve private messages, address books, follower lists or complete account insights for this service. For manual review, please submit only the evidence requested and conceal unnecessary information.

The individual review may include a six-digit confirmation code that we send as a direct message to the Instagram account you provided and that you enter in the app. We record that and when the code was confirmed. The legal basis is Art. 6(1)(f) GDPR and our interest in ruling out third-party or invented profiles.

Information needed for your requested login and account association is processed under Article 6(1)(b) GDPR; additional misuse checks rely on Article 6(1)(f) GDPR. Technical permission at Meta does not automatically authorise unrelated purposes. Any additional processing requiring consent is explained separately and starts only after consent. You can revoke the connection in your Meta settings. This stops further retrieval; a login depending on that connection may then stop working. Please contact support about alternative access. Meta Platforms Ireland Limited is independently responsible for processing within its own services; see privacycenter.instagram.com/policy/.

4 Which offers you see

Offers are matched using your selected city, offer conditions, profile categories, approvals, level and previous redemptions. This involves evaluating profile and usage information, for example whether a benefit has already been used within the relevant period. This matching may constitute profiling. We rely on Article 6(1)(b) GDPR insofar as it is necessary for the personalised service you request.

City selection does not require your device's GPS location. If you open an external map or route service through a link, that provider handles the resulting information under its own notice.

5 Vouchers check-ins and guest lists

For a booking, check-in or redemption, we record the account and Deal IDs, venue or event, time and status. This lets us confirm eligibility, maintain guest lists and recognise benefits already used. Performing the requested offer relies on Article 6(1)(b) GDPR. Necessary checks for suspicious duplicate or fictitious redemptions rely on Article 6(1)(f) GDPR and our interest in reliable operation.

At an ordinary check-in, the venue receives your first name, profile photograph, Instagram handle and follower count, together with information about the specific offer and its redemption status. Your surname, email address, phone number, date of birth, level and history with other Partners are not part of this standard view. Your profile is not published in a public Creator directory.

Special events, guest lists or personalised tickets may also require your full name, email address or phone number, for example for ticket delivery or admission. Before you register, the Deal identifies the specific information, recipient and purpose. We share only what is necessary for that purpose under Article 6(1)(b) GDPR. A note in a Deal does not permit unrestricted collection or automatic marketing use. If you do not want that additional disclosure, you can choose not to take that offer and continue using other available functions.

6 Activity history points levels and referrals

Your account records check-ins, redemptions and event registrations, including cancellations and resolved complaints. Points are credited for the events described in the app. Levels are separate access categories: they may be initially populated from profile information and set or adjusted following personal review. We record the current level and the eligibility applicable to offers already booked.

In addition to the level derived from your profile details, 2HOT 2PAY may assign a further internal rating that unlocks additional offers. It is based on an individual assessment, is stored together with a reason and a timestamp, and is not a decision based solely on automated processing. On request we explain your rating and have it reviewed.

After an event we may ask you whether it took place as announced. We store your answer with your account and the event concerned. It is used to examine complaints about cancelled events or events that differed substantially from the description; several matching responses may lead us to pause the Partner's offers as a precaution and review the case. The Partner is told the outcome of the review but does not receive individual answers linked to your account. Answering is voluntary and has no negative effect on your account. The legal basis is Art. 6(1)(f) GDPR and our interest in reliable offers.

For internal support we combine existing check-ins into an overview showing the Partner location you visited most recently and the time, including as a marker on a map. This is based solely on the check-ins you triggered yourself at a Partner and on the address of that location. No location is determined through your device: the app does not request GPS, does not track movement and does not record where you are outside a check-in. Access is limited to 2H2P staff who need this overview for support or for reviewing cases of misuse. The legal basis is Art. 6(1)(f) GDPR.

A referral is recorded through the personal code or link used, the relationship between the referring account and the new registration, the approval milestone relevant to the reward and any points awarded. 2HOT 2PAY does not need access to your address book for referrals. If you share a referral through another app, that provider handles the information processed within its service.

We use this information for the history, correct point awards, offer eligibility and error resolution under Article 6(1)(b) GDPR. Records of specific misuse or disputes rely on Article 6(1)(f) GDPR. A reported no-show is not treated as established misconduct without review. You can ask support to check an incorrect entry or assessment.

7 Messages enquiries and support

For an enquiry, we process your message, contact details and the account or Deal information needed to resolve it. Please include only necessary information in optional attachments. Requests about a contract or entering one rely on Article 6(1)(b) GDPR; other requests rely on our legitimate interest in responding under Article 6(1)(f) GDPR.

Necessary account messages and messages for your requested login or booking support contract performance under Article 6(1)(b) GDPR. Security-only alerts may rely on Article 6(1)(f) GDPR. Marketing is separate. Where offered, we obtain separate, voluntary consent under Article 6(1)(a) GDPR. Declining does not affect your account; you can withdraw at any time through info@2hot2pay.com or an available unsubscribe function. An operating-system notification permission does not replace any required marketing consent.

8 Technical operation and external links

Operating the service generates IP addresses, browser and device information, timestamps, session identifiers, requested functions and error and security logs. Processing necessary for the connection and session relies on Article 6(1)(b) GDPR. Troubleshooting and necessary protection against attacks rely on Article 6(1)(f) GDPR and our interest in secure accounts and a functioning service.

Login and protection against unauthorised requests use technically necessary cookies or comparable storage under section 25(2)(2) TDDDG. Non-essential storage access and tracking require prior information and, where legally required, consent under section 25(1) TDDDG, together with a legal basis for subsequent processing. This notice does not replace that consent.

The map inside the app is served by us. Loading the map material does not trigger any request to a map provider outside our own operation. If you open a route or map link to an external service, the following paragraph applies.

External shop, social media or map links take you to another provider. It handles information arising on access under its own notice. For the platform operation described here, we do not receive individual order contents from external shops.

9 Who can receive personal information

Within 2H2P, access is limited to people who need information for their tasks. Infrastructure and operation may use instructed providers in the categories of hosting, storage and backups, technical maintenance and message delivery. Their access is limited to their assignment; providers acting as processors are contractually bound under Article 28 GDPR. Selecting a provider does not expand the purposes described here.

Venues and organisers receive the information described in section 5. Where they determine admission, ticket delivery or necessary records for their own activities, they act as independent controllers. 2H2P can help with questions about disclosure by the platform; the Partner can answer questions about its subsequent processing. Meta is responsible for its own Instagram services. Legal advisers and competent authorities receive information only as required for a specific legal matter or statutory obligation.

Even for a special event, contact details are not automatically released for the Partner's marketing. The Partner needs a separate legal basis and must explain its processing. We do not sell contact details disclosed during check-in as a marketing address list.

10 Processing outside Europe

According to Meta's information, Instagram use may involve recipients outside the European Economic Area. Transfers we initiate must meet Articles 44 onwards GDPR. An adequacy decision applies only to the country or recipient it covers. Otherwise, suitable safeguards are required, particularly standard contractual clauses and supplementary measures where needed. You can request details and a copy of the safeguards actually used at info@2hot2pay.com. Any further international transfers through new technical services must be assessed specifically and added to this notice before those services are used.

11 How long information is kept

Profile information is kept while needed for the active account. Optional details no longer needed are removed. Manually submitted verification evidence is deleted after the review, no later than 90 days afterwards, unless a specific dispute or misuse case justifies limited further retention. Support records are kept for their handling and any necessary subsequent resolution; indefinite retention for merely possible future purposes is not intended.

Account deletion ends access; ordinary profile and account information is deleted or genuinely anonymised within 30 days. Personal information may remain longer only for a defined purpose, such as a specific statutory retention duty or a documented claim or misuse case. Access is restricted and we review when that reason ends. Removing names alone does not anonymise a check-in history that can still be linked to you; data protection rules continue to apply. Backups are protected, are not used for everyday operation and are overwritten under the defined backup cycle. If a backup is restored, deletions already carried out must be reapplied.

12 Your choices and data protection rights

You can change profile details and available message preferences in your account. You can revoke an Instagram connection through Meta; section 3 explains possible login consequences. You can exercise privacy rights without an active account.

Subject to the GDPR, you have rights to information and a copy of your data, correction, deletion, restriction and transfer of eligible data in a commonly used format. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to direct marketing at any time without giving a reason. You may withdraw consent for the future at any time; this does not affect the lawfulness of earlier processing.

Send a request to info@2hot2pay.com. We may ask for reasonable information to confirm that the request relates to you. Requests are normally answered within one month, subject to the extensions and exceptions permitted by law, and are ordinarily free of charge.

13 Complaints

You may complain to a data protection authority, particularly in the EU or EEA country where you live or work or where you believe an infringement occurred. The supervisory authority for 2H2P in North Rhine-Westphalia is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, poststelle@ldi.nrw.de.

14 Account reviews and automated processing

Offer listings, point awards and checks for benefits already used may be automated. Section 4 explains the purpose of the categories and levels involved. A person decides account admission and permanent bans. You can request human review of errors. We do not make solely automated decisions producing legal or similarly significant effects within Article 22 GDPR.

15 Updates to this notice

We will revise this notice when the app, our processing or the applicable rules change. The current version will be available through the app or the related 2HOT 2PAY service. We will draw attention to material changes in an appropriate way. If a new activity requires consent, we will ask for it before relying on that consent.