Legal notice
Service provider
Schmaul Games
Willy-Brandt-Straße
64653 Lorsch
Germany
Contact options
Email address: rakhtheboardgame@gmail.com
Contact form: https://rakh.io/contact
Social Media and other online presences
This imprint also applies to the following social media presences and online profiles:
https://www.instagram.com/rakhtheboardgame/
https://discord.gg/sjMv2pBAdT
https://www.patreon.com/Rakh
Privacy Policy
Preamble
With the following privacy policy we would like to inform you which types of your personal data
(hereinafter also abbreviated as "data") we process for which purposes and in which scope. The
privacy statement applies to all processing of personal data carried out by us, both in the
context of providing our services and in particular on our websites, in mobile applications and
within external online presences, such as our social media profiles (hereinafter collectively
referred to as "online services").
The terms used are not gender-specific.
Last Update: 14. October 2025
Table of contents
Controller
Paul Robertz
Willy-Brandt-Straße 7
64653 Lorsch, Germany
E-mail address: rakhtheboardgame@gmail.com
Overview of processing operations
The following table summarises the types of data processed, the purposes for which they are
processed and the concerned data subjects.
Categories of Processed Data
- Inventory data.
- Payment Data.
- Contact data.
- Content data.
- Contract data.
- Usage data.
- Meta, communication and process data.
- Log data.
Categories of Data Subjects
- Service recipients and clients.
- Prospective customers.
- Communication partner.
- Users.
- Business and contractual partners.
Purposes of Processing
- Provision of contractual services and fulfillment of contractual obligations.
- Communication.
- Security measures.
- Direct marketing.
- Office and organisational procedures.
- Organisational and Administrative Procedures.
- Feedback.
- Marketing.
- Provision of our online services and usability.
- Information technology infrastructure.
- Public relations.
- Business processes and management procedures.
Relevant legal bases
Relevant legal bases according to the GDPR: In the following, you will find an
overview of the legal basis of the GDPR on which we base the processing of personal data. Please
note that in addition to the provisions of the GDPR, national data protection provisions of your
or our country of residence or domicile may apply. If, in addition, more specific legal bases
are applicable in individual cases, we will inform you of these in the data protection
declaration.
-
Consent (Article 6 (1) (a) GDPR) - The data subject has given consent to the
processing of his or her personal data for one or more specific purposes.
-
Performance of a contract and prior requests (Article 6 (1) (b) GDPR) -
Performance of a contract to which the data subject is party or in order to take steps at the
request of the data subject prior to entering into a contract.
-
Compliance with a legal obligation (Article 6 (1) (c) GDPR) - Processing is
necessary for compliance with a legal obligation to which the controller is subject.
-
Legitimate Interests (Article 6 (1) (f) GDPR) - the processing is necessary
for the protection of the legitimate interests of the controller or a third party, provided
that the interests, fundamental rights, and freedoms of the data subject, which require the
protection of personal data, do not prevail.
National data protection regulations in Germany: In addition to the data
protection regulations of the GDPR, national regulations apply to data protection in Germany.
This includes in particular the Law on Protection against Misuse of Personal Data in Data
Processing (Federal Data Protection Act - BDSG). In particular, the BDSG contains special
provisions on the right to access, the right to erase, the right to object, the processing of
special categories of personal data, processing for other purposes and transmission as well as
automated individual decision-making, including profiling. Furthermore, data protection laws of
the individual federal states may apply.
Relevant legal basis according to the Swiss Data Protection Act: If you are
located in Switzerland, we process your data based on the Federal Act on Data Protection
(referred to as "Swiss DPA"). Unlike the GDPR, for instance, the Swiss DPA does not generally
require that a legal basis for processing personal data be stated and that the processing of
personal data is conducted in good faith, lawfully and proportionately (Art. 6 para. 1 and 2 of
the Swiss DPA). Furthermore, we only collect personal data for a specific purpose recognizable
to the data subject and process it only in a manner compatible with this purpose (Art. 6 para. 3
of the Swiss DPA).
Reference to the applicability of the GDPR and the Swiss DPA: These privacy
policy serves both to provide information pursuant to the Swiss Federal Act on Data Protection
(FADP) and the General Data Protection Regulation (GDPR). For this reason, we ask you to note
that due to the broader spatial application and comprehensibility, the terms used in the GDPR
are applied. In particular, instead of the terms used in the Swiss FADP such as "processing" of
"personal data", "predominant interest", and "particularly sensitive personal data", the terms
used in the GDPR, namely "processing" of "personal data", as well as "legitimate interest" and
"special categories of data" are used. However, the legal meaning of these terms will continue
to be determined according to the Swiss FADP within its scope of application.
Security Precautions
We take appropriate technical and organisational measures in accordance with the legal
requirements, taking into account the state of the art, the costs of implementation and the
nature, scope, context and purposes of processing as well as the risk of varying likelihood and
severity for the rights and freedoms of natural persons, in order to ensure a level of security
appropriate to the risk.
The measures include, in particular, safeguarding the confidentiality, integrity and
availability of data by controlling physical and electronic access to the data as well as access
to, input, transmission, securing and separation of the data. In addition, we have established
procedures to ensure that data subjects' rights are respected, that data is erased, and that we
are prepared to respond to data threats rapidly. Furthermore, we take the protection of personal
data into account as early as the development or selection of hardware, software and service
providers, in accordance with the principle of privacy by design and privacy by default.
Securing online connections through TLS/SSL encryption technology (HTTPS): To protect the data
of users transmitted via our online services from unauthorized access, we employ TLS/SSL
encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the
cornerstones of secure data transmission on the internet. These technologies encrypt the
information that is transferred between the website or app and the user's browser (or between
two servers), thereby safeguarding the data from unauthorized access. TLS, as the more advanced
and secure version of SSL, ensures that all data transmissions conform to the highest security
standards. When a website is secured with an SSL/TLS certificate, this is indicated by the
display of HTTPS in the URL. This serves as an indicator to users that their data is being
securely and encryptedly transmitted.
Transmission of Personal Data
In the course of processing personal data, it may happen that this data is transmitted to or
disclosed to other entities, companies, legally independent organizational units, or
individuals. Recipients of this data may include service providers tasked with IT duties or
providers of services and content that are integrated into a website. In such cases, we observe
the legal requirements and particularly conclude relevant contracts or agreements that serve to
protect your data with the recipients of your data.
International data transfers
Data Processing in Third Countries: If we transfer data to a third country (i.e., outside the
European Union (EU) or the European Economic Area (EEA)), or if this occurs in the context of
using third-party services or the disclosure or transfer of data to other individuals, entities,
or companies (which becomes apparent either from the postal address of the respective provider
or when explicitly mentioned in the privacy policy regarding data transfer to third countries),
this is always done in accordance with legal requirements.
For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which has
been recognized as a secure legal framework by the EU Commission's adequacy decision of July 10,
2023. Additionally, we have concluded Standard Contractual Clauses with the respective
providers, which comply with the EU Commission's requirements and establish contractual
obligations to protect your data.
This dual safeguard ensures comprehensive protection of your data: The DPF serves as the primary
level of protection, while the Standard Contractual Clauses act as an additional security
measure. Should any changes occur within the DPF framework, the Standard Contractual Clauses
will serve as a reliable fallback option. This ensures that your data remains adequately
protected even in the event of political or legal changes.
For individual service providers, we will inform you whether they are certified under the DPF
and if Standard Contractual Clauses are in place. The list of certified companies and further
information about the DPF can be found on the U.S. Department of Commerce's website at
https://www.dataprivacyframework.gov/.
For data transfers to other third countries, appropriate safeguards apply, particularly Standard
Contractual Clauses, explicit consent, or legally required transfers. Information on
third-country transfers and applicable adequacy decisions can be found in the information
provided by the EU Commission:
https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en.
We will inform you which of our service providers are certified under the Data Privacy Framework
as part of our data protection notices.
Disclosure of Personal Data Abroad: In accordance with the Swiss Data Protection Act (Swiss
DPA), we only disclose personal data abroad when an appropriate level of protection for the
affected persons is ensured (Art. 16 Swiss DPA). If the Federal Council has not determined an
adequate level of protection (list of states:
https://www.bj.admin.ch/bj/de/home/staat/datenschutz/internationales/anerkennung-staaten.html), we implement alternative security measures.
For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which has
been recognized as a secure legal framework by Switzerland's adequacy decision of June 7, 2024.
Additionally, we have concluded Standard Data Protection Clauses with the respective providers,
which have been approved by the Federal Data Protection and Information Commissioner (FDPIC) and
establish contractual obligations to protect your data.
This dual safeguard ensures comprehensive protection of your data: The DPF serves as the primary
level of protection, while the Standard Data Protection Clauses act as an additional security
measure. Should any changes occur within the DPF framework, the Standard Data Protection Clauses
will serve as a reliable fallback option. This ensures that your data remains adequately
protected even in the event of political or legal changes.
For individual service providers, we will inform you whether they are certified under the DPF
and if Standard Data Protection Clauses are in place. The list of certified companies and
further information about the DPF can be found on the U.S. Department of Commerce's website at
https://www.dataprivacyframework.gov/.
For data transfers to other third countries, appropriate safeguards apply, including
international agreements, specific guarantees, FDPIC-approved Standard Data Protection Clauses,
or internal company data protection regulations previously recognized by the FDPIC or a
competent data protection authority of another country.
Under Art. 16 of the Swiss DPA, exceptions can be made for the disclosure of data abroad if
certain conditions are met, including the consent of the affected person, contract execution,
public interest, protection of life or physical integrity, publicly made data, or data from a
legally provided register. Such disclosures always comply with the legal requirements.
We will inform you which of our service providers are certified under the Data Privacy Framework
as part of our privacy notices.
General Information on Data Retention and Deletion
We delete personal data that we process in accordance with legal regulations as soon as the
underlying consents are revoked or no further legal bases for processing exist. This applies to
cases where the original purpose of processing is no longer applicable or the data is no longer
needed. Exceptions to this rule exist if statutory obligations or special interests require a
longer retention or archiving of the data.
In particular, data that must be retained for commercial or tax law reasons, or whose storage is
necessary for legal prosecution or protection of the rights of other natural or legal persons,
must be archived accordingly.
Our privacy notices contain additional information on the retention and deletion of data
specifically applicable to certain processing processes.
In cases where multiple retention periods or deletion deadlines for a date are specified, the
longest period always prevails.
Data that is no longer stored for its originally intended purpose but due to legal requirements
or other reasons are processed exclusively for the reasons justifying their retention.
Data Retention and Deletion: The following general deadlines apply for the retention and
archiving according to German law:
-
10 Years - Fiscal Code/Commercial Code - Retention period for books and records, annual
financial statements, inventories, management reports, opening balance sheet as well as the
necessary work instructions and other organisational documents (Section 147 Paragraph 1 No. 1
in conjunction with Paragraph 3 of the German General Tax Code (AO), Section 14b Paragraph 1
of the German VAT Act (UStG), Section 257 Paragraph 1 No. 1 in conjunction with Paragraph 4 of
the German Commercial Code (HGB)).
-
8 years - Accounting documents, such as invoices, booking and expense receipts (Section 147
Paragraph 1 No. 4 and 4a in conjunction with Paragraph 3 of the German General Tax Code (AO),
Section 257 Paragraph 1 No. 4 in conjunction with Paragraph 4 of the German Commercial Code
(HGB))
-
6 Years - Other business documents: received commercial or business letters, copies of
dispatched commercial or business letters, and other documents to the extent that they are
significant for taxation purposes, for example, hourly wage slips, operating accounting
sheets, calculation documents, price tags, as well as payroll accounting documents, provided
they are not already accounting vouchers and cash register tapes Section (Section 147
Paragraph 1 No. 2, 3, 5 in conjunction with Paragraph 3 of the German General Tax Code (AO),
Section 257 Paragraph 1 No. 2 and 3 in conjunction with Paragraph 4 of the German Commercial
Code (HGB)).
-
3 Years - Data required to consider potential warranty and compensation claims or similar
contractual claims and rights, as well as to process related inquiries, based on previous
business experiences and common industry practices, will be stored for the duration of the
regular statutory limitation period of three years. This period begins at the end of the year
in which the relevant contractual transaction took place or the contractual relationship ended
in the case of ongoing contracts (Sections 195, 199 of the German Civil Code).
Data Retention and Deletion: The following general retention and archiving periods apply under
Swiss law:
-
10 years - Retention period for books and records, annual financial statements, inventories,
management reports, opening balances, accounting vouchers and invoices, as well as all
necessary working instructions and other organizational documents (Article 958f of the Swiss
Code of Obligations (OR)).
-
10 years - Data necessary to consider potential claims for damages or similar contractual
claims and rights, as well as for the processing of related inquiries based on previous
business experiences and usual industry practices, will be stored for the statutory limitation
period of ten years, unless a shorter period of five years is applicable, which is relevant in
certain cases (Articles 127, 130 OR). Claims for rent, lease, and interest on capital, as well
as other periodic services, for the delivery of food, for board and lodging, for innkeeper
debts, as well as for craftsmanship, small-scale sales of goods, medical care, professional
services by lawyers, legal agents, procurators, and notaries, and from the employment
relationship of employees, expire after five years (Article 128 OR).
Start of the period at the end of the year: If a period does not expressly start on a specific
date and lasts at least one year, it automatically begins at the end of the calendar year in
which the event triggering the period occurred. In the case of ongoing contractual relationships
in the context of which data is stored, the event triggering the deadline is the time at which
the termination or other termination of the legal relationship takes effect.
Rights of Data Subjects
Rights of the Data Subjects under the GDPR: As data subject, you are entitled to various rights
under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:
-
Right to Object: You have the right, on grounds arising from your particular situation, to
object at any time to the processing of your personal data which is based on letter (e) or
(f) of Article 6(1) GDPR, including profiling based on those provisions. Where personal data
are processed for direct marketing purposes, you have the right to object at any time to the
processing of the personal data concerning you for the purpose of such marketing, which
includes profiling to the extent that it is related to such direct marketing.
-
Right of withdrawal for consents: You have the right to revoke consents at
any time.
-
Right of access: You have the right to request confirmation as to whether the
data in question will be processed and to be informed of this data and to receive further
information and a copy of the data in accordance with the provisions of the law.
-
Right to rectification: You have the right, in accordance with the law, to
request the completion of the data concerning you or the rectification of the incorrect data
concerning you.
-
Right to Erasure and Right to Restriction of Processing: In accordance with
the statutory provisions, you have the right to demand that the relevant data be erased
immediately or, alternatively, to demand that the processing of the data be restricted in
accordance with the statutory provisions.
-
Right to data portability: You have the right to receive data concerning you
which you have provided to us in a structured, common and machine-readable format in
accordance with the legal requirements, or to request its transmission to another controller.
-
Complaint to the supervisory authority: In accordance with the law and
without prejudice to any other administrative or judicial remedy, you also have the right to
lodge a complaint with a data protection supervisory authority, in particular a supervisory
authority in the Member State where you habitually reside, the supervisory authority of your
place of work or the place of the alleged infringement, if you consider that the processing of
personal data concerning you infringes the GDPR.
Rights of the data subjects under the Swiss DPA:
As the data subject, you have the following rights in accordance with the provisions of the
Swiss DPA:
-
Right to information: You have the right to request confirmation as to
whether personal data concerning you are being processed, and to receive the information
necessary for you to assert your rights under the Swiss DPA and to ensure transparent data
processing.
-
Right to data release or transfer: You have the right to request the release
of your personal data, which you have provided to us, in a common electronic format, as well
as its transfer to another data controller, provided this does not require disproportionate
effort.
-
Right to rectification: You have the right to request the rectification of
inaccurate personal data concerning you.
-
Right to object, deletion, and destruction: You have the right to object to
the processing of your data, as well as to request that personal data concerning you be
deleted or destroyed.
Business services
We process data of our contractual and business partners, e.g. customers and interested parties
(collectively referred to as "contractual partners") within the context of contractual and
comparable legal relationships as well as associated actions and communication with the
contractual partners or pre-contractually, e.g. to answer inquiries.
We process this data in order to fulfill our contractual obligations. These include, in
particular, the obligations to provide the agreed services, any update obligations and remedies
in the event of warranty and other service disruptions. In addition, we process the data to
protect our rights and for the purpose of administrative tasks associated with these obligations
and company organization. Furthermore, we process the data on the basis of our legitimate
interests in proper and economical business management as well as security measures to protect
our contractual partners and our business operations from misuse, endangerment of their data,
secrets, information and rights (e.g. for the involvement of telecommunications, transport and
other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment
service providers or tax authorities). Within the framework of applicable law, we only disclose
the data of contractual partners to third parties to the extent that this is necessary for the
aforementioned purposes or to fulfill legal obligations. Contractual partners will be informed
about further forms of processing, e.g. for marketing purposes, within the scope of this privacy
policy.
Which data are necessary for the aforementioned purposes, we inform the contracting partners
before or in the context of the data collection, e.g. in online forms by special marking (e.g.
colors), and/or symbols (e.g. asterisks or the like), or personally.
We delete the data after expiry of statutory warranty and comparable obligations, i.e. in
principle after expiry of 4 years, unless the data is stored in a customer account or must be
kept for legal reasons of archiving. The statutory retention period for documents relevant under
tax law as well as for commercial books, inventories, opening balance sheets, annual financial
statements, the instructions required to understand these documents and other organizational
documents and accounting records is ten years and for received commercial and business letters
and reproductions of sent commercial and business letters six years. The period begins at the
end of the calendar year in which the last entry was made in the book, the inventory, the
opening balance sheet, the annual financial statements or the management report was prepared,
the commercial or business letter was received or sent, or the accounting document was created,
furthermore the record was made or the other documents were created.
-
Processed data types: Inventory data (For example, the full name, residential
address, contact information, customer number, etc.); Payment Data (e.g. bank details,
invoices, payment history); Contact data (e.g. postal and email addresses or phone numbers).
Contract data (e.g. contract object, duration, customer category).
-
Data subjects: Service recipients and clients; Prospective customers.
Business and contractual partners.
-
Purposes of processing: Provision of contractual services and fulfillment of
contractual obligations; Communication; Office and organisational procedures; Organisational
and Administrative Procedures. Business processes and management procedures.
-
Retention and deletion: Deletion in accordance with the information provided
in the section "General Information on Data Retention and Deletion".
-
Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b)
GDPR); Compliance with a legal obligation (Article 6 (1) (c) GDPR). Legitimate Interests
(Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
-
In-App purchases: On this website and the associated app, users can purchase
visual virtual goods.
Payment Procedure
Within the framework of contractual and other legal relationships, due to legal obligations or
otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure
payment options and use other service providers for this purpose in addition to banks and credit
institutions (collectively referred to as "payment service providers").
The data processed by the payment service providers includes inventory data, such as the name
and address, bank data, such as account numbers or credit card numbers, passwords, TANs and
checksums, as well as the contract, total and recipient-related information. The information is
required to carry out the transactions. However, the data entered is only processed by the
payment service providers and stored with them. I.e. we do not receive any account or credit
card related information, but only information with confirmation or negative information of the
payment. Under certain circumstances, the data may be transmitted by the payment service
providers to credit agencies. The purpose of this transmission is to check identity and
creditworthiness. Please refer to the terms and conditions and data protection information of
the payment service providers.
The terms and conditions and data protection information of the respective payment service
providers apply to the payment transactions and can be accessed within the respective websites
or transaction applications. We also refer to these for further information and the assertion of
revocation, information and other data subject rights.
-
Processed data types: Inventory data (For example, the full name, residential
address, contact information, customer number, etc.); Payment Data (e.g. bank details,
invoices, payment history); Contract data (e.g. contract object, duration, customer category);
Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of
use, types of devices and operating systems used, interactions with content and features);
Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers,
involved parties). Contact data (e.g. postal and email addresses or phone numbers).
-
Data subjects: Service recipients and clients; Business and contractual
partners. Prospective customers.
-
Purposes of processing: Provision of contractual services and fulfillment of
contractual obligations. Business processes and management procedures.
-
Retention and deletion: Deletion in accordance with the information provided
in the section "General Information on Data Retention and Deletion".
-
Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b)
GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
-
Apple Pay: Payment services provider; Service provider:
Apple Inc., Infinite Loop, Cupertino, CA 95014, USA;
Legal Basis: Performance of a contract and prior requests (Article 6 (1)
(b) GDPR); Website:
https://www.apple.com/apple-pay/.
Privacy Policy:
https://www.apple.com/legal/privacy/en-ww/.
-
Google Pay: Payment services provider; Service provider:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland;
Legal Basis: Performance of a contract and prior requests (Article 6 (1)
(b) GDPR); Website:
https://pay.google.com/intl/en_uk/about/. Privacy Policy:
https://policies.google.com/privacy.
-
Klarna: Payment-Service-Provider (technical integration of
online-payment-methods); Service provider: Klarna Bank AB (publ),
Sveavägen 46, 111 34 Stockholm, Sweden;
Legal Basis: Performance of a contract and prior requests (Article 6 (1)
(b) GDPR); Website:
https://www.klarna.com.
Privacy Policy:
https://www.klarna.com/de/datenschutz.
-
PayPal: Payment-Service-Provider (technical integration of
online-payment-methods) (e.g. PayPal, PayPal Plus, Braintree, Braintree);
Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard
Royal, L-2449 Luxembourg;
Legal Basis: Performance of a contract and prior requests (Article 6 (1)
(b) GDPR); Website:
https://www.paypal.com.
Privacy Policy:
https://www.paypal.com/de/legalhub/paypal/privacy-full.
Provision of online services and web hosting
We process user data in order to be able to provide them with our online services. For this
purpose, we process the IP address of the user, which is necessary to transmit the content and
functions of our online services to the user's browser or terminal device.
-
Processed data types: Usage data (e.g. page views and duration of visit,
click paths, intensity and frequency of use, types of devices and operating systems used,
interactions with content and features); Meta, communication and process data (e.g. IP
addresses, timestamps, identification numbers, involved parties); Log data (e.g. log files
concerning logins or data retrieval or access times.). Content data (e.g. textual or pictorial
messages and contributions, as well as information pertaining to them, such as details of
authorship or the time of creation.).
-
Data subjects: Users (e.g. website visitors, users of online services).
Business and contractual partners.
-
Purposes of processing: Provision of our online services and usability;
Information technology infrastructure (Operation and provision of information systems and
technical devices, such as computers, servers, etc.)). Security measures.
-
Retention and deletion: Deletion in accordance with the information provided
in the section "General Information on Data Retention and Deletion".
- Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
-
Provision of online offer on rented hosting space: For the provision of our
online services, we use storage space, computing capacity and software that we rent or
otherwise obtain from a corresponding server provider (also referred to as a "web hoster");
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
-
Collection of Access Data and Log Files: Access to our online service is
logged in the form of so-called "server log files". Server log files may include the address
and name of the accessed web pages and files, date and time of access, transferred data
volumes, notification of successful retrieval, browser type along with version, the user's
operating system, referrer URL (the previously visited page), and typically IP addresses and
the requesting provider. The server log files can be used for security purposes, e.g., to
prevent server overload (especially in the case of abusive attacks, known as DDoS attacks),
and to ensure server load management and stability;
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR). Retention period: Log file information is stored for a maximum period of 30
days and then deleted or anonymized. Data, the further storage of which is necessary for
evidence purposes, are excluded from deletion until the respective incident has been finally
clarified.
-
STRATO: Services in the field of the provision of information technology
infrastructure and related services (e.g. storage space and/or computing capacities);
Service provider: STRATO AG, Pascalstraße 10,10587 Berlin, Germany;
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website:
https://www.strato.de;
Privacy Policy:
https://www.strato.de/datenschutz. Data Processing Agreement: Provided by the service provider.
-
Amazon Web Services (AWS): Services in the field of the provision of
information technology infrastructure and related services (e.g. storage space and/or
computing capacities); Service provider: Amazon Web Services EMEA SARL, 38
avenue John F. Kennedy, 1855, Luxembourg;
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website:
https://aws.amazon.com/;
Privacy Policy:
https://aws.amazon.com/privacy/;
Data Processing Agreement:
https://aws.amazon.com/compliance/gdpr-center/. Basis for third-country transfers: EEA - Data Privacy Framework (DPF),
Standard Contractual Clauses (https://aws.amazon.com/en/service-terms/), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://aws.amazon.com/en/service-terms/).
Use of Cookies
The term "cookies" refers to functions that store information on users' devices and read it from
them. Cookies can also be used for different purposes, such as ensuring the functionality,
security, and convenience of online services, as well as analyzing visitor traffic. We use
cookies in accordance with legal regulations. If necessary, we obtain users' consent in advance.
If consent is not required, we rely on our legitimate interests. This applies when storing and
reading information is essential to provide explicitly requested content and functions. This
includes, for example, saving settings and ensuring the functionality and security of our online
services. Consent can be withdrawn at any time. We clearly inform users about the scope of the
consent and which cookies are used.
Information on legal data protection bases: Whether we process personal data
using cookies depends on users' consent. If consent is given, it serves as the legal basis.
Without consent, we rely on our legitimate interests, as outlined in this section and in the
context of the respective services and procedures.
Storage duration: The following types of cookies are distinguished based on
their storage duration:
-
Temporary cookies (also: session cookies): Temporary cookies are deleted at
the latest after a user leaves an online service and closes their device (e.g., browser or
mobile application).
-
Permanent cookies: Permanent cookies remain stored even after the device is
closed. For example, the login status can be saved, and preferred content can be displayed
directly when the user revisits a website. Additionally, the user data collected with cookies
may be used for audience measurement. Unless we provide explicit information to users about
the type and storage duration of cookies (e.g., when obtaining consent), users should assume
that these are permanent and may have a storage duration of up to two years.
General information on withdrawal and objection (opt-out): Users can withdraw
their consent at any time and also object to the processing according to legal regulations,
including through the privacy settings of their browser.
-
Processed data types: Meta, communication and process data (e.g. IP
addresses, timestamps, identification numbers, involved parties).
-
Data subjects: Users (e.g. website visitors, users of online services).
-
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR). Consent (Article
6 (1) (a) GDPR).
Further information on processing methods, procedures and services used:
-
Processing Cookie Data on the Basis of Consent: We implement a consent
management solution that obtains users' consent for the use of cookies or for the processes
and providers mentioned within the consent management framework. This procedure is designed to
solicit, log, manage, and revoke consents, particularly regarding the use of cookies and
similar technologies employed to store, read from, and process information on users' devices.
As part of this procedure, user consents are obtained for the use of cookies and the
associated processing of information, including specific processing and providers named in the
consent management process. Users also have the option to manage and withdraw their consents.
Consent declarations are stored to avoid repeated queries and to provide proof of consent
according to legal requirements. The storage is carried out server-side and/or in a cookie
(so-called opt-in cookie) or by means of comparable technologies in order to associate the
consent with a specific user or their device.If no specific details about the providers of
consent management services are provided, the following general notes apply: The duration of
consent storage is up to two years. A pseudonymous user identifier is created, which is stored
along with the time of consent, details on the scope of consent (e.g., relevant categories of
cookies and/or service providers), as well as information about the browser, system, and
device used;
Legal Basis: Consent (Article 6 (1) (a) GDPR).
Processing of Data within the Application (App)
We process the data of the users of our application to the extent necessary to provide the users
with the application and its functionalities, to monitor its security and to develop it further.
Furthermore, we may contact users in compliance with the statutory provisions if communication
is necessary for the purposes of administration or use of the application. In addition, we refer
to the data protection information in this privacy policy with regard to the processing of user
data.
Legal basis: The processing of data necessary for the provision of the
functionalities of the application serves to fulfil contractual obligations. This also applies
if the provision of the functions requires user authorisation (e.g. release of device
functions). If the processing of data is not necessary for the provision of the functionalities
of the application, but serves the security of the application or our business interests (e.g.
collection of data for the purpose of optimising the application or security purposes), it is
carried out on the basis of our legitimate interests. If users are expressly requested to give
their consent to the processing of their data, the data covered by the consent is processed on
the basis of the consent.
-
Processed data types: Inventory data (For example, the full name, residential
address, contact information, customer number, etc.); Usage data (e.g. page views and duration
of visit, click paths, intensity and frequency of use, types of devices and operating systems
used, interactions with content and features); Meta, communication and process data (e.g. IP
addresses, timestamps, identification numbers, involved parties); Payment Data (e.g. bank
details, invoices, payment history). Contract data (e.g. contract object, duration, customer
category).
-
Data subjects: Users (e.g. website visitors, users of online services).
-
Purposes of processing: Provision of contractual services and fulfillment of
contractual obligations; Security measures. Provision of our online services and usability.
-
Retention and deletion: Deletion in accordance with the information provided
in the section "General Information on Data Retention and Deletion".
-
Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b)
GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
-
Commercial use: We process the data of the users of our application,
registered and any test users (hereinafter uniformly referred to as "users") in order to
provide them with our contractual services and on the basis of legitimate interests to ensure
the security of our application and to develop it further. The required details are identified
as such within the scope of the conclusion of a contract for the use of the application, the
conclusion of an order, an order or a comparable contract and may include the details required
for the provision of services and any invoicing as well as contact information in order to be
able to hold any consultations;
Legal Basis: Performance of a contract and prior requests (Article 6 (1)
(b) GDPR).
-
Storage of an own unique identifier: In order to provide the application and
ensure its functionality, we use a pseudonymous identifier. The identifier is a mathematical
value (i.e. no clear data such as names are used) that is assigned to a device and/or the
installation of the application installed on it. This identifier is generated during the
installation of the application, remains stored between the start of the application and its
updates and is deleted when users remove the application from the device.
-
Device authorizations for access to functions and data: The use of certain
functions of our application may require access to the camera and the stored recordings of the
users. By default, these authorizations must be granted by the user and can be revoked at any
time in the settings of the respective devices. The exact procedure for controlling app
permissions may depend on the user's device and software. Users can contact us if they require
further explanation. We would like to point out that the refusal or revocation of the
respective authorizations can affect the functionality of our application.
-
Location history and movement profiles: The location data is only used
selectively and is not processed to create a location history or a movement profile of the
devices used or of their users.
Purchase of applications via Appstores
The purchase of our apps is done via special online platforms operated by other service
providers (so-called "appstores"). In this context, the data protection notices of the
respective appstores apply in addition to our data protection notices. This applies in
particular with regard to the methods used on the platforms for webanalytics and for
interest-related marketing as well as possible costs.
-
Processed data types: Inventory data (For example, the full name, residential
address, contact information, customer number, etc.); Payment Data (e.g. bank details,
invoices, payment history); Contact data (e.g. postal and email addresses or phone numbers);
Contract data (e.g. contract object, duration, customer category); Usage data (e.g. page views
and duration of visit, click paths, intensity and frequency of use, types of devices and
operating systems used, interactions with content and features). Meta, communication and
process data (e.g. IP addresses, timestamps, identification numbers, involved parties).
-
Data subjects: Service recipients and clients. Users (e.g. website visitors,
users of online services).
-
Purposes of processing: Provision of contractual services and fulfillment of
contractual obligations. Provision of our online services and usability.
-
Retention and deletion: Deletion in accordance with the information provided
in the section "General Information on Data Retention and Deletion".
- Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
Registration, Login and User Account
Users can create a user account. Within the scope of registration, the required mandatory
information is communicated to the users and processed for the purposes of providing the user
account on the basis of contractual fulfilment of obligations. The processed data includes in
particular the login information (name, password and an e-mail address).
Within the scope of using our registration and login functions as well as the use of the user
account, we store the IP address and the time of the respective user action. The storage is
based on our legitimate interests, as well as the user's protection against misuse and other
unauthorized use. This data will not be passed on to third parties unless it is necessary to
pursue our claims or there is a legal obligation to do so.
Users may be informed by e-mail of information relevant to their user account, such as technical
changes.
-
Processed data types: Inventory data (For example, the full name, residential
address, contact information, customer number, etc.); Contact data (e.g. postal and email
addresses or phone numbers); Content data (e.g. textual or pictorial messages and
contributions, as well as information pertaining to them, such as details of authorship or the
time of creation.); Usage data (e.g. page views and duration of visit, click paths, intensity
and frequency of use, types of devices and operating systems used, interactions with content
and features). Log data (e.g. log files concerning logins or data retrieval or access times.).
-
Data subjects: Users (e.g. website visitors, users of online services).
-
Purposes of processing: Provision of contractual services and fulfillment of
contractual obligations; Security measures; Organisational and Administrative Procedures.
Provision of our online services and usability.
-
Retention and deletion: Deletion in accordance with the information provided
in the section "General Information on Data Retention and Deletion". Deletion after
termination.
-
Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b)
GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
-
Registration with pseudonyms: Users may use pseudonyms as user names instead
of real names;
Legal Basis: Performance of a contract and prior requests (Article 6 (1)
(b) GDPR).
-
Users' profiles are public: Users' profiles are publicly visible and
accessible.
-
Deletion of data after termination: If users have terminated their user
account, their data relating to the user account will be deleted, subject to any legal
permission, obligation or consent of the users;
Legal Basis: Performance of a contract and prior requests (Article 6 (1)
(b) GDPR).
-
No obligation to retain data: It is the responsibility of the users to secure
their data before the end of the contract in the event of termination. We are entitled to
irretrievably delete all user data stored during the term of the contract;
Legal Basis: Performance of a contract and prior requests (Article 6 (1)
(b) GDPR).
Contact and Inquiry Management
When contacting us (e.g. via mail, contact form, e-mail, telephone or via social media) as well
as in the context of existing user and business relationships, the information of the inquiring
persons is processed to the extent necessary to respond to the contact requests and any
requested measures.
-
Processed data types: Inventory data (For example, the full name, residential
address, contact information, customer number, etc.); Contact data (e.g. postal and email
addresses or phone numbers); Content data (e.g. textual or pictorial messages and
contributions, as well as information pertaining to them, such as details of authorship or the
time of creation.); Usage data (e.g. page views and duration of visit, click paths, intensity
and frequency of use, types of devices and operating systems used, interactions with content
and features). Meta, communication and process data (e.g. IP addresses, timestamps,
identification numbers, involved parties).
-
Data subjects: Communication partner (Recipients of e-mails, letters, etc.).
-
Purposes of processing: Communication; Organisational and Administrative
Procedures; Feedback (e.g. collecting feedback via online form). Provision of our online
services and usability.
-
Retention and deletion: Deletion in accordance with the information provided
in the section "General Information on Data Retention and Deletion".
-
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR). Performance of a
contract and prior requests (Article 6 (1) (b) GDPR).
Further information on processing methods, procedures and services used:
-
Contact form: Upon contacting us via our contact form, email, or other means
of communication, we process the personal data transmitted to us for the purpose of responding
to and handling the respective matter. This typically includes details such as name, contact
information, and possibly additional information provided to us that is necessary for
appropriate processing. We use this data exclusively for the stated purpose of contact and
communication;
Legal Basis: Performance of a contract and prior requests (Article 6 (1)
(b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Push notifications
With the consent of the users, we can send the users so-called "push notifications". These are
messages that are displayed on users' screens, devices or browsers, even if our online services
are not being actively used.
In order to sign up for push messages, users must confirm that their browser or device has
requested to receive push messages. This approval process is documented and stored. The storage
is necessary to recognize whether users have consented to receive the push messages and to be
able to prove their consent. For these purposes, a pseudonymous identifier of the browser
(so-called "push token") or the device ID of a terminal device is stored.
The push messages may be necessary for the fulfilment of contractual obligations (e.g. technical
and organisational information relevant for the use of our online offer) and will otherwise be
sent, unless specifically mentioned below, on the basis of user consent. Users can change the
receipt of push messages at any time using the notification settings of their respective
browsers or end devices.
Contents:
"Information about when the opponent made their move in the async match."
"Reminder that the user is up next in the async match."
Our settings and options to unsubscribe:
Push notifications can be turned off in the settings.
-
Processed data types: Usage data (e.g. page views and duration of visit,
click paths, intensity and frequency of use, types of devices and operating systems used,
interactions with content and features). Meta, communication and process data (e.g. IP
addresses, timestamps, identification numbers, involved parties).
-
Data subjects: Communication partner (Recipients of e-mails, letters, etc.).
-
Purposes of processing: Communication. Provision of our online services and
usability.
-
Retention and deletion: Deletion in accordance with the information provided
in the section "General Information on Data Retention and Deletion". Deletion after
termination.
-
Legal Basis: Consent (Article 6 (1) (a) GDPR). Legitimate Interests (Article
6 (1) (f) GDPR).
Newsletter and Electronic Communications
We send newsletters, emails, and other electronic notifications (hereinafter "newsletters")
exclusively with the consent of the recipients or based on a legal basis. If the contents of the
newsletter are specified during registration for the newsletter, these contents are decisive for
the users' consent. Normally, providing your email address is sufficient to sign up for our
newsletter. However, to offer you a personalised service, we may ask for your name for personal
salutation in the newsletter or for additional information if necessary for the purpose of the
newsletter.
Deletion and restriction of processing: We may store unsubscribed email addresses for up to
three years based on our legitimate interests before deleting them to be able to demonstrate
previously given consent. The processing of these data is limited to the purpose of potentially
defending against claims. An individual request for deletion is possible at any time, provided
that at the same time the former existence of consent is confirmed. In case of obligations to
permanently observe objections, we reserve the right to store the email address solely for this
purpose in a blocklist.
The logging of the registration process is based on our legitimate interests for the purpose of
proving its proper execution. If we commission a service provider to send emails, this is done
based on our legitimate interests in an efficient and secure mailing system.
Contents:
Information about us, our services, promotions and offers.
-
Processed data types: Inventory data (For example, the full name, residential
address, contact information, customer number, etc.); Contact data (e.g. postal and email
addresses or phone numbers). Meta, communication and process data (e.g. IP addresses,
timestamps, identification numbers, involved parties).
-
Data subjects: Communication partner (Recipients of e-mails, letters, etc.).
- Purposes of processing: Direct marketing (e.g. by e-mail or postal).
- Legal Basis: Consent (Article 6 (1) (a) GDPR).
-
Opt-Out: You can cancel the receipt of our newsletter at any time, i.e.
revoke your consent or object to further receipt. You will find a link to cancel the
newsletter either at the end of each newsletter or you can otherwise use one of the contact
options listed above, preferably e-mail.
Profiles in Social Networks (Social Media)
We maintain online presences within social networks and process user data in this context in
order to communicate with the users active there or to offer information about us.
We would like to point out that user data may be processed outside the European Union. This may
entail risks for users, e.g. by making it more difficult to enforce users' rights.
In addition, user data is usually processed within social networks for market research and
advertising purposes. For example, user profiles can be created on the basis of user behaviour
and the associated interests of users. The user profiles can then be used, for example, to place
advertisements within and outside the networks which are presumed to correspond to the interests
of the users. For these purposes, cookies are usually stored on the user's computer, in which
the user's usage behaviour and interests are stored. Furthermore, data can be stored in the user
profiles independently of the devices used by the users (especially if the users are members of
the respective networks or will become members later on).
For a detailed description of the respective processing operations and the opt-out options,
please refer to the respective data protection declarations and information provided by the
providers of the respective networks.
Also in the case of requests for information and the exercise of rights of data subjects, we
point out that these can be most effectively pursued with the providers. Only the providers have
access to the data of the users and can directly take appropriate measures and provide
information. If you still need help, please do not hesitate to contact us.
-
Processed data types: Contact data (e.g. postal and email addresses or phone
numbers); Content data (e.g. textual or pictorial messages and contributions, as well as
information pertaining to them, such as details of authorship or the time of creation.); Usage
data (e.g. page views and duration of visit, click paths, intensity and frequency of use,
types of devices and operating systems used, interactions with content and features); Payment
Data (e.g. bank details, invoices, payment history). Contract data (e.g. contract object,
duration, customer category).
-
Data subjects: Users (e.g. website visitors, users of online services).
Business and contractual partners.
-
Purposes of processing: Communication; Feedback (e.g. collecting feedback via
online form); Public relations; Provision of contractual services and fulfillment of
contractual obligations; Marketing. Provision of our online services and usability.
-
Retention and deletion: Deletion in accordance with the information provided
in the section "General Information on Data Retention and Deletion".
- Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
-
Instagram: Social network, allows the sharing of photos and videos,
commenting on and favouriting posts, messaging, subscribing to profiles and pages;
Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04
X2K5, Ireland;
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website:
https://www.instagram.com;
Privacy Policy:
https://privacycenter.instagram.com/policy/. Basis for third-country transfers: EEA - Data Privacy Framework (DPF),
Switzerland - Data Privacy Framework (DPF).
-
Discord: Chat, audio and video broadcasting, instant messaging, and community
management; Service provider: Discord, Inc., 444 De Haro St, Suite 200, San
Francisco, California 94107, USA;
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website:
https://discordapp.com/;
Privacy Policy:
https://discordapp.com/privacy.
Basis for third-country transfers: EEA - Data Privacy Framework (DPF),
Switzerland - Data Privacy Framework (DPF).
-
Patreon: Internet platform for project financing via crowdfunding as well as
the sale of subscriptions and memberships, billing as well as the provision of access and
payment procedures, for the purposes of which cookies are used and the IP address, date, time
and other technical data about the Internet browser used, the operating system as well as
inventory, contract and payment data of the users are processed;
Service provider: Patreon Ireland Limited, German Branch Revaler Strasse 99,
Hall 20, 2nd floor Rooms 3.19 and 3.25. 10245 Berlin-Friedrichshain, Germany;
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website:
https://www.patreon.com/.
Privacy Policy:
https://privacy.patreon.com/policies.
Changes and Updates
We kindly ask you to inform yourself regularly about the contents of our data protection
declaration. We will adjust the privacy policy as changes in our data processing practices make
this necessary. We will inform you as soon as the changes require your cooperation (e.g.
consent) or other individual notification.
If we provide addresses and contact information of companies and organizations in this privacy
policy, we ask you to note that addresses may change over time and to verify the information
before contacting us.
Terminology and Definitions
In this section, you will find an overview of the terminology used in this privacy policy. Where
the terminology is legally defined, their legal definitions apply. The following explanations,
however, are primarily intended to aid understanding.
-
Contact data: Contact details are essential information that enables
communication with individuals or organizations. They include, among others, phone numbers,
postal addresses, and email addresses, as well as means of communication like social media
handles and instant messaging identifiers.
-
Content data: Content data comprise information generated in the process of
creating, editing, and publishing content of all types. This category of data may include
texts, images, videos, audio files, and other multimedia content published across various
platforms and media. Content data are not limited to the content itself but also include
metadata providing information about the content, such as tags, descriptions, authorship
details, and publication dates.
-
Contract data: Contract data are specific details pertaining to the
formalisation of an agreement between two or more parties. They document the terms under which
services or products are provided, exchanged, or sold. This category of data is essential for
managing and fulfilling contractual obligations and includes both the identification of the
contracting parties and the specific terms and conditions of the agreement. Contract data may
encompass the start and end dates of the contract, the nature of the agreed-upon services or
products, pricing arrangements, payment terms, termination rights, extension options, and
special conditions or clauses. They serve as the legal foundation for the relationship between
the parties and are crucial for clarifying rights and duties, enforcing claims, and resolving
disputes.
-
Controller: "Controller" means the natural or legal person, public authority,
agency or other body which, alone or jointly with others, determines the purposes and means of
the processing of personal data.
-
Inventory data: Inventory data encompass essential information required for
the identification and management of contractual partners, user accounts, profiles, and
similar assignments. These data may include, among others, personal and demographic details
such as names, contact information (addresses, phone numbers, email addresses), birth dates,
and specific identifiers (user IDs). Inventory data form the foundation for any formal
interaction between individuals and services, facilities, or systems, by enabling unique
assignment and communication.
-
Log data: Protocol data, or log data, refer to information regarding events
or activities that have been logged within a system or network. These data typically include
details such as timestamps, IP addresses, user actions, error messages, and other specifics
about the usage or operation of a system. Protocol data is often used for analyzing system
issues, monitoring security, or generating performance reports.
-
Meta, communication and process data: Meta-, communication, and procedural
data are categories that contain information about how data is processed, transmitted, and
managed. Meta-data, also known as data about data, include information that describes the
context, origin, and structure of other data. They can include details about file size,
creation date, the author of a document, and modification histories. Communication data
capture the exchange of information between users across various channels, such as email
traffic, call logs, messages in social networks, and chat histories, including the involved
parties, timestamps, and transmission paths. Procedural data describe the processes and
operations within systems or organisations, including workflow documentations, logs of
transactions and activities, and audit logs used for tracking and verifying procedures.
-
Payment Data: Payment data comprise all information necessary for processing
payment transactions between buyers and sellers. This data is crucial for e-commerce, online
banking, and any other form of financial transaction. It includes details such as credit card
numbers, bank account information, payment amounts, transaction dates, verification numbers,
and billing information. Payment data may also contain information on payment status,
chargebacks, authorizations, and fees.
-
Personal Data: "personal data" means any information relating to an
identified or identifiable natural person ("data subject"); an identifiable natural person is
one who can be identified, directly or indirectly, in particular by reference to an identifier
such as a name, an identification number, location data, an online identifier or to one or
more factors specific to the physical, physiological, genetic, mental, economic, cultural or
social identity of that natural person.
-
Processing: The term "processing" covers a wide range and practically every
handling of data, be it collection, evaluation, storage, transmission or erasure.
-
Usage data: Usage data refer to information that captures how users interact
with digital products, services, or platforms. These data encompass a wide range of
information that demonstrates how users utilise applications, which features they prefer, how
long they spend on specific pages, and through what paths they navigate an application. Usage
data can also include the frequency of use, timestamps of activities, IP addresses, device
information, and location data. They are particularly valuable for analysing user behaviour,
optimising user experiences, personalising content, and improving products or services.
Furthermore, usage data play a crucial role in identifying trends, preferences, and potential
problem areas within digital offerings