Privacy Policy

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. For detailed information on the subject of data protection, please refer to our privacy policy listed below.

Data Collection on This Website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. Their contact details can be found in the legal notice (Impressum) of this website.

How do we collect your data?
Some data is collected when you provide it to us directly — for example, data you enter into a contact form or registration form. Other data is collected automatically or with your consent when you visit the website through our IT systems. This includes primarily technical data (e.g. internet browser, operating system, or the time of the page request).

What do we use your data for?
Some data is collected to ensure error-free operation of the website. Other data may be used to analyze your user behavior.

2. Hosting and Data Controller

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel processes data on our behalf in accordance with Art. 28 GDPR. For more information, please refer to the Vercel Privacy Policy.

3. Registration and User Account

When you register on our website, we collect the data you provide (username, email address, password — stored as a salted hash, never in plain text). We also process the gameplay data your account generates (character stats, inventory, guild membership, chat and forum messages, and similar in-game state) in order to operate the game. This data is stored exclusively for the purpose of game management and player identification. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

We also temporarily process your IP address for rate-limiting and abuse prevention (e.g. to stop spam and brute-force login attempts). This is done on the basis of Art. 6(1)(f) GDPR (legitimate interest in keeping the service secure and available) and is not stored permanently.

Your data will not be sold or passed on to third parties, except where described in this policy (payment processing, optional third-party login, hosting, and analytics) or where required by law.

4. Third-Party Login (Discord)

You may optionally link your account to Discord to sign in or to receive a Premium role in our Discord server. If you do, we receive and store your Discord ID, Discord username, and avatar from Discord, and — if provided by Discord — your email address. This data is used solely to authenticate you and to synchronize your Premium status with our Discord server. The legal basis is Art. 6(1)(a) GDPR (your consent, given by initiating the link). You can unlink your Discord account at any time by contacting us. Discord's own processing of your data is described in the Discord Privacy Policy.

5. Purchases and Payment Processing (PayPal)

If you purchase Gems or Premium status, the transaction is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A. We share the information necessary to process the payment (such as your username and the order amount) with PayPal. PayPal acts as an independent controller for the data it collects during checkout (e.g. your payment details) — we do not receive or store your full payment credentials. The legal basis for this processing is Art. 6(1)(b) GDPR (performance of a contract). Details on PayPal's own data processing are available in the PayPal Privacy Statement. We retain records of completed transactions for as long as required by German commercial and tax law (generally up to 10 years, §§ 147 AO, 257 HGB).

6. Cookies

Our website uses cookies — small text files stored on your device. Session cookies are used to keep you logged in while you play and are deleted when you close your browser or when your session expires. These are strictly necessary cookies required for the game to function and do not require consent under § 25(2) No. 2 TDDDG. You may disable cookies in your browser settings at any time, but this will prevent you from staying logged in.

7. Data Retention

We retain your account data for as long as your account remains active. If you request deletion of your account, we delete or anonymize your personal data without undue delay, except for information we are required to retain for longer under statutory retention obligations (e.g. transaction records, see Section 5) or to defend against legal claims.

8. Your Rights

Under the GDPR, you have the right to: access your personal data (Art. 15); rectify inaccurate data (Art. 16); request erasure of your data (Art. 17); restrict processing (Art. 18); receive your data in a portable format (Art. 20); and object to processing carried out on the basis of legitimate interest (Art. 21). Where processing is based on your consent, you may withdraw that consent at any time with effect for the future (Art. 7(3)). For any of these requests, please contact us using the details below.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
www.ldi.nrw.de

9. Contact

If you have any questions about data protection, please contact us at: contact@pixmmo.de