Privacy Information

Controller

Andreas Allenbach

Place of residence: Völs, Österreich

Email: datenschutz@ggedb.de

Further operator information is available in the Legal Notice.

Data processed

• Account data: Username, display name, email address, role, server/alliance assignment and account status.
• Interface setting: selected language (German or English).
• Login summary: Time of the last successful login and total number of successful logins.
• Online status: only the latest activity timestamp (last_seen); no historical online timeline is kept.
• Security data: failed login attempts and, if they lead to a lock, the triggering IP address for a limited period where applicable.
• Game/alliance data: publicly available game statistics such as in-game name, previous player names/name changes, alliance affiliation, alliance rank, event points, might points and loot points. We also store which in-game players you starred as your own and linked to your dashboard account.

No geographic evaluation or external geolocation of IP addresses takes place.

Purposes and legal bases

Account and usage data are processed to provide the dashboard, manage users and permissions, and assign access to the approved alliance.

Processing is based on Art. 6(1)(f) GDPR. The legitimate interest is the secure and proper operation of the private Alliance Dashboard and the provision of its functions to participating users.

Security data are also processed on the basis of Art. 6(1)(f) GDPR. The legitimate interest is protecting the website, user accounts and server infrastructure from unauthorized access, brute-force attacks and other misuse.

Publicly available game and alliance data are processed on the basis of Art. 6(1)(f) GDPR. The legitimate interest is displaying and statistically evaluating game activity within participating alliances.

Registration and User Approval

During registration, username, display name, email address, password, server and desired alliance are provided. A newly registered account is not activated automatically and must be approved by an authorized administrator.

The email address is used to verify the contact address, provide self-service password reset and send necessary account/security messages. Existing accounts must add an email address once after this feature is introduced.

Alliance administrators can manage only users of their own alliance. Security information such as stored IP addresses is not shown to alliance administrators; only the system administrator can access it where necessary to secure the system.

Retention periods

The application automatically cleans up the short-lived security data it manages. Web-server/hosting logs and external backups are managed separately.

Server and Connection Data

When the website is accessed, technically necessary connection data is transmitted to the web server. This may include the IP address of the accessing device.

Server logs may be processed where necessary for secure operation, error analysis and defence against attacks. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is the secure and reliable operation of the server infrastructure.

Server and hosting logs are not used for advertising, profiling or analysis of user behavior.

Cookies and Local Storage

The dashboard uses only technically necessary cookies for sign-in, session management and, if selected, the “Stay signed in” function. Advertising, analytics and tracking cookies are not used.

Under Section 165(3) TKG 2021, prior consent is not required for technically strictly necessary storage or access where it is necessary to provide a service explicitly requested by the user. This particularly applies to the dashboard’s login and session functions.

Therefore, no separate cookie consent banner is used for the technically necessary cookies currently deployed.

Hosting

Hosting provider: Living-Bots.net, Hanauer Landstrasse 328-330, 60314 Frankfurt am Main.

The hosting provider processes technical data to provide and secure the server infrastructure. Where personal data is processed on behalf of the operator, this takes place in accordance with applicable data protection requirements.

Email Delivery

For email verification, password reset and notifications about open admin tasks, the dashboard uses the SMTP service configured on the server.

The recipient address required for delivery, technical delivery data and the content of the respective message are transmitted to the mail provider. Passwords are not sent by email.

Verification and password-reset links are time-limited. Reset links also become invalid automatically after a password change.

GGE Tracker

Game and alliance data comes in particular from the GGE Tracker API. This data is therefore not collected directly from the affected person.

The dashboard retrieves game/alliance statistics server-side. Website usernames, website passwords and other dashboard-account credentials are not transmitted to GGE Tracker.

Optional Discord Integration

An alliance may voluntarily add its own Discord webhook for automatic final event scores. Setup is performed by an authorized administrator of the respective alliance and is not required to use the dashboard.

When enabled, the alliance name, event name, final score, participant/participation values and, if enabled, the in-game names and event points of the top three players are transmitted to Discord. Website email addresses, passwords, login IP addresses and other credentials are not transmitted to Discord.

The webhook URL is stored server-side as secret integration information and is not displayed in full in the browser after saving.

No Advertising or User Tracking

The dashboard currently uses no web analytics services such as Google Analytics and no advertising, marketing or profiling services. No user profiles are created for advertising purposes.

Recipients of Personal Data

Only administrators receive access to personal account data where required for their respective tasks. Alliance administrators are limited to their own alliance and do not receive access to stored IP addresses.

The system administrator can access security information where necessary to administer and secure the system. In addition, technical data may be processed by the hosting provider to the extent required.

Personal website-account data is not shared for advertising or marketing purposes.

Data Subject Rights

Subject to the legal requirements, data subjects have in particular rights of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and objection (Art. 21 GDPR). Where the legal requirements are met, a right to data portability (Art. 20 GDPR) may also apply.

Privacy requests can be sent to datenschutz@ggedb.de.

Right to Lodge a Complaint

Data subjects have the right to lodge a complaint with a data protection supervisory authority. For Austria:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Wien
Austria
Email: dsb@dsb.gv.at

Changes to this Privacy Information

This privacy information may be updated if dashboard functions, services used or legal requirements change. The version published on this website at the time applies.

Last updated: 3 September 2026