Privacy Policy

Privacy Policy (Datenschutzerklärung)

1. Controller and Contact Details

The controller responsible for the processing of personal data within the meaning of Article 4 (7) of the EU General Data Protection Regulation (GDPR) is:

Game Ban Appeal UG (haftungsbeschränkt) Mittelstraße 11, 40789 Monheim am Rhein, Germany (Local Court of Düsseldorf, HRB 114627)

E-mail: privacy@gamebanappeal.com · Telephone: on request

Managing Director: Leonid Shmatenko

The Provider has not appointed a data protection officer, as the statutory thresholds of § 38 BDSG are not met.

For all data protection enquiries, please contact privacy@gamebanappeal.com.

2. Categories of Personal Data Processed

We process the following categories of personal data:

(a) Account and contact data: name, e-mail address, postal address (where provided), telephone number (where provided), gamer tag / in-game name, account ID, platform account information.

(b) Case data: description of the ban or restriction, ban reason, date of ban, prior account history, screenshots, communications with the platform, and any further information voluntarily submitted by the User in the intake form.

(c) Payment data: billing address, payment method, transaction ID, partial card data as transmitted by the payment service provider (full card details are not stored by us).

(d) Technical and usage data: IP address, device and browser identifiers, access timestamps, referrer URL, pages visited, language and country settings, cookie identifiers.

(e) Communication data: content and metadata of e-mails, support tickets, and chat messages exchanged with the Provider.

3. Purposes and Legal Bases of Processing

We process personal data for the following purposes and on the following legal bases:

(a) Performance of the contract (Art. 6 (1) (b) GDPR): processing of intake, case and payment data to draft, structure and transmit appeals and related correspondence, to provide customer support, and to handle payments.

(b) Compliance with legal obligations (Art. 6 (1) (c) GDPR): retention of invoices and tax-relevant documents pursuant to § 147 AO and § 257 HGB, fulfilment of GDPR information and reporting duties.

(c) Legitimate interests (Art. 6 (1) (f) GDPR): security of our website and systems, fraud and chargeback prevention, assertion or defence of legal claims, internal quality assurance, and the use of pseudonymised/anonymised data for the improvement of our services and AI models.

(d) Consent (Art. 6 (1) (a) GDPR): use of non-essential cookies and tracking tools, sending of newsletters or marketing communications, processing of special categories of data voluntarily disclosed in case descriptions. Consent may be withdrawn at any time with effect for the future.

4. Recipients and Categories of Recipients

We disclose personal data only insofar as necessary to:

(a) Payment service providers (e.g., Stripe Payments Europe Ltd., Ireland), for the processing of payments and chargebacks;

(b) Hosting and IT service providers within the EU/EEA, who process data on our behalf as processors under Art. 28 GDPR;

(c) AI service providers used for automated drafting (e.g., OpenAI, Anthropic, or comparable providers), exclusively under data processing agreements and, where applicable, EU standard contractual clauses;

(d) Cooperating law firms to whom your case is forwarded, where individual legal assessment is required and where you have established a separate mandate relationship with such firm;

(e) Tax advisors, auditors, and authorities to the extent legally required;

(f) Debt collection agencies and lawyers in the case of unpaid invoices or unjustified chargebacks.

The service providers we currently use are: Stripe (Stripe Payments Europe, Ltd., Ireland) for payments; our web host in Germany (Serverprofis) for hosting; Brevo (Sendinblue SAS, France) for service e-mails and the newsletter; OpenAI for AI-assisted drafting, where processing may take place in the United States; Cloudflare for domain name services and network security; CookieScript for managing your cookie consent; and Google Analytics (Google Ireland Ltd.), which is loaded only after you have consented to performance cookies.

We do not sell personal data to third parties.

5. International Data Transfers

In certain cases (in particular when using AI service providers), personal data may be transferred to countries outside the EU/EEA, including the United States. Such transfers take place exclusively on the basis of an adequacy decision of the European Commission (Art. 45 GDPR), the EU–US Data Privacy Framework, or appropriate safeguards in accordance with Art. 46 GDPR (in particular EU standard contractual clauses), supplemented by appropriate technical and organisational measures.

6. Storage Periods

We store personal data only for as long as necessary for the purposes described above:

(a) Case and contract data: for the duration of the contractual relationship and a subsequent period of three (3) years (statute of limitations under § 195 BGB); (b) Invoices and tax-relevant documents: ten (10) years pursuant to § 147 AO; (c) Server log files: generally seven (7) days, longer only in the case of a security incident; (d) Data processed on the basis of consent: until withdrawal of consent; (e) Anonymised/aggregated data: indefinitely, as such data no longer constitutes personal data.

7. Cookies and Web Analytics

Our website uses technically necessary cookies on the basis of § 25 (2) TDDDG. Non-essential cookies (in particular for analytics or marketing) are only used with your prior consent obtained via our cookie banner pursuant to § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. You may withdraw your consent at any time via the cookie settings on our website.

8. Your Rights as a Data Subject

Under the GDPR, you have the following rights vis-à-vis the controller:

(a) Right of access (Art. 15 GDPR);

(b) Right to rectification (Art. 16 GDPR);

(c) Right to erasure (Art. 17 GDPR);

(d) Right to restriction of processing (Art. 18 GDPR);

(e) Right to data portability (Art. 20 GDPR);

(f) Right to object to processing based on Art. 6 (1) (e) or (f) GDPR (Art. 21 GDPR), in particular against direct marketing;

(g) Right to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR);

(h) Right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf.

9. Obligation to Provide Data

The provision of personal data is neither legally nor contractually required, but is necessary for the conclusion and performance of the contract. Without the requested data, we are unable to provide the service.

10. Automated Decision-Making and AI Use

We use AI-assisted tools for the drafting and structuring of appeals and correspondence. The output of such tools is reviewed by us before transmission. We do not engage in automated individual decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

11. Changes to this Privacy Policy

We reserve the right to amend this privacy policy in order to adapt it to changing legal requirements or to reflect changes in our services. The version applicable at the time of your visit or contract conclusion shall apply.