Privacy Policy

I. General Information

1. Controller

Below we explain which personal data we collect and process when you use our website and services. The controller within the meaning of the General Data Protection Regulation (GDPR) is:

GIIKU GAMES GmbH
Rehleitenweg 32b
83026 Rosenheim, Germany
Managing Director: Achim Kaspers
E-mail for data protection: datenschutz (at) giikugames.com

We are not legally required to appoint a data protection officer. For all questions regarding data protection, please contact us at the e-mail address above.

2. Legal Basis

Where a legal basis is mentioned in this Privacy Policy, it refers to the GDPR and, where applicable, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). We process personal data on the basis of the following provisions:

• Consent pursuant to Art. 6 para. 1 (a) GDPR. Consent is any freely given, specific, informed and unambiguous indication of your wishes, by a statement or by a clear affirmative action, by which you agree to the processing of your personal data.
• Necessity for the performance of a contract or for taking steps prior to entering into a contract pursuant to Art. 6 para. 1 (b) GDPR, i.e. the data is required so that we can fulfil our contractual obligations towards you or prepare the conclusion of a contract with you.
• Processing to comply with a legal obligation pursuant to Art. 6 para. 1 (c) GDPR, i.e. processing of the data is required by law or other regulations.
• Processing for the purposes of legitimate interests pursuant to Art. 6 para. 1 (f) GDPR, i.e. processing is necessary to safeguard our legitimate interests or those of third parties, unless your interests or fundamental rights and freedoms which require the protection of personal data override them.

3. Rights of data subjects

With regard to the processing of your personal data by us, you have the following rights under the GDPR:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure ("right to be forgotten") (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR, see below)
• Right to withdraw consent at any time with effect for the future (Art. 7 para. 3 GDPR); the lawfulness of processing carried out on the basis of the consent before its withdrawal remains unaffected.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

Right to object: Where we process your personal data on the basis of Art. 6 para. 1 (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. To exercise your rights, an informal message to datenschutz (at) giikugames.com is sufficient.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

4. Data erasure and storage duration

The personal data of the data subject will be erased or restricted as soon as the purpose of storage no longer applies. Storage beyond this may take place if this is provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be restricted or erased when a storage period prescribed by these provisions expires, unless further storage is necessary for the conclusion or performance of a contract.

5. Recipients and transfers to third countries

We use carefully selected service providers (processors) for hosting and e-mail. They process personal data only on our behalf and in accordance with our instructions on the basis of data processing agreements pursuant to Art. 28 GDPR. The individual providers are named in the respective sections below.
Some of these providers belong to groups of companies based in the USA. Where personal data may be processed in the USA, the transfer is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework of 10 July 2023 (Art. 45 GDPR), provided the recipient is certified under it, and additionally on EU Standard Contractual Clauses (Art. 46 para. 2 (c) GDPR).

II. Concrete Data Processing

1. Data collection when visiting the website

a) Scope of data processing

When you visit our website, our web server automatically collects and stores the following data:

• Information about the browser type and version used
• The operating system of the user
• The IP address of the user
• Date and time of access
• The website from which the user's system accesses our website (referrer)
• The pages accessed on our website

The data is stored in the log files of our system. It is not stored together with other personal data of the user. Our website does not use cookies, tracking or analytics tools.

The website is hosted by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg ("AWS"), on servers in the EU region Frankfurt, Germany. AWS is a subsidiary of Amazon.com, Inc., USA; regarding possible access from the USA, please refer to section I.5.

b) Legal basis

The legal basis for processing the data is Art. 6 para. 1 (f) GDPR. Our legitimate interest lies in the functionality, availability and security of our website.
AWS acts as our processor on the basis of a data processing agreement pursuant to Art. 28 GDPR.

c) Purpose of data processing

Temporary processing of the IP address by the system is necessary to deliver the website to the user's device. For this purpose, the IP address must be processed for the duration of the visit.
Storage in log files serves to ensure the functionality of the website and the security of our information technology systems, e.g. to detect and defend against attacks.
The data is not evaluated for marketing purposes.

d) Duration of storage

The data is deleted as soon as it is no longer required for the purpose for which it was collected. Log files are deleted after 14 days at the latest, unless specific security incidents require longer storage for evidence purposes; in that case the data concerned is kept until the incident has been finally resolved.

e) Right to object and removal possibility

The collection of data for the provision of the website and its storage in log files is technically required for the operation of the website. You may object to this processing on grounds relating to your particular situation (Art. 21 GDPR, see section I.3); however, we will continue to process the data for the short storage period stated above where this is necessary for the secure operation of the website.

2. Contact by e-mail

a) Scope of data processing

If you contact us by e-mail, we process the data you provide (in particular your e-mail address, your name if provided, and the content of your message). E-mails are transmitted and stored via Microsoft 365, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft"). Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework; regarding possible processing in the USA, please refer to section I.5.

b) Legal basis

The legal basis is Art. 6 para. 1 (f) GDPR; our legitimate interest lies in answering your enquiry. If your enquiry aims at concluding or performing a contract with us, the additional legal basis is Art. 6 para. 1 (b) GDPR.
Microsoft acts as our processor on the basis of a data processing agreement pursuant to Art. 28 GDPR.

c) Purpose of data processing

The data is used solely to process and answer your enquiry.

d) Duration of storage

The data is deleted as soon as your enquiry has been finally dealt with and it is no longer required for the business contact, unless statutory retention obligations (e.g. under commercial or tax law) require longer storage.

e) Right to object and removal possibility

You can object to the processing of your data and request its deletion at any time by writing to datenschutz (at) giikugames.com. In this case the conversation cannot be continued.