Privacy Policy

1. Controller

The controller for data processing is: Kugelpuls UG (limited liability) in formation, [Straße und Hausnummer], [PLZ] [Ort], Germany. Contact: [datenschutz]@kugelpuls.com.

A data protection officer is not required; we answer data protection enquiries directly at the address given above.

2. Hosting and Technically Necessary Processing

The website is hosted by Vercel Inc.; the API application and the database (PostgreSQL) run on the infrastructure of Railway App Inc. in the EU-West region. When the pages are accessed, technically necessary server log data is processed (IP address in truncated form, time, requested resource, amount of data transferred, browser type). The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a secure, stable operation); no merging with other data takes place. The log data is automatically deleted after a short time.

The domain name is managed via Cloudflare (registrar/DNS); exclusively DNS data is processed in this context.

3. Registration and Account Management

Use of the member areas requires registration. We process: e-mail address, password (exclusively as a modern hash, never in plain text), date of birth (exclusively to verify legal age, 18-year limit), telephone number (only with your consent, currently without technical verification), optional voluntary profile information (name, address) and the selected language. Legal basis: Art. 6 (1) (b) GDPR (contract performance) or (c) for the age check.

We store your consents (terms of use, privacy, age confirmation) in an audit-proof manner with document version, timestamp and a salted hash of your IP address (no plain-text IP). You may withdraw consents at any time with effect for the future – withdrawal does not affect the lawfulness of processing carried out previously.

4. E-mail Delivery (Resend)

We send transactional e-mails (e.g. the confirmation of your e-mail address) via Resend, Inc. Your e-mail address and the delivery status are processed. No newsletter is sent without explicit separate consent. Legal basis: Art. 6 (1) (b) GDPR.

5. Identity Verification (KYC) – Only for Certain Membership Levels

To acquire full member status (player verification), you may – voluntarily and only after prior proof of contact – upload a profile photo as well as the front and back of an identity document. These documents are stored as encrypted-transfer binary data in the database; access is server-side restricted to the approval review and is documented in the access log.

After the review is completed (approval or rejection), the document contents are automatically deleted after 30 days at the latest; of the documents, only an entry without image data remains for evidence and audit purposes. Deletion requests are carried out without delay. Legal basis: Art. 6 (1) (b) GDPR or your consent ((a)), which you may refuse without losing any other functions of basic membership.

6. Number Suggestions, Hit Checking and Community Content

The number suggestions you generate, the automatic hit check against draw results, and optionally experience reports written by you are stored. Experience reports are published exclusively after approval by us and in anonymised form (without naming names); you may withdraw the publication at any time. Number suggestions are automatically deleted after 7 days (your area) or 28 days (internal administrative stock). Legal basis: Art. 6 (1) (b) or (a) GDPR.

7. Payments

For paid memberships, payment processing via Stripe Payments Europe Ltd. is planned; Stripe processes payment instruments and fraud checks in accordance with its own privacy policy. As long as card payment is not activated, activations take place exclusively manually by us. Legal basis: Art. 6 (1) (b) GDPR.

8. Cookies and Local Storage

We do not set tracking or advertising cookies and do not embed third-party analytics or social media services. For functionality we use exclusively local storage in the browser ("localStorage"): the session access key (after you log in), your design/language choice and your view settings. This data does not leave your browser, or it is transmitted exclusively to our API for the duration of your session. Legal basis: § 25 (2) No. 2 TDDDG (technically necessary storage).

9. Recipients and Processing in Third Countries

Recipients are exclusively the service providers named above (hosting, e-mail delivery, domain, payment services). Transfers to third countries (especially the USA) take place on the basis of the respectively applicable safeguards (EU standard contractual clauses or adequacy decision EU-US Data Privacy Framework). Reselling your data never takes place.

10. Storage Duration

Account data is stored until you delete your account; afterwards, irreversible anonymisation takes place (e-mail address and identifying details are made unrecognisable, session keys lose their validity, KYC documents are completely deleted). We retain consent records and accounting data in accordance with the statutory retention periods (§ 147 AO, § 257 HGB). Content whose storage is no longer necessary is deleted regularly.

11. Your Rights

You have the right of access (Art. 15 – available as a machine-readable data export in your account), rectification (Art. 16), erasure (Art. 17 – via the deletion function in your account or by e-mail), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6 (1) (f) (Art. 21). You also have the right to lodge a complaint with the competent supervisory authority.

12. Responsible Gaming

Gambling can be addictive. Our platform does not replace participation in lotteries and is not permitted for minors. Counselling services: BZgA telephone counselling 0800 137 27 00 (free of charge, anonymous) and www.check-dein-spiel.de.