Last updated: 2026-05 — Art. 13 DSGVO.
1. Controller
The controller within the meaning of the DSGVO is the provider named in the . Please address requests regarding your rights to .
2. Your rights (Art. 15–22, 77 DSGVO)
- Access (Art. 15)
- Rectification (Art. 16)
- Erasure (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Objection (Art. 21)
- Lodging a complaint with a supervisory authority (Art. 77 DSGVO in conjunction with § 19 BDSG) — in Lower Saxony, e.g. the LfD Niedersachsen
Requests under Art. 15 (access) and Art. 17 (erasure) are currently handled manually upon email request to . An automated in-game/website workflow for data export (Art. 20 DSGVO, machine-readable format) and self-service deletion is in preparation. We respond within the one-month period under Art. 12 Abs. 3 DSGVO; for complex requests the period may be extended by a further two months, of which we will inform you.
3. Hosting (Art. 6 (1)(f) DSGVO)
Hosting is provided by Hetzner Online GmbH in Germany (EU). A data processing agreement under Art. 28 DSGVO is in place. On every request, technically necessary data is processed (IP address, user agent, timestamp, requested URL) — legal basis: legitimate interest in stable operation. Server logs are deleted or anonymised after 14 days at the latest.
4. Purchases & payment (Art. 6 (1)(b) DSGVO)
To process your purchase, integration with Stripe (Stripe Payments Europe Ltd., Ireland) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) is planned. Currently, only the outgoing PayPal connection for season payouts is integrated on the server side; the incoming webhook paths for Stripe and PayPal are in preparation. During the purchase process we transmit at least your email, the invoice amount and the order reference to the respective provider; you enter card/account details directly with the provider, and they are not accessible to us. Both providers are certified under the EU-US Data Privacy Framework; standard contractual clauses under Art. 46 Abs. 2 lit. c DSGVO are additionally agreed.
5. Minecraft delivery & plugin API
So that a purchase can be delivered in-game, we store your Minecraft username and the link to your order. The Minecraft server queries these entitlements via an HMAC-SHA256-signed interface; replay protection is 5 minutes. Legal basis: Art. 6 (1)(b) DSGVO (contract). During ongoing gameplay, the server plugin additionally processes in-game activities (blocks mined, phase progress, battle pass tier, vote streaks, island memberships, bank balances) to fulfil the game offering.
6. Season participation & book acceptance (Art. 6 (1)(a) DSGVO)
On first joining the server each season, you receive a written book in-game with the season participation terms. If you accept them (command /season accept), your game statistics are included in the season leaderboard as season points and, upon success, processed as part of the top-5 payout. If you decline (/season decline), you do not appear in the leaderboard and are not payout-eligible — regular gameplay is not affected by this. The choice can be revised at any time via /season accept or /season decline (Art. 7 Abs. 3 DSGVO withdrawal). We store a timestamp and a hash of the specific book version accepted (Art. 7 Abs. 1 DSGVO burden of proof) in the table ob_season_participation.
7. Season payouts & verification
For paying out the season prizes, for places 1 and 2 we additionally process the PayPal recipient email you provide and, where applicable, proof of age under § 107 BGB (minors). The PayPal payout is currently carried out manually by the server team via the PayPal Payouts API; automation is in preparation. Legal basis: Art. 6 (1)(b) DSGVO (participation terms). We delete verification data after the payout is completed; we retain tax records for up to 10 years in accordance with § 147 AO.
8. Cookies & comparable technologies (§ 25 TDDDG)
We use exclusively "strictly necessary" storage accesses without consent (e.g. session protection). Convenience functions such as storing the selected display currency or the shopping cart are only activated after your consent. Third-party content (e.g. the Discord widget, vote sites) is only loaded after separate approval.
9. Discord (discord.mythblock.me)
Our Discord server is operated by Discord Inc. (USA). On our website we merely link to the invite link; we load an embedded widget only once you consent to it via the consent manager. When accessing Discord, your IP address, among other data, is transmitted to Discord; Discord is DPF-certified.
10. Retention periods (Art. 5 Abs. 1 lit. e DSGVO)
- Server logs (website): 14 days, then deletion/anonymisation
- Email correspondence: 24 months after conclusion, provided there is no statutory retention obligation
- Order data and invoices: 10 years (§ 147 AO)
- Redeemed in-game coupons: 180 days
- Pending in-game rewards: 90 days
- Season participation and season-points data: active until the end of the respective season, then archived for statistics and deleted once the purpose is fulfilled
- Consent audit trail (season book): for as long as the associated participation or an associated payout must be documented
If you contact us by email, we process your details to handle the request (Art. 6 (1)(b) DSGVO, or (1)(f) for general questions). We delete requests as soon as they are no longer necessary, at the latest after 24 months, provided no statutory retention periods stand in the way.
12. Minors
Purchases are only permitted from the age of 16 or with the consent of the parents/guardians (Art. 8 DSGVO, § 7a BGB by analogy). At checkout you must expressly confirm this. Participation in the season payouts is additionally subject to a minimum age of 18 — minors require the consent of their parents/guardians (§ 107 BGB).
13. Changes
We update this policy when technical or legal conditions change. You can always find the current version at this URL.