Privacy Policy

This policy explains what personal data we collect, why, and your rights under the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Data Controller

zuwo UG (haftungsbeschränkt)
Neusser Str. 28
50670 Cologne
Germany
Email: privacy@zuwo.org

2. Hosting and Server Logs

This website is hosted via Ploi.cloud on infrastructure provided by UpCloud Ltd, with servers located in the EU. When you access our website, your browser automatically transmits data to our servers, including your IP address, browser type, operating system, referrer URL, and the date and time of the request. This data is stored temporarily in server log files to ensure technical operation and security.

Legal basis: Art. 6(1)(f) GDPR — legitimate interests in maintaining the security and proper functioning of the service. Logs are deleted automatically after a short retention period.

3. Content Delivery Network

Static assets (CSS, JavaScript, and images) are served via bunny.net, a content delivery network operated by BunnyWay d.o.o. (Cesta komandanta Staneta 4a, 1215 Medvode, Slovenia). We have configured the CDN to route traffic exclusively through European edge nodes, meaning requests for static files are always handled within the EU. bunny.net's edge servers record your IP address and standard request metadata (URL, browser, timestamp) in access logs for caching and DDoS-protection purposes.

Legal basis: Art. 6(1)(f) GDPR — legitimate interests in fast and reliable asset delivery while keeping data within the EU.

4. Application Monitoring

We use Sentry (Functional Software, Inc.) to monitor application health and track errors. Sentry collects request metadata (URL, HTTP method, response status, duration) and exception stack traces. Request body content and authentication credentials are not transmitted. Our Sentry organisation is configured for EU data residency, so all monitoring data is stored exclusively on servers within the EU.

Legal basis: Art. 6(1)(f) GDPR — legitimate interests in maintaining the security, stability, and performance of the service.

5. Analytics

We use Fathom Analytics, a privacy-respecting analytics service. Fathom does not use cookies, does not track you across websites, and does not collect personal data. All analytics data is processed and stored in the EU. Aggregated, anonymised visitor statistics are publicly accessible via our stats page.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in understanding how the service is used, with minimal privacy impact.

6. Steam Login

You may log in using your Steam account via the OpenID protocol provided by Valve Corporation (Valve, 10400 NE 4th St, Bellevue, WA 98004, USA). When you authenticate, Steam transmits your Steam ID, display name, and avatar hash to us. We do not receive your Steam password. Your game library is retrieved from the public Steam API using your Steam ID.

By logging in with Steam, you interact with Valve's services, which are subject to the Steam Privacy Policy. Your Steam ID and associated data may be transferred to and processed in the United States. Valve participates in the EU–US Data Privacy Framework (DPF).

Legal basis: Art. 6(1)(b) GDPR — processing is necessary to provide the service you requested (account creation and login).

Data stored after login: Steam ID, display name, avatar hash, and a snapshot of your Steam game library. We do not store your game library permanently; it is refreshed on login.

7. Ideas and Votes

When you submit a feature request (idea), we store your Steam ID, the idea title, short description, and long description. When you vote on an idea, we store your Steam ID, the idea identifier, and the direction of your vote. This data is required to provide core site functionality.

Legal basis: Art. 6(1)(b) GDPR — processing is necessary to fulfil the service you requested.

8. Game Preference Voting

If you use the game ranking feature, we store a personalised ELO-based preference score for each game per user account. This is linked to your Steam ID.

Legal basis: Art. 6(1)(b) GDPR — processing is necessary to provide personalised rankings.

9. Data Retention and Account Deletion

We retain your account data and associated content (ideas, votes, game preferences) for as long as your account exists or as long as necessary to provide the service.

You can delete your account at any time directly from your dashboard. Deleting your account will immediately and permanently erase your user record, your Steam profile data, and all your votes. Ideas and comments you have submitted will remain visible but will no longer be linked to your identity — they will appear as authored by [Deleted]. If you wish to exercise your right to erasure under Art. 17 GDPR, please use this self-service function. For any further requests or questions, contact privacy@zuwo.org.

10. Data Sharing and Third Parties

We do not sell your personal data to third parties. We do not use cross-site advertising networks. The only third-party services involved in operating this website are:

• Ploi.cloud / UpCloud — hosting infrastructure (EU)
• bunny.net / BunnyWay d.o.o. — content delivery network, EU-only routing (EU)
• Fathom Analytics — privacy-focused, cookieless analytics (EU)
• Sentry / Functional Software, Inc. — application monitoring and error tracking, EU data residency (EU)
• Valve / Steam — authentication provider (US, DPF participant)
• Iframely / Itteco Corp. — consent-gated embedded media player on editorial pages (US)
• Stripe Payments Europe, Ltd. — payment processing and invoicing for game boosts (EU; limited transfers to Stripe, Inc., US, DPF participant)

11. Your Rights

Under the GDPR you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) — you may request a copy of the data we hold about you.
• Right to rectification (Art. 16 GDPR) — you may request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR) — you may delete your account and data directly from your dashboard, or contact us to request deletion.
• Right to restriction of processing (Art. 18 GDPR) — you may request that we restrict how we use your data.
• Right to data portability (Art. 20 GDPR) — you may request your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR) — you may object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@zuwo.org.

12. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. The competent authority for our company is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestr. 2–4, 40213 Düsseldorf, Germany
www.ldi.nrw.de

13. Payments (Game Boosts)

If you boost a game, the payment is processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). The entire checkout takes place on Stripe's hosted payment page, not on our website. Stripe collects the data required to process the payment and issue your invoice: payment method details, name, email address, billing address, and — optionally — a VAT ID. We never receive or store your payment card details.

On our side we only store the boosted game, the amount paid, the currency, the payment status, and a Stripe transaction reference. Boosts are not linked to your Steam account; who boosted a game is not stored or displayed by us.

Stripe uses cookies on its own checkout pages for security and fraud prevention; this is subject to the Stripe Privacy Policy. Stripe Payments Europe, Ltd. may transfer data to Stripe, Inc. in the United States; Stripe participates in the EU–US Data Privacy Framework (DPF) and relies on EU Standard Contractual Clauses.

Legal basis: Art. 6(1)(b) GDPR — processing is necessary to carry out the payment you requested — and Art. 6(1)(c) GDPR for the retention of invoicing and accounting records under statutory commercial and tax law obligations (Sec. 147 AO, Sec. 257 HGB; up to 10 years).

14. Affiliate Links (G2A)

Game pages contain "Buy on G2A" links to the marketplace g2a.com, operated by G2A.COM Limited (31/F, Tower Two, Times Square, 1 Matheson Street, Causeway Bay, Hong Kong). These are affiliate links: the URL carries a partner identifier so that G2A can attribute purchases to us and pay a commission. The identifier only tells G2A that you arrived from our site — it contains no personal data, and we transmit nothing about you.

Only when you actively click such a link does your browser contact G2A directly. From that point on, G2A processes your data under its own responsibility — including setting cookies for purchase attribution — subject to the G2A Privacy Policy. G2A.COM Limited is based in Hong Kong, so data processed by G2A may be transferred outside the EU.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in financing the service. No processing occurs on our side; G2A's processing starts only after your deliberate click on an external link.

15. Embedded Media (Iframely)

Editorial pages may contain embedded media such as video trailers from YouTube or other platforms. These embeds are delivered through Iframely, a service operated by Itteco Corp. (USA). The embed metadata is retrieved by our servers — no data about you is transmitted in that step.

When you open a page containing an embed, your browser loads the media player from Iframely's servers, which transmits your IP address and standard request metadata (browser, timestamp) to Iframely. The player then shows a consent notice: content from the underlying platform (e.g. YouTube / Google LLC) is only loaded after you actively consent within the player. From that point on, the platform processes your data under its own responsibility and privacy policy — YouTube embeds are subject to the Google Privacy Policy. Iframely and the media platforms may process data in the United States.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in enriching editorial content with media previews — for delivering the consent-gated player; Art. 6(1)(a) GDPR — your consent, given in the player — for loading content from the underlying platform.

Last updated: July 2026