Privacy policy

1. Controller

Peter Christian Preuss
c/o Online-Impressum 11795, Europaring 90, 53757 Sankt Augustin
E-mail: kontakt@havannah.eu

2. General information on data processing

We process personal data exclusively within the framework of the statutory provisions, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Personal data is any information relating to an identified or identifiable natural person.

3. Processing when visiting the website (server log files)

When the website is accessed, our hosting provider (STRATO AG, Berlin, Germany – processor pursuant to Art. 28 GDPR; a data processing agreement is in place) processes technically necessary data: IP address, date/time, page accessed, browser type. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and stability). The data is deleted after 7 days at the latest.

4. Registration and user account

An account is required to use the gaming platform. We process: username, e-mail address, password (as a cryptographic hash with "pepper" and Argon2id – never in plain text), date of birth (age verification), optionally country and profile picture, as well as game statistics (Glicko-2 rating, game history). Legal basis: Art. 6(1)(b) GDPR (performance of contract). Without this data the services cannot be provided.

5. Consents (Art. 6(1)(a) GDPR)

During registration you consent to the terms of service and to data processing in accordance with this policy. Every consent is logged with version, timestamp and truncated IP address and can be revoked at any time with effect for the future (contact see § 1; in your account under "Export my data / Delete account").

6. Age limit

Registration is possible from the age of 16 (Art. 8 GDPR). Younger persons require the consent of their legal guardians.

7. Cookies and local storage (TTDSG)

Only technically necessary cookies and local storage are used: the session ID (session cookie, SameSite=Lax, HttpOnly) and your theme/language choice. These do not require consent under § 25(2) no. 2 TTDSG. We do not use any third-party advertising, tracking or analytics cookies. Details: Cookie policy.

8. Chat, reports and user-generated content

Messages published in the game chat are visible to the playing partners. We process them to provide the service (Art. 6(1)(b) GDPR) and for moderation in case of abuse (lit. f). You can report illegal content via the report function (DSA).

9. E-mails

Transactional e-mails (verification, password reset) are sent via the hosting provider. Legal basis: Art. 6(1)(b) GDPR. We only send marketing e-mails with separate consent (double opt-in).

10. Retention period

Account data is stored for as long as the account exists; server logs max. 7 days; consent logs for the lifetime of the account (burden of proof); e-mail verification tokens max. 24 hours; password reset tokens max. 1 hour.

11. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to lodge a complaint with a supervisory authority (Art. 77). Deletion and data export are available directly in your account ("Delete account" / "Export my data").

12. Recipients and third-country transfer

Data is processed exclusively by us and our hosting provider (STRATO AG, servers located in Germany). No transfer to third countries takes place.

13. Data security

We implement technical and organisational measures: TLS encryption (HTTPS), password hashing with Argon2id, prepared statements, CSRF protection, rate limits and data minimisation (privacy by design, Art. 25 GDPR).

14. Right to lodge a complaint

The competent supervisory authority is the data protection officer of your federal state.