Privacy Policy

1. Controller

Controller within the meaning of the General Data Protection Regulation (DSGVO) and other national data protection laws:

Daniel Krause
Teichweg 13a
50374 Erftstadt
Deutschland
E-mail: [email protected]

2. General information on data processing

2.1 Scope of processing

As a rule, we process personal data only insofar as this is necessary to provide a functional community platform. Processing takes place in accordance with the provisions of the DSGVO and the Federal Data Protection Act (BDSG).

2.2 Legal bases

Personal data are processed on the following legal bases:

• Art. 6 Abs. 1 lit. a DSGVO — consent (e.g. when registering, for web push notifications)
• Art. 6 Abs. 1 lit. b DSGVO — performance of a contract or steps prior to entering into a contract (e.g. provision of the user account)
• Art. 6 Abs. 1 lit. f DSGVO — legitimate interest (e.g. server log files to ensure security)

2.3 Disclosure of data to third parties

Personal data are not disclosed to third parties — neither for advertising purposes nor for profiling or data enrichment. Exceptions apply only where we are legally obliged to do so (e.g. by order of an authority) or where external service providers act as processors within the meaning of Art. 28 DSGVO (hosting, CDN; see sections 8 and 9). These processors are contractually obliged to comply with the DSGVO.

2.4 Cookies and consent management (cookie banner)

Upon your first visit, a cookie banner is displayed, through which you control the use of cookies and comparable technologies yourself. The site is also fully usable without consent (no “cookie wall”). Your selection is stored locally on your device, together with the time and version of the banner. Each decision is also pseudonymously logged (only selection, version and time — without IP address, without account reference), so that we, as controller, can demonstrate consents and withdrawals in accordance with Art. 7 Abs. 1 DSGVO. You may change or withdraw your choice at any time via the “Cookie Settings” link in the footer.

We distinguish between the following categories:

• Necessary — always active, no consent required (legal basis § 25 Abs. 2 TTDSG, technically necessary)
• Statistics — active only with your consent (legal basis § 25 Abs. 1 TTDSG i. V. m. Art. 6 Abs. 1 lit. a DSGVO)

2.5 Overview of cookies

In addition, we store exclusively in the browser (localStorage, without transmission to servers) non-personal settings such as closing the welcome window (bsn_welcome_dismissed) and your cookie consent (pn_consent_v1). Your likes, however, are stored server-side in your user account (submission_likes or comment_likes) and thus appear on all your devices — see section 7.

2.6 Google Analytics (anonymised visitor statistics)

With your consent, we use Google Analytics (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Irland). Your IP address is shortened/anonymised by Google before storage (anonymize_ip). Google Signals and advertising personalisation are disabled; there is no tracking for advertising purposes and no cross-platform profiling for advertising. Details of data processing by Google: policies.google.com/privacy.

The legal basis is your consent pursuant to Art. 6 Abs. 1 lit. a DSGVO (obtained via the cookie banner). You may withdraw your consent at any time with effect for the future — via the “Cookie Settings” footer link — and additionally prevent collection using the Google Analytics opt-out browser add-on. No automated decision-making, including profiling, takes place in accordance with Art. 22 DSGVO.

3. Provision of the website and creation of log files

3.1 Description and scope

Each time the website is accessed, our system automatically collects data and information from the accessing device. The following data are stored in server log files:

• IP address of the requesting device
• Date and time of access
• Requested URL / page
• HTTP status code
• Volume of data transferred
• User-agent string (browser identification and operating system)
• Referrer URL (if transmitted by the browser)

These data are not combined with other data sources.

3.2 Legal basis and purpose

The legal basis for the temporary storage of log files is Art. 6 Abs. 1 lit. f DSGVO (legitimate interest). Storage takes place in order to ensure the functionality of the website, analyse errors and ensure the security of our information technology systems. These purposes also constitute our legitimate interest.

3.3 Storage period

Log files are stored for a maximum of 7 days and subsequently deleted automatically. Storage beyond this period takes place only in individual cases where this is necessary to investigate a specific security incident or misuse.

4. Registration and user account

4.1 Description and scope

You may create a user account on the BSN Community. The following data are collected and stored upon registration:

• Name (publicly visible — appears with your contributions and comments)
• Email address (not public — used for account management and optional notifications)
• Password (stored exclusively as a cryptographic hash, never in plain text)
• Time of registration
• Time of last login

4.2 Legal basis and purpose

The legal basis is Art. 6 Abs. 1 lit. b DSGVO (performance of a contract). The data are required to set up and manage your user account and to provide you with community functions (contributions, comments, likes, follow function).

4.3 Storage period

The data are stored for the duration of the active user account. After the account is deleted, all personal data are deleted in accordance with section 11 (right to erasure).

5. Submission of contributions without an account

5.1 Description and scope

Contributions may also be submitted without registration. The following data are collected:

• Name (publicly visible — appears with the contribution)
• Email address (not public — for queries and erasure requests)
• The submitted contribution (texts, images, videos, voice messages)
• Time of submission

5.2 Legal basis and purpose

Processing takes place on the basis of Art. 6 Abs. 1 lit. f DSGVO (legitimate interest). Our legitimate interest is to enable participation in the community also for users without an account. The email address is used exclusively to enable us to make enquiries or delete the contribution upon request.

5.3 Storage period

The data are stored as long as the contribution is publicly visible. Upon request, the contribution and associated personal data are deleted without delay (see section 11).

6. Submission via messenger (WhatsApp, Signal, Telegram)

6.1 Description and scope

Contributions may in principle also be sent to the BSN Community via WhatsApp, Signal or Telegram. This method is currently disabled; the following information applies should it resume. The following data are processed:

• Your telephone number (necessary for delivery of the contribution)
• Your name, if you provide it (displayed as the author of the contribution)
• The submitted content (text, images, videos, voice messages)
• Time when the message is received

Important: Transmission takes place via the messenger app you choose. The operators of WhatsApp (Meta Platforms, Inc.), Signal (Signal Messenger, LLC) and Telegram (Telegram Messenger Inc.) process message transmission in accordance with their own privacy policies. As soon as the message reaches our systems, it is subject to this privacy policy.

6.2 Legal basis and purpose

Processing takes place on the basis of Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest is to offer you a submission method with the lowest possible threshold. Your telephone number is used exclusively to receive and process your submission and is not stored after your contribution has been successfully published or communication has been concluded — unless you expressly consent to permanent storage.

6.3 Storage period

Telephone numbers from messenger submissions are deleted immediately after the submission has been processed, unless further correspondence is necessary. The submitted contribution itself is subject to the same storage periods as other contributions (see section 5.3).

7. Contributions, comments, likes and media

7.1 Description and scope

As a registered user, you may publish contributions (texts, photos, videos, voice messages), comments and likes. These activities are linked to your profile and — where they are contributions and comments — displayed publicly on the platform.

In addition, the following are processed:

• Timestamp of each activity
• IP address at the time of creation (exclusively to prevent misuse, not public)
• Reputation score (based on your activity, not on personal characteristics)

7.2 Legal basis and purpose

Processing takes place on the basis of Art. 6 Abs. 1 lit. b DSGVO (performance of a contract). The community functions are a core element of the usage agreement. The IP address is stored on the basis of Art. 6 Abs. 1 lit. f DSGVO to prevent misuse (spam, hate speech, automated attacks).

7.3 Storage period

Contributions, comments and likes are in principle stored permanently unless you delete them or request erasure of your entire account. IP addresses from contributions are automatically deleted after 30 days.

8. Hosting

The BSN Community is hosted on servers of Alfahosting GmbH, data centre Nuremberg (Germany). A data processing agreement in accordance with Art. 28 DSGVO is in place with Alfahosting. All personal data are stored and processed exclusively on servers in Germany.

9. Content Delivery Network (CDN)

To optimise loading times and protect against DDoS attacks, we use the CDN of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When the website is accessed, technically necessary data (e.g. your IP address) may be routed through Cloudflare servers and cached there. A data processing agreement, including EU standard contractual clauses in accordance with Art. 46 DSGVO, is in place with Cloudflare. The legal basis is Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in the secure and high-performance provision of the website).

10. Web push notifications

10.1 Description and scope

Registered users may optionally activate web push notifications to be informed about new likes, comments and replies. For push delivery, a pseudonymous identifier (push subscription token) is stored in the browser. This token contains no personal data and is used exclusively to deliver notifications.

10.2 Legal basis and purpose

The legal basis is Art. 6 Abs. 1 lit. a DSGVO (consent). You will be asked for your express consent when activating push notifications.

10.3 Withdrawal

You may disable push notifications at any time in your browser settings or via the notification settings in your community profile.

11. Your data subject rights

As a data subject, you have the following rights:

11.1 Right of access (Art. 15 DSGVO)

You may at any time request confirmation as to whether personal data concerning you are being processed and obtain information about such data and the circumstances of processing.

11.2 Right to rectification (Art. 16 DSGVO)

You have the right to request without delay the rectification of inaccurate personal data or the completion of incomplete personal data.

11.3 Right to erasure (Art. 17 DSGVO)

You have the right to request the erasure of your personal data at any time and without stating reasons. This includes in particular:

• The complete erasure of your user account, including all associated data (name, email, password hash, registration and login data)
• The erasure of all your contributions, comments, likes and uploaded media
• The erasure of IP addresses stored in connection with your activities
• The erasure of your push subscription token

Simply send your erasure request to [email protected] — we will confirm erasure within 14 days.

11.4 Right to restriction of processing (Art. 18 DSGVO)

You have the right to request restriction of processing if you contest the accuracy of the data, processing is unlawful, we no longer need the data, or you have lodged an objection.

11.5 Right to data portability (Art. 20 DSGVO)

You have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller.

11.6 Right to object (Art. 21 DSGVO)

You have the right, on grounds relating to your particular situation, to object at any time to processing of personal data concerning you which takes place on the basis of Art. 6 Abs. 1 lit. f DSGVO. We will then no longer process the data unless there are compelling legitimate grounds which override your interests.

11.7 Withdrawal of consent (Art. 7 Abs. 3 DSGVO)

You may withdraw consent given at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal remains unaffected.

11.8 Right to lodge a complaint with a supervisory authority (Art. 77 DSGVO)

You have the right to lodge a complaint with a data protection supervisory authority if you consider that processing of your personal data infringes the DSGVO. The supervisory authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf
www.ldi.nrw.de

12. Cookies and local storage

12.1 Technically necessary cookies

The BSN Community uses session cookies, which are technically necessary for sign-in and the basic functionality of the platform. These cookies are deleted as soon as you close your browser. The legal basis is Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in providing the technical platform).

12.2 Local storage

We use your browser's local storage to store user settings (e.g. theme choice: dark/light mode, language, filter settings). These data are purely local and are not transmitted to our servers.

12.3 No analytics cookies

We use no analytics, marketing or tracking cookies. There is no Google Analytics, no Facebook pixels, no remarketing tags.

13. Data security

We employ technical and organisational security measures to protect your personal data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. These include:

• Encryption in transit via HTTPS (TLS)
• Passwords are stored exclusively as cryptographic hashes
• Regular security updates to the software used
• Access restrictions at administrative level
• Content Security Policy and further HTTP security headers

14. Amendments to this privacy policy

We reserve the right to amend this privacy policy where necessary in order to adapt it to current legal circumstances or changes to our services. The current version is always available at this URL. Material changes will be notified to registered users by email or via the platform.

15. Contact for data protection queries

For questions concerning the processing of your personal data, the exercise of your data subject rights or data protection matters, you can reach us at:

Email: [email protected]
Post: Daniel Krause, Teichweg 13a, 50374 Erftstadt

Status: August 2026

16. Chat assistant (board-game assistant)

16.1 How the assistant responds

The chat assistant answers questions about the platform, the SPIEL Essen trade fair and board games. Your question is submitted to a language model, which generates the answer. Two routes are used for this purpose:

• Standard case — own server: The question is processed on our own hardware in Germany. It does not leave our infrastructure.
• Fallback case — Mistral AI: If the own server is at capacity, unavailable or the request is too extensive, it is transmitted to Mistral AI SAS (15 rue des Halles, 75001 Paris, Frankreich) and processed there. Your question, the conversation history of this session to date and the background data provided by the system are transmitted — without any reference to name, account or IP address. Processing takes place within the EU. The legal basis is Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in an assistant that is continuously available).

Please do not enter any personal data in the chat — neither your own nor those of other persons. For matters involving personal data, please use the contact and erasure form.

16.2 Anonymous question log and ratings

In order to improve the assistant, we log anonymously which questions are asked and whether an answer was rated helpful or not helpful by means of a thumb rating. The following are stored exclusively:

• the text of the question (shortened) and an excerpt of the answer,
• the interface language, page path, time and model used,
• where a rating is given: “helpful” or “not helpful”.

The following are not stored: user identifier, session identifier, cookie contents and IP address. It is therefore not possible to associate them with you or your account — not even by us. Before storage, email addresses and longer sequences of digits (such as telephone or account numbers) are automatically replaced.

The sole purpose is to improve the assistant: this enables us to identify which questions are frequently asked and where answers have not been satisfactory. No automated decision-making or profiling takes place. The legal basis is Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in improving our offering).

16.3 Storage period

The question log and ratings are automatically deleted after 90 days. Since the entries contain no personal reference, assignment to an individual person and therefore targeted early erasure are technically not possible.

8. Rights of data subjects — erasure and hiding of contributions

You have the right to request the erasure or hiding of contributions concerning you — even if you did not create them yourself. The easiest way is the “Have contribution deleted” form, which is linked in the navigation and footer.

The legal bases for this are in particular:

• DSGVO Art. 17 — right to erasure of personal data (“right to be forgotten”) and Art. 18 (restriction of processing).
• §§ 22, 23 KUG i. V. m. Art. 1, 2 GG — right to one's own image.
• § 97 UrhG — injunction/removal in the event of copyright infringements.
• §§ 823, 1004 BGB and §§ 185–187 StGB — personality rights, insult, defamation.
• § 20 Abs. 1 Nr. 1 DDG — notice and take-down for unlawful content.

Each request is reviewed by the editorial team (supported by an AI pre-review on its own server). Where a complaint is justified, the contribution is temporarily hidden and the author concerned is given the opportunity to comment. The editorial team decides on the final decision (delete, leave hidden or show again). Requests that do not state a legal ground cannot be processed.