What is processed – and what is not

Please note: This English text is provided for convenience. The operator is based in Germany and the legally binding version is the German one – Impressum and Datenschutzerklärung.

1. Controller

Florian Schickling
Eggisried 37
87724 Ottobeuren
Deutschland
Email: Adresse erscheint, sobald JavaScript geladen ist.

2. Visiting the site and server log files

When this website is accessed, technically necessary information is transmitted to the server and processed by the hosting provider. This may include in particular:

• IP address
• date and time of access
• page or file requested
• amount of data transferred
• status of the request
• technical information about the browser and device used

The processing serves to provide the website technically and to ensure its security and stability.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and technically reliable operation of this website.

These data are not used for advertising or profiling.

3. Hosting

This website is hosted with Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Zypern. The provider is based in the European Union.

The hosting provider processes the data required for technical operation solely on our instructions, as a processor within the meaning of Art. 28 GDPR.

The data processing agreement forms part of the provider’s terms of service and is concluded by accepting them.

The provider in turn uses sub-processors. Personal data may therefore also be processed outside the European Economic Area; the European Commission’s Standard Contractual Clauses apply in that case.

4. No cookies and no tracking

This website uses no cookies, no analytics or advertising services and no technologies for reach measurement or the creation of user profiles. The browser’s local storage is not used for tracking purposes either.

As no technologies requiring consent are currently used, no consent banner is necessary.

5. No externally embedded content

Fonts, images, stylesheets and scripts of this website are provided locally or via our own hosting infrastructure. Merely visiting the website loads no additional content from external analytics, advertising, font, map, video or social media services.

This also applies to Buy Me a Coffee. The embed code offered there is not used. The corresponding button on this website is an ordinary link.

6. Links to external services

This website contains links to external services. Only when you actively click such a link is the respective provider’s website or service called up. From that point on, their privacy terms apply.

This concerns in particular:

• the subreddit r/Tippmania on Reddit
• Buy Me a Coffee
• any other external services linked

With external providers, personal data may also be processed outside the European Union or the European Economic Area.

Before you click these links, no data is transmitted automatically from Tippmania to those providers.

7. Contact by email

If you contact us by email, the information you provide is processed in order to answer your enquiry and, where applicable, to deal with follow-up questions.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in handling and answering enquiries. Insofar as the contact serves to initiate or perform a contractual relationship, processing is based on Art. 6(1)(b) GDPR.

The data are deleted as soon as they are no longer required to handle the enquiry and no statutory retention obligations conflict.

No contact form is offered on this website.

If you contact us via Reddit instead or post there, that processing takes place within the Reddit platform. The platform operator’s privacy terms apply to processing there.

8. The application at app.tippmania.com

Sections 2 to 7 describe visiting this website. The application at app.tippmania.com processes further data – accounts, picks, messages. It has no separate policy; it is covered in Part B below. Two maintained versions drift apart over time, and for a legal text that is worse than one extra click.

9. Your rights

Within the statutory requirements you have in particular the following rights:

• access to your personal data pursuant to Art. 15 GDPR
• rectification of inaccurate data pursuant to Art. 16 GDPR
• erasure pursuant to Art. 17 GDPR
• restriction of processing pursuant to Art. 18 GDPR
• data portability pursuant to Art. 20 GDPR
• objection to processing based on legitimate interests pursuant to Art. 21 GDPR

In addition, under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement.

10. Encryption

Website and application are transmitted encrypted via HTTPS. This protects data transferred between your browser and the server from being read by unauthorised parties during transmission.

Part B – The application at app.tippmania.com

Sections 1, 9 and 10 apply here as well: the same controller, the same rights, the same encryption. Everything else differs, because the application requires an account.

11. Account and sign-in

Access is created in three ways: by an invitation from an existing promotion, by that promotion’s join code, or by setting up a promotion of your own. For the account, the following are processed:

• email address (for signing in and for notifications)
• password – only a hash is stored, never the plain text
• a history of earlier password hashes, so that an old password cannot be set again
• the time the account was activated

When a join code is redeemed, it is additionally recorded which account redeemed which code. Without that note, a member removed from a promotion could return immediately using the same code.

If you set up a promotion of your own, your email address and the name you want for it are first stored as a reservation – that is, before an account exists at all. The reservation is valid for seven days and is deleted afterwards; the promotion is only created once you open the link from the email.

When that email is sent, the authentication service already creates an account record holding your address, even if you never open the link. Such a record then remains without membership in any promotion; on request it is deleted (section 9). The same applies to an invitation that is never accepted.

The legal basis is Art. 6(1)(b) GDPR – for the account, to perform the usage relationship; for the reservation, as a pre-contractual measure taken at your request.

12. What comes about while playing

Within a promotion (the group you pick together in) the application processes, per member:

• ring name, chosen avatar and a freely chosen “Signature Line” (a short saying)
• submitted picks and the scores calculated from them
• comments on events and votes on other people’s comments
• messages in the group chat and in direct chats
• notifications and the setting which of them are delivered
• the role in the promotion and any question suggestions submitted

Anyone playing in several promotions has separate profiles there; the details are not visible across promotions.

The legal basis is Art. 6(1)(b) GDPR: it is the purpose of the application. For content other members can see, the legitimate interest in a working group game also applies (Art. 6(1)(f) GDPR).

In this context Tippmania processes no betting or payment data. No stakes are collected for taking part, and no prizes in money or in kind are paid out. Points, standings and virtual titles are part of the game only and have no economic value. The full delimitation is in the legal notice.

13. Database and hosting of the application

The application stores its data with Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapur 049513. The data themselves are held in the European Union: processing takes place in the eu-central-1 (AWS, Frankfurt am Main) region.

The contracting party, however, is based in Singapore and thus in a third country. The European Commission’s Standard Contractual Clauses apply to this constellation and form part of the data processing agreement. The provider also uses sub-processors and maintains a public list of them.

The data processing agreement forms part of the provider’s terms of service and is concluded by accepting them.

14. Cookies and local storage in the application

Unlike this website, the application does set cookies. All of them are necessary for operation; there are no cookies for analytics or advertising there either.

• Sign-in: session cookies of the authentication service. Without them you would be signed out after every page load.
• tippmania_promotion and tippmania_promotionen: which promotion is currently active and what it is called.
• tippmania_ansicht and tippmania_ansichten: which view is currently in effect – President or Chief Content Officer/Contender.

In addition, two entries in the browser’s storage:

• in localStorage, the time of the last activity, so the application signs you out by itself after a longer idle period
• in sessionStorage, a marker that the push subscription has already been synchronised in this session

Because all of these are strictly necessary to provide the service you explicitly requested, consent under § 25(2)(2) TDDDG is not required.

15. Push notifications

Push is voluntary, has to be allowed per device and can be withdrawn at any time – in your profile or in your browser settings. The legal basis is your consent under Art. 6(1)(a) GDPR.

When you enable it, your browser creates a subscription. Its address (the endpoint URL) and the corresponding keys of your device are stored. Delivery uses our own keys (VAPID) via our own server function; no push service provider sits in between.

A transfer to a third country nevertheless takes place here, for technical reasons: web push always runs through the push service of the respective browser vendor – Google for Chrome and Android, Apple for Safari and iOS, Mozilla for Firefox. The endpoint address points to that service. What is transmitted is the title and text of the message, the link to the content concerned and the address of the profile picture of the person who triggered it.

If you do not want that, leave push switched off. The application is fully usable without it; notifications then only appear inside the application.

16. Fetching from Wikipedia

For the leagues’ schedules and an event’s match card, the application fetches content from Wikipedia. This happens on the server and without any action by members; no personal data is transmitted in the process. Your browser makes no connection to Wikipedia.

17. Leaving a promotion and deleting the account

Both happen in the application itself, but they concern different things.

Leaving a promotion removes what belongs to you within that promotion: profile details, picks, scores, comments, messages and the titles won there. Memberships in other promotions and the account itself are untouched. What belongs to the promotion – events, questions, the House Rules and the seasons – remains.

Deleting the account does the same for every promotion at once; in addition, the email address and password are removed.

One entry may deliberately stay behind: per promotion, an entry can be left in the “Hall of Fame” – the ring name and the tally of past seasons. Whether it is created is your own decision, made when you leave or delete. Without it, the final tables of earlier years would be incomplete and the results of the other members no longer comprehensible. The entry contains no email address and no access; signing in with it is not possible. The legal basis is the legitimate interest in the accuracy of the game history (Art. 6(1)(f) GDPR). It can also be removed later – contact us at the address given above.

If the President removes you from a promotion, no such entry is created.

18. Retention in the application

The data remain as long as the account exists – the application depends on past seasons staying comprehensible. Push subscriptions lapse as soon as the device cancels the subscription or push is switched off. After leaving a promotion or deleting the account, section 17 applies.

Shorter periods apply to the preliminary stages of access: a reservation from self-registration lapses after seven days, an invitation after fourteen.