Privacy policy

Controller

Timothy Vida, In den Zeuläckern 20, 60389 Frankfurt am Main, Germany, [email protected]

Hosting

dzbuy.org runs on servers of Hetzner Online GmbH in Germany. Traffic is routed through Cloudflare, Inc. as a content delivery network; Cloudflare processes IP addresses to deliver the site and to protect against attacks.

Account data

When you create an account we store your display name, your email address (if you sign up with one), a scrypt hash of your password and the time of creation. Passwords are never stored in plain text.

If you sign in with Discord we store your Discord ID, your user name and the address of your avatar picture. We do not receive your Discord password.

Legal basis: performance of a contract, Art. 6 (1) (b) GDPR.

Sessions and cookies

We use exactly two cookies. `dzbuy_session` keeps you signed in and holds a random value that only points at your session in our database; it lasts 180 days. `dzbuy_locale` stores your chosen language for one year. Both are strictly necessary for the service, so no consent banner is required.

With every session we store the browser identifier and the IP address of the last sign-in so that you can recognise your own devices in the settings and end them.

Trading data

Listings, trades, balances, ratings and messages are stored so the marketplace can work. Messages between players are visible to the two participants and, in case of a report, to the moderation team of that server.

Balance changes are kept in a ledger so that mistakes stay traceable. Legal basis: performance of a contract, Art. 6 (1) (b) GDPR, and legitimate interest in a working, abuse-free platform, Art. 6 (1) (f) GDPR.

No tracking

dzbuy.org contains no advertising and no analytics. The only content loaded from a third party is the security check described below, and only on the sign-in, sign-up and password pages.

Security check (Google reCAPTCHA)

The sign-in, sign-up and password pages use Google reCAPTCHA v2 to keep automated scripts from creating accounts and guessing passwords. It is loaded only on those pages, never while you browse a marketplace.

When the check runs, Google Ireland Limited receives your IP address, information about your browser and device, and your interaction with the widget, and may set cookies. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to the USA on the basis of the EU-US Data Privacy Framework.

Legal basis is our legitimate interest in protecting accounts against abuse, Art. 6 (1) (f) GDPR. If you do not want this, you can create your account through Discord sign-in instead — that page does not load reCAPTCHA. Google's privacy policy: https://policies.google.com/privacy

Your rights

You have the right to information, correction, deletion, restriction of processing, data portability and objection. You can delete your account at any time in the settings; all your listings, messages and balances are removed with it.

You may lodge a complaint with a supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information.

Retention

Account data is kept until you delete your account. Sessions expire after 180 days at the latest. Read notifications are removed after 60 days.