Data export and account deletion: two buttons instead of two forms

Access and erasure are two rights under the GDPR that at many providers run through a form, which then lands in a mailbox and waits there for somebody to get to it. With us they are two buttons in your account, and what happens behind them is automated.

You will find the data export in the Account section. Once you request it, we collect the data from every service that holds anything about you, meaning identity, profile, billing, community and game servers, put it into an archive and send you a download link by email. The link expires, so that it does not sit in a mailbox indefinitely and get opened one day by somebody it was never meant for.

Account deletion is in the same place. As soon as you confirm it, the account stops working immediately, signing in fails and every open session is ended. A period of 30 days then begins. It is there for the case where the deletion was a mistake or where somebody else had access to the account, because during that window the whole thing can still be undone. Once the period has passed, the record disappears for good and is not merely hidden from view.

Issued invoices are excluded from this. They carry a name and a billing address, and section 147 of the German Fiscal Code requires us to keep them for ten years, whether or not the account behind them still exists. That is commercial law and not ours to decide. Everything that does not fall under that retention duty goes with the account.

If you want to go further than closing the account and explicitly request erasure under Article 17, there is a separate path for that in the same section. It asks for an additional confirmation by email, because it reaches further than an ordinary account closure and cannot be taken back.