Privacy Policy

Controller (Data Processing Responsibility)

Cloud Spheres UG (haftungsbeschränkt)
Represented by: Silas Noel Timmermann and Alan Khudhur (Managing Directors)
Biberweg 24, 33102 Paderborn, Germany · HRB 18602, District Court Paderborn
Email: [email protected]

Data Protection Officer:

The obligation to appoint a Data Protection Officer pursuant to Art. 37 GDPR / § 38 BDSG is being kept under review. Until a formal appointment, data-protection inquiries are handled directly at [email protected]. Once a DPO is appointed, their contact details will be published here.

General Information

This Privacy Policy explains how we collect, process, and use your personal data when you visit our website or use our services (e.g., game servers).

Purposes of Processing

We process personal data for the following purposes:

Provision and management of the compute-hosting platform (game servers, going forward also VPS/VDS and cloud compute)
Payment processing via Stripe Payments Europe Ltd.
Contract fulfilment and invoice generation via FastBill GmbH
Sending transactional emails (e.g. registration, order and invoice notifications) via Postmark (ActiveCampaign, LLC) and Mailjet (Mailjet SAS)
Business communication, support tickets and CRM via Microsoft 365 (Microsoft Ireland Operations Limited)
Edge security, DDoS protection and DNS via Cloudflare
Use of internal services such as customer area, reseller dashboard and community
Internal analytics: aggregated counts of purchases and creator-code usage with no link to personal data
Wallet management: top-ups, voucher redemptions and service billing via credit balance
Optional: aggregated error telemetry via Sentry with PII scrubber and IP anonymisation active

Data Collected

We process the following data:

Billing data: first name, last name, billing address (street, postal code, city, region), company name (optional), VAT ID (optional)
Master data (name, address, email address)
Payment information (depending on payment method)
Usage data (e.g., logins, IP address, server usage)
Communication data (e.g., support requests)
Wallet data: credit balance, transaction ledger (top-ups, refunds, voucher redemptions), voucher codes used
Profile data: username, avatar, privacy settings, parental control preferences, consent timestamps (terms accepted, privacy accepted, age verification)

Legal Basis

Processing is based on Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(c) GDPR (legal obligation), Art. 6(1)(f) GDPR (legitimate interests in a secure and reliable operation of our services) and, to the extent we obtain consent (e.g. for optional cookies or a newsletter), Art. 6(1)(a) GDPR.

Data Sharing with Processors

Customer content is processed on certified infrastructure in European data centres. Infrastructure providers in use:

Contabo GmbH: Nuremberg, Munich (Germany)
Hetzner Online GmbH: Falkenstein, Nuremberg (Germany)
Amazon Web Services EMEA SARL: eu-central-1 Frankfurt · eu-west-1 Dublin
Cloudflare: EU edge PoPs (Frankfurt, Amsterdam, Paris, Dublin)

We engage the following processors with whom data-processing agreements pursuant to Art. 28 GDPR are in place. The complete, continuously maintained list is available at cloud-spheres.com/subprocessors:

Stripe Payments Europe Ltd. (payment processing): Billing name, address and payment-method tokens are transmitted to Stripe for payment processing. Stripe is established in Dublin, Ireland; third-country transfers to Stripe, Inc. (USA) are safeguarded by EU Standard Contractual Clauses and EU-US DPF certification.
FastBill GmbH (invoice generation): Billing name, address and VAT-ID are forwarded to FastBill GmbH (Cologne) for GoBD-compliant invoice generation. FastBill processes this data as a processor exclusively within Germany.
Postmark by ActiveCampaign, LLC (transactional email): To send transactional emails (e.g. registration, order and invoice notifications), we transmit email address, name and the respective message content to Postmark, a service of ActiveCampaign, LLC (Chicago, USA). The transfer to the USA is safeguarded by EU Standard Contractual Clauses and certification under the EU-US Data Privacy Framework.
Mailjet SAS (transactional email): As a failover for transactional system and notification emails we use Mailjet, a service of Mailjet SAS, established in Paris, France (EU). Email address, name and the respective message content are transmitted. Processing takes place within the EU; this service involves no third-country transfer.
Google Ireland Limited (Google Analytics 4, only where analytics consent was granted): Only if you have consented to the “Analytics” category in the cookie banner is Google Analytics 4 loaded; it then transmits usage data (truncated IP address, device and browser details, pages viewed) to Google Ireland Limited (Dublin, Ireland) with onward transfer to Google LLC (USA). The transfer to the USA is safeguarded by EU Standard Contractual Clauses and certification under the EU-US Data Privacy Framework. Without your consent this processing does not take place; you may withdraw it at any time with future effect via the cookie settings in the footer.

Further processors

For business communication, support tickets and CRM we use Microsoft 365 (Microsoft Ireland Operations Limited) with the EU Data Boundary enabled. Application-error telemetry optionally uses Sentry (Functional Software, Inc.) with PII scrubber and IP anonymisation. Tax advisors and authorities receive data only within the legally required scope (Art. 6(1)(c) GDPR). The full list with respective safeguards is available at cloud-spheres.com/subprocessors.

Third-Country Transfers

Data is processed primarily within the EU/EEA. Third-country transfers may arise from the use of Cloudflare, Inc., Stripe, Inc., ActiveCampaign, LLC (Postmark), Microsoft Corporation and Functional Software, Inc. (Sentry). Google LLC (USA) is added by the use of Google Analytics 4; unlike the five recipients named above, that transfer takes place only if you have consented to the “Analytics” category in the cookie banner, and it ends when you withdraw that consent. Such transfers are safeguarded by EU Standard Contractual Clauses (SCC, Module 2/3, Art. 46(2)(c) GDPR) and, where available, by the EU-US Data Privacy Framework adequacy decision. Supplementary measures: client-side AES-256 encryption of backups before off-site transfer, encryption keys held exclusively in the EU, Microsoft EU Data Boundary active, AWS processing exclusively in EU regions.

Data Disclosure in Case of Misuse

In the event of security incidents, abuse, or unlawful use, we may share relevant usage data with our infrastructure partners and, where applicable, competent law enforcement authorities. This is done in accordance with Art. 6(1)(f) GDPR (legitimate interest in preventing misuse) or Art. 6(1)(c) GDPR where there is a legal obligation.

Retention Period

We retain your data only as long as necessary for the respective purposes or where statutory retention obligations apply. For example, tax-relevant records may be retained for up to 10 years under § 147 AO (German Fiscal Code). In particular, your billing name and address are stored immutably in issued invoices and retained for 10 years under § 147 AO even after you request account deletion; only your live billing profile fields are anonymised within 30 days.

Your Rights

GDPR Rights

As a data subject, you have comprehensive rights with respect to your personal data.

Right	Description	Legal basis
Access	Right to access your stored personal data	Art. 15 GDPR
Rectification	Right to correct inaccurate data	Art. 16 GDPR
Erasure	Right to have your data deleted	Art. 17 GDPR
Restriction	Right to restrict processing	Art. 18 GDPR
Data Portability	Right to receive and transfer your data	Art. 20 GDPR
Object	Right to object to processing	Art. 21 GDPR
Withdraw Consent	Consent you have given may be withdrawn at any time with effect for the future	Art. 7(3) GDPR

How to Exercise Your Rights

You can exercise all GDPR rights listed above directly through your account dashboard or by contacting us at [email protected]. We respond to all requests within one month as required by Art. 12 GDPR. For complex requests, this period may be extended by up to two further months with prior notification.

If you believe your rights have been violated, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). See the "Contact & Supervisory Authority" section below.

Security

We implement appropriate technical and organizational measures (TOMs) pursuant to Art. 32 GDPR to protect your data against loss, destruction, and unauthorized access, alteration, or disclosure:

Transport Encryption: All data transmission via HTTPS / TLS 1.2+
Access Controls: Role-based access, principle of least privilege
Password Hashing: Passwords stored using bcrypt, never in plain text
Infrastructure Isolation: Customer server environments are isolated from each other
Regular Updates: Security patches applied on a regular basis
Incident Response: Breach notification within 72 hours per Art. 33 GDPR

Please note that, despite these measures, the transmission of data over the internet (e.g. when communicating by email) can have security vulnerabilities; complete protection against access by third parties is not technically possible.

Cookies and Tracking

Our website uses cookies and similar storage mechanisms. We distinguish between the following categories:

Strictly Necessary (no consent required)

Session cookies keep you logged in during your visit (deleted when the browser is closed)
CSRF tokens protect against cross-site request forgery attacks
The consent cookie “cs-cookie-consent” records your cookie decision (the “Analytics” category on or off) for 12 months (max-age 31536000 seconds); once it expires, or once you delete it, we ask you again
Your language choice is stored in the “cs_locale” cookie for 12 months; the news reading list is kept in the localStorage of your browser (“cs:news:bookmarks”) and stays there until you clear the site data

Analytics and Optional (consent required)

Google Analytics 4 (GA4), Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (with onward transfer to Google LLC, USA)
Purpose: reach measurement and usage statistics to improve the website
Cookies: _ga and _ga_<Container-ID> (approximately 2 years); IP addresses are processed by Google only briefly for coarse location and are not stored
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG
Third-country transfer to Google LLC (USA) is safeguarded by the EU-US Data Privacy Framework and EU Standard Contractual Clauses (SCCs); residual risks: US authorities may access data
Withdrawal: at any time via the cookie settings in the footer or your browser settings, effective for the future
No other advertising or tracking cookies are set without your consent.

You can withdraw or manage optional cookies at any time via the cookie settings in the footer or in your browser settings. Disabling strictly necessary cookies may affect the functionality of our services.

Legal Basis: Storing information on your device, or accessing information already stored there, is based on § 25(2) no. 2 TDDDG for strictly necessary cookies; the subsequent processing of personal data is based on Art. 6(1)(f) GDPR. For optional cookies/technologies and analytics (e.g., GA4), § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent) applies.

Minors

Our services are intended for persons aged 18 and over. Minors may only use our services with the consent of their legal guardians; details are governed by our Terms of Service. Where, in individual cases, we base processing on consent and the offer is made directly to a child, processing in relation to children under the age of 16 is lawful only to the extent that consent is given, or authorised, by the holder of parental responsibility (Art. 8 GDPR). If we become aware that a child's data has been transmitted to us without the required consent, we will delete that data.

Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR that produces legal effects or similarly significantly affects you. Decisions regarding contract acceptance or termination are made by our team manually.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data processing practices.

Material changes will be communicated via email to registered customers at least 14 days before taking effect.
Minor updates (e.g., clarifications or corrections) take effect immediately upon publication on this page.
The "Last updated" date at the bottom of this page always reflects the current version.

Contact and Supervisory Authority

Privacy Contact

If you have any questions or concerns about privacy, feel free to reach out to us at any time.

Direct Contact

Contact us directly with general or privacy-related questions.

Email: [email protected]
Privacy matters:: [email protected]

Competent Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2-4, 40213 Düsseldorf, Germany

Phone:: +49 211 38424-0
Email: [email protected]
www.ldi.nrw.de: https://www.ldi.nrw.de

You also have the right to contact any other data protection supervisory authority (Art. 77 GDPR).