Privacy Policy

1. Privacy at a Glance

General Information

The following notes provide a simple overview of what happens to your personal data when you visit this website.

2. Data Collection on This Website

Who is responsible for data collection?

Data processing on this website is carried out by the website operator. You can find their contact details in the legal notice (Impressum).

How do we collect your data?

Your data is collected, on the one hand, when you provide it to us. This may, for example, be data you enter into a contact form.

3. Hosting and Content Delivery Networks

This website is hosted by an external service provider (OVH). The personal data collected on this website is stored on the servers of the host.

4. Payment Providers

We use Stripe as our payment service provider. During payment, your payment data is transmitted directly to Stripe and processed there.

5. Server Log Files

The host of our website automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Page visited on our domain
• Date and time of the server request
• Browser type and browser version
• Operating system used
• Referrer URL (previously visited page)
• Hostname of the accessing computer
• IP address

This data is not merged with other data sources. This data is collected on the basis of Art. 6(1)(f) GDPR (legitimate interest in the technically error-free presentation and optimization of the website). Server log files are automatically deleted after 14 days.

6. Security Logging and Login Data

What data is stored when you log in?

To protect your account and to detect unauthorized access, we store the following data each time you log in:

• IP address
• Approximate location (city, country) based on the IP address
• Browser and device used (user agent)
• Time of login
• Success or failure of the login attempt

Why do we store this data?

This storage is based on our legitimate interest (Art. 6(1)(f) GDPR) in the security of your user account and our systems. In particular, the data serves:

• To detect unauthorized access to your account
• Fraud prevention
• Traceability in the event of security incidents

How long is the data stored?

The login logs are automatically deleted after 90 days. You may request information about your stored login data at any time or request its early deletion.

Location Determination (GeoIP)

To determine your approximate location, we use a local GeoIP database (MaxMind GeoLite2). No data is transmitted to external services. The location data is not exact and merely serves to detect unusual login patterns (e.g., a login from a different country).

7. Third-Party Providers and Data Processing

Hosting

The website, customer accounts, database and billing data are hosted on our server at OVH SAS (2 rue Kellermann, 59100 Roubaix, France) in the Roubaix data centre (France). For game servers and backups, we also use Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in Germany. The game servers you book run on several machines; some of them are operated by OVH SAS (2 rue Kellermann, 59100 Roubaix, France) in its Limburg an der Lahn (Germany) and Roubaix (France) data centres. During normal game operation, IP addresses of connecting players and content you store on the server may be processed there. All of these locations are within the European Union; no transfer to a third country takes place. Legal basis: Art. 6(1)(f) GDPR.

Payment Processing (Stripe)

Payments are processed via Stripe, Inc. (510 Townsend Street, San Francisco, CA 94103, USA). Stripe processes payment data (card number, name, expiry date) directly — we do not store any credit card data. Stripe is PCI DSS Level 1 certified. Privacy notice: stripe.com/de/privacy. Legal basis: Art. 6(1)(b) GDPR (contract performance).

CDN and DNS (Cloudflare)

We use Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) for DNS management and DDoS protection. In doing so, Cloudflare may process visitors' IP addresses. Privacy notice: cloudflare.com/privacypolicy. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security).

Email Delivery (Resend)

Transactional emails (order confirmations, server notifications) are sent via Resend (Resend Technologies Inc., USA). In this process, your email address and message content are transmitted to Resend. Privacy notice: resend.com/legal/privacy-policy. Legal basis: Art. 6(1)(b) GDPR (contract performance).

Click tracking: Links contained in our emails are redirected via a tracking domain operated by Resend. This allows us to detect whether and when you click a link in an email. In doing so, your IP address, the time of the click, and information about your email program or browser are processed. We use this data to improve the relevance of our emails and to be able to recover abandoned orders. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the needs-based design and optimization of our communication). You may object to this processing at any time by contacting us at support@game-serverhosting.com.

Measurement of page views and ordering steps

Regardless of your cookie choice, we record in our own system which pages of our website are visited and which steps of the ordering process are reached (for example game selection, package selection, continue to payment, completed payment). For this we store one pseudonymous session per visit with the time, the page visited and its title, the entry page, the referring page (referrer), campaign parameters from the link used (utm_*), the browser identifier (user agent) and the browser, operating system and device type derived from it, your IP address and the approximate location derived from it (country, region, city) and, if you are logged in, your account identifier. To link these entries we use the session our website needs anyway; no additional cookie is set for this purpose.

The purposes are to detect technical problems and drop-offs in the ordering process, to evaluate the comparison tests of page variants (see below) and to keep automated traffic out of our statistics. To do this, we check the full IP address against known data-centre and bot networks during the first days. After 7 days we automatically shorten the IP address (for IPv4 by the last block of digits, for IPv6 to the first 48 bits) so that it can no longer be attributed to an individual connection. We evaluate aggregated figures; this data is not combined with the hosting provider's server log files (section 5). The entries are deleted after 180 days.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in a working and understandable ordering process, in measuring which version of a page works better and in protection against abusive access. You can object to this processing at any time on grounds relating to your particular situation under Art. 21 GDPR, for example by email to support@game-serverhosting.com.

Web Analytics (Google Analytics 4)

We use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to analyze user behavior. GA4 is loaded only after explicit cookie consent. Without your consent, no analytics data is collected. IP addresses are anonymized. Legal basis: Art. 6(1)(a) GDPR (consent).

Usage Analytics (Microsoft Clarity)

On our website, in the ordering process and in the customer area we use Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) to understand how visitors interact with our pages: click and scroll heatmaps as well as recordings of how a session is operated (mouse movements, clicks, scrolling, visible page areas). Clarity is loaded only after explicit cookie consent and only then sets the cookies _clck and _clsk. Input into form fields is masked before transmission. In the customer area (server management, profile, invoices, support) all displayed text is additionally hidden before transmission (strict masking); there Microsoft only sees the page layout, mouse movements, clicks and scrolling, but no server names, IP addresses, console output or invoice amounts. The address of the page visited is also transmitted and may contain technical identifiers such as a server number; pages whose address contains search terms or other freely entered text are not recorded, and while recording the page title only shows our brand name. Your account identifier is not transmitted to Microsoft. Microsoft processes the data as an independent controller in the Microsoft Azure cloud; a transfer to the United States may take place and is safeguarded by standard contractual clauses. Recordings are deleted after 30 days. Legal basis: Art. 6(1)(a) GDPR (consent). Further information: Microsoft Privacy Statement.

First-party interaction analytics on the website and in the customer area

With your analytics consent, our own system also measures which form fields on our website and in the customer area receive focus or are changed, whether browser validation fails, whether a form is submitted, and whether an expandable section is opened or closed. A submission event indicates an attempt, not a successful outcome. These events contain technical field and form identifiers or their positions, field type, a fixed validation category or expansion state where applicable, timestamp, page path without query parameters, and a pseudonymous session identifier. Entered values, selected options, filenames and individual error messages are not collected by this measurement. Account, payment, IP and device data are not additionally stored in these field events. The analytics session can connect them to previously recorded page views and order steps; a logged-in session may be associated with your account. The purpose is to identify usability problems, confusing fields and abandoned workflows. Raw events follow the general analytics retention period of 180 days. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw consent at any time in the cookie settings; this collection then stops.

With the same consent we also record where on a page you click: a technical identifier of the clicked element, derived from its attributes and its position in the page structure (never from the displayed text), the click position within the element and relative to the page height in whole percent, repeated rapid clicks on the same spot, clicks without a visible effect, clicks on areas that are not clickable, copy actions (only which element the copy happened in, never the copied content) and, on product pages, how long individual sections were visible. The purpose is to identify confusing pages, features that are hard to find and misleading controls. Raw events follow the same 180-day retention period. From them we calculate daily totals per page, device type and page variant (for example "how often was this button clicked on mobile devices"); these totals contain no session or account identifiers and are deleted after 400 days.

Comparison tests of page variants (A/B tests)

To improve our pages and the order process, we temporarily show visitors different variants of a page (for example a different headline or layout) and compare which variant more often leads to the next order step. The variant is assigned randomly but consistently. If you have consented to analytics cookies, we store a random identifier without any link to your person in the encrypted HttpOnly cookie gsh_vid, so that you see the same variant on a later visit (retention 90 days; legal bases Article 6(1)(a) GDPR and Section 25(1) TDDDG; after you withdraw consent in the cookie settings we no longer evaluate the cookie). Without consent no additional cookie is set; the assignment then only applies to the current session and uses the session our website requires anyway. For each assigned session we store once in our own system which variant was shown, and we note the variant on the analytics and order-step events of that session. No characteristics of your device are evaluated for recognition. Only aggregated figures per variant are analysed. The legal basis for assignment and measurement without consent is Article 6(1)(f) GDPR (legitimate interest in an understandable and working order process); you may object to this processing on grounds relating to your particular situation under Article 21 GDPR. The events are deleted after 180 days.

First-party usage analytics in the server configurator

After your explicit consent, we also record in our own system which offered setting fields are used in the server configurator and whether the associated pseudonymous session subsequently reaches the next order step or checkout. In addition to its timestamp, event type, and pseudonymous session identifier, this additional field event contains only technical identifiers for the game, server software and field, the field type, the technical effect of the change, and whether the setting differs from its default. No account, IP, device, location, referrer, page, or campaign data is added to this field event. The entered value itself is not collected. This specifically includes passwords, tokens, world seeds, and free text. Raw events are deleted together with the associated analytics session no later than after the general analytics retention period of 180 days. Internal reports expose only aggregated field groups containing at least five sessions and do not contain session identifiers. We use this information to identify unnecessary or unclear inputs and improve the ordering flow. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time through the cookie settings.

Duration of pseudonymous sessions

Regardless of your analytics consent, your browser tells our own system roughly every 20 seconds, while a page is visible, that the pseudonymous session already kept on our server is still open. This signal contains no page address, no scroll depth, no input and no additional identifier; it sets no further cookie and relies solely on the technically necessary session cookie. We use it only to extend the recorded duration of the session. The purpose is to see whether visitors to our offer pages, in particular from paid advertising, actually read the page or leave at once. The duration is deleted together with the analytics session no later than after the general analytics retention period of 180 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring the reach of our own offers without accessing your device).

Functional and error logs in the customer panel

Regardless of your analytics consent, our own system records whether an action you triggered in the customer panel succeeded or was rejected, whether a panel tool could be loaded, and whether a navigation led nowhere. These entries contain the timestamp, the technical identifier of the feature and action, a fixed failure class (for example "invalid input", "server must be stopped", "technical error"), the identifier of the affected server where applicable, and your account identifier or a pseudonymous session identifier. Entered values, file contents, search texts and individual error messages are not collected. The purpose is to keep the service you use working: we detect faults and failing steps, often before you contact support, and can trace the sequence of events when you open a support request. The legal bases are Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (legitimate interest in a reliable service); no information is stored on or read from your device beyond what the service requires. Entries are deleted after 90 days. You may object to this processing on grounds relating to your particular situation under Art. 21 GDPR.

Error Logging (Sentry)

To detect and remediate software errors, we use Sentry (Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA). In the event of an error, technical information (error message, stack trace, browser type) is transmitted to Sentry. No personal data such as email addresses or IP addresses is sent to Sentry (send_default_pii = false). Privacy notice: sentry.io/privacy. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in system stability).

Marketing Attribution (Source Measurement)

In order to measure through which of our content (e.g., guide articles) visitors reach an order, we store the source information from the referral link (utm_source, utm_medium, utm_campaign) as so-called first-touch attribution. For Google ads, we also store available click identifiers (gclid, gbraid, wbraid) and their capture time so a later order can be attributed to the ad click. This is done exclusively after your consent to analytics cookies: a cookie gsh_attr holds the first recorded source and the encrypted HttpOnly cookie gsh_gads holds the latest Google ad click (30 days each); if an account exists, these details are assigned to the account so that a later order can be attributed. Your analytics decision is stored in the cookie gsh_consent. Without consent, no permanent source storage takes place. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time via the cookie settings.

Only if you additionally allow marketing cookies do we store this decision separately in gsh_marketing_consent. Upon live payments (the first and every following one), upon registration and when the checkout is opened, available Google click identifiers, click and event times, a pseudonymous transaction identifier and, for payments, value and currency may then be transmitted to Google through the Google Data Manager API. In addition, we transmit your email address exclusively as a SHA-256 hash value ("Enhanced Conversions") so that Google can attribute the purchase to the ad click even where the click identifier alone is not sufficient; Google only matches the hash against the hash values of its signed-in users. Name and IP address are not transmitted. If a reported payment is later refunded in full or in part, we report a corresponding correction of the value to Google. The purpose is to measure which ad led to a purchase; each event is transmitted at most once. The legal basis is Art. 6(1)(a) GDPR. Withdrawal in the cookie settings blocks future transmissions.

Google Ads (Conversion Tag and Remarketing)

After your consent to marketing cookies we also load the Google Ads tag (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). It sets cookies on the domains google.com and doubleclick.net, records your page views on our website and assigns you to remarketing lists so that we can show suitable ads in Google Search to visitors who did not complete an order. Without consent the tag is not loaded and no data is sent to Google (Google Consent Mode, default "denied"). Data may be transferred to the United States; this is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses. Legal basis: Art. 6(1)(a) GDPR (consent); you may withdraw at any time via the cookie settings. Further information: policies.google.com/privacy and policies.google.com/technologies/ads.

Invoicing (InvoiceNinja)

For invoice creation, we use a self-hosted instance of InvoiceNinja (InvoiceNinja, LLC, USA). The invoice data (name, address, email, invoice amounts) is processed on our own server at OVH in France; backups are also stored on our infrastructure at Hetzner in Germany. No data is transmitted to third parties. Legal basis: Art. 6(1)(b) GDPR (contract performance).

Data Processing (DPA)

We have concluded data processing agreements (DPA) pursuant to Art. 28 GDPR with the following service providers:

• Hetzner Online GmbH — hosting for game servers and backups (data processing in Germany)
• OVH SAS (Roubaix, France) — hosting for the website, customer accounts, database, invoices and part of the game servers; data processing in the Limburg an der Lahn (Germany) and Roubaix (France) data centres, both within the EU
• Stripe, Inc. — payment processing (EU-US Data Privacy Framework certified)
• Cloudflare, Inc. — CDN, DNS, and DDoS protection (EU-US Data Privacy Framework certified)
• Resend — transactional emails

Mod and plugin catalogues (Modrinth, CurseForge)

Our mod, modpack and plugin listings take their data from Modrinth (Rinth, Inc., USA) and CurseForge (Overwolf Ltd., Israel). These requests are made exclusively by our own servers: your browser never connects to either provider, and your IP address is not transmitted. Only the search query itself (for example the mod name you typed) and technical parameters such as game version and loader are sent. Preview images of the entries are cached on our own servers and served from there. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a working catalogue that does not pass on visitor data). Provider privacy notices: modrinth.com/legal/privacy, overwolf.com/legal/privacy.

Partner programme and commission payouts

If you open our website via a referral link (?ref=), we set the cookie ref_code containing the referral code for 30 days and record the click with its time, the referral code, a truncated (anonymised) form of your IP address, your browser identifier and the referring page. If you register within this period, we attribute your account to the referring partner so that their commission can be calculated. In their partner area, the partner sees only your first name plus the date, amount and status of the commission, not your email address or your orders. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is rewarding referrals and detecting duplicate or self-referrals. You can delete the cookie in your browser at any time.

If you request a payout of your commission credit as a partner, we process the chosen payout method, for bank transfers the account holder and IBAN, for PayPal the email address of your PayPal account, as well as the amount, request and processing times and, in case of a rejection, its reason. The purpose is reviewing and manually executing the payout. The legal basis is Art. 6(1)(b) GDPR and, for retention as an accounting record, Art. 6(1)(c) GDPR in conjunction with Section 257 HGB and Section 147 AO. We store the payment details encrypted; only authorised staff read them for the transfer, and they reach your bank or PayPal solely as part of executing the payment. If we reject the request, we delete the payment details immediately; after a completed payout we retain them with the payment record for 8 years.

In addition, we store whether you request the payout as a private individual or as a business and, for businesses, the country of the registered office and the uploaded invoice. The purpose is settling the commission correctly for tax purposes; the legal basis is Art. 6(1)(c) GDPR in conjunction with Section 147 AO. The invoice is not publicly accessible on our server; only authorised staff download it. On rejection we delete it immediately; after a completed payout it is deleted together with the payment details after 8 years.

8. Retention Period

We store your personal data only for as long as necessary for the respective purposes:

Type of Data	Retention Period
Server log files	14 days
Login logs	90 days
User account	Until deleted by the user
Contract and accounting data	Generally 8 years where retained as accounting records under Section 257 HGB; longer only where another statutory basis applies
Invoices	8 years (Section 14b UStG)
Server metrics (CPU, RAM)	30 days
Functional and error logs of the customer panel	90 days
Cookies (analytics)	Until consent is withdrawn
Variant cookie for A/B tests (gsh_vid)	90 days; no longer evaluated after consent is withdrawn
Page views and ordering steps (pseudonymous session)	180 days; the IP address is shortened after 7 days
Analytics events (interaction analytics, A/B tests)	180 days
Daily page totals without session or account identifiers	400 days
Marketing attribution (gsh_attr, gsh_gads)	30 days
Referral cookie (ref_code)	30 days
Partner programme: payout payment details and partner invoice	Immediately on rejection; 8 years after a completed payout (Section 257 HGB)
Support requests	2 years after completion

9. Controller

Jens Röcker
Südeschstraße 32
48429 Rheine
Email: support@game-serverhosting.com

10. Your Rights as a Data Subject

You have the right at any time to: access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and objection (Art. 21 GDPR).

Right to lodge a complaint with the competent supervisory authority: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Postfach 20 04 44, 40102 Düsseldorf.

Last updated: October 2026