Privacy Policy

1) Introduction and contact details of the controller

1.1 We are pleased that you are using our services and thank you for your interest. In the following we inform you about how your personal data is handled when you use our website, our shop, our control panel and our donation pages. Personal data here means all data by which you can be personally identified.

1.2 The controller for the data processing within the meaning of the General Data Protection Regulation (GDPR) is 24fire GmbH, Kronenstraße 4, 68723 Schwetzingen, Germany, tel.: +49 156 78711099, e-mail: kontakt@24fire-gmbh.de. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 This privacy policy applies to all of the following services of 24fire GmbH:

• our website and our shop at 24fire.de,
• our control panel at cp.24fire.de, including its programming interface at api.24fire.de and the share links at my-kvm.de,
• our donation pages at spenden.24fire.de and donate.24fire.de,
• our short-link service at 24fi.re,
• our invoice portal at invoice.24fire-gmbh.de.

Where a processing operation concerns only one of these services, we say so in the respective section.

2) Data collection when visiting our services

2.1 When you use our services for information purposes only, i.e. if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to the site server (so-called "server log files"). When you access one of our pages, we collect the following data, which is technically necessary for us to display the page to you:

• The page of ours that you visited
• Date and time at the moment of access
• Amount of data sent, in bytes
• Source/referrer from which you reached the page
• Browser used
• Operating system used
• IP address used

The processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our services. The data is not passed on or used in any other way. However, we reserve the right to check the server log files retrospectively should concrete indications point to unlawful use. We delete the server log files after 30 days.

To protect against overload and abuse, we limit the number of requests that can be made from one IP address within a short time. For this purpose we keep the IP address — mostly only as an irreversible check value — in the cache of our servers for the duration of the respective time window, usually a few minutes (Art. 6(1)(f) GDPR).

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), our services use SSL or TLS encryption. You can recognise an encrypted connection by the string "https://" and the padlock symbol in your browser bar.

3) Hosting & content delivery network

3.1 Cloudflare

We use a content delivery network of the following provider: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files such as graphics, page content or scripts more quickly via a network of regionally distributed servers, and protects our services against attacks and overload. It sits in front of our services; requests to these services therefore pass through the provider's servers. In doing so, the provider determines from your IP address the country from which a request originates and passes it on to us. We use this country information to preset the language and to secure sign-ins to the control panel (section 6.2). The processing takes place in order to safeguard our legitimate interest in improving the stability, security and functionality of our services pursuant to Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

3.2 Cloudflare Turnstile (protection of registration)

To prevent automated registrations in the control panel, we use the same provider's Turnstile service on the registration page. Turnstile checks, on the basis of technical characteristics of your browser and your IP address, whether the request comes from a human; as a rule you do not have to solve a picture puzzle. We send the result of the check together with your IP address to the provider for confirmation.

The processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in protecting our infrastructure against accounts created in bulk and the associated abuse. Access to your device is strictly necessary for this protection (§ 25(2) no. 2 TDDDG). Section 3.1 applies to the transfer of data to the USA.

4) Cookies

In order to make visiting our services attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your end device. Some of these cookies are automatically deleted again after you close the browser (so-called "session cookies"), while others remain on your end device for longer and enable page settings to be saved (so-called "persistent cookies"). In the latter case you can find the storage period in the overview of your web browser's cookie settings.

Insofar as personal data is also processed by individual cookies we use, the processing takes place pursuant to Art. 6(1)(b) GDPR either to perform the contract, pursuant to Art. 6(1)(a) GDPR where consent has been given, or pursuant to Art. 6(1)(f) GDPR in order to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the site visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them, or exclude the acceptance of cookies in certain cases or generally.

Please note that the functionality of our website may be limited if cookies are not accepted.

4.1 Referral cookie ("fire_ref")

If you reach our website through a partner's referral link (recognisable by the ?ref= parameter in the address), we store the partner code it contains in a signed cookie named fire_ref. The first visit counts: a code already set is never overwritten. The cookie holds the partner code and the time of that first visit, expires after 90 days and is only read if you subsequently complete an order — the code is then passed to our control panel along with the order so that the referral can be credited to the partner.

The cookie is set without your consent because it is strictly necessary for the service you requested by following the referral link (§ 25(2) no. 2 TDDDG); the subsequent processing is based on our legitimate interest in settling our partner programme pursuant to Art. 6(1)(f) GDPR. If you visit the site without a referral link, no such cookie is set. You can delete it in your browser at any time.

In the control panel we attribute an order referred in this way to the partner. For this purpose we store, together with the referral, your e-mail address, the order with its amounts and the time of the first visit; we show the partner neither your name nor your e-mail address. A referral is considered confirmed after 28 days if the order has not been reversed by then.

4.2 Overview of technically necessary cookies and local storage

Apart from the referral cookie, we only set cookies and entries in your browser's storage that are strictly necessary for operating our services (§ 25(2) no. 2 TDDDG):

The service of our content delivery network (section 3.1) may set its own technically necessary cookies to protect against automated access (such as __cf_bm).

5) Contacting us

When you contact us (e.g. via a contact form, via the ticket system in our control panel or by e-mail), personal data is processed exclusively for the purpose of handling and answering your enquiry and only to the extent necessary for this.

The legal basis for processing this data is our legitimate interest in answering your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted once it can be inferred from the circumstances that the matter concerned has been conclusively clarified, and provided that no statutory retention obligations prevent this. Tickets in the control panel, including their attachments, remain visible in your customer account until you delete the account (section 6.7).

6) Data processing when opening and using a customer account

We keep your customer account in our control panel. It is also your sign-in for the shop (section 10.1). Unless stated otherwise, the legal basis for the processing described in this section is Art. 6(1)(b) GDPR.

6.1 Registration

To register we need your first and last name, your e-mail address and your acceptance of the Terms and Conditions. We then send you a confirmation link; only via this link do you set your password. Later you may voluntarily store further details, such as your mobile number, a billing address with company name, a separate billing e-mail address and VAT identification number, and your date of birth; which details are required for a particular order is shown in the respective input mask.

We store your acceptance of the Terms and Conditions and your acknowledgement of this privacy policy together with the version, the point in time, your IP address and your browser identification (user agent); likewise when you accept a new version after a change. The purpose is to evidence which version you accepted and when (Art. 6(1)(f) GDPR).

Registration is protected by Cloudflare Turnstile (section 3.2). We do not accept addresses of providers of short-lived disposable mailboxes (section 11).

6.2 Sign-in and account security

We store your password exclusively as an irreversible check value. For additional protection you can set up two-factor authentication — with an authenticator app including recovery codes, with passkeys or by confirming in our paired app. If you have confirmed a mobile number, you can have a recovery code sent to you by text message (section 6.3).

To protect against unauthorised sign-ins we remember the countries from which you have already signed in; only the country is stored, not the IP address. We determine the country from the information supplied by our content delivery network (section 3.1). If you sign in from a new country, you additionally confirm the sign-in with a code we send you by e-mail. You can see the remembered countries in your security settings and remove them there individually. After repeated failed attempts we switch your account to a protection mode, notify you by e-mail and only allow sign-in again with an unlock code (section 11).

You additionally confirm particularly consequential actions — such as reinstalling a server or changing access credentials. We log these confirmations with the type of action, the method, the point in time, the IP address and the browser identification, and keep the record for three years. Excepted is the confirmation with which you conclude a data processing agreement with us: it evidences the conclusion of the contract and remains stored for as long as we keep the agreement.

The processing takes place pursuant to Art. 6(1)(b) GDPR and pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the security of your account and our systems.

6.3 Mobile number and text messages

If you store or change a mobile number, you confirm it with a code we send you by text message; you can likewise request a recovery code for two-factor authentication by text message. The messages are sent by our service provider seven communications GmbH & Co. KG, Kiel, Germany (seven.io) as a processor; only the phone number and the text of the message are transmitted. Section 10.3 additionally applies to the free test server.

6.4 Sign-in via third-party providers (single sign-on)

Where we offer it in the control panel, you can sign in with your existing account at one of the following providers instead of using a password:

• Google: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• Apple ("Sign in with Apple"): Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland
• GitHub: GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA
• Discord: Discord Netherlands BV, Schiphol Boulevard 195, Schiphol, Netherlands

If you choose one of these providers, you are redirected to it and sign in there. The provider then transmits to us an identifier of your account there as well as your name and e-mail address, together with the information whether the provider has confirmed the address (for Discord additionally your user name; for Apple possibly a relay address generated by Apple). Of this we only store the account identifier (for Discord additionally the user name) in order to link it to your customer account — and only if the provider reports your e-mail address as confirmed. We do not create new customer accounts this way: if no account exists yet, we merely pre-fill the registration form with your name and e-mail address (section 6.1). When you sign in via a third-party provider, you always stay signed in (section 4.2).

The provider learns that you are signing in with us and processes further data under its own responsibility for this purpose, such as your IP address; for details please refer to its privacy policy. This may involve a transfer of personal data to the USA; according to their own statements, the providers rely on the EU-US Data Privacy Framework or on standard contractual clauses of the European Commission for this.

The processing takes place pursuant to Art. 6(1)(b) GDPR because you choose this sign-in method for using your customer account. You can remove the link with Discord at any time in the settings of your customer account; we remove the link with Google, Apple or GitHub upon your message to the contact details stated in section 1.2. Otherwise we store the account identifier until your customer account is deleted.

6.5 Linking with Discord (notifications and bot)

Independently of sign-in, you can link your customer account with your Discord account in the settings. To do so, you first confirm your identity with us and then confirm the link at Discord; we store your Discord identifier and your Discord user name, but no access credentials to your Discord account.

• Notifications by direct message: In your notification settings you can choose Discord as the channel for individual types of notification (such as backups, provisioning, contract terms and shares). We then send you the notification as a direct message; its content — such as the name of a product, a date or an amount — is processed by Discord. We never send security notifications via Discord.
• Management bot: If you grant our Discord bot access in a separate confirmation dialog, it can query and control your services (e.g. servers, webspaces and domains) via our programming interface on your behalf. Because the bot works inside Discord, Discord processes the commands you give it and its replies.

The legal basis is Art. 6(1)(a) GDPR on the basis of your consent, which you give by linking the accounts and choosing the notifications or by granting the bot access. You can withdraw it at any time by removing the link in the settings; this also revokes the bot's access. Section 6.4 applies accordingly to the processing by Discord and the transfer to the USA.

6.6 Logs in the control panel

So that we can find errors, detect abuse and trace operations in your customer account, we keep the following logs (Art. 6(1)(f) GDPR, for payment transactions additionally Art. 6(1)(c) GDPR):

• Programming interface log: time, access credential used, function called, result, IP address and content of request and response (access credentials masked). It also covers access by our app and by API keys you have created. Storage period: 90 days.
• Activity log: which action was triggered by whom on which object; for money, account and administrative operations, orders, the use of share links and sign-ins to the webspace additionally the IP address and country. Storage period: two years.
• Security log: security-relevant events such as failed sign-ins with IP address, country and an irreversible check value of your account identifier. Storage period: 30 days.
• Sessions of our app: device, platform, app version, IP address and browser identification. Storage period: until seven days after the session expires or is signed out.

6.7 Access to data and deletion of the customer account

You can request a copy of the data stored about you (Art. 15 GDPR) as a PDF at any time in the privacy settings of your customer account; the download link is valid for seven days.

You can request the deletion of your customer account at any time in the privacy settings of your customer account or by sending a message to the controller's address stated above. You can withdraw the request until 30 days have passed; after that we anonymise your data. In doing so we remove, among other things, your contact details, billing addresses, payer details, ticket contents including attachments and the donor details on your donation pages. Domain owner records held by our service provider are currently not covered by this (section 10.4). Data that we must keep due to statutory retention obligations — in particular invoices and bookings — is kept until these periods expire (section 13).

Before anonymisation we record the data to be deleted in a securely stored deletion log. It serves to evidence that we have fulfilled your request (Art. 5(2), Art. 6(1)(c) GDPR) and is deleted after three years.

7) Newsletter, e-mail dispatch and notifications

7.1 Newsletter

If you subscribe to our e-mail newsletter, we will regularly send you information about our offers. You can only subscribe to the newsletter in your customer account: during registration, after you have proven your e-mail address via the confirmation link, or later in the notification settings. Because this is only possible while signed in and with an e-mail address that has already been confirmed, it is ensured that the newsletter subscription comes from the owner of the address; we therefore do not carry out a separate confirmation procedure (double opt-in). We note your decision in your customer account.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. The data we use for the newsletter is used strictly for that purpose.

You can unsubscribe from the newsletter at any time in the notification settings of your customer account or by sending a corresponding message to the controller named at the outset. After you have unsubscribed, we no longer use your e-mail address for the newsletter, unless you have expressly consented to further use of your data or we reserve the right to use the data beyond this in a manner permitted by law and about which we inform you in this declaration.

7.2 Scaleway (e-mail dispatch)

We send both our newsletter and all contract-related e-mails (such as order confirmations, invoices, notifications from the control panel or the confirmation of receipt of a declaration of withdrawal) via the following provider: Scaleway SAS, 8 rue de la Ville l'Évêque, 75008 Paris, France

On our behalf, the provider processes your e-mail address as well as the content and dispatch metadata of the respective message so that it can be delivered. The processing is carried out pursuant to Art. 6(1)(b) GDPR insofar as the message serves the performance of the contract, and otherwise pursuant to Art. 6(1)(a) GDPR on the basis of your consent to receive the newsletter.

Processing takes place on the provider's servers within the European Union; no transfer to a third country is involved. We have concluded a data processing agreement with the provider which ensures the protection of your data and prohibits unauthorised disclosure to third parties.

7.3 Push notifications

We inform you about important events concerning your services — such as completed backups, the provisioning of a server, upcoming renewals or new replies to a ticket — by e-mail and, if you wish, additionally as a push notification. You decide in the notification settings of your customer account which notification you receive by which channel. A notification consists of a title and a short text and may contain personal details, such as the name of a product, a date, an amount or the beginning of a ticket reply. We send notifications about the security of your account exclusively by e-mail; the exception is the request to confirm a sign-in in the paired app (section 6.2).

• In our mobile app we deliver push notifications via the Firebase Cloud Messaging service, whose provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you allow the app to send you notifications, we store a device identifier for notifications (token) together with the platform, device name, app version and language setting. The notification itself is delivered via the provider's servers, and on iOS devices additionally via Apple's notification service. A transfer to Google LLC in the USA cannot be ruled out; Google LLC has joined the EU-US Data Privacy Framework. We have concluded a data processing agreement with the provider. We delete the device identifier as soon as you sign out of the app, end the session or the service reports it as invalid.
• In the browser you can, where we offer it, activate push notifications for the respective device in the settings of your customer account. For this we store the delivery address and the keys that your browser generates for this purpose. Delivery takes place via the notification service of the browser vendor (such as Google, Mozilla, Apple or Microsoft); the content of the message is encrypted in such a way that this service cannot read it.

The legal basis is Art. 6(1)(b) GDPR and, for choosing additional channels, your consent pursuant to Art. 6(1)(a) GDPR. Storing the device identifier is strictly necessary for the service you have requested (§ 25(2) no. 2 TDDDG). You can switch off push notifications at any time in the notification settings or in the settings of your device or browser.

Notifications via Discord are described in section 6.5.

8) Data processing for order handling, payment and invoicing

8.1 Insofar as necessary for the performance of the contract for payment purposes, the personal data collected by us is passed on to the respective payment service provider and the commissioned credit institution pursuant to Art. 6(1)(b) GDPR.

Our services are predominantly digital services. Occasionally we also offer physical items in limited quantities, such as merchandise products like our "24fire merchandise mug". If you order such an item, we pass your name and delivery address on to the following shipping service provider for delivery pursuant to Art. 6(1)(b) GDPR: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. We only pass your e-mail address or telephone number on to the shipping service provider if you have expressly consented to this during the order process, so that it can inform you about the delivery (Art. 6(1)(a) GDPR); you can withdraw this consent at any time with effect for the future. We keep the shipping data as part of the order records for the statutory retention periods (section 13).

Insofar as we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact data you provided when ordering (name, address, e-mail address) in order to inform you personally about upcoming updates within the period provided for by law, by a suitable means of communication (such as post or e-mail), within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact data is used strictly for the purpose of notifications about updates owed by us and is processed by us for this purpose only to the extent necessary for the respective information.

To handle your order we also work with the following service provider(s), which support us wholly or partly in performing concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

8.2 Use of payment service providers

For processing online payments — in the shop, when topping up your credit in the control panel and on our donation pages — we exclusively use the two payment service providers named below. Which payment methods are available is shown in the respective order, top-up or donation process; which of the two providers is involved depends on the payment method you select there. You enter your payment details, such as card or account details, directly with the respective provider; we neither receive nor store them.

• PayPal

If you select a payment method of the following provider, the payment data you provide during the order process (including name, address, bank and payment card details, currency and transaction number) as well as information about the content of your order is passed on to them pursuant to Art. 6(1)(b) GDPR: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. In this case your data is passed on exclusively for the purpose of payment processing with the provider and only insofar as it is necessary for that purpose.

If you set up a recurring top-up of your credit via PayPal in the control panel, you take out a subscription with PayPal for this purpose. We store the identifier of this subscription as well as the name and e-mail address of your PayPal account that PayPal communicates to us, in order to assign the payments to your customer account.

• Mollie

We process all other online payment methods — such as card payments, bank transfer and pay-by-bank methods, wallets or prepaid methods — via the following provider: Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands

If you select a payment method of the provider, the payment data you provide during the order process (including name, address, bank and payment card details, currency and transaction number) as well as information about the content of your order is passed on to them pursuant to Art. 6(1)(b) GDPR. In this case your data is passed on exclusively for the purpose of payment processing with the provider and only insofar as it is necessary for that purpose.

To carry out the payment method you have chosen, the provider in turn involves the payment systems and credit institutions concerned, insofar as this is necessary for the processing. This also applies if a payment method of another provider (such as PayPal) is offered via Mollie on our donation pages.

If you choose SEPA bank transfer, no payment service provider is involved; payment runs exclusively via the credit institutions named under section 8.1 (for the matching see section 8.4). If you pay using your account credit, no data is transferred to a payment service provider for this purpose.

We neither carry out nor commission any credit assessment: our services are paid for in advance without exception, so we never perform in advance.

If a payment is charged back (chargeback), the payment service provider informs us; section 11 describes the consequences.

8.3 Record of the declarations made during the order process

Every time you click "Order with obligation to pay" we record which declarations you made — acceptance of the Terms and Conditions, acknowledgement of the withdrawal policy, the express request for early performance pursuant to § 356(4) of the German Civil Code and, depending on the order, consent to passing the owner details to the registry as well as to Microsoft's terms of use.

We store the verbatim text of each declaration, a checksum of the version of the Terms and the withdrawal policy in force at that moment, the order data, your IP address, your browser's user agent, the interface language and the point in time. The record is additionally archived as a PDF.

The purpose is to prove that — and with what wording — these declarations were made. The legal basis is Art. 6(1)(c) GDPR where statutory record-keeping and information duties apply to us (in particular §§ 312j, 356 of the German Civil Code), otherwise Art. 6(1)(f) GDPR based on our legitimate interest in being able to evidence a later dispute about the content of the contract. The retention period is ten years, following the commercial and tax retention periods for business records.

8.4 Credit and matching of bank transfers

If you top up your credit by bank transfer, we assign the incoming payment to your customer account on the basis of the transactions on our business account. For this purpose we process and store the payer's name, IBAN, payment reference and date of payment. We import the account transactions via the accounting software described in section 8.5. The processing takes place pursuant to Art. 6(1)(b) GDPR to credit your payment and pursuant to Art. 6(1)(c) GDPR to comply with our bookkeeping obligations.

8.5 Invoicing and bookkeeping (sevDesk)

We issue invoices for orders, top-ups of your credit and donations (section 10.5). For this purpose we transmit the name, company name where applicable, address, e-mail address, customer number, VAT identification number where applicable and the invoice items via our own invoicing system to the cloud-based accounting software of the following provider: sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany

In addition, the provider processes incoming and outgoing invoices and our company's bank movements, in order to record invoices automatically, match them to transactions and produce the financial accounts from these in a partly automated process.

The processing takes place pursuant to Art. 6(1)(c) GDPR to comply with our statutory obligations regarding invoicing and bookkeeping (in particular § 14 of the German VAT Act, § 147 of the German Fiscal Code, § 257 of the German Commercial Code) and pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the efficient organisation and documentation of our business operations. We have concluded a data processing agreement with the provider.

Invoice portal. You retrieve your invoices via a personal link in our invoice portal at invoice.24fire-gmbh.de, for example from the control panel or from an e-mail. The link is encrypted and only valid for a limited time, at most 30 days. Depending on the invoice, you confirm your e-mail address or postcode before retrieval; your entry is only compared with an irreversible check value stored in the link and is not stored. The portal only loads the invoice itself as a PDF from the accounting software when you retrieve it. To protect against abuse, we limit the number of retrievals and check attempts per link and IP address (section 2.1). The portal only sets technically necessary cookies (section 4.2). The legal basis is Art. 6(1)(b) GDPR and, for protection against abuse, Art. 6(1)(f) GDPR.

9) Web analytics and consent management

9.1 Audience measurement without additional cookies

We analyse how our website is used — which pages are opened, how visitors find us, and where an order process is abandoned. This analysis takes place entirely on our own servers. No analytics service and no other third party is involved; the data does not leave our systems.

In doing so we process:

• the page opened and the time it was opened,
• the address of the page you came from — of which we keep only the domain name (for example "www.google.com"), not the full address,
• campaign identifiers contained in a link we distributed (the usual utm_ parameters),
• a coarse device class ("mobile phone", "tablet", "computer"), derived from the browser identification, which we do not store,
• the language setting,
• the contents of a shopping basket expressed as counts, catalogue product identifiers and price totals,
• the course of an order process (checkout opened, order placed, paid or abandoned) with the amount, the chosen payment method and the order number, so that we can match the outcome to the basket,
• a discount code you use, only as an irreversible pseudonym,
• for a domain search, only the length of the search term and how many extensions were available,
• if you sign in: an irreversible pseudonym of your customer number, so that an order process can be analysed coherently across the sign-in.

We do not process: your IP address (neither stored nor truncated nor stored in encrypted form), your full browser identification, the domain names you search for, domain names in your basket, or your name or email address.

We store nothing on your device for this measurement. To group the page views of a visit, we use the session our shop keeps for the shopping basket anyway, which is assigned via a technically necessary session cookie (section 4). Within this session we store a randomly generated number on our server. It is not derived from any characteristic of your device, contains no information about you, and is kept in the analyses only in an irreversible, encrypted form. A visit ends with the session; we do not recognise you on a later visit.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in tailoring our offering to demand and in detecting problems in the ordering process.

Your objection is honoured technically. If your browser sends the "Global Privacy Control" (Sec-GPC) or "Do Not Track" (DNT) signal, no processing for measurement purposes takes place at all. Both signals can be enabled in the settings of common browsers or via an extension. Independently of this, you may object to the processing at any time under Art. 21 GDPR using the contact details in section 1.

We delete individual page views after 90 days and the summaries derived from them (visits and baskets) after 180 days.

We currently use no third-party analytics or marketing services. Should this change, it will only happen after your prior consent given via the consent banner described below (Art. 6(1)(a) GDPR, § 25(1) TDDDG); this policy will be amended accordingly beforehand.

9.2 Usercentrics (consent management)

To obtain, manage and document consent we use the consent management tool of the following provider: Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany

When you access our website, the consent banner is loaded from the provider's servers. In doing so, your IP address as well as details of your browser, device and the time of access are processed. Your decision is stored together with a randomly generated identifier so that we do not have to ask again on your next visit and can demonstrate that consent was given.

The processing takes place pursuant to Art. 6(1)(c) GDPR to fulfil our legal obligation to be able to demonstrate consent, and pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant consent management. Storing your consent decision on your device is strictly necessary for this service that you have requested (§ 25(2) no. 2 TDDDG) and therefore does not itself require consent.

You can change your settings at any time via the "Cookie settings" link in the footer of our website.

10) Site functionalities

10.1 Signing in to the shop via our control panel

You sign in to our shop via our own control panel at cp.24fire.de. You are redirected there, sign in with your credentials and then return to the shop; only the profile we hold for you is transferred. The shop itself stores no passwords and no two-factor authentication details.

The controller for this is likewise the entity named under section 1.2; no disclosure to third parties takes place. The processing is carried out pursuant to Art. 6(1)(b) GDPR for the performance of the contract or of pre-contractual measures. Section 6 applies in all other respects.

Whether you sign in to the control panel with a password or via a third-party provider is your choice there; sign-in via third-party providers is described in section 6.4. The shop itself does not integrate any third-party provider for signing in.

10.2 Forms for statutory declarations and reports

Our website provides three forms for statutory declarations: withdrawal from a contract (§ 356a of the German Civil Code), reporting illegal content (Art. 16 of Regulation (EU) 2022/2065 — DSA) and reporting terrorist content (Regulation (EU) 2021/784).

We process the details you enter — for a withdrawal your name, email address, order number and an optional reason; for a report the location of the content, your reasoning and, optionally, your name and email address (Art. 16(2)(c) DSA expressly permits anonymous reports) — together with the wording of your declaration, the point in time and your IP address.

The purpose is to process your declaration and to evidence that it reached us at that time and with that content. The legal basis is Art. 6(1)(c) GDPR (compliance with the statutory duties named above) and Art. 6(1)(f) GDPR based on our legitimate interest in that evidence. If you provided an email address, we confirm receipt stating content, date and time.

We keep withdrawal declarations for three years and DSA/TCO reports likewise for three years; the records are then deleted automatically. The period follows the regular limitation period (§ 195 of the German Civil Code) and how long we may need to justify a decision on a report.

10.3 Free test server

For a free test server we process the details from the request form: first and last name, e-mail address, mobile number, the selected package, your acceptance of the Terms and Conditions and the Acceptable Use Policy (wording and version) as well as the time and IP address of the request. If you are signed in and a confirmed mobile number is already stored in your customer account, we use that number from our control panel; a renewed check and text message are then not needed.

Before we send you a verification code, we check whether the number is a reachable mobile number (number lookup: country, network, network type, reachability) and send the code by text message. Both are performed by our service provider seven communications GmbH & Co. KG, Kiel, Germany (seven.io) as a processor; only the phone number and the text of the message are transmitted.

The purpose is to provide the test server and to prevent abuse: a test server is meant to give new customers a first impression and not to be used repeatedly or in an automated way. To this end we compare the number, e-mail address and connection with earlier requests and a block list. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures and performance of the contract for the test server) and Art. 6(1)(f) GDPR based on our legitimate interest in preventing abuse of our infrastructure. The details needed to open your account are passed to our control panel (section 10.1); otherwise section 6 applies.

We delete the details in plain text 90 days after the request is closed. After that we only keep check values of the number, e-mail address and connection that are formed with a secret key and cannot be reversed, so that the same test server cannot be requested more than once; they are deleted after two years.

10.4 Registration and management of domains

For the registration, transfer and management of a domain we process the details of the domain owner: salutation, first and last name, organisation where applicable, address, e-mail address and telephone number. You provide these details during the order process or in the control panel. The registry for the respective extension requires them mandatorily; without them a domain cannot be registered.

Registration and management are carried out for us as a processor by: Andreas Beck (sole proprietorship), Am Spielacker 18a, 63571 Gelnhausen, Germany. He transmits the owner details — where applicable via a registrar accredited with the registry — to the registry responsible for the extension, such as DENIC eG for .de, and — for generic extensions such as .com — where applicable to the Internet Corporation for Assigned Names and Numbers (ICANN). The registries process the data under their own terms and on their own responsibility; depending on the extension, owner details are shown in publicly accessible directories (WHOIS/RDAP), today mostly only to a limited extent for natural persons. Where the registry is located outside the European Union — for many generic extensions in the USA — the transfer is necessary for the performance of the contract for the domain (Art. 49(1)(b) GDPR).

The legal basis is Art. 6(1)(b) GDPR.

Our service provider keeps the owner details as an owner record (handle), which all domains of the same owner can share. We retrieve them from there when needed and do not store them permanently ourselves; we delete the logs of our domain interface, which may contain this data, after 30 days. The owner record at the service provider currently remains after the registration ends, because it cannot yet be deleted there for technical reasons; this also applies after your customer account has been deleted. In addition, the registries store the data under their own rules.

If you search for an available domain on our website, we check the name you entered via public name servers and with the registry. Only the domain name is queried, no information about you.

10.5 Donation pages

Our customers can create their own donation pages in the control panel, which are available at spenden.24fire.de and donate.24fire.de. A donation is credited to the page owner's customer account as credit.

For a donation we process your first and last name, your e-mail address, your country, the amount, the selected package, the payment method and — if the page owner asks for an entry for a package (such as a player name) — your entry for it. We do not store your IP address with a donation. With these details we process the payment via our payment service providers (section 8.2), issue you an invoice (section 8.5) and credit the donation to the page owner. The legal basis is Art. 6(1)(b) GDPR.

The page owner receives your name, your country, the amount, the selected package and your entry for it, but not your e-mail address. The page owner needs these details to provide a service associated with the package and to attribute your donation; the legal basis is Art. 6(1)(b) GDPR and otherwise Art. 6(1)(f) GDPR on the basis of the page owner's legitimate interest in knowing who supports them. The page owner is responsible for any further use of these details. We do not publicly show any details about donors on the donation page.

We also provide the page owner with statistics on their donation page — page views per day, number and amount of donations and their distribution across packages and countries. We only count page views as a total per day, without a cookie, without an IP address and without any other identifier.

In the donation pages' system we delete donations whose payment is not completed after 30 days; for completed donations we remove the name and package entry there after 180 days. We show the details to the page owner for as long as their customer account exists. We keep the invoice and the booking for the duration of the statutory retention periods (section 13).

11) Automated decisions and profiling

Some decisions are taken automatically by our systems without an employee examining them in the individual case. We inform you about this pursuant to Art. 13(2)(f) GDPR:

• Chargeback of a payment: If a payment for an order is charged back via the payment service provider (chargeback), we automatically block the products of that order. A refund that we initiate ourselves does not trigger a block. An employee lifts the block as soon as the matter has been clarified.
• Negative credit: If your credit falls below zero, your customer account can automatically only be read; topping up remains possible. As soon as the credit has been balanced again, we lift the restriction automatically.
• Sign-in protection: After repeated failed attempts we automatically switch your account to a protection mode; you additionally confirm sign-ins from a new country with an e-mail code (section 6.2).
• Registration: We automatically reject e-mail addresses of providers of short-lived disposable mailboxes on the basis of a list of such providers.
• Free test server: Whether a test server is provided is decided by our system on the basis of the checks described in section 10.3.
• Order quantity: In the shop we limit the number of servers a customer can order within 24 hours.

These decisions serve the performance of the contract and protection against payment defaults and abuse (Art. 22(2)(a) GDPR, Art. 6(1)(b) and (f) GDPR). You have the right to have the decision reviewed by an employee, to express your point of view and to contest the decision; please contact us using the contact details stated in section 1.2 or our support.

Approval of mail sending (SMTP): If you apply for the approval of mail sending for a server, the application is assessed by an AI model that we operate on our own hardware in Frankfurt am Main; no external AI service is involved. This assessment is profiling within the meaning of Art. 4(4) GDPR. If it raises no doubts, we approve mail sending automatically; if there are doubts, an employee decides. An application is never rejected automatically, but always by an employee.

The assessment takes into account your details in the application (domain, purpose of sending, mail system used, expected sending volume and your description) as well as characteristics of your customer account and of the server — such as how long you have been a customer, your payment and block history and previous applications, as well as the abuse status of the server and its IP addresses. To check the domain and server, public DNS records are also queried. We do not transmit your name, your e-mail address or customer and product numbers to the model; it knows the application only by an application number. If you mention such details yourself in your description, the model receives them with the application.

After an approval we monitor the server for 90 days for new blocks, abuse reports, early termination or deletion and changes to the reverse DNS entry. Such a finding is noted with the application and is taken into account in the assessment of future applications. To check the quality of the assessments, we report the outcome of the application and later findings to the assessment system — likewise only under the application number.

The purpose is to protect our IP networks and recipients against spam and abuse. The legal basis is Art. 6(1)(b) and (f) GDPR; the automatic approval is based on Art. 22(2)(a) GDPR. Here too you can request that an employee reviews the decision, express your point of view and contest the decision. We store the application, the assessment and findings until your customer account is deleted.

12) Rights of the data subject

12.1 Applicable data protection law grants you the following data subject rights (rights to information and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the legal basis cited for the respective conditions of exercise:

• Right of access pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to notification pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to withdraw consent given pursuant to Art. 7(3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

12.2 RIGHT TO OBJECT

IF, IN THE CONTEXT OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSES OF SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

13) Duration of storage of personal data

The duration for which personal data is stored is determined by the respective legal basis, the purpose of the processing and — where applicable — additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).

Where personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.

Where statutory retention periods exist for data processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods have expired, provided it is no longer required for the performance or initiation of a contract and/or we have no continuing legitimate interest in further storage.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(2) GDPR.

Unless otherwise stated in the other information in this declaration on specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

The most important periods at a glance: