Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

We process personal data only where a legal basis allows it. Each section below names the basis that applies. The ones we rely on are:

• —Consent — Art. 6 (1) (a) GDPR, and § 25 (1) TDDDG for storing or reading information on your device. You can withdraw consent at any time with effect for the future.
• —Contract — Art. 6 (1) (b) GDPR, where processing is needed to perform a contract with you or to take steps before entering one, such as an order or an enquiry.
• —Legal obligation — Art. 6 (1) (c) GDPR, such as retention duties under commercial and tax law.
• —Legitimate interests — Art. 6 (1) (f) GDPR, such as running the website securely and reliably. Where we rely on this basis you have a right to object (see “Your rights”).

The website is hosted by Vercel. Every time a page is called up, the server automatically records technical access data so the site can be delivered, kept secure and debugged.

To protect our contact and newsletter forms from spam and abuse, we hold IP-based request counters in the server’s working memory. The newsletter counter uses a one-minute window; the contact counter uses a five-minute window. Expired counters are replaced or cleared as the server handles further requests, or disappear when the server process ends; expiry of the counting window does not itself delete the entry. These counters are not written to a database or disk by the application. Hosting logs are handled separately as described above. The legal basis is Art. 6 (1) (f) GDPR — protecting our forms from automated abuse.

In addition, the contact form uses Vercel BotID to tell people from automated programs. When you send the form, a short check runs invisibly in your browser and evaluates technical signals such as browser properties and how the page was used. The result is checked once by Vercel and is not used to identify you or to build a profile. No cookies are set. The legal basis is Art. 6 (1) (f) GDPR — protecting our contact form from automated abuse.

Cookies and similar technologies that are not strictly necessary are used only after you have given your consent in our consent banner. Strictly necessary storage — to remember your consent choice and your shopping cart, and, for the current browser tab only, whether you have already seen the homepage intro or dismissed the live banner — needs no consent (§ 25 (2) no. 2 TDDDG).

We use the consent management platform Usercentrics to collect, store and document your choices. You can change or withdraw your consent at any time via the “Privacy Settings” link in the footer of every page.

If you consent, we use Google Analytics 4 to understand how visitors use the site and improve it. The analytics code is loaded through Google Tag Manager, a tool that manages website tags; Tag Manager itself does not create user profiles. Without your consent, neither is used to track you.

If you consent to statistics, we also use Vercel Speed Insights to measure how fast our pages load. It records performance values such as loading and response times, together with the page URL, device type, browser and country. It sets no cookies and does not track you across sites. Without your consent it is not loaded.

If you consent to marketing, we use the following tools to measure the success of our advertising and to show our ads to people who have visited our site. They are loaded through Google Tag Manager only after you have given consent in the consent banner. The tools set cookies or similar identifiers in your browser and can link your visit to an account you have with the provider.

If you write to us through the contact form, we use your details to answer your enquiry. The form sends your message to our team inbox by email, using the email delivery service Resend.

You can subscribe to the Kölsch Letter for CGN results, merch drops and event invitations. There is no fixed sending schedule. We use double opt-in: submitting the form requests a confirmation email, sent immediately through Resend. Open the link in that email and press the confirmation button on our website to complete your signup. Opening the link alone does not subscribe you. The link is valid for 24 hours; after it expires you can request a new one by signing up again.

Your address is added to the Resend subscriber list only after successful confirmation. Before confirmation, Resend already processes your address and the confirmation email to deliver it. Our website does not maintain a separate pending-subscriber database. The confirmation link contains a signed, encoded email address and expiry time; it is not encrypted, so please do not share it. Your selected language determines the confirmation email and page, but is not currently saved as a subscriber preference.

You can unsubscribe at any time using the link in every newsletter, or by writing to us. This withdraws your consent with effect for the future.

Our online shop runs on Shopify. When you add a product to your cart, a cart is created at Shopify. Checkout takes place on Shopify’s checkout pages, where you enter the details we need to process your order.

The payment provider you choose in checkout — such as PayPal, Klarna or a card payment via Shopify Payments — receives the payment details it needs to process the payment, and processes them under its own privacy policy.

The contact page shows our location on a map. The map tiles are loaded from the OpenStreetMap servers, which means your browser sends your IP address to them.

The videos on our pages are stored on Cloudflare R2 and loaded directly from there. When one of our players or creators is live, the site shows a preview image of the stream, loaded from the servers of Twitch or YouTube, depending on where they stream. In each case your browser sends your IP address to the provider.

We link to our profiles on Instagram, X (Twitter), YouTube, Twitch, TikTok and Discord. These are plain links, not embedded plugins: no data is sent to these platforms when you view our site. Only when you click a link do you leave our site, and the platform’s own privacy policy then applies.

We share personal data only with the providers named above. Vercel, Usercentrics, Resend, Shopify and Cloudflare process it on our behalf under a data processing agreement (Art. 28 GDPR). Google, Meta and LinkedIn receive analytics and marketing data only with your consent; for the Meta Pixel we are joint controllers with Meta (see “Marketing”). OpenStreetMap, Twitch and YouTube receive your IP address directly from your browser when the map or a stream preview loads, and process it as independent controllers. The payment provider you choose in checkout also acts under its own responsibility. We do not sell personal data.

Some of these providers are based outside the EU or the European Economic Area, or may transfer data there. We only allow this where an adequate level of protection is ensured: through an EU adequacy decision (United Kingdom, Canada, and US companies certified under the EU-US Data Privacy Framework) or through the EU standard contractual clauses (Art. 46 (2) (c) GDPR).

We store personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires. The periods for each kind of data are listed in the sections above. In summary:

• —Server logs — one day.
• —Consent records — as long as needed to prove consent, generally three years.
• —Analytics data — event data 2 months; data linked to a user identifier 14 months after your last visit.
• —Marketing cookies — up to 13 months, depending on the tool.
• —Contact enquiries — until the enquiry is fully dealt with.
• —Newsletter — for the active subscription; unsubscribed records may be retained to prevent further mailings. Confirmation links expire after 24 hours, independently of provider email-record retention.
• —Orders and invoices — up to 10 years, as required by commercial and tax law.

Under the GDPR you have the right to:

• —Access the personal data we hold about you (Art. 15 GDPR)
• —Have inaccurate data corrected (Art. 16 GDPR)
• —Have your data deleted (Art. 17 GDPR)
• —Restrict the processing of your data (Art. 18 GDPR)
• —Receive your data in a portable format (Art. 20 GDPR)
• —Withdraw consent you have given at any time, with effect for the future (Art. 7 (3) GDPR)
• —Lodge a complaint with a supervisory authority (Art. 77 GDPR)

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. You may object to the use of your data for direct marketing at any time, without giving reasons.

To exercise any of these rights, write to us:

The supervisory authority responsible for us is:

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.