Burgherr: A.D. 1157

Mark Brandenburg

Privacy Policy

×

This English version is provided for information only. Only the German version is legally binding.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:

Andreas Dortgolz
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen
Germany
Email: mail@dortgolz.net
Website: https://burgherr.online/

The legal notice is available at: https://burgherr.online/en/imprint

2. General information and SSL/TLS encryption

In accordance with Art. 13 and Art. 14 GDPR, this privacy policy informs you which personal data are collected, processed and stored when you use this website, for which purposes this happens and which rights you have with regard to your data.

Personal data is any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR). This includes, for example, names, email addresses, location data or IP addresses, which according to the case law of the Court of Justice of the European Union (CJEU, C-582/14) constitute personal data.

SSL/TLS encryption: For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser's address bar changing from “http://” to “https://” and by the lock symbol in the browser bar. When SSL/TLS encryption is active, the data you transmit to us cannot be read by third parties.

Operators of this website have no control over whether third parties — in particular law enforcement authorities — access the log data generated during hosting. For this reason, log files are only kept for the period stated in the section “Storage periods” and are then deleted.

3. Legal bases of processing

In Art. 6(1), the GDPR provides six equivalent legal bases for the processing of personal data. This privacy policy applies the following legal bases:

  • Art. 6(1)(a) GDPR (consent): The data subject has given consent to the processing of his or her personal data for one or more specific purposes. Consent given can be withdrawn at any time with effect for the future.
  • Art. 6(1)(b) GDPR (performance of a contract): The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract.
  • Art. 6(1)(c) GDPR (legal obligation): The processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Art. 6(1)(f) GDPR (legitimate interests): The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. The legitimate interests pursued in each case are named in the following sections.

4. Hosting and server operation

This website is operated on a server in Germany. When the website is accessed, the web server automatically collects and stores so-called server log files. These contain in particular:

  • IP address of the requesting device (personal data according to CJEU C-582/14)
  • Date and time of the server request
  • Name and URL of the file retrieved
  • Amount of data transferred
  • Notification of successful retrieval (HTTP status code)
  • Browser type and version as well as operating system
  • Website from which the request comes (referrer URL)

Purpose and legal basis: The temporary storage of the IP address by the server is technically necessary in order to deliver the website to the user's device. Storage in log files serves to ensure the functionality and security of the website and to detect and defend against attacks (e.g. DDoS). The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and trouble-free operation of the website and in the ability to detect, defend against and investigate abusive access.

Processing on behalf: Insofar as a hosting service provider is used to operate this website, it is contractually bound as a processor pursuant to Art. 28 GDPR and processes data exclusively on the instructions of the controller.

Cloudflare: All requests to this website pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare forwards the requests to our server, keeps images and other unchanging files of the game cached and fends off attacks. In doing so, Cloudflare processes the connection data mentioned above, in particular your IP address. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a fast and secure delivery of the game and in protection against overload attacks. Cloudflare may also transfer data to the USA; Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and in addition the EU Standard Contractual Clauses in Cloudflare's data processing agreement apply. Further information: https://www.cloudflare.com/privacypolicy/

Storage period: Log files and IP addresses are stored for a period of 7 to 30 days and then deleted, unless security-related retention is required in individual cases.

5. Cookies and tracking

This website may use cookies and comparable technologies (e.g. local storage, pixels). Cookies are small text files that are stored in the user's internet browser or by the internet browser on the user's device.

According to § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act), storing information on a user's terminal equipment or accessing information already stored there is only permitted with the user's express consent, unless this is technically strictly necessary. Technically necessary cookies that serve solely to transmit a message over an electronic communications network or that are strictly necessary for the service provider to provide a service expressly requested by the user do not require separate consent (§ 25(2) TDDDG).

What this website actually stores: exclusively technically necessary information within the meaning of § 25(2) TDDDG, namely a session cookie that keeps you signed in (valid for 30 days or until you sign out; during a sign-in with Google, also a check value against forged sign-ins), and settings of the game in your browser's local storage (such as sound, graphics and the position of windows), which do not leave your device. We do not use analytics, marketing or tracking cookies or pixels; a consent banner is therefore not required.

6. Customer account / login area

This website offers a protected member or customer area that requires registration and sign-in (login).

6.1 Registration

New accounts are currently created with an access key; sign-in with Google (section 6.4) will be enabled in November 2026. The following is stored:

  • the Google account identifier (for accounts with Google) or the login name and password, the password only encrypted/hashed (for older accounts with a password)
  • the self-chosen name in the game, portrait, coat of arms and origin
  • the game state (castle, inhabitants, stores, chronicle, experience)
  • the time and version of your consent to the terms of use and the time of your last sign-in

We do not collect an email address or your civil name.

Purpose and legal basis: The registration data are processed in order to give you access to the customer account and its functions. The legal basis is Art. 6(1)(b) GDPR, since the registration and provision of the customer account serve to initiate or perform a (usage) contract.

6.2 Sign-in (login)

Each time you sign in, your sign-in data (login name and password, or the confirmation by Google) as well as the date, time and, where applicable, the IP address of the requesting device are processed in order to verify your identity and to grant access to the customer account.

Purpose and legal basis: The processing serves authentication and ensures that only authorised persons can access the respective customer account. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR with regard to securing the account against unauthorised access (legitimate interest: protection of the user account and the data it contains).

6.3 Storage period

The data of your customer account are stored for as long as the account exists. If you delete your customer account or request its deletion, your account data will be deleted unless statutory retention obligations prevent immediate deletion. In the latter case, processing is restricted to the legally required minimum.

6.4 Sign-in with Google

Sign-in with Google will be enabled in November 2026; until then it cannot be used, and no data are processed in connection with it. From its activation, the following applies: For users in the EU, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Our site does not load any content or scripts from Google for this. Only when you click “Mit Google anmelden” (“Sign in with Google”) are you redirected to Google; there you sign in to Google, and Google processes your data in accordance with its own privacy policy (https://policies.google.com/privacy). Google then sends you back to us.

We only request the basic permission “openid” from Google. As a result, we only receive a fixed identifier of your Google account assigned by Google — no email address, no name and no profile picture. We store this identifier in order to recognise you the next time you sign in, for as long as your account exists.

The legal basis is Art. 6(1)(b) GDPR, as you choose this sign-in method in order to use the game. Google may also transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023, Art. 45 GDPR).

7. Chatbot / live chat

A chatbot or live chat service is integrated into this website, through which you can communicate with us in real time.

7.1 Data processed

When you use the chat, the following personal data may be processed:

  • Content you enter in the chat (messages, enquiries)
  • Contact details you provide voluntarily, if any (e.g. name, email address)
  • Technical connection data (e.g. IP address, time stamp)
  • Metadata about the chat session, if any (e.g. page path, browser information)

7.2 Purpose and legal basis

The chat serves to answer your enquiries and to communicate with you. If you use the chat to make an enquiry about an existing or intended contractual relationship, the legal basis is Art. 6(1)(b) GDPR. In all other cases, the legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in providing a low-threshold, direct communication channel for visitors to the website. Insofar as the chat provider stores cookies or comparable technologies on your device that are not technically strictly necessary, this only takes place on the basis of your prior consent pursuant to § 25(1) TDDDG (Art. 6(1)(a) GDPR).

7.3 Use of a chat service provider / processing on behalf

Insofar as an external service provider is used to operate the chatbot or live chat system, it is contractually bound as a processor pursuant to Art. 28 GDPR and processes chat data exclusively on the instructions of the controller. Further information on the service provider used and any transfers to third countries can be found in the general terms and conditions and the privacy policy of the respective provider.

7.4 Automated processing of conversations (chatbot)

Insofar as a chatbot is used, your entries are processed automatically in order to generate a suitable answer. No automated decision-making within the meaning of Art. 22 GDPR takes place; the processing serves exclusively to answer your enquiries.

7.5 Storage period

Chat histories are only stored for as long as is necessary for the respective communication purpose. In the case of general enquiries that do not establish a further contractual relationship, chat data are generally deleted once the matter has been concluded and at the latest after any statutory retention periods have expired. Otherwise, the statutory retention obligations apply (e.g. retention periods under commercial and tax law of up to 10 years).

7.6 Right of withdrawal and objection

Insofar as the processing is based on consent, you can withdraw it at any time with effect for the future. Insofar as the processing is based on Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

7.7 In the game: Cunrat the Scribe and the chat (“Botenstube”)

Cunrat is a chatbot in the game that answers questions about the game. For this, we use the language model Claude from Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA. When you ask Cunrat a question, your question, the previous conversation with Cunrat and information about the game state of your castle are transmitted to Anthropic in order to generate the answer. This involves a transfer to the USA; it is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in Anthropic's data processing agreement. Questions and answers are also stored on our server in Germany and deleted after 30 days. Using Cunrat is voluntary; if you do not ask him, your data are not sent to Anthropic. Further information: https://www.anthropic.com/legal/privacy

Messages in the “Botenstube” (the chat between players) are stored on our server in Germany and shown to the fellow players to whom they are addressed. They are not transmitted to third parties. Messages in the open channels, which everyone or all allies can read, are no longer shown after 24 hours and are deleted the following night; private messages and messages in group conversations are kept and are deleted after 90 days, letters between castles likewise after 90 days.

8. Storage periods and deletion concept

We store personal data only for as long as is necessary for the respective processing purpose or as long as statutory retention obligations exist. In detail, the following periods apply:

  • Customer account data: Until the customer account is deleted. When the account is deleted, the data are deleted immediately unless statutory retention obligations prevent this.
  • Game state (your castle): As long as you play. Anyone who does not play for a longer period loses their castle, and its place becomes free for others: after 14 days while the castle is at level 0, after 60 days from castle level 1 and after 90 days from castle level 3, each counted in real days since your last visit to the game. Your account, including your name and experience, remains; you then start with a new castle. The chronicle of a castle is shortened continuously.
  • Game history: Battle reports, concluded events, trade journeys, campaigns, missions and shipments of goods, as well as deceased or departed inhabitants and fallen or dismissed soldiers, are deleted at the latest 30 days after they have ended.
  • Chat (“Botenstube”), open channels: no longer visible 24 hours after sending, deleted the following night.
  • Chat (“Botenstube”) and letters: 90 days after sending.
  • Conversations with Cunrat: 30 days after the question.
  • Backup copies: To ensure that nothing is lost in the event of an error, we back up the game database hourly to storage of Cloudflare, Inc. located in the EU (Cloudflare R2), daily to web space in Germany and before every change to the game on our server. Every backup copy is deleted after 31 days; anything deleted in the game therefore also disappears from the backups at the latest 31 days later.
  • Cookie data: The session cookie for signing in expires after 30 days or is deleted when you sign out. Settings in local storage remain in your browser until you delete them there.
  • Server log files / IP addresses: 7 to 30 days after they are created, then automatic deletion, unless security-related retention is required in individual cases.
  • Statutory retention periods: Insofar as data are subject to retention obligations under commercial or tax law (§ 257 HGB, § 147 AO), they are retained for the legally prescribed period (generally 6 or 10 years) and then deleted. During this time, processing is restricted to the legally required minimum.

9. Transfers to third countries

Our server is operated in Germany. A transfer of personal data to third countries outside the European Union (EU) or the European Economic Area (EEA) is only possible via the services named in sections 4 (Cloudflare), 6.4 (sign-in with Google) and 7.7 (Cunrat).

Insofar as external service providers (e.g. for the chat service) process data outside the EEA in individual cases, an adequate level of data protection is ensured by one of the following transfer mechanisms:

  • an adequacy decision of the EU Commission (e.g. the EU-US Data Privacy Framework, in force since July 2023), provided the recipient is certified under the respective framework;
  • EU Standard Contractual Clauses (SCC) pursuant to Art. 46(2)(c) GDPR, in conjunction with any additional safeguards required.

Details of any transfers to third countries are given in the service-specific sections of this privacy policy.

10. Rights of data subjects

As a data subject, you have the following rights vis-à-vis the controller:

10.1 Right of access (Art. 15 GDPR)

You have the right to obtain confirmation as to whether personal data concerning you are being processed. If this is the case, you have the right of access to these data and to the information listed in detail in Art. 15 GDPR, in particular about the purposes of processing, the categories of data, the recipients and the planned storage period.

10.2 Right to rectification (Art. 16 GDPR)

You have the right to request without undue delay the rectification of inaccurate personal data concerning you and the completion of incomplete data.

10.3 Right to erasure (Art. 17 GDPR)

You have the right to request the erasure of personal data concerning you where the conditions of Art. 17 GDPR are met, in particular if the data are no longer necessary for the original purpose of processing, consent has been withdrawn and there is no other legal basis for the processing, or the processing was unlawful. The right to erasure does not exist insofar as statutory retention obligations prevent erasure; in this case, processing is restricted.

10.4 Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of the processing of your personal data if one of the conditions listed in Art. 18(1)(a)–(d) GDPR applies, e.g. if you contest the accuracy of the data or if the processing is unlawful and you request the restriction of use instead of erasure.

10.5 Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format, and you have the right to transmit these data to another controller, provided the processing is based on consent (Art. 6(1)(a) GDPR) or on a contract (Art. 6(1)(b) GDPR) and is carried out by automated means.

10.6 Right to withdraw consent (Art. 7(3) GDPR)

Insofar as the processing of your personal data is based on consent, you have the right to withdraw this consent at any time with effect for the future. The lawfulness of the processing carried out on the basis of the consent before its withdrawal is not affected by the withdrawal. Please send your withdrawal to: mail@dortgolz.net

10.7 Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR (legitimate interests). Following an objection, the controller will no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims (Art. 21(1) GDPR).

Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. In the event of such an objection, the personal data will no longer be processed for these purposes (Art. 21(2) GDPR).

Please send your objection to: mail@dortgolz.net

10.8 Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of personal data concerning you infringes the GDPR.

The controller is based in Hungen (Hesse, Germany). The competent supervisory authority is therefore:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (the Hessian Commissioner for Data Protection and Freedom of Information)
Postfach 3163
65021 Wiesbaden
Germany
Phone: +49 611 1408-0
Email: poststelle@datenschutz.hessen.de
Website: https://www.datenschutz.hessen.de

You can also contact another data protection supervisory authority, in particular the supervisory authority of your habitual residence or place of work.

11. Automated decision-making and profiling

No automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR takes place. No decisions are made that are based solely on automated processing and that produce legal effects concerning the data subject or similarly significantly affect him or her.

12. Currency and changes to this privacy policy

This privacy policy is up to date. Due to the further development of the website or to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current privacy policy can be accessed at any time on the website at https://burgherr.online/.

As of: October 2026

Version 2026-10-20.1