Privacy Policy

1. Controller

Email: info@schwabba.de

2. Hosting and server logs

This website is hosted by the following processor:

When the website is accessed, the hosting provider processes connection data required for technical operation. This particularly includes the IP address, date and time, requested file or URL, referrer, browser and operating-system information, access status and transferred data volume.

This processing is necessary to deliver and secure the website and to identify technical faults and attacks. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure and reliable operation of this service.

According to the host's privacy information, regular web-server logs are deleted after no more than seven days. Longer storage may be required in the event of a security incident. Further details are available in the privacy information of ALL-INKL.COM.

The application code of this website does not additionally write visitor IP addresses to its own database or diagnostic log.

3. Trackmania game and profile data

The website processes publicly available Trackmania data obtained from official or publicly accessible Ubisoft/Nadeo interfaces. This particularly includes:

• Trackmania account ID, display name and club tag,
• country, region and the corresponding country identifier,
• map UIDs, personal best times, positions and timestamps,
• improvements, first finishes, medals and derived statistics.

The data is used for event leaderboards, map rankings, player profiles, statistics, final season snapshots and hunting mode. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is to run, document and make the community event traceable.

The data is not collected directly from the players concerned. Its source is the Trackmania interfaces described above; this section therefore also provides information under Article 14 GDPR.

Live data is updated during a season and the subsequent hunting mode. Final season snapshots remain stored as historical event results for as long as the project and its archive are operated.

4. Graphics loaded from trackmania.io

Country flags, language flags and medal graphics on leaderboard, map, statistics, profile and legal pages are partly loaded directly from trackmania.io. When these images are requested, the browser connects to that provider. In technical terms, this particularly transmits the IP address and information about the requested file, browser and, where applicable, referrer.

The graphics provide a clear visual representation of countries, languages and Trackmania medals. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is a clear presentation related to the game and event.

5. Session, functional storage and website events

The website uses a technically necessary PHP session. The session cookie lasts only for the browser session and is set with the Secure, HttpOnly and SameSite=Lax attributes. It is used in particular for CSRF protection, force-update requests and secure operation.

A SHA-256 hash is generated server-side from the session ID. When a player profile is viewed or shared, or when a force update is requested, this hash, the relevant profile or map ID, the action result and the time may be stored as a website event. The original session ID and the IP address are not stored in the site_events table.

No fixed automatic deletion period is currently configured for website events. They remain stored while the website and the related event and protection functions are operated, unless they are deleted earlier during maintenance.

The browser also stores only functional settings:

• the div3kacky_timezone cookie for displaying times in the visitor's local time zone, for no more than one year,
• localStorage for selected season views and filter, sorting and table states until reset or deleted through the browser settings,
• sessionStorage for a temporary new-season notice until the browser or tab session ends.

These storage mechanisms are not used for advertising or cross-site tracking. The legal basis for access to the user's device is Section 25(2)(2) TDDDG; where personal data is processed, Article 6(1)(f) GDPR additionally applies.

6. Technical error logs

If a technical error occurs, the website may create a protected diagnostic log. It may contain the error type, message, affected file, time, requested path, redacted query parameters, browser identifier (user agent) and technical memory values. Visitor IP addresses are not stored in this diagnostic log.

Sensitive parameters such as passwords, tokens, secrets, CSRF values and cookies are redacted before storage. The log is available only in the authenticated administration area. Individual entries or the entire log can be deleted manually; no fixed automatic deletion period is currently configured. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is error analysis and system security.

7. YouTube trailers using a two-click solution

No connection to YouTube is made when the trailer page is initially opened. The embedded player is loaded only after the visitor explicitly clicks “Load video”.

After that click, the player is loaded from youtube-nocookie.com. This may transmit the IP address, browser and device information, referrer and usage data to Google or YouTube. YouTube may also store information on or read information from the user's device. Processing in third countries cannot be ruled out.

The legal bases are consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent applies only to the player that was loaded and is not stored permanently by this website. Reloading the page blocks the player again.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information is available in Google's Privacy Policy and the information about privacy-enhanced mode.

8. External links

The website contains links to external services, including YouTube, Twitch, Discord, Matcherino and Trackmania.io. A normal link establishes a connection to the destination provider only after it is clicked. This is separate from the externally loaded graphics described in section 4 and the YouTube player loaded after consent.

9. Contact by email

When contact is made by email, the submitted information, including the email address and message content, is processed in order to respond to the enquiry. The legal basis is Article 6(1)(f) GDPR and, for pre-contractual or contractual matters, additionally Article 6(1)(b) GDPR.

The data is deleted once the matter has been resolved, unless statutory retention duties or legitimate reasons require further storage.

10. Data-subject rights

Subject to the requirements of the GDPR, data subjects particularly have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on legitimate interests, there is also a right to object. Consent may be withdrawn at any time with effect for the future.

Requests can be sent to info@schwabba.de. Appropriate proof of identity may be required to prevent disclosure to an unauthorised person.

11. Right to lodge a complaint

Data subjects may lodge a complaint with a data-protection supervisory authority. For a private controller established in Bavaria, the competent authority is generally:

BayLDA online complaint form