Privacy Policy

This policy explains what personal data we collect, why, and your rights under the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Data Controller

zuwo UG (haftungsbeschränkt)
Neusser Str. 28
50670 Cologne
Germany
Email: privacy@zuwo.org

2. Hosting and Server Logs

This website is hosted via Ploi.cloud on infrastructure provided by UpCloud Ltd, with servers located in the EU. When you access our website, your browser automatically transmits data to our servers, including your IP address, browser type, operating system, referrer URL, and the date and time of the request. This data is stored temporarily in server log files to ensure technical operation and security.

Legal basis: Art. 6(1)(f) GDPR — legitimate interests in maintaining the security and proper functioning of the service. Logs are deleted automatically after a short retention period.

3. Analytics

We use Fathom Analytics, a privacy-respecting analytics service. Fathom does not use cookies, does not track you across websites, and does not collect personal data. All analytics data is processed and stored in the EU. Aggregated, anonymised visitor statistics are publicly accessible via our stats page.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in understanding how the service is used, with minimal privacy impact.

4. Steam Login

You may log in using your Steam account via the OpenID protocol provided by Valve Corporation (Valve, 10400 NE 4th St, Bellevue, WA 98004, USA). When you authenticate, Steam transmits your Steam ID, display name, and avatar hash to us. We do not receive your Steam password. Your game library is retrieved from the public Steam API using your Steam ID.

By logging in with Steam, you interact with Valve's services, which are subject to the Steam Privacy Policy. Your Steam ID and associated data may be transferred to and processed in the United States. Valve participates in the EU–US Data Privacy Framework (DPF).

Legal basis: Art. 6(1)(b) GDPR — processing is necessary to provide the service you requested (account creation and login).

Data stored after login: Steam ID, display name, avatar hash, and a snapshot of your Steam game library. We do not store your game library permanently; it is refreshed on login.

5. Ideas and Votes

When you submit a feature request (idea), we store your Steam ID, the idea title, short description, and long description. When you vote on an idea, we store your Steam ID, the idea identifier, and the direction of your vote. This data is required to provide core site functionality.

Legal basis: Art. 6(1)(b) GDPR — processing is necessary to fulfil the service you requested.

6. Game Preference Voting

If you use the game ranking feature, we store a personalised ELO-based preference score for each game per user account. This is linked to your Steam ID.

Legal basis: Art. 6(1)(b) GDPR — processing is necessary to provide personalised rankings.

7. Data Retention and Account Deletion

We retain your account data and associated content (ideas, votes, game preferences) for as long as your account exists or as long as necessary to provide the service.

You can delete your account at any time directly from your dashboard. Deleting your account will immediately and permanently erase your user record, your Steam profile data, and all your votes. Ideas and comments you have submitted will remain visible but will no longer be linked to your identity — they will appear as authored by [Deleted]. If you wish to exercise your right to erasure under Art. 17 GDPR, please use this self-service function. For any further requests or questions, contact privacy@zuwo.org.

8. Data Sharing and Third Parties

We do not sell your personal data to third parties. We do not use cross-site advertising networks. The only third-party services involved in operating this website are:

• Ploi.cloud / UpCloud — hosting infrastructure (EU)
• Fathom Analytics — privacy-focused, cookieless analytics (EU)
• Valve / Steam — authentication provider (US, DPF participant)

9. Your Rights

Under the GDPR you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) — you may request a copy of the data we hold about you.
• Right to rectification (Art. 16 GDPR) — you may request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR) — you may delete your account and data directly from your dashboard, or contact us to request deletion.
• Right to restriction of processing (Art. 18 GDPR) — you may request that we restrict how we use your data.
• Right to data portability (Art. 20 GDPR) — you may request your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR) — you may object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@zuwo.org.

10. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. The competent authority for our company is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestr. 2–4, 40213 Düsseldorf, Germany
www.ldi.nrw.de

Last updated: June 2026