Privacy policy

1. Controller

The controller for personal data processed on randwelten.de and in the universes of Randwelten (for example alpha.randwelten.de) is:

Pascal Wattler
Dycker Weinhaus 3
41363 Jüchen, Germany
Email: kontakt@waddel.de
Phone: +49 178 3 44 11 42

Randwelten is a game by waddel.de and has the same operator. Your Waddel account itself is covered by the waddel.de privacy policy.

2. Overview

Randwelten is a space strategy game. It consists of the hub at randwelten.de (start page, sign-in, list of universes, administration) and of the universes where the game is played. Each universe has its own database. Randwelten does not manage passwords or email addresses; you sign in with your Waddel account.

Until Randwelten opens to everyone, the start page only shows "Coming soon". The processing described below only takes place if you sign in.

3. Visiting the website, hosting and logs

When you visit, our servers necessarily process your IP address, time and target of the request and information sent by your browser. This serves to deliver the pages and protect against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.

The proxy in front of our services keeps no access logs. Our services write error and operating messages to log files of fixed size (at most 3 × 10 MB per service) that are overwritten continuously. They do not log IP addresses, sign-in passes, session identifiers or form contents; messages may contain an internal player ID. To limit requests, counters per player or per IP address are kept in memory for at most one minute.

Randwelten runs on a self-managed server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

4. Signing in with your Waddel account

When you tap "Play now", we forward you to waddel.de, where you sign in or create an account. waddel.de then sends your browser a short-lived, signed pass for Randwelten. It only contains the identifier of your Waddel account, a one-time pass identifier, validity times and a random value binding it to your browser, no email address and no nickname. We pass your chosen language to waddel.de as a parameter.

From this, Randwelten stores a player account: its own player ID, the identifier of your Waddel account, when it was created and last signed in, your chosen language, a role in the Randwelten team if any, and the status of blocks. We store the pass identifier so that every pass can be used only once.

If waddel.de blocks or deletes your account, waddel.de tells Randwelten (identifier, type of event, time). For a block we end your sessions; for a deletion we separate the player data from your Waddel account (see section 9). If such a notice arrives before you first enter Randwelten, we keep it for ten minutes.

The legal basis is Art. 6(1)(b) GDPR (providing the game); for single use of passes, blocks and abuse protection additionally Art. 6(1)(f) GDPR.

5. Playing in a universe

When you enter a universe, it creates a player account with your player ID and stores the times of your visits to show you "Since your last visit". The game world includes your commands, your locations, stocks, fleets, the events calculated by the server, a booking journal of all movements of goods, messages to you, combat reports and Federation case files. Other players only see what the game shows them, for example a combat report they took part in. Internal assessments of the Federation are never delivered.

You can play in at most two universes at the same time; for this the hub remembers which universes you take part in.

The legal basis is Art. 6(1)(b) GDPR; for checking moves for manipulation additionally Art. 6(1)(f) GDPR.

6. Cookies

Randwelten only sets cookies that are strictly necessary for the service you asked for (Section 25(2) no. 2 TDDDG). There are no statistics or advertising cookies and no embedded third-party services.

7. Administration

Admins use a second factor (authenticator app) for the administration of Randwelten. For admin accounts we therefore store an encrypted secret, hashed recovery codes and failed attempts. Actions in the administration, such as blocks or resetting a universe, are logged with the admin's identifier, type, time and the affected account. The legal basis is Art. 6(1)(f) GDPR; our interest is secure and traceable administration.

Evaluations for balance, operations and abuse detection. From your commands and your game state we compile daily: visits with a game decision, active minutes of play, the distribution of your actions (building, trade, research, exploration, combat) and the game profile derived from it, attacks and the strength ratio to players you attacked, Federation cases, your progress level, and wealth and combat power at fixed reference prices. In addition there are anomalies in trade, such as one-sided prices or goods going round in circles. The purpose is to check the game balance, monitor operations and detect abuse such as multiple accounts or sham trading. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a fair and stable game. Only admins and team members can see the evaluations in the administration. Apart from your player ID and commander name, no information about you reaches the hub in the process. The evaluations are pointers for review by people; no automated decisions or sanctions follow from them.

Team alert addresses. For operational alerts an admin can store an e-mail address for team members. Alert e-mails contain no player data, only the type and severity of the alert and a link to the administration. The legal basis is Art. 6(1)(f) GDPR; our interest is reliable operation.

Multiple accounts are not detected by technical characteristics such as IP addresses.

8. Recipients

Data is received by the hosting provider Hetzner (processing on our behalf), by waddel.de to the extent described for sign-in, and by other players within the game. No data is transferred to countries outside the European Economic Area.

9. Storage period and deletion

You start the deletion of your account on waddel.de. You can also write to us at kontakt@waddel.de.

10. Your rights

Subject to the legal requirements, you have the right of access, rectification, erasure, restriction of processing and data portability. Where we process data under Art. 6(1)(f) GDPR, you can object on grounds relating to your particular situation. Please contact kontakt@waddel.de.

You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, poststelle@ldi.nrw.de.

11. Automated decisions

The server evaluates moves according to fixed game rules; this includes decisions of the Federation in the game. These are game mechanics without legal or similarly significant effect within the meaning of Art. 22 GDPR. Accounts are only blocked manually by the team or by waddel.de. The evaluations in section 7 do not lead to automated decisions either.

12. Changes

If the processing changes, we update this policy. We inform you in advance about new purposes.