1. Controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Dennis Michael Heine
Amselweg 4
70794 Filderstadt
Germany
Email: [email protected]
2. Data protection officer
No data protection officer has been appointed because there is currently no legal obligation to do so. If this changes, the contact details of the data protection officer will be provided here.
3. General information on processing
We process personal data only where a legal basis permits it. Depending on the specific situation, the legal basis may be Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contract or pre-contractual measures), Article 6(1)(c) GDPR (legal obligation) or Article 6(1)(f) GDPR (legitimate interests).
We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
4. Visiting the website and server log files
When you access this website, the hosting system may automatically collect technical access data. This may include the requested page or file, date and time of access, amount of data transferred, notification of successful retrieval, browser type and version, operating system, referrer URL, IP address and requesting provider.
This processing is necessary to deliver the website, maintain technical stability, detect misuse and ensure information security. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and efficient operation of this website.
Server log files are retained only for as long as necessary for the above purposes and are then deleted or anonymised, unless longer retention is required for security incidents, legal claims or statutory obligations.
Our servers are preceded by a content delivery network with security functions. Details can be found in the section “Content delivery network and protection against attacks (Cloudflare)”.
5. Hosting provider
This website is hosted by the following technical service provider:
ZAP-Hosting GmbH
Hafenweg 8
48155 Münster
Germany
Email: [email protected]
Abuse and authority requests: [email protected]
Fax: +49 251 149 811 89
Managing Director: Marvin Kluck
Register court: Amtsgericht Münster
Commercial register number: HRB 15672
ZAP-Hosting GmbH processes technical data, including server log files and IP addresses, to provide the hosting infrastructure, deliver this website, maintain technical security, identify abuse and enable legally required cooperation with competent authorities where applicable.
The legal basis for the use of a hosting provider is Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and efficient provision of this website. Where ZAP-Hosting GmbH processes personal data on our behalf, this is done under a data processing arrangement pursuant to Article 28 GDPR.
6. Content delivery network and protection against attacks (Cloudflare)
To operate this website, our interfaces (API) and our game servers, we use services of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (“Cloudflare”).
Cloudflare is a content delivery network with security functions and is placed in front of our servers. All requests to this website are therefore routed through Cloudflare’s network before they reach our systems. In doing so, Cloudflare processes in particular the IP address of the requesting device, the time of the request, the address requested, the volume of data transferred, HTTP header information such as user agent and referrer, connection and protocol information, response status codes, and security-relevant characteristics of the request.
The connection between your device and Cloudflare is encrypted in transit and is decrypted at Cloudflare in order to inspect and forward the request. Cloudflare is therefore technically able to access the transmitted content. The request is passed on to our servers over a separately encrypted connection.
Your requests are answered by whichever data centre of Cloudflare’s worldwide network is closest to you. Processing may therefore also take place outside the European Union and the European Economic Area.
The purposes of using Cloudflare are the availability, reachability and stability of this website, defending against distributed denial-of-service attacks and other attacks on our infrastructure, filtering out abusive requests, distributing server load, and speeding up data transfer through caching.
The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable, performant and attack-resistant operation of this website and our online services.
Cloudflare processes this data as a processor on our behalf. We have concluded a data processing agreement with Cloudflare pursuant to Article 28 GDPR. Cloudflare stores the log data arising in this context only for a limited period and only for the purposes stated above.
We do not use Cloudflare for reach measurement, analytics, profiling or advertising purposes.
Further information on data processing by Cloudflare can be found in Cloudflare’s privacy policy at cloudflare.com/privacypolicy.
7. Contact by email
If you contact us by email, we process the information you provide, such as your email address, name, message content and any attachments. The purpose is to handle your request and communicate with you.
If your request relates to a contract or pre-contractual communication, the legal basis is Article 6(1)(b) GDPR. In other cases, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is responding to enquiries. If you have given consent for a specific processing activity, Article 6(1)(a) GDPR may apply.
Contact enquiries are retained for as long as necessary to respond and handle follow-up questions. Statutory retention periods and the need to preserve evidence for legal claims may require longer storage.
8. Cookies, analytics and tracking
This website, as provided in this package, does not set analytics cookies, advertising cookies or tracking pixels. It does not use Google Analytics, Meta Pixel or comparable tracking services.
If analytics, embedded media, social plugins, newsletter tools, payment providers, storefronts or external fonts are added later, this Privacy Policy must be updated before publication and, where required, a consent mechanism must be implemented.
When you access this website, Cloudflare may, as part of a security check, set a technically necessary cookie or use a comparable technology in order to recognise a request that has already been checked and not check it again. This does not serve analytics or tracking purposes.
9. Recipients and processors
Personal data may be processed by technical service providers, especially hosting providers, email providers or maintenance service providers. This includes ZAP-Hosting GmbH as the hosting provider for this website and providers of content delivery networks and protection against attacks, in particular Cloudflare, Inc. Where required, such providers are bound by data processing agreements under Article 28 GDPR. We do not sell personal data.
10. International transfers
Personal data may be transferred to countries outside the European Union or the European Economic Area. This applies in particular to Cloudflare, Inc., which is based in the United States and operates data centres worldwide. Because Cloudflare’s network is placed in front of our servers, personal data – in particular your IP address and the technical characteristics of your requests – may be transferred to the United States and to other third countries.
Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. The transfer is therefore based on the adequacy decision of the European Commission of 10 July 2023 pursuant to Article 45 GDPR. In addition, we have agreed the standard contractual clauses of the European Commission pursuant to Article 46(2)(c) GDPR with Cloudflare as part of the data processing agreement.
Despite these safeguards, it cannot be entirely ruled out that authorities in third countries may access personal data. You may object to processing based on legitimate interests at any time (see the section “Objection to processing based on legitimate interests”).
If further service providers located outside the EU/EEA are used later, transfers will take place only where a valid transfer mechanism exists, such as an adequacy decision or Standard Contractual Clauses, and where additional safeguards are applied if required.
11. Storage periods
We store personal data only for as long as necessary for the purposes for which it was collected, unless statutory retention obligations or legal claims require longer storage. Data no longer required is deleted or anonymised.
12. Your rights
Subject to the conditions set out in the GDPR, you have the following rights:
- right of access under Article 15 GDPR;
- right to rectification under Article 16 GDPR;
- right to erasure under Article 17 GDPR;
- right to restriction of processing under Article 18 GDPR;
- right to data portability under Article 20 GDPR;
- right to object under Article 21 GDPR;
- right to withdraw consent at any time with future effect under Article 7(3) GDPR.
You also have the right to lodge a complaint with a competent supervisory authority. You may contact the supervisory authority responsible for your place of residence, your place of work, the place of the alleged infringement or the controller’s establishment.
13. Objection to processing based on legitimate interests
If we process personal data on the basis of Article 6(1)(f) GDPR, you may object to that processing on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.
14. Automated decision-making
We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR.
15. Children
This website is a promotional website for a citybuilder strategy game. It is not directed specifically at children and does not knowingly collect personal data from children. If you believe that a child has provided personal data, please contact us so that we can review and delete the data where appropriate.
16. Changes to this Privacy Policy
We may update this Privacy Policy when the website, services or legal requirements change. The version published on this page applies at the time of your visit.
Last updated
1 September 2026