Business:Tippspiel
Sign up

Privacy policy

The German version is legally authoritative.

Thank you for your interest in Business-Tippspiel. Protecting your personal data matters to us. Below we explain which data we process when you use this website, for what purpose and on what legal basis.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is Sebastian Bischoff, trading as “KIIT Solutions”, Paul-Klee-Weg 53A, 48165 Münster, Germany, email: [email protected]. See the imprint for further details.

2. Your rights as a data subject

You have the right to access data stored about you (Art. 15 GDPR), to rectification of inaccurate data (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR), and to object to processing (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future.

This website does not currently offer a self-service function for data access requests or account deletion. Please contact [email protected] instead — we will handle your request without undue delay, and at the latest within one month (Art. 12(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority — typically the authority for your habitual residence or for our registered office: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

3. Hosting

This website is hosted by STRATO AG, Pascalstraße 10, 10587 Berlin, Germany. Transactional emails we send (e.g. order confirmations, invoices) are also delivered technically through STRATO. We have a data processing agreement with STRATO under Art. 28 GDPR. The legal basis is our legitimate interest in a reliable, secure website (Art. 6(1)(f) GDPR).

Uploaded media files (e.g. your company logo during white-label setup) are stored exclusively on this server, not with an external cloud/CDN provider.

In addition, access to this website is routed through the content delivery network (CDN) of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Technically, Cloudflare sits between you and our hosting at STRATO, terminates the encrypted connection and protects against denial-of-service attacks (DDoS). In doing so, Cloudflare processes, on every page request, the same technical connection data described in section 4 (including IP address, timestamp, page requested). As with STRATO, the legal basis is our legitimate interest in a reliable, secure website (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare under Art. 28 GDPR including the EU standard contractual clauses for transfers to the USA; Cloudflare is also certified under the EU-US Data Privacy Framework. Depending on which security features we enable at Cloudflare (e.g. bot detection on suspicious behaviour), Cloudflare may set its own technical cookies in addition to the Turnstile cookies described in section 6 — for details, see Cloudflare’s privacy policy at cloudflare.com/privacypolicy.

4. Providing the website and server log files

Every time this website is accessed, technically necessary connection data is processed as part of hosting (including IP address, date and time of the request, page requested, browser type, referring URL). This is necessary to deliver the website and ensure system security (Art. 6(1)(f) GDPR, legitimate interest). We additionally log technical errors (stack trace, affected order, IP address) for a maximum of 30 days to fix faults; these entries are then deleted automatically.

5. Cookies and consent

This website uses cookies. Strictly necessary cookies (e.g. for signing in to your customer account and remembering your cookie choice) are set on the basis of our legitimate interest in technical operation (Art. 6(1)(f) GDPR, § 25(2) no. 2 TDDDG). This category cannot be switched off.

Cookies and similar technologies that are not strictly necessary (e.g. statistics and marketing) are only used with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). On your first visit we ask you, with equally weighted “Reject all” and “Accept all” options and the ability to choose each category individually. You can change or withdraw your choice at any time with effect for the future via the “Cookie settings” link in the footer, where the individual services, cookies and retention periods for each category are listed.

6. Bot protection (Cloudflare Turnstile)

On the contact form and registration, we use Cloudflare Turnstile to detect automated form abuse (bots, spam). The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (for processing within the EEA: Cloudflare Germany GmbH or the relevant EU Cloudflare entity under the existing data processing agreement). This processes technical data such as IP address, browser/device information and behavioural signals during form use to distinguish humans from bots.

Unlike the analytics/marketing services above, this is NOT a consent-requiring form of processing: Turnstile does not set cookies for marketing or tracking purposes and does not track you across sites. The legal basis is our legitimate interest in functional, abuse-protected forms (Art. 6(1)(f) GDPR). Turnstile therefore loads independently of your cookie choice as soon as you open one of the forms mentioned.

For more information, see Cloudflare’s privacy policy at cloudflare.com/privacypolicy.

7. Analytics and marketing (only with your consent)

If you consent, we use Google Analytics 4 (reach and usage measurement) and – where enabled – Google Ads (measurement of advertising campaigns). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This may set cookies and process usage data (e.g. pages viewed, truncated/anonymised IP address, device/browser information) and transmit them to Google.

Data may be transferred to the USA in this context. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, Google has entered into the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of the standard contractual clauses via the contact address given in section 1.

The legal basis is solely your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). These services are not loaded before you consent (Google Consent Mode v2). You can see which services are actually active, by category, under “Cookie settings”, where you can withdraw your consent at any time.

For more information, see Google’s privacy policy at policies.google.com/privacy.

8. Customer account and orders

When you create a customer account or place an order, we process the information required for this — depending on customer type, e.g. email address, password (stored encrypted), first and last name, company name, VAT ID, phone number, and billing/delivery address. The purpose is to perform the contract (setting up your prediction-game instance, order processing, support). The legal basis is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures).

If you have separately consented to receive marketing/newsletter communication, we process this additionally on the basis of your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time informally via our contact address or — where the consent relates to your customer account — directly in your customer account.

We store your account and order data for the duration of the business relationship. We then delete it as soon as no statutory retention obligation applies; data forming part of an accounting record (in particular invoice data) is subject to the ten-year retention described in section 10. We retain the record of your marketing consent as evidence (Art. 7(1) GDPR) for up to three years after you withdraw it.

The details marked as mandatory are strictly necessary for concluding the contract and issuing invoices (in particular name and full address, § 14(4) UStG). Without them we cannot conclude the contract or issue an invoice; providing them is therefore contractually required (Art. 13(2)(e) GDPR). All other details are optional.

8a. Support requests and file attachments

When you create a support ticket via your customer account, we process your messages, the processing history and the file attachments you upload. The purpose is to handle your request within the existing contractual relationship; the legal basis is Art. 6(1)(b) GDPR. We delete tickets including attachments no later than three years after the matter is closed, unless a retention obligation applies. Please do not upload documents that are not required in order to handle your request.

9. Payment processing

Depending on the payment method chosen, we pass on the data required for payment processing (order number, amount, currency) to the following recipients: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland (card/online payment) and PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (PayPal). For payment by invoice or advance bank transfer, no data is transmitted to an external payment provider; payment is handled manually by bank transfer. Payment details themselves, such as card numbers or PayPal login credentials, are only ever handled on the respective provider’s own page and are never stored or seen by us.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). For more information, see the privacy notices of Stripe (stripe.com/privacy) and PayPal (paypal.com/privacy).

10. Invoices and statutory retention

Invoices and credit notes contain personal data (including name/company, address, order content) and are subject to statutory commercial and tax retention obligations (§ 147 German Fiscal Code, § 257 German Commercial Code, GoBD) of currently ten years. The legal basis for this retention is Art. 6(1)(c) GDPR (legal obligation) in conjunction with the provisions named above. Deletion at your request is not possible within this period; when corrected, previously issued invoices are not deleted but marked as cancelled or superseded in a GoBD-compliant way.

11. Contact form and quote requests

If you contact us via the contact form or a quote request, we process your details solely to handle your enquiry. Some forms confirm your email address via double opt-in. The legal basis is your consent (Art. 6(1)(a) GDPR) or, where the enquiry serves to prepare a contract, Art. 6(1)(b) GDPR. You can withdraw your consent at any time with effect for the future.

We delete enquiries from the contact form and quote requests no later than twelve months after the last communication, provided no contractual relationship has arisen from them and no statutory retention obligation applies.

12. Recipients and processors

We use the following external service providers. We have agreements under Art. 28 GDPR in place with all recipients acting as processors.

  • STRATO AG, Pascalstraße 10, 10587 Berlin, Germany — hosting, database, delivery of transactional emails; processing in Germany.
  • Cloudflare, Inc. / Cloudflare Germany GmbH — content delivery network, denial-of-service protection, bot protection (Turnstile), DNS; processing in the EEA, possibly the USA (Data Privacy Framework and EU standard contractual clauses).
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — reach measurement (Analytics 4) and campaign measurement (Ads), only with your consent; processing in the EEA, possibly the USA (Data Privacy Framework and EU standard contractual clauses).
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg — payment processing; PayPal acts as an independent controller in this respect, not as a processor.
  • Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland — payment processing; processing in the EU, possibly the USA.
  • The provider of our encrypted offsite backup — storage of encrypted backup copies; processing in Germany.

Beyond these cases, we do not share your data with third parties unless we are legally obliged to do so or you have consented.

13. Automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

14. Changes to this privacy policy

We update this privacy policy whenever our data processing or the legal situation changes. The version published on this page at any given time applies.