PODIUMWAR
RulesQuick formulas

Privacy Policy

1. Controller

Robert Macu, Zillestraße 2A, 60488 Frankfurt am Main, Deutschland, email: securobity@proton.me. No data protection officer has been appointed (no legal obligation).

2. Visiting the website

The domain is operated via Cloudflare, Inc. (USA). Cloudflare resolves the address and forwards requests to our hosting provider as an upstream network and security service (protection against attacks and overload, caching). In doing so, Cloudflare processes connection data (IP address, time, requested address, browser identifier) and may set a strictly necessary cookie to fend off automated access (__cf_bm, lifetime 30 minutes). Legal basis: Art. 6(1)(f) GDPR (secure and available operation); the cookie is strictly necessary and does not require consent (Art. 5(3) Directive 2002/58/EC, Regulation 5(5) S.I. 336/2011).

When you visit the site, our hosting provider Vercel Inc. (USA) processes technically necessary connection data (IP address, time, requested address, browser identifier) to deliver and secure the site. Legal basis: Art. 6(1)(f) GDPR (secure operation). The logs are deleted automatically according to Vercel's retention periods, usually after a few days.

Audience measurement with Plausible Analytics (Plausible Insights OÜ, Estonia, EU): without cookies and without personal profiles; the IP address is only used in a daily changing, irreversible hash and is not stored. Legal basis: Art. 6(1)(f) GDPR.

Live visitor counter: an irreversible hash is created from the IP address and browser identifier using a secret key in order to count each visitor once per day. The hash is deleted after three days at the latest. Legal basis: Art. 6(1)(f) GDPR.

Your light/dark mode setting is stored in your browser's local storage only at your request and is not transmitted.

3. Entries and payment

For an entry, we process display name, target URL, optionally logo address and short description, email address, amount, country, timestamps, the version of the terms, the times of your two declarations on the right to cancel, a payment reference and, where applicable, a referral code. Legal basis: Art. 6(1)(b) GDPR (contract). Without email address, display name and target URL, no contract is possible.

Publicly visible are display name, target URL, logo, short description (podium only), ranking value, click count and time of entry, including in automatically generated preview images of shared links. That is the purpose of the contract. Please do not publish third-party data there without their consent.

Payment is processed by Stripe Payments Europe, Ltd. (Ireland) as an independent controller. Stripe collects, among other things, payment data, billing address and, where applicable, your VAT number and creates a customer account at Stripe for this purpose. We do not see or store card details. Stripe's privacy policy applies (stripe.com/privacy).

Clicks on an entry: your IP address is cached for no more than 10 minutes so that the same click is not counted more than once. After that, only an anonymous counter per entry remains. Legal basis: Art. 6(1)(b) and (f) GDPR (fair calculation of the guarantee in line with the contract).

Retention: the email address is automatically anonymised 12 months after payment. We keep contract and payment data for up to 10 years because of commercial and tax law obligations (Art. 6(1)(c) GDPR, section 147 of the German Fiscal Code, section 257 of the German Commercial Code). For this purpose, entries are not deleted but only removed from public display.

Ranking, value decay and refunds are calculated automatically according to the published rules. This is necessary for the performance of the contract (Art. 22(2)(a) GDPR). You can request human review, express your point of view and contest the calculation at any time: securobity@proton.me.

4. Emails

We send contract confirmation, displacement, refund and moderation notices via Resend, Inc. (USA). Legal basis: Art. 6(1)(b) and (c) GDPR.

Some of these emails contain information about topping up your own entry. Legal basis: Art. 6(1)(f) GDPR (direct marketing to customers). You can object to this at any time via the unsubscribe link in every email. We then store only an irreversible hash of your email address in order to respect the objection permanently.

5. Partner programme, reports, cancellation

Partner programme: email address, referral code, commission rate and settlement status. Legal basis: Art. 6(1)(b) GDPR. Retention: for the duration of participation, settlement data up to 10 years (Art. 6(1)(c) GDPR).

Report form: reported entry, reason, message, where applicable your email address and an irreversible hash of your IP address for abuse detection. Legal basis: Art. 6(1)(c) GDPR (Art. 16 Digital Services Act) and (f) GDPR. The email address is deleted after 12 months. The hash of the IP address is deleted after 30 days.

Cancellation form: email address, name, details of the entry and your message. Legal basis: Art. 6(1)(c) GDPR. After processing is complete and 12 months have passed, email address and name are anonymised.

6. Other recipients

  • Supabase Inc. (USA): database, stored in Frankfurt am Main (EU)
  • Vercel Inc. (USA): hosting and delivery
  • Cloudflare, Inc. (USA): DNS, upstream network (CDN) and protection against attacks
  • Resend, Inc. (USA): email delivery
  • Upstash, Inc. (USA): short-term caching of IP addresses for abuse protection (rate limiting) and click counting, deleted automatically after a few minutes
  • Functional Software, Inc. / Sentry (USA): error monitoring, in the event of an error with technical data such as IP address and request data, stored for no more than 90 days
  • GitHub, Inc. (USA): storage of encrypted backups; the provider has no access to the key

Data processing agreements (Art. 28 GDPR) are in place with all service providers. Where data reaches the USA, we rely on the EU standard contractual clauses (Art. 46(2)(c) GDPR) and, where the provider is certified, additionally on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). A copy of the safeguards is available on request.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). Requests to securobity@proton.me.

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. You may object at any time, without giving reasons, to the use of your email address for information about top-ups.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence; in Ireland this is the Data Protection Commission. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Wiesbaden, Germany.