1. Controller
The controller responsible for processing personal data on this website within the meaning of the EU General Data Protection Regulation (GDPR) is:
David Weyrauch, trading as CrossOrbit Studio, Ostergasse 13, 6091 Götzens Austria
Email: admin[at]crossorbit.de Website: https://crossorbit.de
We have not appointed a data protection officer, as we are not legally required to. For any privacy question or request, write to the email address above.
2. Scope and legal bases
This policy covers the website crossorbit.de, including the community forum. Our games have their own privacy policies (see section 12).
We process personal data only where one of these legal bases applies:
| Legal basis | Used for |
|---|---|
| Art. 6(1)(b) GDPR – contract | Forum accounts, logging in, sending account emails |
| Art. 6(1)(f) GDPR – legitimate interest | Server logs, security and spam protection, answering emails |
| Art. 6(1)(a) GDPR – consent | Non-essential cookies and embedded third-party content |
| § 165(3) TKG 2021 | Storing or reading information on your device (cookies): only with consent, unless strictly necessary for a service you requested |
Our legitimate interests are running a secure, working website and forum and protecting it from abuse.
3. Hosting and server logs
This website is hosted by ZAP-Hosting GmbH, Germany, on servers in the EU. ZAP-Hosting processes data only on our behalf under a data processing agreement (Art. 28 GDPR).
Each time you visit, the server automatically records:
- your IP address
- date and time of the request
- the page or file requested and the referring page
- browser type and operating system
- HTTP status code and amount of data transferred
We need this to deliver the website, find errors and detect attacks (Art. 6(1)(f) GDPR). Log files are deleted after 60 days, unless a specific incident requires us to keep them longer to investigate it.
4. Cookies and consent
We use cookies and similar technologies. Cookies that are strictly necessary are set without consent: login session, security and spam protection, the forum’s read markers, and storing your consent choice. All other cookies and third-party content load only after you consent.
Your consent is managed with our cookie banner (Complianz). You can change or withdraw your consent at any time via Manage consent at the bottom of every page. Withdrawal does not affect processing that took place before.
The full list of cookies, their purpose and how long they are stored is in our Cookie Policy.
5. Forum and user accounts
To post in the forum you need an account. The forum runs on WordPress with the wpForo plugin, on our own hosting.
Registration. We collect your username and email address. We then send a confirmation email; your account becomes active once you set your password via the link in it. Your password is stored only as a hash. We also store the IP address and time of registration to detect abuse.
Using the forum. We store your posts, topics, profile details you choose to add (e.g. avatar, signature, about text), your forum settings, read markers and the IP address and time of each post.
What is public. Your username, profile details you made public, and everything you post are visible to all visitors. Your email address and IP addresses are never shown publicly.
Emails from the forum. We send account emails (confirmation, password reset) and, if you subscribe, notifications about topics or forums. You can unsubscribe from notifications at any time in your forum settings.
Legal basis and retention. Art. 6(1)(b) GDPR for the account and forum use; Art. 6(1)(f) GDPR for the IP addresses (abuse prevention). We keep your account until you delete it or ask us to. Unconfirmed registrations are removed after 30 days. When an account is deleted, its posts are deleted or anonymised.
6. Spam and attack protection
We use the security plugin WP Cerber, which runs on our own server. It checks logins, registrations and form submissions for bots and attacks, using your IP address, the request data and a few technical cookies. No data is sent to third parties. Legal basis: Art. 6(1)(f) GDPR, our interest in protecting the website and its users. Security logs are deleted after 60 days.
7. Email
Contacting us. If you email us, we process your email address, name (if given) and the content of your message to answer you (Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR if your request concerns your account). Our mailboxes are hosted by ZAP-Hosting (see section 3). We delete correspondence when it is no longer needed, unless we must keep it for legal reasons.
Sending emails. All emails from crossorbit.de (forum emails and our personal replies) are delivered through Mailgun (Mailgun Technologies, Inc., USA), using its EU region. Mailgun processes your email address, the message and delivery data (time, delivery status, bounces) on our behalf under a data processing agreement. Click and open tracking is switched off. Because Mailgun is a US company, access from the USA cannot be ruled out; such transfers are covered by the safeguards described in section 9. Mailgun keeps delivery logs for a limited period according to its retention settings.
8. Embedded third-party content
Steam store widgets. Our project pages show Steam store widgets from Valve Corporation, 10400 NE 4th St, Bellevue, WA 98004, USA. When a widget loads, your browser connects to Steam’s servers and transmits your IP address and browser information to Valve; if you are logged in to Steam, Valve can link the visit to your account. The widgets load only after you consent (Art. 6(1)(a) GDPR); until then you see a placeholder. Valve’s privacy policy: https://store.steampowered.com/privacy_agreement/
Links to other platforms. Links to Steam, social media or other external sites are plain links. No data is sent to those platforms until you click them.
Fonts. All fonts are hosted on our own server. No connection to font providers is made.
Avatars. If you have not uploaded a forum avatar, your profile image may be loaded from Gravatar (Automattic Inc., USA). For this, an encrypted value (hash) of your email address and your IP address are transmitted to Automattic. Privacy policy: https://automattic.com/privacy/
9. Recipients and international transfers
We do not sell your data or use it for advertising. Your data reaches only these recipients:
| Recipient | Role | Location | Purpose |
|---|---|---|---|
| ZAP-Hosting GmbH | Processor | Germany (EU) | Web hosting, mailboxes |
| Mailgun Technologies, Inc. | Processor | EU region; company in USA | Email delivery |
| Valve Corporation | Separate controller | USA | Steam widgets, only with consent |
| Google Ireland Ltd. / Google LLC | Separate controller | Ireland / USA | reCAPTCHA, only with consent (Variant A) |
Where data may be transferred to the USA, the transfer is based on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). For services that load only with consent, your consent also covers the transfer (Art. 49(1)(a) GDPR).
We disclose data to authorities only where we are legally obliged to.
10. How long we keep data
| Data | Retention |
|---|---|
| Server access logs | 60 days |
| Security logs (WP Cerber) | 60 days |
| Unconfirmed registrations | 30 days |
| Forum account and profile | Until you delete it or ask us to |
| Forum posts | Until deleted by you or us; deleted or anonymised when the account is deleted |
| Emails to and from us | Until the matter is closed, unless a legal duty requires longer |
| Consent choice (cookie) | 365 days |
Other cookies: see the Cookie Policy.
11. Your rights
Under the GDPR you have the right to:
- access the data we hold about you (Art. 15)
- rectification of incorrect data (Art. 16)
- erasure of your data (Art. 17)
- restriction of processing (Art. 18)
- data portability – receive your data in a common machine-readable format (Art. 20)
- object to processing based on legitimate interest (Art. 21)
- withdraw consent at any time, with effect for the future (Art. 7(3)) – for cookies via “Manage consent” at the bottom of every page
To exercise a right, email admin@crossorbit.de. We respond within one month. We may ask you to confirm your identity, for example by writing from your account’s email address.
Right to complain. You can lodge a complaint with a data protection supervisory authority. In Austria this is:
Österreichische Datenschutzbehörde Barichgasse 40–42, 1030 Vienna, Austria dsb@dsb.gv.at · https://www.dsb.gv.at
You can also contact the authority in your own EU country of residence.
12. Other information
Minimum age. Forum accounts are intended for users aged 14 and over. If you are younger, please ask a parent or guardian before registering.
Security. The website is served only over encrypted connections (HTTPS). Passwords are stored as hashes, access to the server is restricted, and our software is kept up to date.
No automated decisions. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
Our games. Each game has its own privacy policy:
Changes. We update this policy when our website or the law changes. The current version is always available on this page.
Last updated: 10.10.2026