§/Legal

Privacy

This English version is provided for convenience. The German version is legally binding.

1. Controller

Controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR):

[Missing – add in the admin area]

For any data protection questions or to exercise your rights, please use the address above or the contact form. No data protection officer has been appointed as there is no legal obligation to do so.

2. Overview

This website is a private hobby portfolio about airsoft. Personal data is only processed where necessary to operate the website, to provide the features you use (guestbook, contact form, wishlist) or to prevent abuse. There is no advertising, no analytics or tracking service, no profiling and no disclosure to third parties for advertising purposes. Fonts and icons are served locally from this server.

The legal bases are in particular Art. 6(1)(a) GDPR (consent), (b) (enquiries and pre-contractual communication) and (f) (legitimate interests). Data is deleted as soon as the purpose no longer applies and no statutory retention obligations prevent deletion. Specific retention periods are stated in the individual sections.

3. Hosting and server log files

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS. When you visit the pages, the web server automatically processes technically necessary data in server log files: IP address, date and time, requested page, amount of data transferred, referrer URL, browser type and operating system. This data is required to deliver the website and to operate it securely (Art. 6(1)(f) GDPR). It is not combined with other data. Retention follows the hosting provider's policies.

Cloudflare: For secure delivery (HTTPS encryption) and protection against attacks, requests to this website are routed through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (reverse proxy/content delivery network). Cloudflare processes the technical connection data listed above, in particular your IP address, and may set strictly necessary security cookies (e.g. “__cf_bm” to detect automated traffic). The legal basis is our legitimate interest in providing the website securely, encrypted and reliably (Art. 6(1)(f) GDPR, Section 25(2) no. 2 TDDDG). Cloudflare is certified under the EU-U.S. Data Privacy Framework; Cloudflare's data processing terms including EU standard contractual clauses also apply. More information: cloudflare.com/privacypolicy.

For security reasons, this site uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in the address bar.

4. Cookies and local storage

Simply visiting the public pages does not set any cookies or store anything in your browser. Cookies are only created when you explicitly use one of the following features:

• “omune_vid” – set when you write or like a guestbook entry. It contains a random identifier so that your like can be assigned, withdrawn again and is not counted twice, and so that you can verify your own entry with Discord later. Storage period: 1 year.
• “omune_gb” – session cookie when you verify with Discord for a guestbook entry. It is deleted when the browser is closed or when you end the verification.
• “omune_notice” – session cookie so that the “under construction” notice only appears once. It contains no personal data and is deleted when the browser is closed.
• “omune_staff” – only for operators and moderators: lets them view the website during maintenance. Storage period: 12 hours.
• “omune_admin” – session cookie for the login of operators and moderators in the protected administration area. It is deleted when the browser is closed or on logout.

In addition, the website stores the following in your browser's local storage (local/session storage) without transferring it to us: whether you turned the background music off (“omune_music”; the music is an audio file from this server, no third-party service is loaded) and – only until the tab is closed – the music playback position (“omune_music_t”) so that it continues when you change pages. You can delete these entries at any time in your browser settings.

These cookies and entries are strictly necessary for the feature you requested. The legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

5. Contact form

You can use the contact form to report bugs, suggest improvements or ask questions. We store the selected category, the subject, your message, optionally the affected page (URL), optionally your name and email address, the page language and the date and time. Name and email address are voluntary; without an email address we cannot reply. The data is used solely to handle your enquiry and is only visible to the operators and moderators authorised to do so.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering enquiries and improving the website) or Art. 6(1)(b) GDPR if your enquiry relates to an agreement. Completed enquiries are deleted automatically no later than 365 days after completion; you can request earlier deletion at any time. To protect against spam, your IP address is only processed as a hash that changes daily (see section 12).

6. Guestbook

When you post a guestbook entry, we store the display name you enter, an optional callsign, your message, the page language and the date and time. This information is publicly visible. The legal basis is your consent by submitting the form (Art. 6(1)(a) GDPR), which you can withdraw at any time; your entry will then be deleted.

Verification with Discord (optional): Instead of entering a name and callsign yourself, you can verify via Discord (Discord Inc., 444 De Haro Street, San Francisco, CA 94107, USA). You will be redirected to Discord and sign in there; from that point on, Discord's privacy policy applies (discord.com/privacy). We only receive your Discord display name, your Discord user ID and the identifier of your profile picture (scope “identify”), no email address. The display name is shown publicly with the Discord logo and the label “Trusted” on your entry (no callsign is requested with this option). If you have a profile picture, our server downloads it once from Discord and stores a copy (for animated pictures also the animated version) on this website; it is displayed publicly next to your entry and deleted together with the entry. Visitors to the guestbook therefore load the picture from our server, not from Discord; the user ID is not published but stored together with the entry so that operators and moderators can trace the verification and detect abuse. It is deleted together with the entry. The legal basis is your consent by clicking “Verify with Discord” (Art. 6(1)(a) GDPR). So that you can also verify an entry you have already written, a non-reversible hash of the identifier from the “omune_vid” cookie is stored with each entry; it is never displayed and is deleted together with the entry. Verified entries are marked “Trusted” and shown at the top of the list.

Likes: Visitors can like entries. We store the entry, a non-reversible hash of the random identifier from the “omune_vid” cookie (see section 4) and the date and time. Only the number of likes is shown publicly. The data is deleted together with the entry. Section 12 also applies to protect against manipulation. The legal basis is Art. 6(1)(f) GDPR (providing the feature you use).

To protect against offensive or unlawful content, each entry is automatically checked against a list of blocked terms. If it contains such a term, it is not published immediately but reviewed by a person and then approved or deleted. No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place. Visitors can report entries; reported entries are also reviewed. The legal basis is Art. 6(1)(f) GDPR (protection of the website and its users).

7. Wishlist and click log

The wishlist page lists items I would be happy to receive. The “To shop” button leads to the respective online shop via a redirect on this website. When you click it, we store your full IP address, the date and time, the item clicked and the page language. The purpose is to let me know when someone is interested in an item (e.g. to avoid duplicate gifts and mark items as received) and to detect abuse. The legal basis is Art. 6(1)(f) GDPR. Repeated clicks from the same IP address on the same item within a short time are recorded only once; automated requests (e.g. link previews) are not logged.

To show the approximate origin (country, region, city), a truncated IP address (IPv4 without the last octet, IPv6 only the first 48 bits) is sent to the IPinfo service (IPinfo Inc., USA). The truncated address does not identify an individual connection. The lookup only takes place when an administrator opens the log. As IPinfo is based in the USA, data may be transferred to a third country (see section 14). IPinfo privacy policy: ipinfo.io/privacy-policy.

The click data is only visible to the operators and authorised moderators and is deleted automatically after 90 days at the latest. You may object to this processing at any time under Art. 21 GDPR (see section 15). If you do not want to be recorded, you can search for the item directly in the shop instead of using the button. Once you visit the shop, its own privacy policy applies.

8. YouTube

The pages show the latest videos of the own YouTube channel and selected videos from other channels (“Favourite content”). Titles, channel names, dates and thumbnails are fetched and delivered by our server, so merely visiting a page does not connect you to YouTube. Only when you actively start a video and confirm loading is the player from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) loaded in privacy-enhanced mode (youtube-nocookie.com). Data such as your IP address is then transferred to Google, including Google LLC in the USA. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which ends for the future when you reload the page. More information: policies.google.com/privacy.

9. Instagram

The media page shows selected as well as the latest posts and Reels of the own Instagram account. The content (caption, date, link) is entered in the administration area or fetched server-side via the official Instagram API, and thumbnails are delivered by our server; merely visiting the page does not connect you to Instagram. Only when you open a post with “View here” and confirm loading is the Instagram embed loaded. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Data such as your IP address and browser information is then transferred to Meta, including Meta Platforms, Inc. in the USA, and Meta may set cookies. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you follow the “View on Instagram” link, Instagram's privacy policy applies: privacycenter.instagram.com/policy.

10. Twitch

The live status of the Twitch channel is checked server-side via the official Twitch API; no visitor data is transmitted. The Twitch player is loaded only after you actively click. The provider is Twitch Interactive, Inc., 350 Bush Street, San Francisco, CA 94104, USA. Data such as your IP address is then transferred to Twitch. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG). More information: twitch.tv/p/legal/privacy-notice.

11. Links to social networks and shops

Links to YouTube, Twitch, Instagram, Discord, Airsoft-Verzeichnis, manufacturers and shops are plain links. Data is only transferred when you click a link and visit the respective page; the provider's privacy policy then applies. Section 7 also applies to the wishlist button.

12. Protection against spam and abuse

For the guestbook, contact form, reporting feature and login, your IP address is not stored in plain text. Instead, a non-reversible hash that changes daily is derived from it. It is used only for rate limiting and to prevent duplicate reports and is deleted automatically after 48 hours at the latest (for reports of entries: until the entry concerned is deleted). The legal basis is Art. 6(1)(f) GDPR.

13. Administration area and Discord login

The administration area is intended only for the operators and moderators of the website. For their accounts we store the username, password (only as a secure hash), role, permissions, optionally the Discord user ID and the time of the last login. With the optional Discord login (Discord Inc., San Francisco, USA), only the public Discord user ID is requested (“identify” scope), no email address. The legal basis is Art. 6(1)(f) GDPR (secure administration of the website).

Operators and moderators can receive push notifications on their own devices about new guestbook entries, reports, likes, contact requests and wishlist clicks. Such a notification may contain, for example, the display name and an excerpt of a guestbook entry or the category and subject of a contact request – never the name or email address from the contact form. Delivery runs via the push service of the respective browser vendor (e.g. Google, Apple, Mozilla); the content is end-to-end encrypted, so these services cannot read it. The legal basis is Art. 6(1)(f) GDPR (timely moderation and answering of requests).

14. Recipients and transfers to third countries

Recipients of personal data are exclusively IONOS as hosting provider and Cloudflare as network service provider (processors, see section 3) and – only in the cases described above – Google/YouTube, Meta/Instagram, Twitch, IPinfo and Discord. These providers may transfer data to the USA. For the USA there is an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) for companies certified under it. Where a provider is not certified, the transfer is based on the provider's EU standard contractual clauses or – for YouTube, Instagram and Twitch – on your explicit consent given by clicking (Art. 49(1)(a) GDPR).

15. Your rights

You have the right at any time to access your stored data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). Simply contact the address above.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

16. Obligation to provide data, automated decisions

You are under no legal or contractual obligation to provide personal data. Without the required fields, however, you cannot post a guestbook entry or send an enquiry. No automated decision-making including profiling under Art. 22 GDPR takes place.

Last updated: October 2026