Privacy Policy
Protecting your personal data matters to us. This privacy policy informs you in accordance with the General Data Protection Regulation (GDPR) about the type, scope and purposes of the processing of personal data on this website. Version: 2026-10-11.
1. Controller
[Name, address – to be completed before launch]
E-Mail: kontakt@surakarta.eu
2. Hosting and data processing agreements
This website is operated by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, in data centres within the European Union. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the provider. Technically necessary server log data (e.g. IP address, time, requested page) is processed when the site is accessed in order to ensure operation and security (Art. 6(1)(f) GDPR).
3. Processing activities in detail
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| User account (registration, login) | Username, e-mail address, password hash, language setting | Art. 6 Abs. 1 lit. b DSGVO | Until the account is deleted |
| Game and rating data | Games, moves, Elo ratings, statistics (linked to the account) | Art. 6 Abs. 1 lit. b DSGVO | 24 months after last activity, then anonymised; immediately anonymised upon account deletion |
| Technical security logs | IP address, timestamp, requested endpoint | Art. 6 Abs. 1 lit. f DSGVO (Art. 32 DSGVO) | 14 days |
| Communication (chat in bot/friend games, reports) | Message contents, timestamps, reports of rule violations | Art. 6 Abs. 1 lit. b DSGVO | With the game: 24 months, then anonymised; immediately anonymised upon account deletion |
| Login (login cookie) | Session/login ID (technically required for login) | Art. 6 Abs. 1 lit. b / § 25 Abs. 2 TDDDG | Until logout, max. 30 days |
| Local settings (guest) | Theme, language (stored only in your own browser) | Section 25(2) TDDDG (technically required); session: Art. 6(1)(f) GDPR | Can be deleted via the browser |
There is no tracking, no profiling for advertising purposes and no disclosure to third parties for marketing purposes. No third-party content (fonts, scripts, advertising networks) is embedded. Personal data is not transferred to third countries outside the EU/EEA (Art. 13(1)(f) GDPR).
4. Your rights
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR) – available directly in the account settings
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR) – export in the account settings
- Objection (Art. 21 GDPR)
- Withdrawal of consent (Art. 7(3) GDPR)
You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), e.g. the authority responsible for your place of residence.
5. Data security
The connection is encrypted (TLS). We implement technical and organisational measures pursuant to Art. 32 GDPR (including password hashing, access controls, logging, backups). Backups are stored encrypted and overwritten after 30 days.
6. Changes
We reserve the right to adapt this policy in the event of changes to the legal situation or the service. The version published here applies.
Version: 2026-10-11