Privacy policy

This is a translation for your convenience. Only the German version is legally binding.

1. Controller

The controller responsible for processing personal data on this website and on our CS2RPG game servers is:

2. The essentials

• We only process the data needed for the website, your user account and running the game servers.
• We use no cookies and no analytics, tracking or advertising services, and we do not sell any data.

3. Hosting

We run the website, the login system, the database and the game servers on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, with data centres in Germany and Finland. Hetzner processes the data on our behalf and only on our instructions (Art. 28 GDPR).

4. Visiting the website and server log files

With every request our web server automatically processes your IP address, the date and time, the requested address, the previously visited page (referrer), your browser and operating system (user agent), the response status and the amount of data transferred.

This is needed to deliver the website, for security (for example to fend off attacks) and for troubleshooting. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation. We delete the web server log files after 14 days at the latest, and the error and security logs of our backend after 7 days at the latest.

The connection between your browser and the website is encrypted with TLS (HTTPS).

5. No cookies, local storage

This website sets no cookies. When you sign in, we store your login tokens in your browser's local storage so that you stay signed in. This is strictly necessary for the sign-in you asked for (Section 25(2) no. 2 TDDDG). When you sign out, we delete the tokens and end the session on our login server.

6. User account

For an account we process your username, your email address and your password, as well as your language setting and the times of registration, email confirmation and last sign-in. Our self-hosted login system (Keycloak) stores your password only as a secure hash; we cannot see it.

After you register, we send you an email from our own mail server with a confirmation link that is only valid for a limited time. You can sign in once you have confirmed it.

This serves to provide your account (sign-in, profile, link to your game progress); the legal basis is Art. 6(1)(b) GDPR. Username, email address and password are required for an account. You do not need an account to play on our servers. We keep the account data until you have your account deleted; an email to support@fse-esport.de is enough.

For administration, we and the administrators and moderators we appoint can access account and player data as far as their task requires.

7. Linking with Steam

If you link your account with Steam, we redirect you to the Steam sign-in page, a service of Valve Corporation (Bellevue, USA). You sign in directly with Steam; we only receive your SteamID64 - no password and no other profile data. Valve's privacy policy applies to the processing by Steam.

The legal basis is Art. 6(1)(b) GDPR, as you link your account at your own request. You can unlink it in your profile at any time.

8. CS2RPG game servers

When you play on our Counter-Strike 2 servers, we process your SteamID64, your player name, your game progress (level, XP, credits, skills and prestige), your language and HUD settings and the time of your last visit. The server processes your IP address for the connection; Steam (Valve) checks whether your Steam account may play.

This serves to run the game: saving your progress, keeping leaderboards and preventing cheating and abuse, such as "farming" XP. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the protection against abuse.

The server records game events in log files, which may contain player names, SteamIDs, chat messages and IP addresses. We delete these log files after 14 days at the latest. We keep your game progress for as long as we run the game servers or until you request its deletion.

Event log for highlight clips

When it is switched on, the servers also keep an event log: kills and selected game events (such as level-ups and triggered skills) with the time and the SteamID64 and player name of those involved. We use it to find highlights in recordings of our own game rounds, for example for videos on our channels. The legal basis is Art. 6(1)(f) GDPR. The log is stored on the game server and in our database, only administrators can access it, and we delete it after 14 days at the latest. You can object to the recording by email.

Leaderboard

On the website and in the game we publicly show a leaderboard with player name, prestige, level, XP, credits and the time of the last visit; if no player name is stored, the SteamID is shown instead. This is part of the competitive nature of the game (Art. 6(1)(f) GDPR). If you do not want to appear on the leaderboard, you can object by email; we will then remove you from the leaderboard or delete your game progress.

Live player list, kicks and bans

So that administrators and moderators can see who is playing, the servers report the connected players to our backend every few seconds: SteamID64, player name, team, level, kills, deaths, score, ping and how long you have been connected, but no IP address. This list is only kept in memory, is not stored and is only visible in the admin area.

If someone breaks the rules, administrators and moderators can kick or ban them from the server, stating a reason. The affected player and the other players see the reason in the chat. For a ban we store the reason, the start and end of the ban and the account that issued it with your SteamID64; banned players do not appear on the leaderboard. The legal basis is Art. 6(1)(f) GDPR (fair play, protection against abuse). We delete this data as soon as a ban is lifted, and for temporary bans no later than one hour after they end; permanent bans are stored until they are lifted.

Builds (saved skill setups)

You can save your skills as a build, in game or in your profile; before every prestige we save them automatically (the five newest automatic ones are kept). A build contains a name, a description, skills with target levels and your prestige level, and belongs to your SteamID64. If you pick a build as your guide, we store that with your player. Every build has a code: anyone who knows it can copy the build without seeing your name. If you publish a build, signed-in users see it in the community list with your user name and badge as in the feedback board (section 9) and how often it was copied. The legal basis is Art. 6(1)(b) GDPR. We keep builds until you delete them; the team can remove published builds from the list.

9. Community: feedback, changelog and private messages

With your account you can write posts and answers in the feedback board and vote on them, read the changelog and send private messages to other signed-in users. For this we process your posts, answers and votes, your private messages with sender, recipient and time, up to which point you have read or deleted a conversation, whom you have blocked, your community settings and when you last opened the changelog.

Other signed-in users see your username and your role (such as moderator) next to your posts and messages. If you have linked Steam, we also show the level and prestige of your player there; you can turn this off in your profile. We do not show your SteamID, player name or email address there. These pages are only visible to signed-in users.

The legal basis is Art. 6(1)(b) GDPR, as you use these features with your account. We keep posts, answers and votes until they are deleted - by you, as far as the board allows it, or by the team.

Private messages

Only you and the other person see private messages; administrators and moderators do not read along (but see "Reports"). If you delete a conversation, it only disappears for you. Once both sides have deleted it, we delete the messages from our database. Anyone you block can no longer send you messages. In your profile you can choose that nobody can write to you; the team can still reach you, for example about a report.

Email notifications

Unless you turn them off in your profile, we send you an email from our mail server when you receive a new private message (at most one per conversation until you have read it, and none while you are on the website) or when the team changes the status of your feedback or replies to it. We never include the content of private messages. The legal basis is Art. 6(1)(b) GDPR.

Reports, mutes and spam protection

You can report posts, answers and private messages sent to you to the team. We then store a copy of the reported content, who wrote it and who reported it, the reason given and how the report was handled. For private messages the team only sees the reported message, not the rest of the conversation. The author does not find out who reported it. In case of violations of the terms of use, the team can delete content and mute accounts for feedback and messages; for a mute we store the reason, start and end and the account that muted. So that nobody floods the board or inboxes, we limit how much an account can write in a short time; the timestamps for this are only kept in memory and for at most one hour.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting users from harassment, spam and illegal content. We delete handled reports after 90 days and expired mutes no later than one day after they end.

If you have your account deleted (section 6), we also delete your private messages, votes and blocks. Your posts and answers in the feedback board remain without your name ("Deleted account") so that discussions stay understandable; on request we delete them as well.

10. Fonts (Google Fonts)

For a consistent look, this website loads fonts from Google Fonts, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your browser transmits your IP address to Google; a transfer to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework, for which the EU Commission has adopted an adequacy decision. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a consistent and readable presentation.

11. Contact by email

If you email us, we process your email address and the content of your message to handle your request (Art. 6(1)(b) GDPR, otherwise (f)). We delete the message once it has been dealt with, unless we are legally required to keep it.

12. Recipients

Your data is only received by Hetzner as our hosting provider (section 3), by Valve for Steam features (sections 7 and 8) and by Google when the fonts are loaded (section 10). Beyond that, we only pass on data if we are legally obliged to. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21). An email to support@fse-esport.de is enough.

You can also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

14. Changes

We update this privacy policy when our services or the law change. The version published here applies.