Privacy Policy

1. Controller

The controller for data processing on bspmarket.de is:

Data protection requests can be made by e-mail with the subject “Datenschutz / bspmarket.de”.

2. Principles of processing

We process personal data only insofar as this is necessary for operating the platform, providing user accounts, handling purchases and downloads, running creator functions, communication, security, fulfilling legal obligations or safeguarding legitimate interests.

The legal bases are in particular Art. 6 (1) (b) GDPR for contract performance and pre-contractual measures, Art. 6 (1) (c) GDPR for legal obligations, Art. 6 (1) (f) GDPR for legitimate interests and Art. 6 (1) (a) GDPR for consent.

3. Hosting, website access and server logs

bspmarket.de is operated on a dedicated virtual server provided to us by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. Hetzner processes the data stored on the server exclusively on our behalf (Art. 28 GDPR). The database, e-mail sending and all background processes run on this server; we do not use a content delivery network or external web hosting.

After they have been checked, uploaded files (purchase files, individually marked buyer copies, files in the BSP Vault and BSP Protection results and packages) are stored in the “Hetzner Object Storage” of the same Hetzner Online GmbH in its Falkenstein data centre (Germany), likewise exclusively on our behalf (Art. 28 GDPR). During upload, virus scanning, preparation and delivery, files are also stored temporarily on our server. The storage is not publicly accessible and there are no direct links to it. Downloads always run through our server after your login and authorisation have been checked. Files are stored there under random identifiers, not under user names, file names or IP addresses; files in the BSP Vault and other protected files additionally remain encrypted by us.

When the website is accessed, technically necessary access data is processed. This may include the IP address, date and time of access, requested URL, referrer, user agent, browser/device information, HTTP status, amount of data transferred and security events.

The purposes are delivery of the website, stability, error analysis, attack detection, abuse prevention and evidence of technical processes. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure and reliable operation of the platform.

Individual page requests are not stored in access logs by the web server. System and application logs (e.g. error messages, login attempts on the server, delivery logs of the mail server) are automatically deleted after 30 days at the latest. We store security-relevant account events (e.g. logins, permission changes) for 180 days in an audit log together with an IP address that is hashed with a key changing daily and is not stored in plain text. Longer retention only takes place where specific incidents, attacks, suspected fraud or legal claims require it.

3a. Audience measurement without cookies

To understand how bspmarket.de is used (for example which pages and products are viewed, how visitors find us and how many visits lead to a purchase), we run our own statistical evaluation. It runs entirely on our server; no external analytics service is integrated and no data is passed on to third parties.

We do not use cookies for this purpose and do not place any identifiers on your device. When a page is opened, your browser transmits the page viewed, where applicable the host name of the website you came from, campaign parameters from the link (utm_source, utm_medium, utm_campaign) and the active time spent on the page. From the IP address and browser identification (user agent) we calculate an identifier using a random key that changes daily and is then deleted, in order to group several page views of one visit within a day. The IP address and user agent themselves are not stored for this purpose; after the change of day the identifier can no longer be assigned to an IP address and does not allow recognition across several days or across other websites. In addition, when a page is opened we derive from the IP address the country from which the access originates. This lookup takes place exclusively on our server using a country list stored there (“IP to Country Lite” database by DB-IP); the IP address is neither stored for this purpose nor transmitted to the provider of the list or to other third parties.

For each visit we store: time, pages viewed and time spent, source channel and host name of the referring website (never its full address), campaign parameters, rough device class, browser and operating system family, page language and the language set in the browser, the country of access (only as a country code, without region or city), whether the visit took place while logged in (without assignment to an account), search terms of the catalogue search, whether the cookie notice was displayed and acknowledged (derived from the technically necessary storage of your cookie choice described in section 4; only this yes or no is counted), and whether a product was added to the cart, a checkout was started, a purchase was completed or an account was created. So that a purchase can be attributed to the correct visit, the order is temporarily linked to the visit; this link is deleted as soon as the payment has been completed or cancelled, at the latest after three days. After that, the statistical data no longer contains any reference to an account or an order.

The legal basis for the brief processing of IP address and user agent is Art. 6 (1) (f) GDPR. Our legitimate interest lies in designing the offering according to demand and measuring its reach without identifying visitors or creating profiles. As neither cookies nor comparable identifiers are stored on or read from your device for this purpose, we do not obtain consent under § 25 (1) TDDDG.

Objection: You can object to this measurement at any time by activating “Do Not Track” or “Global Privacy Control” in your browser. Visits carrying this signal are not counted. Visits by our team and recognisable automated access are not recorded either. The statistical data is deleted after 400 days.

4. Cookies and local storage

bspmarket.de currently uses only technically necessary cookies and local storage required for login, cart, security, cookie choice and usability of the platform. Marketing, tracking or analytics cookies are not currently active. The audience measurement (section 3a) works without cookies and without local storage.

The legal basis for technically necessary cookies and comparable storage is § 25 (2) TDDDG. The subsequent processing of personal data takes place, depending on the purpose, on the basis of Art. 6 (1) (b), (c) or (f) GDPR.

The cookie banner informs about this necessary storage. As no optional analytics or marketing cookies are currently active, no separate tracking consent is obtained. Should optional services be integrated in the future, they will be described in the cookie banner and in this privacy policy before activation.

Embedded YouTube videos: Creators can add YouTube videos to their product pages. These are only loaded when you click on the respective video; before that, no connection to YouTube is established and no preview image is loaded from YouTube. After the click, the video is embedded via youtube-nocookie.com. In the process, your browser transmits in particular your IP address and technical data to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; YouTube may set its own cookies or comparable storage and may also transfer data to Google LLC in the USA. The legal basis is your consent given by the click (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Further information: https://policies.google.com/privacy.

During payment processes via Stripe, Stripe's own cookies or comparable technologies may be used on Stripe's pages or systems. These are outside our direct control and are governed by Stripe's privacy and cookie notices.

5. User account and Discord login

Registration currently takes place via Discord OAuth. When you sign in, we process the data provided by Discord, in particular the Discord ID, username, avatar URL and technical OAuth data. Where OAuth tokens must be stored, they are stored in a technically protected manner.

The purposes are registration, login, account assignment, abuse protection, display of the profile, purchase and download management, creator functions and support. The legal basis is Art. 6 (1) (b) GDPR and Art. 6 (1) (f) GDPR for security and abuse protection.

We do not receive an e-mail address via the Discord login. We only process an e-mail address if you store one yourself for notifications (section 6).

Discord is an external service. When using the Discord login, Discord's privacy information additionally applies. This may involve data processing outside the European Union or the European Economic Area.

6. E-mail address and e-mail notifications

You can store an e-mail address for notifications in your account settings. For buyers this is voluntary. For creators, a confirmed address is a prerequisite for applying, so that we can reliably reach them regarding approvals, payouts and in particular leak findings.

The address only becomes active once you have clicked the confirmation button in the e-mail sent to it (double opt-in). Unconfirmed addresses and confirmation links are discarded after 48 hours. We send to this address exclusively notifications relating to your account, in particular regarding leak cases and monitoring findings, product and version approvals, creator decisions, payouts, retention periods and deletions of files, warnings concerning server-exclusive licences and – only if you have activated them yourself – price alerts from your wishlist and notices about new versions of products you have subscribed to. We do not send advertising or newsletters. Every notification e-mail contains a link with which you can unsubscribe with a single click.

We process the e-mail address (stored in encrypted form), the time of confirmation and a delivery log containing the truncated recipient address, subject, time and delivery status. We send the e-mails from our own server with the sender address noreply@bspmarket.de; no external e-mail service provider is used. Please direct replies and queries to kontakt@bspmarket.de. Transmission to your provider's mail server is encrypted, provided that server supports it.

The legal basis is, for creators, Art. 6 (1) (b) GDPR (performance of the creator contract) and, for buyers, your consent under Art. 6 (1) (a) GDPR. You can remove the address in your account settings at any time; after that you will no longer receive any e-mails. The delivery log is deleted after 30 days.

7. Optional Steam link

Users may voluntarily link a Steam profile. This may in particular process the SteamID64, profile name, avatar URL, profile URL and technical linking data.

The purposes are profile display, licence and account assignment, creator/buyer verification, abuse prevention, account protection and use of certain map, scanner or protection functions. The legal bases are Art. 6 (1) (b) GDPR, Art. 6 (1) (a) GDPR for voluntary linking and Art. 6 (1) (f) GDPR for security and evidence interests.

The Steam link can be removed in the account, unless overriding legal, contractual or security-related grounds prevent this.

8. Purchases, orders, invoices and downloads

For purchases and downloads we process data such as the user account, product, order number, purchase time, payment status, price, currency, tax information, download times, download status, licence assignment, product version, hash values and technical download logs.

The purposes are order processing, payment assignment, provision of digital content, proof of licence, support, warranty, withdrawal, abuse prevention, fraud prevention and legal retention. The legal bases are Art. 6 (1) (b), (c) and (f) GDPR.

Download and licence data may be stored for the duration of the licence and beyond within statutory limitation, evidence and retention periods.

Resumable downloads: When you download a purchased file, we create a download grant that is valid for 24 hours and bound to your account. This lets you resume an interrupted download without a new copy being generated. For this we store your account ID, product, version and purchase, timestamps (creation, preparation, first and last access, expiry), the number of requests and the amount of data transferred; IP address and browser data are not stored for this purpose, and the link itself is stored only as a hash value. File copies generated only for the grant are deleted when it expires, the grant data seven days after expiry. The legal basis is Art. 6 (1) (b) GDPR.

If you add products to your wishlist, activate a price alert or subscribe to updates of a product, we store this selection with your account and, for a price alert, additionally the price at the time of activation. If the price drops, you receive a notification no more than once every 24 hours; with a subscription, you receive a notification when a new version is approved. The legal basis is Art. 6 (1) (b) GDPR (function requested by you). The data remains stored until you deactivate the function or your account is deleted.

Contract confirmation by e-mail: After every paid order, rental or subscription we send you a contract confirmation containing the order number, items and prices, the consent given at checkout, information on term and cancellation, the withdrawal policy and our terms (Section 312f BGB). It is sent to the e-mail address you entered in the Stripe checkout or, if none is available, to your confirmed notification address. For this purpose we store the address in encrypted form until it has been sent successfully and afterwards only in shortened form as proof of dispatch, as well as the interface language last used when ordering so that the confirmation reaches you in your language. The legal basis is Art. 6(1)(b) and (c) GDPR (performance of the contract and statutory information obligation). The proof of dispatch is deleted after three years, the dispatch log after 30 days.

Cancellations via “Cancel contracts here”: If you cancel a contract via the cancellation button, we process the details of your notice of cancellation (type of cancellation, reason if applicable, name, e-mail address, the identifiers you provide such as Discord name, account ID, order or receipt number, contract and requested date), the time of receipt, your account if you are logged in, a daily changing hash of your IP address to prevent abuse (the IP address itself is not stored), a shortened browser identifier and the processing log. The purposes are carrying out the cancellation, the confirmation of receipt by e-mail and proof. The legal bases are Art. 6(1)(b) and (c) GDPR (Section 312k BGB) and Art. 6(1)(f) GDPR for abuse prevention and proof. The data is deleted three years after receipt.

9. Payment processing via Stripe

For paid purchases, coin packages, protection passes, subscriptions and other chargeable services we use Stripe as the payment service provider. The provider is in particular Stripe Payments Europe, Limited, Ireland, and affiliated Stripe companies where necessary for the respective payment processing, fraud prevention, security, billing or technical provision.

When a checkout starts, we transmit the information necessary for payment processing to Stripe, or Stripe collects it directly at checkout. This may include: e-mail address, customer/account reference, order or checkout ID, product or package name, amount, currency, payment status, billing and tax information, payment method, truncated payment references, transaction and fraud prevention data, IP address, device/browser data, timestamps and technical security information.

We do not store complete credit card or payment instrument data on our servers. Complete payment data is processed by Stripe. We store only the payment and status information required for order, licence, credit, support, evidence, accounting and legal retention, for example the Stripe checkout session ID, payment intent ID, payment status, amount, currency, order number and webhook events.

The purposes of processing are payment handling, contract performance, provision of digital content, crediting of BSP Credits or protection passes, subscription management, invoicing and accounting, fraud prevention, abuse defence, support, refunds, chargebacks and legal evidence.

The legal bases are Art. 6 (1) (b) GDPR for payment processing and contract performance, Art. 6 (1) (c) GDPR for statutory retention, tax and accounting obligations, and Art. 6 (1) (f) GDPR for secure payment processing, fraud prevention, abuse defence and legal defence.

Stripe may also process data under its own responsibility and use service providers, sub-processors or affiliated companies. This may involve transfers to countries outside the EU or EEA. According to its own information, Stripe bases such transfers on appropriate safeguards such as standard contractual clauses, adequacy decisions or other legally provided mechanisms.

Further information is provided by Stripe at https://stripe.com/privacy, on the Data Processing Agreement at https://stripe.com/legal/dpa and on service providers/sub-processors at https://stripe.com/legal/service-providers.

10. Creator functions, uploads and product management

For creator functions we process in particular application data, creator status, profile details, payment/payout data, tax details, product data, uploads, file names, hash values, scan results, approval decisions, admin comments, product versions, sales data, payout data and support/communication data.

The purposes are review and approval of creators, product publication, rights and security review, sale, payout, billing, abuse prevention, compliance with legal obligations and platform operation. The legal bases are Art. 6 (1) (b), (c) and (f) GDPR.

Where legally required, tax-relevant creator data may be retained or transmitted to the competent authorities.

Statistics for creators: For the view statistics, we only count the number of views per product and day as well as a rough source category (e.g. direct, search engine, Discord, Steam). The category is derived from the host name of the referring page; the host name itself, IP addresses, cookies or user identifiers are not stored for this purpose. Views of their own product by the creator and recognisable bots are not counted. The counters are deleted after 400 days. The legal basis is Art. 6 (1) (f) GDPR (provision of sales analytics for creators).

Public creator profile: Creators can upload a profile banner and publish links to their Discord server, Steam profile and website. Before storing uploaded images (banners and product images), we remove embedded metadata such as EXIF data, including location information. The links are ordinary outgoing links without tracking.

Discord notifications: Creators can optionally store a Discord webhook address in order to receive notices about sales, reviews, versions, payouts and leak findings in their own Discord server. We store the webhook address in encrypted form. In doing so, we only transmit to Discord (Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA) product titles, the price or creator share, star ratings, status messages and timestamps – never names, usernames or any other data of buyers or reviewers. The legal basis is Art. 6 (1) (b) GDPR (function requested by the creator). The creator can switch the function off at any time.

Own servers and Workshop items: For leak monitoring, creators can register their own server addresses and their own Workshop items as known, so that these are not reported as suspected cases. These entries remain stored until the creator removes them or the product is deleted.

11. Protection functions, fingerprints, obfuscation and scanner

For licence protection, evidence and abuse prevention, technical protection data may be processed. This includes in particular the product ID, creator ID, buyer ID, order ID, licence ID, protection ID, file hashes, product version, download time, fingerprint/carrier metadata, review results, evidence files, IP hash values and audit logs.

With buyer fingerprinting enabled, a delivered file may be provided with a secret, non-publicly visible proof that can enable later assignment to an order or licence. The proof does not serve to observe your usage behaviour but licence assignment, fraud prevention, account security and securing evidence in the event of unauthorised redistribution. It is only evaluated when a file is examined in a leak case (section 12).

The legal bases are Art. 6 (1) (b) GDPR for licence-related contract performance and Art. 6 (1) (f) GDPR. Our legitimate interest lies in protecting digital content, defending against fraud, platform security and enforcing legitimate claims.

We store uploaded BSP Protection originals only as long as they are needed for processing: once the job has finished (successfully or not), the original file is deleted automatically from our server and from object storage. The log keeps only the checksum (SHA-256), file size, time and reason of deletion, never the content of the map. Only if you explicitly choose “Keep the original for re-protect” when ordering does the original remain stored for up to 30 days so that a re-protect is possible without a new upload; after that it is deleted automatically as well. The protected result and the report are subject to the periods in section 18.

11a. Server-Exclusive licences, rental licences and licence checks

Purchase and rental: If you buy or rent a Server-Exclusive licence, we process, in addition to the order data (section 8), the server address you enter (public IPv4 address with port) and the server name. We store the address in encrypted form, additionally as a hash value (HMAC) of the IP address formed with a secret key for the server binding, and in masked form (e.g. 45.13.x.x:27015) for display. We store the same information while a licence is in your cart. For rental licences, the subscription status, billing periods, scheduled cancellations and, for each paid monthly invoice, the invoice ID, amount, period and time of payment are added. If you request a move, we process the new address in the same form, the new server name, your optional reason and the decision with its justification. For each licence we keep a licence log with events such as purchase, provision, move, cancellation, expiry or blocking, each with the time, acting role and technical details.

Licence check: With every licence check, the game server transmits technical data to bspmarket.de. For this we store the time, result, licence ID, map name and checksum as well as hash values of the requesting IP address, of a technical server fingerprint, of the user agent and of the one-time identifier of the request. The requesting IP address is only compared with the server binding as a hash value and is not stored in plain text. Checks may also come from servers that run a map without a valid licence and may therefore relate to their operators.

Purposes and legal bases: We process this data to generate and provide the licence package, to bind the licence to your server and check it, to bill rentals, to handle moves, to provide support, to document licence events and to detect and prevent misuse such as use on other servers. The legal bases are Art. 6 (1) (b) GDPR (performance of the licence or rental contract), Art. 6 (1) (f) GDPR (our legitimate interest and that of the creator in protecting the map against unauthorised use and in the traceability of licence events) and, for invoices and accounting records, Art. 6 (1) (c) GDPR.

What the creator sees: For each licence, the creator of the product only sees a pseudonymous reference (SXL-…), the server name you entered, the status and term and, for a move request, the new server name and your reason. In their live overview, the creator only sees aggregated values, such as the number of active servers, estimated map starts and rejected checks, and, for each server, an eight-character abbreviation of the fingerprint hash value. The creator does not receive the name, user name, account data, IP addresses or IP hash values of buyers. You should therefore choose the server name and any move reason so that they do not contain information the creator should not see. The bspmarket team sees the buyer account and server address where this is necessary for support, moves and misuse cases.

Recipients: One-time licences are paid via Stripe like other purchases (section 9). We bill rental licences via a Stripe subscription; Stripe receives in particular the product name, the monthly price, the server name as part of the item description, internal identifiers of the licence, product and account, your e-mail address if you have stored one, and the payment data. Apart from our hosting provider (section 3), there are no further recipients of this data.

Storage period: We automatically delete the log of licence checks after 90 days. We store licence data, move requests and the licence log for the duration of the licence and thereafter until the end of the regular limitation period of three years from the end of the year (Sections 195, 199 of the German Civil Code, BGB). We retain orders and rental invoices in accordance with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB), for eight or ten years depending on the document. If you delete your account, we first remove the server address (encrypted and masked), the server name and the move reason from licence data and move requests, remove licences from the cart and end running rentals at Stripe. The hash value of the server binding is retained so that a licence already paid for can continue to run, as are the accounting-relevant data and the licence log, including where server names are recorded in it, in each case until the end of the periods stated.

11b. Licence checks for Garry’s Mod addons we sell

We sell our own addons for Garry’s Mod through the gmodstore marketplace (for example “Dossier F4”). To tell whether a copy was lawfully acquired and on how many servers it runs, we process the following data on bspmarket.de.

Download: When you download such an addon through gmodstore, gmodstore sends us your SteamID64, your gmodstore user ID, the product number and the name of the downloaded version. The SteamID64 is also written into your copy.

Licence check: A server running the addon contacts bspmarket.de after start and then every six hours. It transmits the buyer’s SteamID64 written into the copy, the addon version, the server address (IP address and port), the server name and the game mode. We also store the IP address the message came from, the time of the first and the last message, their number and the result of the check. No data about players on these servers is transmitted. If our service cannot be reached, the addon keeps working unchanged.

Purposes and legal bases: We use this to verify the licence and to protect our software against unauthorised distribution and use. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in protecting our copyright and in establishing, exercising and defending legal claims. Towards buyers we additionally rely on Art. 6 (1) (b) GDPR insofar as the processing serves the performance of the licence agreement.

Recipients: Only the bspmarket team sees this data. If the same SteamID64 is linked to a bspmarket account, the team also sees that link. The data is not passed on to third parties; for hosting see section 3.

Storage period: We automatically delete the messages from servers 400 days after the last message. The licence record (SteamID64, product, status, times of downloads) is kept for as long as the licence exists.

12. Leak protection: reports, analysis and case handling

Creators can report that a product is being distributed without authorisation (“Report leak”). In doing so, we process the details of the report (link to the location found, description, reporting creator, time) and, where applicable, an uploaded map file.

An uploaded file is automatically checked on our server for the buyer fingerprint and for a match with delivered copies. The file is deleted immediately after the check; its hash value, file name, file size and the check result are retained. If the file can be assigned to a delivery, we link the case to the relevant order and the buyer account.

The reporting creator only receives a pseudonymous reference and the confidence level of the assignment, but not the name, username or any other data of the buyer. Only the bspmarket team can see the assignment to the buyer account. Measures such as blocking further downloads of the affected copy are taken by the team after its own review; no automated decision within the meaning of Art. 22 GDPR takes place. The block can be lifted if the suspicion is not confirmed. For each case we keep a log of status changes, messages and internal notes.

Creators can also restore an earlier, already approved product version or temporarily pause new downloads; these actions are logged with the time, reason and acting account.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interests and those of the creators lie in protecting digital content against unauthorised redistribution, in investigating licence infringements and in the establishment, exercise and defence of legal claims. Insofar as the assignment concerns buyers, the processing is at the same time necessary for the performance of the licence contract (Art. 6 (1) (b) GDPR).

Closed cases are automatically deleted at the end of the third calendar year following the year in which they were closed. This corresponds to the regular limitation period.

13. Automatic monitoring of public sources

In order to detect leaks at an early stage, we regularly (currently every six hours) compare the map names of published products with publicly accessible information. For this purpose, we query the public list of Garry's Mod servers and the Steam Workshop via the Steam Web API of Valve Corporation, 10400 NE 4th St, Bellevue, WA 98004, USA. In these requests we only transmit map names and our API key, no data of our users.

From the results we store for each finding: for servers, the public server address (IP address and port), the server name, the map being played and the number of players; for Workshop items, the Workshop ID, the title, the link and the public Steam ID of the uploading account. This information may relate to server operators or Workshop authors. The affected creator sees the findings in their account and can open a leak case from them (section 12).

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in protecting the content offered on bspmarket.de against unauthorised distribution. We process exclusively information that the data subjects have made public themselves. Findings are automatically deleted twelve months after they were last seen, unless they are part of a leak case; logs of the monitoring runs after 90 days. Data subjects may object to the processing under Art. 21 GDPR.

Registered servers of buyers: In their library, buyers can register up to three of their own server addresses (IP address or host name with port) for a purchased product. We use them exclusively to label monitoring findings on these servers for the creator with the note “Stated by a buyer as their own server”. The creator only sees this note and how many buyers stated the same address, but not which buyers. The legal basis is Art. 6 (1) (b) GDPR (voluntary function relating to the licence contract). The entries are deleted when you remove them, the purchase is refunded or your account is deleted.

14. Reviews, comments, reports and DSA/abuse procedures

When users post reviews, comments, reports or other content, we process the entered content, account data, timestamps, affected products, processing status, moderation decisions and communication data.

The purposes are platform communication, quality assurance, reporting and reviewing illegal content, abuse prevention, enforcement of platform rules and compliance with legal obligations. The legal bases are Art. 6 (1) (b), (c) and (f) GDPR.

15. Support and communication

When users contact us, we process the data provided, contact data, message content, attachments, account data, order/product references and processing notes. The purposes are handling the request, contract performance, evidence, quality assurance and abuse prevention.

The legal bases are Art. 6 (1) (b), (c) and (f) GDPR.

16. Recipients and processors

Personal data is only transmitted to third parties where necessary or legally permitted. Recipients are in particular Hetzner Online GmbH as hosting provider (processor, section 3), Stripe as payment service provider (sections 9 and 11a) and Discord and Valve (Steam) as external login and platform services respectively (sections 5, 7 and 13). Discord also receives the webhook notifications requested by the creator, without buyer data (section 10); Google/YouTube only receives data when you start an embedded video (section 4). In addition, tax advisers, legal advisers, authorities and courts may be recipients in individual cases, insofar as this is required by law or necessary for enforcing legal claims. We send e-mails ourselves from our server; we do not use an external e-mail service provider. E-mails are delivered to the mail server of the respective recipient.

Where service providers process personal data on our behalf, we conclude the necessary data processing agreements. Where third parties act on their own responsibility, their privacy information additionally applies.

17. Third-country transfers

When using external services, in particular Discord (including webhook notifications for creators), Steam, Stripe and YouTube, processing may take place in countries outside the European Union or the European Economic Area. In the Steam Web API queries for leak monitoring (section 13), we do not transfer any personal data of our users to the USA. Where necessary, providers base such transfers on adequacy decisions, standard contractual clauses or other legally provided safeguards.

18. Storage period

We store personal data only for as long as necessary for the respective purposes or as legally required. Decisive factors are in particular contract performance, licence duration, statutory retention periods, tax and commercial law obligations, limitation periods, security interests and ongoing disputes.

Account deletion requests are generally reviewed and processed within 48 hours. Complete deletion of individual data may be excluded where statutory retention obligations, open contracts, payment records, licence records, security interests or legal claims prevent it.

19. Data subject rights

Subject to the statutory conditions, data subjects have the following rights:

• information about the personal data processed,
• rectification of inaccurate data,
• erasure of personal data,
• restriction of processing,
• data portability,
• objection to processing based on legitimate interests,
• withdrawal of consent given, with effect for the future,
• complaint to a data protection supervisory authority.

A message to kontakt@bspmarket.de is sufficient to exercise these rights.

20. Right to complain to the supervisory authority

Data subjects may complain to a data protection supervisory authority. The authority likely responsible for us is:

Data subjects may also contact any other competent data protection supervisory authority.

21. Security

We take technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and unauthorised disclosure. These include in particular exclusively encrypted transmission (HTTPS with HSTS), encrypted storage of sensitive details such as e-mail addresses, access and payout data, hashed IP addresses in logs, a role and permission concept, virus scanning of uploaded files, short-lived one-time links for downloads, a firewall with protection against login attacks, automatic security updates of the server, daily database backups, DKIM-signed e-mails and the removal of metadata from uploaded images.

22. Minors

The platform is not specifically aimed at children. Minors may only use the platform where legally permitted and where the required consent of a legal guardian is present. We reserve the right to block accounts or request evidence if there are doubts about the permissibility of use.

23. Changes to this privacy policy

We may amend this privacy policy if platform functions, data processing, the legal situation or technical processes change. The version available on the platform at the relevant time applies.