Privacy Policy

Preamble

With this privacy policy we would like to inform you which types of your personal data (hereinafter also referred to as "data") we process, for which purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the course of providing our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offering").

The terms used are not gender-specific.

Last updated: 6 November 2026

This is an English translation of the German Datenschutzerklärung. In case of doubt, the German version prevails.

Controller

Johannes Krüger
c/o der-Bierbaron
Breite Str. 8
16225 Eberswalde
Germany

Email: [email protected]

Data protection requests can also be addressed to the operator, who appears online and in the Bierbaron app under the pseudonym "MrUnknownDE", via the Discord server "Der Bierbaron".

Legal notice: https://der-bierbaron.de/en/legal-notice.html

Overview of Processing Operations

The following overview summarizes the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of Data Processed

Inventory data (e.g. Discord ID, display name, profile picture, freely chosen app username).
Employee data.
Contact data.
Content data (e.g. recipes, drinks, photos, cheers messages).
Usage data (e.g. drink statistics, page views).
Meta, communication and procedural data.
Log data.
Health data (special category, Art. 9 GDPR): heart rate and blood alcohol value, only after active setup in the app.

Categories of Data Subjects

Service recipients and clients.
Employees.
Users (website visitors, users of the Bierbaron app and the community features).
Third parties.
Whistleblowers.

Purposes of Processing

Security measures.
Provision of our online offering and user-friendliness.
Information technology infrastructure.
Whistleblower protection.
Display of live statistics, community features (recipes, drinks, photos, cheers messages) and login via Discord.
Moderation and protection against abuse.
Audience measurement.

Relevant Legal Bases

Relevant legal bases under the GDPR: The following is an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country of residence or in ours. Should more specific legal bases apply in individual cases, we will inform you of them in this privacy policy.

Consent (Art. 6(1)(1)(a) GDPR) - The data subject has given consent to the processing of their personal data for one or more specific purposes.
Explicit consent to the processing of special categories of personal data (Art. 9(2)(a) GDPR) - The data subject has given explicit consent to the processing of their health data (here: heart rate and blood alcohol value) for one or more specified purposes.
Performance of a contract (Art. 6(1)(1)(b) GDPR) - The processing is necessary for the performance of a contract to which the data subject is party, or for the implementation of pre-contractual measures. This includes providing the functions requested by the data subject (e.g. login, recipes, cheers, statistics).
Legal obligation (Art. 6(1)(1)(c) GDPR) - The processing is necessary for compliance with a legal obligation to which the controller is subject.
Legitimate interests (Art. 6(1)(1)(f) GDPR) - The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests, fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. These include in particular the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, transmission and automated individual decision-making, including profiling. In addition, state data protection laws of the individual German states may apply.

Security Measures

In accordance with the statutory requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input, disclosure, availability and separation of the data. We have also established procedures to ensure the exercise of data subject rights, the deletion of data and responses to data compromise. Furthermore, we take the protection of personal data into account already during the development and selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.

Shortening of IP addresses: Where IP addresses are processed by us or by the service providers and technologies we use, and the processing of a full IP address is not necessary, the IP address is shortened (also referred to as "IP masking"). In this process, the last digits or the last part of the IP address are removed or replaced by placeholders. Shortening the IP address is intended to prevent, or significantly impede, the identification of a person on the basis of their IP address.

Securing online connections with TLS/SSL encryption (HTTPS): To protect the data of users transmitted via our online services against unauthorized access, we rely on TLS/SSL encryption. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user's browser (or between two servers), protecting the data from unauthorized access. TLS, as the more advanced and more secure version of SSL, ensures that all data transmissions meet the highest security standards. If a website is secured by an SSL/TLS certificate, this is indicated by HTTPS in the URL. This serves as an indicator for users that their data is transmitted securely and in encrypted form.

Transfer of Personal Data

In the course of our processing of personal data, it happens that data is transmitted to or disclosed to other bodies, companies, legally independent organizational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content embedded in a website. In such cases, we observe the statutory requirements and in particular conclude corresponding contracts or agreements with the recipients of your data that serve to protect your data.

Data transfer within the organization: We may transmit personal data to other departments or units within our organization or grant them access to it. Where the data is passed on for administrative purposes, this is based on our legitimate business interests, or takes place where necessary to fulfil our contractual obligations, or where the data subjects have consented or a legal permission exists.

International Data Transfers

Data processing in third countries: If we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if this happens in the context of the use of third-party services or the disclosure or transmission of data to other persons, bodies or companies (which is apparent from the postal address of the respective provider or if the privacy policy expressly refers to the data transfer to third countries), this always takes place in accordance with the statutory requirements.

For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which was recognized as a safe legal framework by an adequacy decision of the EU Commission of 10 July 2023. In addition, we have concluded standard contractual clauses with the respective providers, which comply with the requirements of the EU Commission and set out contractual obligations to protect your data.

This twofold safeguard ensures comprehensive protection of your data: the DPF forms the primary level of protection, while the standard contractual clauses serve as additional security. Should changes occur within the DPF, the standard contractual clauses act as a reliable fallback. In this way we ensure that your data remains adequately protected even in the event of political or legal changes.

For the individual service providers, we inform you whether they are certified under the DPF and whether standard contractual clauses are in place. Further information on the DPF and a list of certified companies can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/.

For data transfers to other third countries, corresponding safeguards apply, in particular standard contractual clauses, explicit consent or legally required transfers. Information on third-country transfers and applicable adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with the statutory provisions as soon as the underlying consents are withdrawn or no further legal bases for the processing exist. This applies to cases in which the original purpose of processing no longer applies or the data is no longer needed. Exceptions apply if statutory obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal prosecution or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that applies specifically to certain processing operations.

Where several retention periods or deletion periods are stated for a data item, the longest period always applies. Data that is no longer retained for the originally intended purpose but because of statutory requirements or other reasons is processed by us exclusively for the reasons that justify its retention.

Retention and deletion of data: The following general periods apply to retention and archiving under German law:

10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheet and the working instructions and other organizational documents necessary to understand them (Section 147(1) no. 1 in conjunction with (3) AO, Section 14b(1) UStG, Section 257(1) no. 1 in conjunction with (4) HGB).
8 years - Accounting vouchers, such as invoices and expense receipts (Section 147(1) nos. 4 and 4a in conjunction with (3) sentence 1 AO and Section 257(1) no. 4 in conjunction with (4) HGB).
6 years - Other business documents: received commercial or business letters, copies of sent commercial or business letters, other documents insofar as they are relevant for taxation, e.g. hourly wage slips, operating accounting sheets, calculation documents, price labels, but also payroll documents insofar as they are not already accounting vouchers, and cash register receipts (Section 147(1) nos. 2, 3, 5 in conjunction with (3) AO, Section 257(1) nos. 2 and 3 in conjunction with (4) HGB).
3 years - Data necessary to take potential warranty and damage claims or similar contractual claims and rights into account, and to process related inquiries, based on previous business experience and customary industry practice, is stored for the duration of the regular statutory limitation period of three years (Sections 195, 199 BGB).

Start of period at the end of the year: If a period does not expressly start on a specific date and is at least one year long, it automatically starts at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in the context of which data is stored, the event triggering the period is the time at which notice of termination or other termination of the legal relationship takes effect.

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject you have various rights under the GDPR, arising in particular from Articles 15 to 21 GDPR:

Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
Right of access: You have the right to request confirmation as to whether data concerning you is being processed, and to access to this data as well as further information and a copy of the data in accordance with the statutory requirements.
Right to rectification: In accordance with the statutory requirements, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
Right to erasure and restriction of processing: In accordance with the statutory requirements, you have the right to request that data concerning you be erased without delay or, alternatively, to request restriction of the processing of the data.
Right to data portability: You have the right to receive the data concerning you which you have provided to us in a structured, commonly used and machine-readable format in accordance with the statutory requirements, or to request its transmission to another controller.
Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Provision of the Online Offering and Web Hosting

We process users' data in order to be able to provide our online services to them. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

Types of data processed: Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved); log data (e.g. log files concerning logins or the retrieval of data or access times).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing and legitimate interests: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); security measures.
Retention and deletion: Deletion in accordance with the information in the section "General Information on Data Storage and Deletion".
Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services:

Provision of the online offering on own/dedicated server hardware: To provide our online offering we use server hardware operated by us, as well as the associated storage space, computing capacity and software; legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).
Collection of access data and log files: Access to our online offering is logged in the form of so-called "server log files". Server log files may include the address and name of the web pages and files accessed, date and time of access, data volumes transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. Server log files can be used on the one hand for security purposes, e.g. to avoid server overload (especially in the case of abusive attacks, so-called DDoS attacks), and on the other hand to ensure the load and stability of the servers; legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is necessary for evidentiary purposes is excluded from deletion until the respective incident has been finally resolved.
Content delivery network: We use a "content delivery network" (CDN). A CDN is a service that helps to deliver content of an online offering, in particular large media files such as graphics or program scripts, faster and more securely by means of regionally distributed servers connected via the internet; legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).
Cloudflare (CDN, reverse proxy and security service): The essential part of our online offering is provided via the infrastructure of the provider Cloudflare. Cloudflare acts as an upstream reverse proxy ("Cloudflare Shield") between visitors and our systems: all user requests are first routed to Cloudflare's servers and from there passed on to our downstream infrastructure (internal load balancing and web application). Static web pages are delivered via the "Cloudflare Pages" service. Cloudflare provides content delivery network functions (accelerated delivery of content via regionally distributed servers) as well as security functions, in particular protection against overload and abuse attacks (including DDoS attacks), a web application firewall (WAF) and TLS/SSL encryption. To provide these services, Cloudflare processes technically necessary data, in particular the users' IP address, information on the browser and operating system used, the requested content (URLs) and the time and extent of the accesses. This processing is necessary to deliver the content to the users' browser, to ensure the availability and stability of our online offering and to ward off attacks; service provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR); website: https://www.cloudflare.com; privacy policy: https://www.cloudflare.com/privacypolicy/; basis for third-country transfers: Data Privacy Framework (DPF), standard contractual clauses. Data processing agreement: https://www.cloudflare.com/cloudflare-customer-dpa/.

Plug-ins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may be, for example, graphics, videos or maps (hereinafter uniformly referred to as "content").

The integration always requires that the third-party providers of this content process the users' IP address, since without the IP address they could not send the content to the users' browsers. The IP address is therefore necessary for the display of this content or these functions. We endeavor to use only content whose respective providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also called "web beacons") for statistical or marketing purposes. Pixel tags can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the users' device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and further information about the use of our online offering, but may also be combined with such information from other sources.

Notes on legal bases: Where we ask users for their consent to the use of third-party providers, the legal basis for the data processing is that consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context we also refer you to the information on the use of cookies in this privacy policy.

Types of data processed: Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing and legitimate interests: Provision of our online offering and user-friendliness.
Retention and deletion: Deletion in accordance with the information in the section "General Information on Data Storage and Deletion". Storage of cookies for up to 2 years (unless stated otherwise, cookies and similar storage methods may be stored on users' devices for a period of two years).
Legal bases: Consent (Art. 6(1)(1)(a) GDPR). Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services:

Integration of third-party software, scripts or frameworks (e.g. jQuery): We integrate software into our online offering which we retrieve from servers of other providers (e.g. function libraries that we use for the presentation or user-friendliness of our online offering). The respective providers collect the users' IP address and may process it for the purposes of transmitting the software to the users' browser as well as for security purposes and for the evaluation and optimization of their offering; legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).
Google Fonts (retrieval from Google server): Retrieval of fonts (and icons) for the purpose of a technically secure, maintenance-free and efficient use of fonts and icons with regard to up-to-dateness and loading times, their uniform presentation and consideration of possible licensing restrictions. The user's IP address is disclosed to the provider of the fonts so that the fonts can be made available in the user's browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted that is necessary for providing the fonts depending on the devices used and the technical environment. This data may be processed on a server of the font provider in the USA. When visiting our online offering, users' browsers send their browser HTTP requests to the Google Fonts Web API (i.e. a software interface for retrieving fonts). The Google Fonts Web API provides users with the Cascading Style Sheets (CSS) of Google Fonts and subsequently the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the respective user to access the internet, (2) the requested URL on the Google server and (3) the HTTP headers, including the user agent describing the browser and operating system versions of website visitors, as well as the referrer URL (i.e. the web page on which the Google font is to be displayed). IP addresses are neither logged nor stored on Google servers and are not analyzed. The Google Fonts Web API logs details of the HTTP requests (requested URL, user agent and referrer URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families for which the user wants to load fonts. This data is logged so that Google can determine how often a particular font family is requested. For the Google Fonts Web API, the user agent must adapt the font generated for the respective browser type. The user agent is primarily logged for debugging and used to generate aggregated usage statistics that measure the popularity of font families. These aggregated usage statistics are published on the Google Fonts "Analytics" page. Finally, the referrer URL is logged so that the data can be used for production maintenance and an aggregated report on top integrations based on the number of font requests can be generated. According to Google, it does not use any of the information collected by Google Fonts to create profiles of end users or to serve targeted ads; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR); website: https://fonts.google.com/; privacy policy: https://business.safety.google/privacy/; basis for third-country transfers: Data Privacy Framework (DPF). Further information: https://developers.google.com/fonts/faq/privacy.

Bierbaron Live Server

The Bierbaron Live Server shows live statistics of users of the Bierbaron app: drink quantities and, optionally, heart rate and blood alcohol value. It also includes a community page (recipes, drinks, photos) and cheers messages between users. The infrastructure is operated by the controller alone. Technical service providers are Discord (login, notifications) and Cloudflare (delivery of the site, storage for images).

Types of data processed: Inventory data (Discord ID, display name, profile picture, freely chosen app username); content data (recipes, drinks, photos, cheers messages); usage data (drink statistics); health data (heart rate, blood alcohol value); meta, communication and procedural data and log data (IP addresses, time stamps).
Data subjects: Users of the Bierbaron app, visitors of the live page, logged-in visitors and the moderation team.
Service providers: Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA (https://discord.com/privacy); Cloudflare, Inc. (see section "Provision of the Online Offering and Web Hosting").

Discord Login and Cookies

There are two types of login. Both use the Discord service and request only your Discord ID, display name and profile picture from Discord (scope "identify"). Your email address and your server list are not requested. The access token issued by Discord is not stored after login. There is no password.

Visitor login (voluntary): It enables cheers messages under your Discord name and the submission of recipes, drinks and photos. For this purpose two cookies are set, each valid for 7 days: a signed login cookie and a display cookie with your name and profile picture. The profile picture is stored as a reduced copy (128 pixels) at Cloudflare so that it remains visible even if you change it at Discord.
Team login (admins and moderators only): A signed session cookie (7 days) is set. The team is registered by Discord ID. Moderation actions are logged with the name and ID of the acting person in order to make them traceable.
Logging out: "Log out" deletes all login cookies.
Language cookie: In addition, a cookie storing your language setting (1 year) is set, which has no personal reference.
Legal bases: Performance of a contract or use of the requested function (Art. 6(1)(1)(b) GDPR); for the team login and the logging of moderation actions additionally legitimate interests in security and traceability (Art. 6(1)(1)(f) GDPR). The cookies are required for the respective requested function or for storing the language setting.
Retention and deletion: Cookies expire after the stated duration or are deleted when you log out. The profile picture copy and display name remain stored for as long as they are linked to your published contributions. On request we delete your data (see "Data subject rights for the Live Server").

Connection of the Bierbaron App and Live Data

The Bierbaron app connects to the Live Server in encrypted form (HTTPS/WebSocket) and logs in under a freely chosen username. This name is a pseudonym. It is not linked to Discord and is not verified. Please choose a name that does not allow conclusions about your person if you do not want that.

Live data: Heart rate, current drink count and blood alcohol value are only displayed and not stored permanently. They are gone after a server restart. The blood alcohol value is additionally deleted immediately when the app disconnects or withdraws the value.
Permanently stored data: Only drink and kilometer statistics under the chosen username (drink, amount in ml, time).
Private groups: Members of private groups do not appear in public lists, in the VRChat interface or in the blood alcohol average. Their live values are visible only within the group.
Cloud backup: The app can upload backup data. The server does not evaluate its content. Access is protected by a token.
Legal bases: Performance of a contract or use of the requested function (Art. 6(1)(1)(b) GDPR); for heart rate and blood alcohol value consent (Art. 6(1)(1)(a) and Art. 9(2)(a) GDPR), see next section.
Retention and deletion: Statistics and backups remain stored until they are deleted at your request or by us once they are no longer necessary for the purpose. There is currently no automatic deletion after a fixed period. For live data see above.

Health Data (Heart Rate and Blood Alcohol) and Consent

Heart rate and blood alcohol value are health data within the meaning of Art. 9 GDPR. We process them exclusively on the basis of your explicit consent.

How consent is given: By actively setting up the "heart rate" or "blood alcohol" function in the Bierbaron client. Without this setup the values are not transmitted.
Who can see the values: Visitors of the public live page; members of private groups see the values only within the group.
Voluntariness and withdrawal: Consent is voluntary and can be withdrawn at any time with effect for the future. To do so, deactivate the function in the app. The live values are then no longer displayed and are removed immediately. The lawfulness of the processing carried out before the withdrawal remains unaffected. You can also declare the withdrawal by email or via the Discord server.
Storage: These values are not stored permanently (see "Connection of the Bierbaron App and Live Data").
Note: Since the values can be publicly visible, you should only activate the function if you agree that others can see your values under your pseudonym.

IP Addresses, Server Logs and Block List

The IP address is used (via Cloudflare) for rate limiting, protection against abuse and moderation. Server logs contain, among other things, IP addresses when a connection is established. They are retained for 30 days and then deleted. IP addresses are stored permanently only if someone is blocked for abuse (block list and moderation log).

Legal bases: Legitimate interests in security and protection against abuse (Art. 6(1)(1)(f) GDPR).

Cheers Messages

The message, the sender name, where applicable the address of the profile picture and the recipient are stored. A spam filter evaluates messages automatically. It stores only word counts, not the messages themselves. Messages identified as requiring moderation are reviewed by the moderation team, which approves or rejects them.

Legal bases: Performance of a contract or use of the requested function (Art. 6(1)(1)(b) GDPR); spam filter and moderation: legitimate interests in security and protection against abuse (Art. 6(1)(1)(f) GDPR).
Retention and deletion: The message history remains stored until deleted. There is currently no fixed automatic deletion period. On request we delete your messages.

User Recipes, Drinks and Photos

Recipes and drinks: For the author, the Discord ID, display name and profile picture are stored. The recipe, display name and profile picture are publicly visible, not the Discord ID. New and edited entries are published only after review by the moderation team. You can delete your own recipes yourself.
Photos: Uploading is possible only after login. The original is never stored. The server converts the image into reduced variants and removes EXIF and GPS metadata in the process. A moderator reviews the photo before publication. Rejected photos are deleted completely. Please do not upload photos in which third parties are recognizable without their consent.
Legal bases: Performance of a contract or use of the requested function (Art. 6(1)(1)(b) GDPR).
Retention and deletion: Until deletion by you or the moderation team, or until the data is no longer necessary for the purpose.

Notification of the Moderation Team (Discord Webhook)

The moderation team receives internal notifications via Discord when a cheers message has been identified as requiring moderation or when a new or changed recipe, a new drink or a photo has been submitted for review. The notifications go only to an internal moderation channel and are not public. They may contain the content of the submission and the name of the submitter.

Legal bases: Legitimate interests in moderation and protection against abuse (Art. 6(1)(1)(f) GDPR).

Legal Bases, Recipients and Data Subject Rights for the Live Server

Heart rate and blood alcohol (health data): Consent, Art. 6(1)(1)(a) and Art. 9(2)(a) GDPR.
Discord login, cheers, recipes, drinks, photos, statistics: Performance of a contract or use of the requested function, Art. 6(1)(1)(b) GDPR.
IP addresses, logs, block list, spam filter, moderation: Legitimate interests in security and protection against abuse, Art. 6(1)(1)(f) GDPR.
Recipients: Discord (login, webhook notification) and Cloudflare (delivery, image storage). Both companies are based in the USA. The Data Privacy Framework and/or EU standard contractual clauses apply to the transfer (see "International Data Transfers").
Data subject rights: You can exercise your rights of access, rectification, erasure, restriction, objection, data portability and withdrawal of consent towards the operator by email to [email protected] or via the Discord server "Der Bierbaron". You can also delete your own recipes yourself. You also have the right to lodge a complaint with a data protection supervisory authority (see "Rights of Data Subjects").

Audience Measurement (Matomo)

We use the software Matomo for the statistical evaluation of the use of our online offering. Matomo is operated on a server run by us (matomo.mrunk.de). The data is not passed on to third parties. In particular, the pages accessed, time stamps, browser and device information, the referring page and the IP address are processed. Matomo may use cookies to recognize returning visitors.

Recording of accesses by AI crawlers: In addition, our delivery infrastructure (Cloudflare Pages Function) detects accesses by known AI crawlers on the basis of the user agent and reports them server-side to Matomo (accessed URL, user agent, HTTP status). No visitor sessions are created in the process.

Types of data processed: Usage data (e.g. page views, duration of visit, device and browser information); meta, communication and procedural data (e.g. IP addresses, time stamps).
Data subjects: Website visitors.
Purposes of processing: Audience measurement, improvement of the online offering.
Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).
Objection: You can object to the processing at any time (see "Rights of Data Subjects"), for example by email to [email protected].

Changes and Updates

We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Where we state addresses and contact information of companies and organizations in this privacy policy, please note that addresses may change over time, and please verify the information before contacting them.

Definitions of Terms

This section provides an overview of the terms used in this privacy policy. Where the terms are defined by law, their statutory definitions apply. The following explanations, by contrast, are intended primarily to aid understanding.

Employees: Employees are persons who are in an employment relationship, whether as staff, salaried employees or in similar positions. An employment relationship is a legal relationship between an employer and an employee, established by an employment contract or agreement. It includes the employer's obligation to pay remuneration while the employee performs their work. Employee data is all information relating to these persons in the context of their employment. This covers aspects such as personal identification data, identification numbers, salary and bank data, working hours, vacation entitlements, health data and performance evaluations.
Inventory data: Inventory data comprises essential information required for the identification and management of contractual partners, user accounts, profiles and similar assignments. This data may include personal and demographic details such as names, contact information (addresses, telephone numbers, email addresses), dates of birth and specific identifiers (user IDs). Inventory data forms the basis for any formal interaction between persons and services, institutions or systems by enabling unique assignment and communication.
Content data: Content data comprises information generated in the course of creating, editing and publishing content of all kinds. This category of data may include texts, images, videos, audio files and other multimedia content published on various platforms and media. Content data is not limited to the content itself, but also includes metadata that provides information about the content, such as tags, descriptions, author information and publication dates.
Contact data: Contact data is essential information that enables communication with persons or organizations. It includes, among other things, telephone numbers, postal addresses and email addresses, as well as means of communication such as social media handles and instant messaging identifiers.
Meta, communication and procedural data: Meta, communication and procedural data are categories containing information about how data is processed, transmitted and managed. Meta data, also known as data about data, comprises information describing the context, origin and structure of other data. It can include details on file size, creation date, the author of a document and change histories. Communication data captures the exchange of information between users via various channels, such as email traffic, call logs, messages on social networks and chat histories, including the persons involved, time stamps and transmission paths. Procedural data describes the processes and workflows within systems or organizations, including workflow documentation, transaction and activity logs, as well as audit logs used for tracking and reviewing operations.
Usage data: Usage data refers to information that captures how users interact with digital products, services or platforms. This data covers a wide range of information showing how users use applications, which functions they prefer, how long they stay on certain pages and which paths they take through an application. Usage data can also include frequency of use, time stamps of activities, IP addresses, device information and location data. It is particularly valuable for analyzing user behavior, optimizing user experiences, personalizing content and improving products or services. Usage data also plays a crucial role in identifying trends, preferences and possible problem areas within digital offerings.
Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Log data: Log data is information about events or activities logged in a system or network. This data typically includes information such as time stamps, IP addresses, user actions, error messages and other details about the use or operation of a system. Log data is often used to analyze system problems, for security monitoring or to generate performance reports.
Controller: The "controller" is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processing: "Processing" means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, be it collecting, evaluating, storing, transmitting or deleting.

Created with the free Datenschutz-Generator.de by Dr. Thomas Schwenke