Privacidad
This is a translation; the German version is legally binding. Deutsche Fassung
Esta página solo está disponible en alemán e inglés. La versión alemana es la jurídicamente vinculante.
1. Controller
The controller is Michael Obermair, address and phone see legal notice. For questions about data protection, you can reach us at info@rookie-racing.eu.
2. Overview
This website has no analytics or advertising trackers and no social media plugins. Fonts, images and scripts come from our own server. The only exception is the Paddle checkout, which is loaded only after a click on a purchase button (section “Payment through Paddle”). We do not sell data and pass it on only to the parties named here.
3. Hosting and server log files
The website and its database run at ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, as a processor. When a page is requested, the server automatically stores IP address, date and time, requested address, referrer, browser and operating system. This data serves security and troubleshooting (Art. 6(1)(f) GDPR).
To protect against abuse, we count requests to forms and interfaces per IP address for a few minutes in a cache, for example to slow down too many sign-in attempts (Art. 6(1)(f) GDPR).
4. Cookies and browser storage
We only use technically necessary cookies (§ 165(3) TKG 2021, Austrian Telecommunications Act): a session cookie that, for example, links your language choice and your sign-in, and XSRF-TOKEN as protection against forged form requests. The session itself is stored in the database on our server, together with IP address and browser identifier. It expires two hours after the last request and is then deleted, immediately when an account is deleted.
If you choose “Stay logged in” when signing in, we additionally set a cookie that keeps you signed in in this browser for up to 400 days. It ends when you sign out, and a new password invalidates it on other devices.
Your choice between light, dark and auto is stored by your browser in localStorage under “theme”. It stays on your device and is not transmitted to us.
5. The Rookie Overlay program
Telemetry data from your game stays on your PC. With EA SPORTS F1 25, the game sends it over your local network to the PC running the program, also from a console. The program only contacts rookie-overlay.com: at startup and then every 6 hours, to ask whether Pro is locked and whether it should offer sign-in (/api/app/status), and when searching for updates, whether there is a new version (/api/app/update, with its own version number). If you are signed in to the program, it also requests your Pro status and your released designs at the same times (/api/app/me).
These requests also run without an account. Only the update search can be switched off in the settings. The requests contain no identifier, neither for you nor for your PC. Only /api/app/me identifies itself with the access you granted when signing in to the program, otherwise the Pro status could not be assigned. Each request produces the server log data from section 3 (Art. 6(1)(f) GDPR: the program should stay up to date and know the correct status).
To know how often the program is used, we count the update checks. This produces only one number per day and program version: no identifier, no IP address and nothing that can be linked to you or your PC. Nothing is stored on your PC for this. For clicks on “Download installer”, we only count how often this happens per day.
The program’s Twitch features (chat, clips, markers and chat commands) connect directly to Twitch, not through our website. If you sign in to Twitch in the program, this happens between the program and Twitch; we receive nothing from it. Twitch’s privacy policy applies to Twitch.
The program’s YouTube features (chat in the overlay and chat commands) use the YouTube API Services by Google and also connect directly to Google, not through our website. Signing in to Google happens between the program and Google; the program stores the access encrypted on your PC, and we receive nothing from it. The YouTube Terms of Service and the Google Privacy Policy apply. You can disconnect the access in the program or revoke it in your Google account under third-party connections.
The program loads nothing from rookie-racing.eu. It ends an old sign-in from an earlier version there once and deletes it. You can voluntarily link an account of the Rookie Racing League in your profile, see section “Account”.
6. Contact form, messages and bug reports
If you write to us via the contact form, including via “Report a bug” in the program, we store name, email address, subject, message, voluntarily attached screenshots (up to five per message, up to 3 MB each) and, if provided, program version and Windows version. We use this information only to process and answer your request (Art. 6(1)(b) and (f) GDPR). With an account, you can also write to us and reply under “Messages” in your profile. For this, we store the same information, your replies and the time you last opened a conversation, so that we can mark new replies. Only you and our team can see the conversation. You receive emails from us about it. We check messages sent via the contact form and under “Messages” automatically for spam (links, typical advertising terms, time and input while filling in the form), without third-party services. Anything that looks like spam is kept for 30 days for review and then deleted, unless it turns out to be a genuine request (Art. 6(1)(f) GDPR: protection against abuse). We delete closed cases including screenshots when they are no longer needed, at the latest after two years. If you wrote while signed in and later delete your account, we remove name and email address from your cases and conversations; they are then no longer linked to an account.
7. Emails
We send emails via SMTP through the mail server of our host from section 3: confirmation of the email address, links for a new password, replies to cases and messages and, if you have the trial month, a reminder before it ends. We do not send advertising emails or a newsletter.
8. Account
For an account, we store display name, email address and the time it was confirmed, your password only in hashed form (using a one-way method from which the password cannot be recovered), the language at registration, your Pro status and the connected programs (Art. 6(1)(b) GDPR). If an account is blocked or we need notes for your requests, we store an internal note (Art. 6(1)(f) GDPR). You can delete the account yourself at any time in your profile. In doing so, we disconnect all programs, end all sessions and delete the information from this section. We delete accounts whose email address has not been confirmed after seven days.
If you sign in to the program, you grant it access to your account. With it, the program sees your display name, your Pro status and your released designs, never your password. For the access, we store the name of the program and when it was last used. An access ends after 180 days without use, at the latest after one year, and can be disconnected in your profile at any time.
The trial month is available once per email address. So that this also applies after an account is deleted, we store only a hash of the address (a checksum from which the address cannot be read; it can only be compared with a known address) and the date it was granted. We delete both three years after the trial month was granted. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is that nobody receives the free trial month more than once. Three days before the trial month ends, we send one reminder by email, in the language that was set at registration (Art. 6(1)(b) GDPR).
If you link your account with rookie-racing.eu, we store the membership number there, your name, the end of your Hotlap Club membership and an encrypted access, and query this end there daily so that Pro applies here (Art. 6(1)(b) GDPR). You can remove the link in your profile at any time; we then delete this information and end the access at rookie-racing.eu.
Accounts with access to the administration additionally sign in with a second factor. For this, we store an encrypted secret, the last used time step and the recovery codes only as a hash (Art. 6(1)(f) and Art. 32 GDPR).
9. Payment through Paddle
Pro is sold by Paddle.com Market Limited, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom, as reseller (Merchant of Record). Paddle is your contracting party for the purchase, receives the payment, issues the invoice and processes your details in the checkout for this, such as email address, country and payment details, under its own responsibility, including for fraud prevention. Paddle’s privacy policy applies (paddle.com/legal/privacy). There is an adequacy decision of the European Commission for the United Kingdom.
The account page loads the checkout from cdn.paddle.com only when you click a purchase button. From then on, Paddle receives the usual connection data such as IP address and browser. So that the purchase is assigned to your account, we pass Paddle the number of your account with us and your email address (Art. 6(1)(b) GDPR).
From Paddle, we receive only what we need for Pro: customer, subscription and payment number, plan, subscription status with next renewal or end, amount paid with currency and date, as well as refunds and chargebacks (Art. 6(1)(b) GDPR). Invoices and the customer portal for cancelling are fetched from Paddle when you click; they are not stored by us. We keep the payments for accounting, refunds and chargebacks for as long as statutory retention obligations exist, usually seven years (§ 132 BAO, Austrian Federal Fiscal Code). If you delete your account, they are kept without being linked to an account.
10. Backups
We back up the database with the information from these sections daily to prevent data loss (Art. 6(1)(f) GDPR). The backup is created on the server from section 3 and kept there for 14 days.
Once a day, we fetch the backups to our PC, encrypt them there with AES-256 and store only the encrypted copies in our OneDrive storage. OneDrive is a service of Microsoft (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). The copies are kept for 90 days and then deleted. Encryption happens before upload; only we have the key, and Microsoft cannot read the copies. We use a private OneDrive storage; Microsoft may store the data in data centres outside the EU, for example in the USA. Microsoft is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR); since only encrypted copies are transferred, no readable data reaches them.
Deleted data, including a deleted account, remains in the backups until these periods expire. We use them only to restore the database after a failure.
11. Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability. You can object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation. An email to info@rookie-racing.eu is enough. There is no automated decision-making or profiling. If you believe that we are not processing your data lawfully, you can lodge a complaint with the supervisory authority. In Austria, this is the Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.