Privacy Policy

1. Controller

The controller responsible for processing your personal data is:

Good Game GmbH
Mathildenstraße 15a
45130 Essen
Germany

Represented by the Managing Directors: Jan Peters and Julian Sakowski
Email: contact@goodgame.gmbh
Commercial register: Amtsgericht Essen, HRB 37920

Data Protection Officer: Good Game GmbH is not legally required to appoint a Data Protection Officer under § 38 BDSG. For any privacy-related matter, please contact us at the address above.

2. What Data We Collect and Why

a) Server log files

When you visit our websites, our hosting provider automatically collects technical data that your browser transmits, including:

• IP address
• Date and time of the request
• Browser type and version
• Operating system
• Referrer URL (the page you came from)
• Pages accessed on our site

Purpose: to deliver the website reliably, ensure its stability, and protect it against misuse and attacks.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in the secure and stable operation of our website).
Retention: Log data is deleted after 7 days, unless a security incident requires longer retention.

b) Contact data

When you reach out to us by email (contact@goodgame.gmbh), we process the information you provide — typically your name, email address, company, and the content of your message.

Purpose: to respond to and process your inquiry. Where your inquiry relates to a potential business relationship, the data is also processed to take steps prior to entering into a contract.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and/or Art. 6(1)(f) GDPR (our legitimate interest in responding to inquiries).
Retention: We keep your message for as long as needed to handle your request. Where correspondence is subject to statutory retention obligations under commercial or tax law (§ 257 HGB, § 147 AO), it is retained for the legally prescribed period (generally 6 to 10 years).

3. Cookies and Local Storage

We do not use tracking, advertising, or analytics cookies.

We use your browser's local storage solely to remember your display preferences — specifically your theme (light/dark) and language selection. This information remains on your device, is not transmitted to us, and is used only to provide the display settings you have actively chosen.

Because this storage is strictly necessary to deliver functionality you have explicitly requested, it does not require consent under § 25(2) TDDDG. You can delete it at any time through your browser settings.

4. Web Analytics — Google Analytics 4

Once you have given your consent, we use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

What it processes

GA4 records how visitors use our websites — for example, the pages you view, how long you stay, your approximate location (derived from your IP address), your device and browser type, and specific interactions. This includes an event we record when you click the demo-booking button ("appointment_booked"). GA4 assigns your browser a pseudonymous identifier (client ID) and stores it, together with the data above, using cookies (e.g. _ga and _ga_<id>). GA4 does not log or permanently store your full IP address; it is used only briefly to determine coarse location and is then discarded.

Purpose

To understand how our websites are used and to improve their content, structure, and performance.

Legal basis

Your consent — Art. 6(1)(a) GDPR and § 25(1) TDDDG. GA4 is loaded only after you consent, and you can withdraw your consent at any time with effect for the future (see Section 3). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Recipients and international transfer

Google processes this data on our behalf as a processor. Data may be transferred to and processed by Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of data protection (see also Section 6).

Retention

GA4 retains user- and event-level data for the period configured in our account (by default, between 2 and 14 months), after which it is automatically deleted.

How to opt out

Besides declining or withdrawing consent through our cookie banner, you can install Google's browser add-on to prevent GA from collecting data: https://tools.google.com/dlpage/gaoptout. Google's handling of data is described in its privacy policy: https://policies.google.com/privacy.

5. External Services and Recipients

We do not sell your personal data. Data is shared only in the following cases.

a) Hosting (Lovable)

Our websites are hosted on the Lovable platform, operated by Lovable Labs Incorporated, 1111B South Governors Avenue, Dover, DE 19904, USA (EU representative: Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden). Lovable processes the server log data described in Section 2(a) on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR. Lovable maintains a current list of its subprocessors at lovable.dev/subprocessors.

Lovable offers regional data hosting, and our project is configured to store data in the EU region, so visitor data is stored within the EU/EEA. As Lovable's contracting entity (Lovable Labs Incorporated) is incorporated in the United States, any access to or transfer of data outside the EU/EEA is safeguarded by the measures described in Section 6.

b) Demo booking (Google Calendar)

Our websites include a link to book a demo. This is a plain hyperlink that opens a Google appointment scheduling page (Google Calendar) in a new browser tab, operated by Google Ireland Limited / Google LLC. No data is transmitted to Google through this link until you actively click it and interact with the page on Google's own platform.

When you book a demo there, the data you enter (such as your name, email address, and the chosen time slot) is processed by Google as part of providing the scheduling service. This may involve a transfer of data to servers in the United States. Google participates in the EU-U.S. Data Privacy Framework and/or relies on Standard Contractual Clauses as a safeguard for such transfers.

Google's processing of your data is governed by Google's own privacy policy: https://policies.google.com/privacy.

Legal basis for offering and your use of the booking option: Art. 6(1)(b) GDPR (steps prior to a contract) and Art. 6(1)(f) GDPR (legitimate interest in offering a convenient way to schedule a demo).

c) Legal disclosure

We may disclose personal data where we are legally obliged to do so, for example in response to a lawful request from a public authority.

6. International Data Transfers

Where personal data is transferred to recipients outside the EU/EEA (for example, in connection with Google as described above, or any non-EU subprocessor used by our hosting provider), we ensure an adequate level of protection through an adequacy decision of the European Commission, the EU-U.S. Data Privacy Framework, or EU Standard Contractual Clauses.

7. How Long We Keep Your Data

We store personal data only for as long as necessary for the purposes described in this Policy, or for as long as we are required to retain it under statutory obligations. Specific retention periods are noted in the relevant sections above. Once the purpose no longer applies and no legal retention obligation remains, the data is deleted.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interest (Art. 21 GDPR)
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interests, you have the right to object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing serves to establish, exercise, or defend legal claims.

Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2-4
40213 Düsseldorf
Phone: 0211 / 38424-0
Email: poststelle@ldi.nrw.de
Website: www.ldi.nrw.de

To exercise any of these rights, please contact us at contact@goodgame.gmbh.

9. Contact

For any questions about this Privacy Policy or to exercise your rights:

Good Game GmbH
Mathildenstraße 15a, 45130 Essen, Germany
Email: contact@goodgame.gmbh

10. Changes to This Policy

We may update this Privacy Policy to reflect changes to our services or to legal requirements. The current version always applies.

Last updated: 12 June 2026