The following information supplements our general notes and fulfils the information obligations under Art. 13 (1) and (2) GDPR for the processing described there.
1) Processing in the context of voice/video communication (lobby, quiz, comparable game rooms)
• Purposes of processing: provision of the real-time communication you have chosen within the quiz/community offering; technical forwarding and synchronisation of the media streams.
• Legal basis: Art. 6 (1) lit. b GDPR (performance of the user agreement for the platform), to the extent that the use of these features forms part of the contract. Where technically necessary security and integrity measures additionally arise (e.g. protection against misuse of the infrastructure), Art. 6 (1) lit. f GDPR may apply; our legitimate interest lies in secure and stable operation of the platform.
• Categories of personal data: voice data (audio), where applicable image data (video), technical connection and metadata (e.g. timestamps, room/game reference, technical session identifiers), user or participant identifiers.
• Categories of recipients: providers of real-time communication infrastructure (processors), hosting/infrastructure service providers, where necessary for operation.
• Storage period / criteria: real-time transmission; no permanent storage of the voice/image streams for this purpose, unless described under points 2 or 3 below.
2) Processing of user reports and in the moderation procedure
• Purposes: handling a specific report; checking for breaches of these terms of use or applicable law; documentation for carrying out measures (e.g. warning, ban); where applicable cooperation with law enforcement or supervisory authorities, where a legal obligation exists.
• Legal bases (depending on the case):
– Art. 6 (1) lit. b GDPR, where processing is necessary to enforce or perform the user agreement (including enforcement of house rules);
– Art. 6 (1) lit. f GDPR: legitimate interest in detecting and preventing abuse, in the integrity of the platform and the protection of affected users, and in defending against legal claims; balancing of interests: your interests in confidentiality are taken into account; processing is limited to what is necessary for the review;
– Art. 6 (1) lit. c GDPR, where we are legally obliged to store or disclose data.
• Categories of personal data: where applicable audio recordings or excerpts (evidence), automatically generated transcripts (text), user IDs of the reporting and the reported user, game/lobby reference, timestamps, report ID, and any further details you provide about the report.
• Categories of recipients: technical object storage (e.g. an S3-compatible storage system), where applicable a provider of transcription infrastructure (processor), authorised internal bodies (moderation/administration).
• Storage period / criteria (Art. 13 (2) lit. a GDPR): erasure as soon as the data is no longer necessary for handling the specific case, as a rule within 90 days of the moderation case being concluded (conclusion = final decision and implementation of the measure, provided no further review is pending), unless longer retention is required for legal reasons. Longer storage only to the extent necessary and proportionate for the establishment, exercise or defence of legal claims (Art. 17 (3) lit. e GDPR), for compliance with a legal obligation (e.g. an official order, criminal prosecution) or for evidentiary reasons in the case of serious breaches; the duration then follows the respective statutory requirements and the principle of storage limitation (Art. 5 (1) lit. c, e GDPR).
3) Automated analysis (e.g. to support moderation)
Where technical aids (e.g. automatic speech recognition or simple classification) are used, these serve to prepare or prioritise a human or organisational review. A decision based solely on automated processing within the meaning of Art. 22 GDPR that would have legal effect on you without human involvement does not take place; significant measures with noticeable consequences for your account are not based on automated analysis alone.
4) Your rights (cross-reference)
Regarding access, rectification, erasure, restriction, data portability, withdrawal of consent given and objection to processing based on Art. 6 (1) lit. f GDPR, we refer to the section "Rights of data subjects" in this privacy policy and to Art. 21 GDPR (objection on grounds relating to your particular situation, where applicable).
5) Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or the place of the alleged infringement.
