Privacy policy

1. Data controller

2. Hosting the website

The website is hosted through ChatGPT Sites by OpenAI and Cloudflare’s technical infrastructure. Loading pages involves processing technically necessary connection data such as IP address, time, requested URL and browser information.

We host and secure the site based on our legitimate interest in a functioning website under Article 6(1)(f) GDPR. Contractual details, data processing arrangements and specific retention periods of the hosting providers still need to be completed for the final version.

3. Cookies and local storage

We do not currently use our own analytics or marketing services. The language follows the URL you visit. The development stage in the concept preview is also controlled through the URL.

We store your privacy preferences as technically necessary in your browser’s local storage under bsc-privacy-choice for up to six months. You can reopen the Cookie settings at any time or clear your browser storage. The legal basis for necessary storage is Section 25(2) TDDDG.

4. Contact form and email

When you contact us, we process your email address, message, subject and any name you provide to respond to your enquiry. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is handling incoming enquiries.

We use the Brevo transactional email service to deliver contact forms. Data is transmitted server-side only after submission. Our contact address uses Microsoft Outlook.com. Messages are kept for as long as needed to handle the enquiry, subject to statutory retention duties.

Please do not send particularly sensitive information through the form. Provider details, data processing agreements and retention periods for the final delivery service will be added before regular use.

5. External links and content

External links lead to the respective providers’ websites. Embedded videos, maps, calendars or tracking services are not currently loaded automatically. Before activating new content that requires consent, we will identify the provider and purpose and obtain the necessary consent.

6. Your rights

Subject to the applicable legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests. You may withdraw consent at any time for the future and lodge a complaint with a data protection authority.

For questions or to exercise your rights, email bsc-berlin@outlook.de.

7. Member account and optional profile

We use Supabase Auth and a Supabase database hosted in Ireland (EU) for the members area. Supabase processes your email address, authentication and securely hashed password verification values. The community database stores membership status and the profile details you provide: first name, optional last name, locality or town, region and, where applicable, postcode, profile picture, gaming interests, game languages, hosting preference and a short introduction. You can optionally provide external profile identifiers and permission for a later BGG collection import. Passwords are not stored in the community profile table.

After email confirmation, the administrator reviews your community access. You can complete your profile only after approval. The administrator is notified of new confirmed requests; we email you the approval or rejection. Your profile appears only if you opt into the directory. Approved members who are not listed themselves can see only your first name, region and gaming interests. Listed members can also see your picture and the other directory details, with only the initial of your last name. Email addresses do not appear in the directory. You can turn off directory visibility and permission for a later BGG collection import. Profile pictures are stored privately and served through the website only to authorized members.

Signing in uses technically necessary session cookies protected against JavaScript access, with a lifetime of up to seven days. Confirmation and password emails are sent through the configured email delivery service. Signing out ends the local session. To delete your account or ask a privacy question, please use our contact form.

The public profile and directory previews contain fictional examples only. The legal basis, provider contract details and final retention periods for the membership service will be added to this working draft before the regular launch.