Controller
The controller for the processing of your data on prac.world is pRactiCe c/o RAHFT Management GmbH, Schwalbenweg 15, 15806 Zossen, Germany, email: management@rahft.com. We are not required to appoint a data protection officer. If you have questions about data protection, write to this address.
In short
- You can visit the site without signing in. There is no customer account; in the shop you order as a guest.
- We set no advertising cookies and no tracking pixels. We do not use Google Analytics.
- Videos from YouTube, clips from Twitch and posts from Instagram load only when you click them.
- Fonts, images and videos of the site are hosted on our own server.
- We do not sell data and do not send newsletters.
Visiting the website
Server log files
On every visit our web server stores: your IP address, date and time, the address requested, the amount of data transferred, the status of the response, your browser and operating system and the page you came from (referrer). The website loads its content, for example follower counts, stream schedule, articles, prices and legal texts, through our own interface at api.prac.world. The interface also writes the IP address, time, path requested and response status of every call to a log file.
Purpose: secure operation of the site, troubleshooting and defence against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Storage period: 14 days, then we delete the log files.
Protection against abuse
The interface limits the number of calls per IP address, for example for the contact form, orders and withdrawals. For this it stores your IP address only as a hash value (SHA-256) together with a counter, for at most one day after the last call. Legal basis: Art. 6(1)(f) GDPR.
Hosting
Website and interface run on a server in a data centre in Germany. A technical service provider operates the server for us and processes the data on our behalf (Art. 28 GDPR). All connections to the site are encrypted with TLS (HTTPS).
Content from Twitch, YouTube, Instagram and other platforms
Our server regularly fetches follower counts, stream schedule, live status, videos, clips, Instagram posts, game icons and the donation goal at the bottom of the page from Twitch, YouTube, Instagram, Kick, TikTok, Discord and StreamElements and caches them. Your browser loads them from our server. Visiting the site therefore sends no data about you to these platforms.
The links to our channels on Twitch, YouTube, Instagram, TikTok, Kick and Discord lead to the providers’ sites. The donate button at the bottom of the page leads to pRactiCe’s donation page at StreamElements. Once you are there, the privacy rules of that provider apply.
Bits and subscriptions on Twitch
When you give Bits in the Twitch channel or start, renew, gift or receive a gifted subscription, Twitch reports it to our server. We store your Twitch display name, the kind of support, the number of Bits, tier and number of subscriptions, the number of months, your message and the time. For anonymous Bits and anonymous gift subscriptions we receive no name. Only the pRactiCe team sees the entries in the admin area. They do not appear on the website.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is an overview of the support for the channel. Storage period: 30 days, after that we delete the entries automatically.
Embedded content after a click
In the media library the site loads third-party content only when you click it (two-click solution). Before that it transfers nothing, not even preview images. With the click your browser connects to the provider. The provider receives your IP address and details of your browser, can set its own cookies and evaluate your behaviour, and can link it to your profile if you have an account.
- YouTube videos load via youtube-nocookie.com in privacy-enhanced mode. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google privacy policy.
- Twitch clips load via clips.twitch.tv. Provider: Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA, an Amazon company. Twitch privacy notice.
- Instagram posts: the picture or video loads from Instagram’s servers. Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Instagram privacy policy.
The legal basis is your consent, which you give with the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG). It applies to the content you clicked; on the next page view the site asks again. The providers may transfer data to the USA, see the section “Transfers to countries outside the EU”.
Contact form
Through the form on the page Business & contact we process: name, email address, company (optional), topic, message, time and your IP address. The IP address serves to protect against spam and fraud. The message goes by email to us or to our management, which handles business enquiries. Our interface does not store the message. Your email address is the reply address.
Legal basis: your consent via the checkbox in the form (Art. 6(1)(a) GDPR); for enquiries about an order or a contract Art. 6(1)(b) GDPR; for the IP address Art. 6(1)(f) GDPR. Storage period: until your enquiry is dealt with. Business correspondence that we must keep is deleted after 6 years (§ 257 HGB, German Commercial Code). You can withdraw your consent at any time by email; processing up to the withdrawal remains lawful.
Orders in the shop
Order data
For an order we process: first name, last name, email address, phone number (optional), delivery address, a different billing address if given, country, the articles ordered with size and price, shipping costs, VAT, payment method, language, order number, time and status of the order, for PayPal the identifier of the payment and, when we ship, the carrier and the tracking number. We store the order in our system. Only the people who handle orders for us have access.
Purpose: conclusion and performance of the purchase contract, shipping, payment processing and handling of withdrawals and warranty claims. Legal basis: Art. 6(1)(b) GDPR. Without name, delivery address and email address we cannot fulfil the order. Storage period: we keep order data and order confirmations for 6 years and accounting records for 8 years (§ 257 HGB, § 147 AO, Art. 6(1)(c) GDPR). The period starts at the end of the year in which you ordered. After that we delete the data.
Emails about the order
You receive the order confirmation with the terms and the cancellation policy and, when we ship, a shipping confirmation with the tracking number. A copy of every order confirmation goes to our mailbox for orders. Our interface sends the emails through the mail server of our email provider.
Payment with PayPal
If you choose PayPal, we create a payment at PayPal with the amount and the order number and redirect you to PayPal. You enter your payment details at PayPal; we do not receive them. PayPal tells us whether the payment was made and the identifier of the payment. Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal is itself responsible for the processing of your payment data; the PayPal privacy statement applies. Legal basis: Art. 6(1)(b) GDPR.
Payment by bank transfer
If you transfer the amount, we see your name, your IBAN and the payment reference on our bank statement. We keep these details as an accounting record for 8 years. Legal basis: Art. 6(1)(b) and (c) GDPR.
Shipping
For delivery we pass your name and delivery address to the carrier named on the page Shipping & payment. Legal basis: Art. 6(1)(b) GDPR. Your phone number is optional. If you enter it, we pass it to the carrier so that the carrier can reach you for the delivery. Legal basis: your consent given by entering it (Art. 6(1)(a) GDPR). You can withdraw it at any time by email.
In your browser
The site keeps the contents of your cart in your browser’s local storage. After the order the site remembers name, email address, order number, payment method and delivery time in your browser’s session storage, so that the thank-you page can show them after you return from PayPal. Neither leaves your browser; the browser clears the session storage as soon as you close the tab. Details under Cookies.
Withdrawal via the button “Withdraw from contract”
Through the form on the page Withdrawal we process: name, email address, order number (optional), details of the order (optional), time and your IP address. The withdrawal goes by email to our mailbox for orders. You immediately receive an acknowledgement of receipt by email with the content of your statement and the date and time of its receipt, as § 356a BGB (German Civil Code) requires. Legal basis: Art. 6(1)(b) and (c) GDPR; for the IP address Art. 6(1)(f) GDPR. Storage period: as for the order, 6 years.
Game “Le pRacBerger” and highscore with Twitch sign-in
You can play the game in the media library without signing in. In that case we store nothing about you. If you want to enter the highscore, you sign in with your Twitch account.
Signing in with Twitch
To sign in, the site either shows a code that you approve at Twitch under twitch.tv/activate, or it sends you to the Twitch sign-in page and back. The sign-in itself happens at Twitch; the Twitch privacy notice applies (Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA). We request no special permissions at Twitch and receive from Twitch only your Twitch ID, your login name and your display name. We revoke the Twitch access token immediately after reading them; we do not store it.
What we store
Twitch ID, login name, display name, your best score with its time, every round played while signed in with start, end, points and level, and interim results that the game reports about every 45 seconds. With the interim results we check whether the points match the playing time and the level; this keeps manipulated scores out of the highscore. The site remembers your sign-in with a token in your browser’s local storage; the server holds only a hash of it. The token is valid for one year from its last use. “Log out” deletes it in the browser and ends the sign-in on the server.
Public highscore
The highscore shows every visitor of the site the 20 best players with Twitch display name, score and the level of their best round. If you are signed in, you also see your own rank. We may hide or delete entries from the highscore, for example in the case of manipulation or offensive names.
Legal basis: Art. 6(1)(b) GDPR for taking part in the highscore, which you request by signing in, and Art. 6(1)(f) GDPR for checking the scores and protecting against manipulation. Storage period: the interface deletes interim results of rounds that ended more than 30 days ago automatically. We keep everything else until you ask for deletion. To do so, write to management@rahft.com with your Twitch name; we then delete your player with all rounds and scores.
Cookies and browser storage
We set no cookies ourselves. For the cart, the background setting and the sign-in for the highscore the site uses your browser’s local storage, and for the thank-you page after an order and during the Twitch sign-in the session storage. These entries are technically necessary or arise only from an action you take yourself (§ 25(2) no. 2 TDDDG). All entries with purpose and duration and a button to reset them are under Cookies.
Recipients of your data
We pass on data only as far as the purposes named above require, namely to:
- the technical service provider that operates server, website and interface for us (processor),
- our email provider for sending the emails (processor),
- our management, which handles enquiries from the contact form,
- the carrier for the delivery,
- PayPal for the payment, if you choose PayPal,
- Twitch, if you sign in for the highscore,
- Google, Twitch and Meta, if you click embedded content.
Authorities receive data only if we are legally obliged to provide it.
Transfers to countries outside the EU
Our own systems are located in Germany. A transfer to the USA can take place if you click embedded content, sign in with Twitch or pay with PayPal. Google LLC, Meta Platforms, Inc. and Amazon.com, Inc., to which Twitch belongs, are certified under the EU-US Data Privacy Framework, so an adequacy decision of the European Commission under Art. 45 GDPR applies. In addition, the providers use the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). PayPal transfers data under its own responsibility, see the PayPal privacy statement.
Your rights
You have the right to obtain access to your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR): by email to management@rahft.com.
Right to object: where we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (State Commissioner for Data Protection of Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, email: Poststelle@LDA.Brandenburg.de, www.lda.brandenburg.de.
No automated decisions
We make no decisions based solely on automated processing and create no profiles (Art. 22 GDPR).
Changes
We update this privacy policy when the website or the legal situation changes. The version shown on this page applies. This is a translation of the German privacy policy for your convenience; the German version prevails.