Privacy Policy

Unless otherwise stated below, the provision of your personal data is neither legally nor contractually required, nor necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide it has no consequences. This only applies as long as no other information is provided in the following processing operations. "Personal data" means any information relating to an identified or identifiable natural person.

Server Log Files

You can visit our websites without providing any personal information. Each time you access our website, usage data is transmitted to us or our web host/IT service provider by your internet browser and stored in log data (so-called server log files). These stored data include, for example, the name of the accessed page, the date and time of access, the IP address, the amount of data transferred, and the requesting provider. Processing is carried out on the basis of Art. 6(1)(f) GDPR out of our overriding legitimate interest in ensuring the trouble-free operation of our website and improving our services.

Registration and user account

To use an account we process the data you provide (username, e-mail address, password in hashed form) as well as settings such as language and time zone. The processing serves to provide the account and to perform the contract on the basis of Art. 6(1)(b) GDPR. The data is stored for the duration of the account and deleted after its closure, subject to statutory retention periods.

Sign-in via Discord and Discord bot

You can sign in via Discord (OAuth). We process your Discord ID, your Discord username and your Discord avatar as well as encrypted access tokens in order to link your account and enable sign-in (Art. 6(1)(b) GDPR). The provider is Discord Inc., San Francisco, USA. In addition, our Discord bot can be used on Discord servers that you manage. The respective server owner (the guild) is the controller for the processing of personal data on that Discord server; GuildNest merely provides the bot and processes the data required for its functions (e.g. aggregated activity and attendance statistics) in a data-protection-compliant manner to perform the contract. Any transfer to the USA is based on appropriate safeguards (see the section on transfers to third countries).

Hosting

Our website, the database and further subdomains (including e-mail and blog) are hosted with netcup GmbH on servers in Germany (Nuremberg location). The processing is carried out by the host as a processor on the basis of a data processing agreement and serves the secure, uninterrupted operation (Art. 6(1)(f) GDPR).

File and image storage and content delivery network

Images and files you upload (e.g. profile and bot avatars, banners, guild files) are stored in an object storage (Cloudflare R2). We also use Cloudflare’s content delivery network to deliver content. The provider is Cloudflare, Inc., San Francisco, USA. The processing serves to perform the contract and to ensure secure operation (Art. 6(1)(b) and (f) GDPR); regarding third-country transfers, please see the relevant section.

Cookies and consent management

We use technically necessary cookies or local storage that are required for operation and secure sign-in; no consent is required for these (Section 25(2) TDDDG). No further tracking by third-party analytics or advertising services takes place. To manage cookie settings we use the consent management tool CookieYes.

Public profile and player search (Adventurer Pass)

With the Adventurer Pass you can provide a public profile at a self-chosen address (/u/handle). The information you release (display name, handle, description, linked social profiles, profile picture) is then shown publicly, also visible to visitors who are not signed in, and may be indexed by search engines. The additional discoverability in the player search (Explorer) only takes place after your active consent via an opt-in toggle. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future by disabling the visibility in your profile settings.

Cross-guild analysis (Adventurer Pass)

The Adventurer Pass shows you a cross-guild analysis of your own data (e.g. DKP, attendance, events). This analysis is visible only to you. Other guilds or members do not receive any information about which other guilds you are a member of; a combination of your memberships is not disclosed to third parties. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Contact

Controller:

Riccardo D'Arcangelo
Am Boberg 2, 86554 Pöttmes, Germany
+49 (0) 172 8941743
[email protected]

Customer-Initiated Contact by Email

If you contact us on your own initiative by email, we collect your personal data (name, email address, message text) only to the extent provided by you. Data processing is carried out for the purpose of handling and responding to your contact request. If contact is made for the purpose of carrying out pre-contractual measures (e.g., advice on purchase interest, preparing an offer) or concerns an existing contract, this data processing is based on Art. 6(1)(b) GDPR. If contact is made for other reasons, processing is based on Art. 6(1)(f) GDPR out of our overriding legitimate interest in handling and responding to your request. In this case, you have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR. We use your email address only to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Payment Service Providers

Use of the Payment Service Provider Stripe

We use the payment service Stripe (Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) on our website. Data processing is carried out for the purpose of offering you payment via the payment service. By selecting and using Stripe, the data required for payment processing is transmitted to Stripe in order to fulfill the contract with you using the selected payment method. This processing is based on Art. 6(1)(b) GDPR. Stripe reserves the right to obtain a credit report based on mathematical-statistical procedures using credit agencies. For this purpose, Stripe transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of a payment default to make a balanced decision about the establishment, execution, or termination of the contractual relationship. The credit report may contain probability values (score values) that are calculated on the basis of scientifically recognized mathematical-statistical methods and may include address data in their calculation. Your legitimate interests will be considered in accordance with legal requirements. Data processing serves the purpose of credit assessment for contract initiation. Processing is based on Art. 6(1)(f) GDPR out of our overriding legitimate interest in protection against payment default if Stripe makes an advance payment. You have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR by notifying Stripe. The provision of data is necessary for the conclusion of the contract with the payment method you have chosen. Failure to provide it will result in the contract not being concluded with the payment method you have chosen. All Stripe transactions are subject to the Stripe privacy policy, which you can find at https://stripe.com/privacy

For paid subscriptions, Link (Stripe) acts as merchant of record (seller) and handles payment processing, invoicing and the calculation and remittance of VAT.

Transfers to third countries

Insofar as we use services from providers established outside the EU/EEA (in particular in the USA) (e.g. Discord, Cloudflare, Stripe/Link), personal data may be transferred to third countries. Such transfers take place on the basis of appropriate safeguards under Art. 46 GDPR (EU standard contractual clauses) or a certification under the EU-US Data Privacy Framework.

Data Subject Rights and Storage Duration

Duration of Storage

After the contract has been fully processed, the data will initially be stored for the duration of the warranty period, then in accordance with statutory, in particular tax and commercial retention periods, and deleted after the expiry of these periods, unless you have consented to further processing and use.

Rights of the Data Subject

If the legal requirements are met, you have the following rights under Articles 15 to 20 GDPR: right to information, correction, deletion, restriction of processing, data portability. You also have the right to object to processing based on Art. 6(1)(f) GDPR and to processing for direct marketing purposes under Art. 21(1) GDPR.

Right to Lodge a Complaint with a Supervisory Authority

According to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data is not lawful.

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach, Tel.: +49 981 1800930, Fax: +49 981 180093800, Email: [email protected]

Right to Object

If the personal data processing operations listed here are based on our legitimate interest according to Art. 6(1)(f) GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation with effect for the future. After an objection, the processing of the affected data will be stopped unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing serves to assert, exercise, or defend legal claims.

last updated: 09 Aug 2026