Privacy Policy & Data Protection Declaration

1. General Overview & Legal Foundations

The protection of your personal privacy and data security is a central priority for the operators of the Roaring 20s community project. When you visit our website (Roaring-20s.de), utilize our web utilities, join our Discord hub, or play on our Minecraft roleplay servers, personal data is processed in accordance with strict statutory data protection regulations.

This Privacy Policy provides you with full transparency regarding the nature, scope, purpose, legal legal bases, and retention periods of all personal data collected across our web presence and game infrastructure. Our data processing practices strictly comply with:

• Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR / DSGVO)
• Austrian Data Protection Act — Datenschutzgesetz (DSG)
• Austrian Telecommunications Act 2021 — Telekommunikationsgesetz 2021 (TKG 2021)
• Austrian E-Commerce Act — E-Commerce-Gesetz (ECG)

2. Data Controller & Contact Information

The Data Controller responsible for the collection, processing, and use of personal data on this website and associated gaming services within the meaning of Article 4 No. 7 GDPR is:

Roaring 20s Community Project
Non-commercial Gaming & Roleplay Initiative
Data Protection Inquiries & Legal Contact: [email protected]
Official Project Website: https://Roaring-20s.de/

If you have any questions, concerns, or formal data subject requests regarding this Privacy Policy or the handling of your personal data, please contact us directly via the email address above.

3. Automated Data Collection & Web Server Log Files

Every time our website is accessed, our web servers automatically record technical telemetry and connection metrics transmitted by your internet browser. This data collection is technically necessary to display our website reliably, deliver content securely, and maintain server infrastructure integrity.

The automatically collected technical data includes:

• IP Address: The Internet Protocol address assigned to your device by your Internet Service Provider (ISP).
• Date & Timestamp: Exact time, date, and time zone of the incoming server request.
• Request Details: Specific URL path, requested files, HTTP method, and HTTP status/response codes (e.g., 200 OK, 404 Not Found).
• Data Transfer Volume: Total volume of data transmitted during the server session (in bytes).
• Referrer Header: The URL of the external web page from which your device was redirected to our site.
• Browser & System Telemetry: User-Agent string containing browser name, exact version number, operating system, layout engine, language settings, and screen resolution.

Purpose of Processing: Ensuring seamless connection establishment, optimizing site performance, preventing network overload, maintaining server security, and aiding forensic investigation in the event of cyber attacks or unauthorized access attempts.

Legal Basis: Article 6 para. 1 lit. f GDPR (Legitimate interest in operating a secure, functional, and technically stable web environment).

Retention & Storage Duration: Server log files are stored for a maximum duration of 30 days. After 30 days, log entries are permanently deleted or fully anonymized. Log data whose further retention is strictly required for legal evidentiary purposes in active security investigations is exempt from deletion until the respective incident is fully resolved.

4. Content Delivery Network & Security Shield (Cloudflare Services)

To secure our website infrastructure against automated threats, DDoS attacks, and unauthorized intrusion, and to ensure high-speed global content delivery, we utilize infrastructure services provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA).

4.1 Cloudflare Content Delivery Network (CDN) & Web Application Firewall (WAF)

All web traffic between your browser and our servers is routed through Cloudflare's global edge network. Cloudflare operates reverse proxies that cache web content, filter malicious network traffic, and manage SSL/TLS encryption. During this process, technical request metadata, IP addresses, and HTTP header telemetry are processed on Cloudflare nodes.

Legal Basis: Article 6 para. 1 lit. f GDPR (Legitimate interest in ensuring website security, uptime availability, DDoS mitigation, and system performance).

4.2 Cloudflare Turnstile (Smart Bot Mitigation)

We implement Cloudflare Turnstile on our web forms, login gateways, and registration endpoints. Turnstile evaluates non-intrusive browser telemetry (such as screen geometry, device characteristics, request timing, and HTTP headers) to verify whether an interaction originates from a genuine human user or an automated bot script.

Turnstile replaces traditional intrusive image CAPTCHAs, protecting user privacy by evaluating telemetry without tracking users across unrelated third-party websites or reading private device storage.

Legal Basis: Article 6 para. 1 lit. f GDPR (Legitimate interest in securing web forms against automated spam, brute-force exploitation, credential stuffing, and bot attacks).

5. Web Analytics & Cookie Tracking (Google Analytics)

This website utilizes Google Analytics, a web analytics service operated by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies and client tracking tokens to analyze how visitors interact with our site, evaluate traffic sources, compile usage reports, and measure feature engagement.

5.1 IP Anonymization & Data Handling

IP anonymization is strictly enabled on this website. Your IP address is truncated by Google within member states of the European Union or other contracting states to the Agreement on the European Economic Area (EEA) before being transmitted to or stored on Google servers. Only in exceptional operational cases is the full IP address sent to a Google server in the United States and shortened there.

5.2 Legal Basis & Consent Management

Legal Basis: Article 6 para. 1 lit. a GDPR and § 165 para. 3 TKG 2021 (Explicit User Consent). Analytics cookies and tracking scripts are strictly blocked by default and will only be executed if you explicitly grant permission via our Cookie Consent Banner.

Revocation of Consent: You can manage, alter, or revoke your analytics tracking consent at any time with future effect by clearing your browser cookies or adjusting your settings in our website's Cookie Settings panel.

6. Game Server Data Processing & Whitelist Management

To participate in the Roaring 20s Prohibition-Era Minecraft Roleplay community, link your identity, and access our multiplayer server network, specific account identifiers and gameplay logs must be collected and processed.

6.1 Account Identifiers & Whitelist Linking

We process the following core user identifiers:

• Minecraft Unique Identifier (UUID): Used to track player inventories, character progress, permissions, and whitelist access status.
• Minecraft In-Game Username: Used for in-game identity display and administrative moderation logs.
• Discord User ID & Tag: Used for community verification, ticket support, whitelist application matching, and role synchronization.

6.2 In-Game Logging & Anti-Cheat Telemetry

During active game server sessions, automated server software records gameplay interaction logs. This includes chat logs, transaction records, character movement/action events, staff audit records, and anti-cheat telemetry data.

6.3 Purpose, Legal Basis & Retention

Purpose: Operating game servers, whitelist authorization, character state saving, anti-cheat detection, enforcing roleplay rules, resolving player disputes, and protecting server economy integrity.

Legal Basis: Article 6 para. 1 lit. f GDPR (Legitimate interest in delivering a secure, fair, and cheat-free multiplayer roleplay environment).

Storage & Retention Policy: Active player profiles and character progression data are stored for the duration of your community participation. Inactive player records are archived after 12 months of inactivity. Game interaction logs are purged from live server databases every 30 days and archived in encrypted backups for active administrative investigations or security audits.

7. Third-Party Integrations & External Platforms (Discord)

Our website features prominent integration links to our official community hub hosted on Discord (operated by Discord Inc., 444 De Haro Street, Suite 100, San Francisco, CA 94107, USA).

When clicking external Discord links on our website, you are redirected directly to Discord's servers and application environment. Data processing, account linking, voice/text communications, and storage on Discord are governed exclusively by Discord's own terms of service and privacy policies (https://discord.com/privacy).

8. Data Security & Encryption Standards

To protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, we implement comprehensive technical and organizational security measures (TOMs):

• SSL/TLS Encryption: All connection routes across Roaring-20s.de utilize HTTPS with modern TLS 1.3 encryption protocols.
• Access Control & Isolation: Database access is strictly restricted to authorized server administrators via multi-factor authentication (MFA) and SSH keys.
• Encrypted Backups: Sensitive game logs and administrative archives are stored in encrypted form with zero public internet accessibility.

9. Your Rights as a Data Subject under GDPR

Under European (GDPR) and Austrian (DSG) data protection laws, you possess statutory rights regarding the personal data we hold about you:

• Right of Access (Art. 15 GDPR): You have the right to request confirmation as to whether your personal data is being processed, along with a structured copy of your stored records. (Note: Encrypted or security-hashed system tokens, anti-cheat signatures, and internal audit tokens are excluded from exports to preserve server security).
• Right to Rectification (Art. 16 GDPR): You have the right to request the immediate correction of inaccurate or incomplete personal data records.
• Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): You may request the permanent deletion of your stored personal data. Please note: Requesting the complete deletion of your Minecraft UUID or Discord ID will result in the immediate termination of your server whitelist status, community access, and character progression. IMPORTANT: This action is irreversible and will result in a denial of our Server Network.
• Right to Restriction of Processing (Art. 18 GDPR): You may request that the processing of your data be restricted under statutory conditions.
• Right to Data Portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format. (Note: This Process can take a few days, due to the large amount of data.)
• Right to Object (Art. 21 GDPR): You have the right to object at any time to data processing based on legitimate interests (Art. 6 para. 1 lit. f GDPR).

The Usage of these Right needs the verification of the Ownership of the Discord & Minecraft account.The Verification Process will need you to have acceses to all Connected accounts.

10. Competent Supervisory Authority & Complaints

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a formal complaint with a competent data protection supervisory authority if you believe that the processing of your personal data violates data protection regulations:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40-42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: [email protected]
Official Website: https://www.dsb.gv.at/

11. Updates & Revisions to this Privacy Policy

We reserve the right to update or modify this Privacy Policy as necessary to reflect technical developments, new features, operational changes, or updated legal regulations. The latest updated version is always accessible directly at Roaring 20s Privacy Policy.

Last Updated: September 2026