Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

A. Beck
Am Buchenhain 10, 56479 Neustadt/Westerwald, Germany
Email: becko@tabletop-minis.de

2. Principles

We process personal data sparingly and only for the purposes described below. In particular:

• we do not use any external analytics, advertising or tracking services;
• we do not create user profiles and do not sell personal data;
• the application itself does not store your IP address;
• we use only cookies that are strictly necessary to operate the site.

3. Hosting and server log files

This website is hosted by Host Europe GmbH, Gertrudenstraße 30-36, 50667 Köln on our behalf as a processor (Art. 28 GDPR). When you access the site, the web server automatically collects and temporarily stores technical access data in server log files, such as your IP address, the requested resource, date and time, referrer and browser/operating-system information. This data is required to deliver the website, to guarantee its stability and security, and cannot be attributed to a specific person by us. The legal basis is our legitimate interest in a secure and functional website (Art. 6 (1)(f) GDPR).

4. Cookies and local storage

We use only strictly necessary cookies and comparable local storage that are required for the site to function, for example a session cookie for logging in and protecting forms (CSRF protection) and a stored display preference (such as your chosen theme). These are essential (§ 25 (2) TDDDG; legal basis Art. 6 (1)(f) GDPR) and therefore do not require consent. We do not use tracking, advertising or analytics cookies, so no cookie consent banner is displayed.

5. User account and authentication

You can browse the public catalog and build temporary lists without an account. If you register, we process the data you provide (your display name, email address and a securely hashed password) as well as account-management metadata (for example the number of logins, the number of failed login attempts and a temporary lockout after repeated failed attempts, which protects your account against unauthorised access).

The legal basis for maintaining your account is the performance of the usage relationship (Art. 6 (1)(b) GDPR); the security measures rest on our legitimate interest (Art. 6 (1)(f) GDPR).

6. Sign in with Google (optional)

You may choose to register or sign in using your Google account. If you use this option, authentication is handled by Google and Google transmits your basic profile information (in particular your email address and name) to us so that we can create or identify your account. Using this option involves a transfer of data to Google LLC, which may process data in the United States (a third country); Google relies on suitable safeguards for such transfers. The legal basis is your consent, given by actively choosing this sign-in method (Art. 6 (1)(a) GDPR), together with the performance of the usage relationship (Art. 6 (1)(b) GDPR). You can withdraw your consent at any time with effect for the future, for example by using a regular email and password login instead. Please refer to Google's privacy policy at https://policies.google.com/privacy for details of Google's own processing.

7. Transactional emails

We use your email address to send messages that are necessary to operate your account, such as email verification, password-reset links and, where applicable, onboarding information. Emails are delivered through A. Beck acting as a processor. The legal basis is the performance of the usage relationship (Art. 6 (1)(b) GDPR) and our legitimate interest in secure account communication (Art. 6 (1)(f) GDPR). We do not send advertising newsletters.

8. Your lists and content

When you save lists, mark favourites, create quick links or change personal settings, we store this data to provide those features to you (Art. 6 (1)(b) GDPR). If you create a share link for one of your lists, the corresponding list becomes accessible in read-only form to anyone who has that link, until you delete the share link or the list. Please only share links you intend to make available to others.

9. Usage statistics

To understand which parts of the catalog are used and to improve the service, we record lightweight, privacy-conscious usage events (for example which Books, Army Lists, print views or share links are opened, and basic user actions). These records do not contain your IP address, no full browser fingerprint and no list contents; where a session reference is useful it is stored only as a keyed hash, and paths are stored without query strings. The legal basis is our legitimate interest in operating and improving the service (Art. 6 (1)(f) GDPR). You may object to this processing at any time (see section 12).

10. Backups

We create periodic backups of the application data to protect against data loss. Backups are kept only for as long as necessary for that purpose and are then overwritten or deleted. The legal basis is our legitimate interest in data security (Art. 6 (1)(f) GDPR).

11. Recipients and third-country transfers

Personal data is processed on our behalf by the hosting and email providers named above, with whom we have concluded data-processing agreements pursuant to Art. 28 GDPR. If you use Google sign-in, data is transferred to Google as described in section 6. We do not otherwise disclose your personal data to third parties, unless we are legally obliged to do so.

12. Retention

We store account data for as long as your account exists. If you delete your account, your personal data is deleted, unless statutory retention obligations require otherwise. Server log files and usage events are kept only for a limited period appropriate to their purpose and are then deleted or aggregated.

13. Your rights

Under the GDPR you have the right to:

• access to your personal data (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interests (Art. 21).

Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7 (3) GDPR). To exercise your rights, please contact us using the details in section 1.

You also have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your residence, place of work or the place of the alleged infringement.

14. Obligation to provide data

Using the public catalog does not require you to provide personal data. Creating an account requires at least an email address and a password (or a Google sign-in); without this data an account cannot be created.

15. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

16. Changes to this policy

We may update this privacy policy to reflect changes to the service or the legal situation. The current version is always available on this page.