1. Privacy and Data Controller
We take the protection of your personal data seriously. This Privacy Policy explains which personal data is processed when you use hummelgaming.com and our online shop, for which purposes such data is processed, and on which legal basis the processing takes place.
Personal data means any information relating to an identified or identifiable natural person. This may include, for example, your name, address, email address, telephone number, IP address, order information and contractual data.
Data Controller
The controller responsible for the processing of personal data on this website is:
Niklas Hebbel
Düsseler Feld 10
42489 Wülfrath
Germany
Phone: +49 (0) 163 881 69 86
Email: kontakt@niklashebbel.de
If you have any questions regarding the processing of your personal data or wish to exercise your data protection rights, you may contact us using the contact details above.
2. Data Processed When You Visit Our Website
When you access our website, certain technical information is automatically processed. This may include the IP address of the device used to access the website, browser type and version, operating system, referring URL, hostname of the accessing computer, and date and time of access.
This information is processed to technically provide the website, ensure system stability and security, and identify and resolve technical problems.
The processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and technically functional operation of our website.
As a general rule, this technical information is not combined with information from other sources unless this is necessary to investigate a specific security incident or is otherwise legally permissible.
3. Hosting
Our website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.
As part of the hosting service, STRATO processes technical access information, including server log files and IP addresses. This processing is necessary to operate the website securely and reliably.
The processing is based on Article 6(1)(f) GDPR due to our legitimate interest in maintaining a secure and reliable website.
Where legally required, we have entered into a data processing agreement with our hosting provider pursuant to Article 28 GDPR.
Further information on data protection at STRATO can be found in the provider’s privacy information.
4. Contacting Us
If you contact us via our contact form, by email or by other means, we process the information you provide insofar as this is necessary to handle your request.
This may include your name, email address, telephone number and the content of your message.
Depending on the nature of your request, processing is based on Article 6(1)(b) GDPR where the request concerns the performance of a contract or pre-contractual measures, or on Article 6(1)(f) GDPR based on our legitimate interest in properly handling enquiries. Where consent is requested, processing is based on Article 6(1)(a) GDPR.
The information provided will be deleted once the purpose of the processing no longer applies and no statutory retention obligations prevent deletion.
5. Customer and Contract Data
When you purchase software through our online shop or enter into a software-related contract with us, we process the personal data required to process the purchase and perform the contract.
This may include, in particular:
- first and last name
- billing and, where applicable, delivery address
- email address
- contact details
- products ordered
- licence and contractual information
- order number
- invoice and payment information
- communications relating to the order
- other information required to perform the contract
The data is used in particular to receive and process orders, conclude and perform contracts, provide software or licence information, issue invoices, process payments and handle customer enquiries relating to the contractual relationship.
Processing is based on Article 6(1)(b) GDPR insofar as it is necessary for the performance of a contract with you or for pre-contractual measures.
Data may also be processed where this is necessary to comply with legal obligations, in particular tax and commercial record-keeping requirements. In such cases, the legal basis is Article 6(1)(c) GDPR.
6. Orders Through Our Online Shop
You can purchase software products developed by Hummel Gaming through hummelgaming.com.
When you place an order, we process the information you provide insofar as it is necessary to process and perform the purchase contract.
This includes, in particular, processing your order, issuing and providing invoices, providing the purchased software or associated licence information, and communicating with you in connection with your order.
The processing required for these purposes is based on Article 6(1)(b) GDPR.
Certain personal data is necessary to conclude and perform the contract. Without the information required for contract processing, an order may not be able to be completed.
Where statutory retention obligations apply, the relevant information will be retained for the duration of the applicable statutory period. After the applicable retention period has expired, the data will be deleted unless another legally permissible reason requires continued retention.
7. Provision of Digital Content and Software Licences
Our online shop primarily offers software products developed by Hummel Gaming and the associated rights of use and licences.
To perform the contract, we may need to process personal data in order to provide the purchased software, a download, a licence key or other information required to use the product.
Where software or licence information is provided electronically, the processing required for this purpose is based on Article 6(1)(b) GDPR.
Where technical information is processed for the verification or administration of a software licence, this processing takes place only insofar as it is necessary to provide, activate, administer or enable the contractual use of the purchased software, or where another legal basis permits the processing.
8. Licence Activation and Licence Management
To activate and manage software licences provided by Hummel Gaming, certain customer and technical data is transmitted to and stored on our licence server when a software licence is activated.
This data includes, in particular:
- the licence key,
- the email address or customer number associated with the licence,
- a technical device or installation identifier (Hardware ID / Machine ID),
- the purchased product or corresponding product edition,
- the software version in use, and
- the date and time of activation.
The processing of this data is necessary to verify the validity of a purchased licence, activate the software and manage the use of the licence. The technical device or installation identifier is used in particular to associate a licence with a specific installation or device and to detect unauthorised multiple use of licence keys.
The processing is based on Article 6(1)(b) GDPR insofar as it is necessary for the performance of the software agreement with you and for providing the licence you have purchased.
Where the processing of technical data additionally serves to prevent misuse, secure our licence system or enforce contractual usage restrictions, the processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and proper administration of the software licences we issue and in protecting our software against unauthorised use.
The data collected as part of the licence activation process is stored on our licence server on an ongoing basis. This permanent storage is necessary to verify the validity of licences and to ensure that licence status and authorised use can be checked during subsequent use of the software.
The stored licence data will be deleted if the respective licence is permanently invalidated or if there is no longer a legitimate or contractual reason for retaining the data, unless statutory retention obligations or other legally permissible reasons require continued storage.
9. Disclosure of Data in Connection with Contracts
Personal data may be transferred to external service providers where this is necessary to conclude or perform a contract with you.
These may include technical service providers, hosting providers, providers involved in the delivery of digital content, payment service providers or other service providers supporting the processing of orders.
Data is disclosed only where there is an appropriate legal basis. Where external service providers process personal data on our behalf, they are engaged on the basis of a data processing agreement pursuant to Article 28 GDPR where such an agreement is legally required.
10. Payment Processing
External payment service providers may be used to process payments through our online shop.
If you select a particular payment method during the checkout process, the personal data required to process and authorise the payment may be transmitted to the relevant payment service provider.
This may include your name, billing information, email address, order information, payment amount and other information required for the selected payment method.
The transfer is necessary for the performance of the contract and is therefore based on Article 6(1)(b) GDPR.
Depending on the payment method selected, the relevant payment service provider may process additional data under its own responsibility as a separate data controller. The privacy policy of the respective payment service provider applies to such processing.
Note: The specific payment service providers used by the online shop will be named in this Privacy Policy once the payment providers have been selected.
11. Cookies and Similar Technologies
Our website may use cookies and similar technologies. Cookies are small data files stored on your device or used to access information already stored on your device.
Some technologies are necessary for the technical operation of the website or for functions expressly requested by you.
Other technologies may be used, for example, for statistical analysis of website usage or other functions. Such technologies will generally only be used where the required consent has been obtained.
The processing of information stored on or accessed from your device is governed in particular by Section 25 of the German Telecommunications and Digital Services Data Protection Act (TDDDG). Consent is generally required unless a statutory exception applies.
Where personal data is subsequently processed, the applicable legal basis under the GDPR also applies.
Your consent decision is documented through our consent management system. You may change or withdraw your consent at any time with effect for the future.
12. Consent Management with Complianz
We use Complianz as a consent management system to manage and document consent relating to cookies and similar technologies.
The system may store information about the consent decision you have made and when that decision was made. Technical information required to manage and document consent may also be processed.
The processing serves to comply with data protection obligations and our legitimate interest in maintaining a transparent and technically appropriate consent management process.
Where the processing concerns consent itself, the applicable legal basis for consent also applies.
13. Google Fonts
Our website uses fonts originating from the Google Fonts library. The fonts are hosted locally on our own server.
No connection to Google’s servers is established merely for displaying these locally hosted fonts.
14. Google Analytics
Where you have provided the required consent through our consent management system, we use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics enables us to statistically analyse how visitors use our website. This may include information about pages visited, duration of use, devices used, approximate geographic location and interactions with the website.
The service is used only after the required consent has been obtained. The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG where information is stored on or accessed from your device.
You may withdraw your consent at any time with effect for the future through our consent management system.
Depending on the configuration of Google Analytics, measures designed to reduce the personal reference of the data may be used, such as IP address truncation.
Further information on Google’s processing of personal data can be found in Google’s privacy information.
15. Legal Bases for Processing
Depending on the particular processing activity, we rely in particular on the following legal bases:
Article 6(1)(a) GDPR: Processing based on your consent.
Article 6(1)(b) GDPR: Processing necessary for the performance of a contract or for taking steps at your request prior to entering into a contract.
Article 6(1)(c) GDPR: Processing necessary for compliance with a legal obligation.
Article 6(1)(f) GDPR: Processing necessary for the purposes of our legitimate interests, provided that these interests are not overridden by your interests or fundamental rights and freedoms.
The specific legal basis applicable to each processing activity is stated in the relevant section of this Privacy Policy.
16. Recipients of Personal Data
Personal data is generally disclosed only to parties that require the information for the relevant processing purpose or whose involvement is legally permissible or necessary.
These parties may include hosting providers, technical service providers, payment service providers, providers involved in digital delivery and licence management, tax advisers, public authorities and other data processors.
Personal data will not be disclosed to third parties for their own advertising purposes unless an appropriate legal basis exists.
17. Transfers to Countries Outside the European Union
Certain services used by us may involve the processing of personal data outside the European Union or the European Economic Area.
Where personal data is transferred to a third country, this will only take place in accordance with Articles 44 et seq. GDPR.
Depending on the recipient, the transfer may be based on an adequacy decision of the European Commission or appropriate safeguards such as standard contractual clauses approved by the European Commission.
Where a specific transfer to a third country takes place, the relevant information will be provided in the section concerning the respective service.
18. Data Retention
We retain personal data only for as long as necessary for the relevant processing purpose.
Once the relevant purpose no longer applies, the data will be deleted unless statutory retention obligations or another legally permissible reason requires longer retention.
Contractual, accounting and business records may be subject to statutory retention periods under tax and commercial law.
The data processed in connection with software licence activation is subject to the specific retention provisions described in Section 8 of this Privacy Policy.
19. Your Rights
Subject to the applicable legal requirements, you have the following rights:
- right of access to your personal data;
- right to rectification of inaccurate data;
- right to erasure;
- right to restriction of processing;
- right to data portability;
- right to object to certain processing activities;
- right to withdraw consent with effect for the future; and
- right to lodge a complaint with a data protection supervisory authority.
If you wish to exercise any of these rights, you may contact us using the contact details provided above.
Withdrawal of Consent
You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.
Right to Object
Where we process your personal data on the basis of Article 6(1)(f) GDPR, you may object to such processing on grounds relating to your particular situation.
Where personal data is processed for direct marketing purposes, you may object to such processing at any time.
20. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority concerning the processing of your personal data.
A complaint may in particular be lodged with the supervisory authority in the Member State of your habitual residence, place of work or the place where an alleged infringement occurred.
21. Data Security and SSL/TLS Encryption
Our website uses SSL/TLS encryption for security reasons.
An encrypted connection can generally be identified by the browser address beginning with “https://” and the corresponding padlock symbol.
Encryption is intended in particular to protect information transmitted by you against access by unauthorised third parties.
Despite appropriate technical and organisational measures, complete security of data transmission over the Internet cannot be guaranteed.
22. Objection to Unsolicited Advertising
The use of contact details published as part of our legal notice for sending unsolicited advertising or informational material is expressly prohibited.
We reserve the right to take legal action against unsolicited advertising, particularly spam emails.
23. Changes to This Privacy Policy
We reserve the right to amend this Privacy Policy where changes occur to the technical structure of our website, the services we use or the applicable legal and data protection requirements.
The current version published on this website shall apply.