Privacy Policy — Community Forum

In this Privacy Policy, we explain how we handle your personal data on our community forum at Prontera.info. The applicable legal framework is the current data protection law, in particular the General Data Protection Regulation (GDPR). With the exception of the service providers and third parties explicitly named in this Privacy Policy, we do not share any data with third parties. If you have any questions, please feel free to contact us.

Our forum is also the central account system for our game hubs (Ro3.Prontera.info and RoZ.Prontera.info); how your data is handled on those subdomains is described in their own privacy policies.

Data Controller
General Information
Forum Hosting (Netcup)
Cookies and Consent Management
Registration and Login via Discord (Single Sign-On)
Forum Content: Posts, Profiles, Private Messages, and Uploads
IP Addresses and Abuse Prevention
Email Notifications (Brevo)
Embedded Content (YouTube and Link Previews)
Analytics and Advertising
Data Backups (Hetzner)
Content Delivery Network (Cloudflare)
Cross-Domain Single Sign-On (Our Game Hubs)
Rights of Data Subjects

1. Data Controller

The entity responsible for data processing on this forum is:

Lukas Metzger
Hauptstr. 173
79365 Rheinhausen
Germany

Email: [email protected]
Phone: +49 1573 7930766

2. General Information

Provision of Data
Browsing public areas of the forum generally does not require you to provide personal data. Creating an account and posting content requires the data described below. If providing data is necessary for a specific function, we will inform you about this and the consequences of not providing it.

Data Transfer to Third Countries
We may use service providers located outside the European Union (EU) and the European Economic Area (EEA). The transfer of personal data to such third countries occurs—unless you have consented—on the basis of an adequacy decision by the European Commission (Art. 45 GDPR) or provided that we have implemented appropriate safeguards (Art. 46 GDPR, e.g., Standard Contractual Clauses). Where an adequacy decision exists, we point this out below. Otherwise, you can request a copy of the appropriate safeguards from us.

Automated Decision-Making
No automated decision-making, including profiling, takes place.

Processing for Other Purposes
Data is generally only processed for the purposes for which it was collected. Should it exceptionally be processed for other purposes, we will inform you beforehand.

3. Forum Hosting (Netcup)

We operate this forum on servers provided by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. All forum data (accounts, posts, private messages, uploads, and log files) is stored on Netcup’s servers in Germany.

With every access, your browser transmits technical data that is stored in server log files:

Browser type and version
Operating system
Accessed pages and files
Amount of data transferred
Date and time of access
IP address (in anonymized form)

Legal Basis: Art. 6(1)(f) GDPR (secure, stable operation). Server log files are automatically deleted after 30 days.
Data Processing Agreement (DPA): We have concluded a DPA with Netcup.

4. Cookies and Consent Management

Our forum software (Discourse) sets strictly necessary cookies that are required to operate the service — in particular an authentication cookie that keeps you logged in, and cookies that store your display and notification preferences. These do not require consent.
Legal Basis: Art. 6(1)(f) GDPR and, where applicable, national telecommunications privacy law (strictly necessary storage).

Cookies and technologies that are not strictly necessary (for example analytics or advertising, see Section 10) are only used after you have given your explicit consent via the consent banner on this forum. You can withdraw your consent at any time with effect for the future.
Legal Basis: Art. 6(1)(a) GDPR (consent).

5. Registration and Login via Discord (Single Sign-On)

This forum is the central account system of our network. Registration and login are handled exclusively through the “Discord” service. The provider is Discord Inc., 444 Rhode Island Street, Suite 400, San Francisco, CA 94107, USA.

When you log in, you first authenticate with Discord. Only after you approve Discord’s authorization prompt does Discord transmit your Discord User ID, username, email address, and avatar to our forum. We use this data to create and authenticate your forum account and to display your profile. Your email address is stored with your forum account and used for the notifications described in Section 8.

Legal Basis: Art. 6(1)(a) and (b) GDPR (your consent to using the Discord login and performance of the account relationship you request). The transfer to Discord Inc. in the USA takes place on the basis of the EU-U.S. Data Privacy Framework, under which Discord is certified; insofar as this does not apply, on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR).
Discord Privacy Policy

6. Forum Content: Posts, Profiles, Private Messages, and Uploads

When you use the forum, we process the content you create and the metadata attached to it:

Public posts and topics — Your username, avatar, the content you write, and the timestamp are visible to other users and, for public categories, to unregistered visitors and search engines.
Profile information — Optional details you add to your profile (e.g., bio, location, links).
Private messages — Messages you exchange with other users are stored on our servers so they can be delivered and displayed.
Uploads — Images and files you attach are stored on our infrastructure (see Sections 3, 11, and 12).
Interactions — Likes, bookmarks, notification and read states.

Legal Basis: Art. 6(1)(b) GDPR (providing the community service you use) and Art. 6(1)(f) GDPR (functioning and integrity of the forum).
Deletion: You can request deletion of your account. Private messages and profile data are removed; public posts may be retained in anonymized form so as not to break ongoing discussions, unless legal obligations require otherwise.

7. IP Addresses and Abuse Prevention

Our forum software records the IP address associated with account registration and with posting actions. This is used to detect and prevent spam, abuse, and security incidents, and to enforce bans.
Legal Basis: Art. 6(1)(f) GDPR (security and abuse prevention). IP records tied to actions are retained only as long as necessary for these purposes and are then deleted or anonymized.

8. Email Notifications (Brevo)

Our forum sends transactional and notification emails — such as sign-in confirmations, replies and mentions, moderation messages, and (if you opt in) activity digests. For delivery we use the service provider Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany). Your email address and username are transferred to Brevo for this purpose; Brevo logs the time and IP address for technical verification.

Legal Basis: Transactional and account-related emails are based on Art. 6(1)(b) GDPR. Optional digests and any newsletter are sent only with your active consent under Art. 6(1)(a) GDPR; you can adjust your email preferences or unsubscribe at any time.
Data Processing Agreement (DPA): We have concluded a DPA with Sendinblue GmbH.
Brevo Privacy Policy

9. Embedded Content (YouTube and Link Previews)

When you or other users paste a link, the forum may generate a preview (“onebox”) and, for supported media such as YouTube, embed a player. Rendering an embed can load content directly from the third party’s servers (e.g., Google/YouTube), which receives your IP address in the process. Where possible, YouTube is embedded in privacy-enhanced mode. Provider: Google Ireland Ltd., Gordon House, Barrow St, Dublin 4, Ireland.
Legal Basis: Art. 6(1)(f) GDPR (rich link previews as a core forum function).
Google Privacy Policy

10. Analytics and Advertising

Insofar as we use analytics or advertising on the forum, these technologies are activated only after your explicit consent (Section 4).

Google Analytics — website analysis with the anonymize IP extension; analyzed data includes approximate location, device, browser, and visited pages; retention 14 months. Provider: Google Ireland Ltd.
Legal Basis: Art. 6(1)(a) GDPR (consent).
Google Analytics Opt-Out | Google Privacy Policy

If no consent is given, no analytics or advertising cookies are set.

11. Data Backups (Hetzner)

To protect against data loss and ensure availability, we regularly create encrypted backups of the forum (Art. 32 GDPR). These backups are stored in encrypted form on the infrastructure of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Technical measures prevent the storage provider from viewing the encrypted data.
Legal Basis: Art. 6(1)(f) GDPR (protection against data loss, operational security).
Data Processing Agreement (DPA): We have concluded a DPA with Hetzner.

12. Content Delivery Network (Cloudflare)

We use the content delivery network of Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA, to improve the speed, availability, and security of the forum (e.g., protection against attacks). Cloudflare processes connection data, including your IP address, to route and secure requests.
Legal Basis: Art. 6(1)(f) GDPR (security and performance). The transfer to the USA is based on Cloudflare’s certification under the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses.
Cloudflare Privacy Policy

13. Cross-Domain Single Sign-On (Our Game Hubs)

Your forum account also lets you sign in to our game hubs (Ro3.Prontera.info and RoZ.Prontera.info). When you choose to log in there, our forum transmits your User ID, username, avatar, and group memberships to the respective hub via DiscourseConnect so it can display your logged-in state. Your email address is not transferred to the hubs. Details on the processing that takes place on the hubs are provided in their own privacy policies.
Legal Basis: Art. 6(1)(a) and (b) GDPR.

14. Rights of Data Subjects

Under the GDPR, you have the following rights:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR)
Right to withdraw consent (Art. 7(3) GDPR)
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Status of this Privacy Policy: July 23, 2026