Privacy Policy

Privacy Policy

Last updated: June 26, 2026

1. Controller

The controller responsible for data processing on this website is:

Blossom Path Games UG (haftungsbeschränkt)
Nürnberger Straße 38
95448 Bayreuth
Germany

Represented by the managing directors:
Lucas Pöthe
Sascha Brehmer
Florian Kretzschmar

E-mail: contact [at] blossompathgames.de

Commercial Register: Local Court of Bayreuth
Commercial Register Number: HRB 8162
VAT ID: DE 368 369 146

2. General information on data processing

We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and applicable German telecommunications and digital services data protection law.

We only process personal data to the extent necessary to provide this website, respond to enquiries, ensure website security, and operate our online presence.

3. Hosting

This website is hosted by:

netcup GmbH
Emmy-Noether-Straße 10
D-76131 Karlsruhe
Germany

When you visit this website, technical access data is processed on the servers of our hosting provider. This may include:

  • IP address
  • date and time of access
  • requested URL
  • referrer URL
  • browser type and version
  • operating system
  • status code of the request
  • amount of data transferred
  • user agent
  • technical connection data

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and efficient provision of this website.

We have concluded, or will conclude where required, a data processing agreement with netcup GmbH in accordance with Art. 28 GDPR.

Server log files are stored for a maximum of 14 days and are then deleted, unless longer retention is necessary in individual cases for security reasons, investigation of misuse, or legal obligations.

4. Server log files

For technical and security reasons, server log files are created automatically when this website is accessed.

The data is used to:

  • display the website correctly
  • maintain system security
  • investigate technical problems
  • prevent misuse or attacks
  • ensure the stable operation of the website

The legal basis is Art. 6(1)(f) GDPR. The data is not merged with other data sources and is deleted after a maximum of 14 days, unless further retention is legally required or necessary for security purposes.

5. Contact by e-mail or contact form

If you contact us by e-mail or via the contact form, we process the personal data you provide to us. This may include:

  • name
  • e-mail address
  • subject
  • message content
  • date and time of the enquiry
  • technical metadata generated during transmission

We process this data solely to handle and respond to your enquiry.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or pre-contractual communication. In all other cases, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is communication with users, players, press contacts, business partners and other interested persons.

Contact enquiries sent by e-mail or contact form are stored for 30 days after completion of the enquiry and are then deleted, unless statutory retention obligations or legitimate reasons for longer storage apply.

Business correspondence may be retained longer where statutory commercial or tax retention obligations apply.

6. Contact Form 7

We use the WordPress plugin Contact Form 7 to provide contact forms on this website.

Contact Form 7 does not store submitted form data in the WordPress database by default. Form submissions are sent to us by e-mail.

If additional logging or storage plugins are used in the future, this Privacy Policy will be updated accordingly.

The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR, depending on the nature of the enquiry.

7. Cookies and consent management

This website uses cookies and similar technologies. Some are technically necessary for the operation of the website, while others may be used only with your consent.

We use Complianz as a consent management tool to obtain, manage and document cookie and service consents.

Complianz stores consent preferences in your browser. These cookies are technically necessary because they allow us to remember your privacy choices.

The legal basis for necessary cookies and consent storage is Art. 6(1)(f) GDPR and § 25(2) TDDDG. Our legitimate interest is legally compliant consent management and secure operation of the website.

For non-essential cookies and third-party services, the legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Cookie consent preferences are stored for up to 365 days.

You can withdraw or change your consent at any time using the “Manage Consent” or cookie settings link on this website.

Further details are available in our Cookie Policy.

8. No use of Google Fonts

We do not use Google Fonts loaded from Google servers.

Fonts used on this website are either system fonts or locally hosted resources. Therefore, no personal data is transmitted to Google for font delivery when visiting this website.

9. Embedded videos and external media

Our website may include or link to videos and media from third-party platforms such as YouTube.

If such content is embedded directly, data may be transferred to the respective provider when the content is loaded. This may include:

  • IP address
  • device and browser information
  • referrer URL
  • interaction data
  • cookies or similar technologies, depending on consent settings

Embedded third-party media is only loaded after you have given consent, where consent is legally required.

The legal basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG.

If you click a normal external link to YouTube, Steam, Discord, Instagram, TikTok, LinkedIn or another platform, you leave our website. The respective provider is then responsible for its own data processing.

We do not use Twitch embeds and do not link to or embed X on this website.

10. Social media and external platform links

Our website may link to external platforms, including but not limited to Steam, Discord, Instagram, TikTok, LinkedIn and YouTube.

These links are ordinary external links. No data is transferred to these providers merely because the link is displayed on our website, unless third-party content is embedded or loaded.

When you click one of these links, you leave our website and access the platform of the respective provider. The provider may process personal data according to its own privacy policy.

11. Press kit and downloadable media

Our website provides press materials, images, logos and downloadable files.

When such files are accessed or downloaded, technical access data may be processed as part of normal website and hosting operations.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is providing press and business information about our company and games.

12. Recipients of personal data

Personal data may be disclosed to the following categories of recipients where necessary:

  • hosting provider
  • e-mail provider
  • website and IT service providers
  • consent management provider
  • third-party media or social platform providers, if you consent to embedded content or click external links
  • authorities or legal advisors, where legally required or necessary to defend legal claims

We do not sell personal data.

13. International data transfers

Some third-party providers, especially providers of social media platforms, video platforms or other external services, may process data outside the European Economic Area.

Where personal data is transferred to third countries, this is done only where a legal basis exists, such as:

  • an adequacy decision by the European Commission
  • standard contractual clauses
  • your explicit consent
  • another legal basis under Chapter V GDPR

Please note that some providers based in or connected to the United States may process data in the United States.

14. Storage duration

We store personal data only for as long as necessary for the relevant purpose or as required by law.

The following retention periods apply:

  • server log files: maximum of 14 days
  • contact enquiries by e-mail or contact form: 30 days after completion of the enquiry
  • cookie consent preferences: up to 365 days
  • business correspondence: according to applicable commercial and tax retention obligations
  • security-related data: as long as necessary to investigate incidents or protect the website

15. SSL / TLS encryption

This website uses SSL/TLS encryption. You can recognize an encrypted connection by “https://” in the browser address bar.

Encryption helps protect data transmitted through the website from unauthorized access.

16. Data security

We implement appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration and disclosure.

These measures include, where appropriate:

  • SSL/TLS encryption
  • access restrictions
  • regular updates
  • secure passwords and administrative controls
  • backups
  • technical security measures provided by our hosting environment

17. Your rights under GDPR

You have the following rights regarding your personal data:

  • right of access under Art. 15 GDPR
  • right to rectification under Art. 16 GDPR
  • right to erasure under Art. 17 GDPR
  • right to restriction of processing under Art. 18 GDPR
  • right to data portability under Art. 20 GDPR
  • right to object under Art. 21 GDPR
  • right to withdraw consent at any time under Art. 7(3) GDPR

If processing is based on consent, withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, contact us at:

contact [at] blossompathgames.de

18. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for private companies in Bavaria is generally:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
Website: www.lda.bayern.de

19. Obligation to provide personal data

You are not legally required to provide personal data when visiting this website.

However, certain technical data is necessary to access and display the website. If you contact us by e-mail or contact form, we need the information required to respond to your enquiry.

20. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

21. Changes to this Privacy Policy

We may update this Privacy Policy if our website, services or legal obligations change. The current version is always available on this website.