1. Who is responsible
This store is operated for the Minecraft server WindVanilla.net. The controller responsible for the processing of your data within the meaning of the GDPR is:
WindVanilla – David Voss
c/o Online-Impressum 11311
Europaring 90
53757 Sankt Augustin
Germany
E-mail: [email protected]
See our Legal Notice for further details. For questions about a specific order, [email protected] or Discord usually gets you a faster answer.
2. What we collect and why
Order data. When you buy something we store your Minecraft username, your e-mail address, the items in your order, the prices and discounts (coupon or gift card code), the order number, the payment status and the dates of the order. We need this to deliver your items, to provide support and to keep the accounting records that we are legally required to keep. Legal basis: performance of the contract (Art. 6 (1) b GDPR) and legal obligations (Art. 6 (1) c GDPR).
Login. You log in with your Minecraft username only. There is no password. The username is kept in your session while you use the store.
E-mail address. When you check out you enter an e-mail address. We use it only to send you your receipt and order confirmation, notices about refunds and about your subscription payments, and to answer questions about your order. We do not send newsletters or advertising. The e-mails are sent through our e-mail hosting provider (vweb01.eu), which processes them on our behalf. Legal basis: performance of the contract (Art. 6 (1) b GDPR).
Technical data. Our web server processes your IP address and browser information when you visit the site. This is needed to show the site, to keep it secure and to limit abuse (for example too many requests in a short time). For the abuse protection your IP address is only stored in a one-way hashed form (not readable) for a short time. Legal basis: our legitimate interest in a secure and working store (Art. 6 (1) f GDPR).
Cookies. We only use one technically necessary session cookie. It remembers your basket, your username and a security token and expires after 30 days at most. Because this cookie is strictly necessary to operate the store, it does not need your consent under § 25 TDDDG. We do not use advertising or tracking cookies and no analytics.
3. Payments (Stripe)
Payments are processed by our payment provider Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). The payment form is loaded from Stripe and you enter your card or account details directly there – they never reach or get stored on our server. Stripe processes your payment data (for example your card or account details, the amount, your IP address and device information for fraud prevention) as an independent controller and according to its own privacy policy: stripe.com/privacy. We receive the result of the payment (paid, failed or refunded), the payment method type and a reference number. Legal basis: performance of the contract (Art. 6 (1) b GDPR).
For monthly subscriptions Stripe also stores the payment method you chose so that the monthly payments can be collected until you cancel.
4. Player skins (mc-heads.net)
To show the head or skin of your Minecraft account, your browser loads images from mc-heads.net. Your IP address and the username are transmitted to that service in the process. Legal basis: our legitimate interest in a friendly store (Art. 6 (1) f GDPR).
5. Server status (mcstatus.io)
To show the live player count, our own server – not your browser – asks mcstatus.io for the status of the Minecraft server. No data about you is sent to mcstatus.io in this process.
6. Who gets your data
Apart from Stripe and our e-mail hosting provider, only our hosting provider (who runs the web server) receives the data described above for the operation of the store. We do not sell your data and do not pass it on for advertising.
7. How long we keep it
We keep order data for as long as German commercial and tax law requires (currently up to 10 years for invoice-relevant records under § 147 of the German Fiscal Code, AO), then it is deleted. Data we only need for support is deleted once your request is resolved and any legal retention period has passed. Technical data of the abuse protection is deleted automatically after a short time, and the session cookie after at most 30 days.
8. Your rights
You have the right to information about your data, to correction, deletion, restriction of the processing, data portability and to object to processing that is based on legitimate interests. To use these rights, contact us as described in section 1. You also have the right to complain to a data protection supervisory authority – for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), or the authority where you live in the EU/EEA.