Data protection · United States

Privacy Notice

As of 12. September 2026 · Version 2026-08-06-club-live+US-1.1

Translation. Only the German version is binding.

1. Controller

Schlachter Advertising GmbH
Westermühlstraße 21
80469 München
Germany

Managing Director: Björn Schlachter
Telephone: 089 62084998
Email: service@mitspiel.com

This notice applies to the website https://mitspiel.com, user accounts, the prize draw directory, the Mitspiel Club, the Club waiting list, newsletters, organiser enquiries and the associated technical systems.

2. Hosting, delivery and server logs

The website and related services are operated via ALL-INKL.COM and additionally via server services from Hetzner. The providers process technical data on our behalf to the extent necessary for providing, securing, troubleshooting and scaling the platform.

When the website is accessed, the following in particular may be processed: IP address, date and time, the address accessed, volume of data transferred, referrer, browser and device information, and technical status and error data. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in secure and stable operation, defence against misuse and technical error analysis. Security-relevant data is stored only for as long as is necessary for these purposes or for the establishment, exercise or defence of legal claims.

3. Technically necessary cookies and sessions

Mitspiel uses technically necessary cookies and comparable storage, in particular for sessions, login, CSRF protection, security and for storing your privacy choices. These functions are necessary to provide platform services that you have expressly requested. The legal bases are Section 25(2) TDDDG and, depending on the function, Art. 6(1)(b) or (f) GDPR.

Your choice regarding analytics and marketing is stored in a necessary, signed consent cookie and is additionally logged in a pseudonymised form that minimises data. You can change your choice at any time via "Cookie settings" in the footer. A change applies for the future.

4. User account and free platform features

When you register, we process your email address, password hash, confirmation status, security data and proof of the document versions accepted. In your account, your name, address, date of birth, telephone number, interests, preferences, favourites, participation status and notification settings may also be stored. Particularly sensitive profile fields are stored encrypted at application level.

The legal basis is Art. 6(1)(b) GDPR for providing the account and the features you want. We also process security and proof data pursuant to Art. 6(1)(c) and (f) GDPR. Account data is generally stored until the account is deleted. Statutory retention obligations and necessary proof remain unaffected.

5. Prize draw directory, favourites and redirects

Mitspiel provides information on prize draws run by independent organisers. When you save favourites or participation status, the relevant prize draw ID, timestamps and your user account are linked. When you click through to the organiser's official page, we store technical click data that minimises data so that we can detect faulty destinations, evaluate reach and prevent misuse.

When you leave Mitspiel, the organiser's privacy notice applies. In the Mitspiel Club, profile data is transmitted only for a specific entry covered by your Club instruction. Automatic transmissions take place only where technical certifications are active and current; manual steps are shown in your account.

6. Mitspiel Club, participation profile and power of attorney for participation

For the Club, we process your participation profile with name, email address, address, date of birth, optional telephone number, interests and regional settings. We also store the power of attorney for participation that you have granted, with its text, version, hash, timestamp and pseudonymised technical evidence.

For a specific Club entry, we log at least the organiser, prize draw, URL, timestamp, document version or text hash, technical certification status, dispatch status and any user action. This data serves the performance of the contract, the prevention of duplicate entries, security and proof of which terms were used for the specific transaction.

Voluntary consents to newsletters or advertising are not derived from a general profile setting. A technical selection is made only if the organiser, purpose, channel, consent text and URL correspond exactly to a documented approval. Any change requires fresh confirmation. Double opt-in and other manual steps remain open user tasks in the dashboard.

The legal basis for the Club service is Art. 6(1)(b) GDPR. Where a voluntary consent to advertising is given, Art. 6(1)(a) GDPR applies. Security and proof data may additionally be based on Art. 6(1)(f) GDPR.

6a. Club waiting list

For the Club waiting list, we process your email address, optionally the link to a user account, the source of sign-up, consent text and version, timestamp, pseudonymised technical evidence, and confirmation and unsubscription status. Sign-up is by double opt-in and can be withdrawn at any time.

7. Newsletter and prize draw updates

For prize draw updates, we process your email address, optionally the account link, consent text and version, sign-up source, confirmation and unsubscription data and pseudonymised technical evidence. Sign-up is by double opt-in. The legal basis is Art. 6(1)(a) GDPR.

Brevo may be used for dispatch and optional list management. Brevo processes the contact data and dispatch events required for this on our behalf. You can unsubscribe at any time via the unsubscribe link in every message or in your user account.

8. Organiser enquiries and organiser accounts

For an enquiry, we process name, company, contact details, website, requested package, message, proof of consent and processing status. For organiser accounts and campaigns, organisation, campaign, contact, participation and billing data are added. The legal bases are Art. 6(1)(b) GDPR for pre-contractual and contractual measures and Art. 6(1)(f) GDPR for orderly handling, documentation and protection against misuse.

Data from organiser enquiries is not automatically used for the general newsletter.

9. Payments via Stripe

Payments for the Mitspiel Club are processed via Stripe. When a checkout is started, the data required for payment, fraud prevention, invoicing and statutory obligations is transmitted to Stripe. Payment data such as full card numbers is generally processed directly by Stripe and is not stored in full on Mitspiel servers.

The legal bases are Art. 6(1)(b) and (c) GDPR. Data is transmitted to Stripe when you start the Club checkout, manage payment data or a subscription event is processed.

10. Support hotline via Retell and Twilio

For a support hotline to be activated in future, Retell and Twilio may be used for call routing, speech recognition and handling. In this context, telephone number, time, call content, transcript and technical metadata may be processed. Before any such processing, we will inform you transparently at the start of the call about the assistant used and the specific scope. Recording or further analysis takes place only on a suitable legal basis and with the required information or consent.

11. Google Analytics 4

Google Analytics 4 is loaded only if you have consented to the "Analytics" category and a measurement ID is technically activated. In particular, page views, interactions, device and browser information, referrer, approximate location information and pseudonymous identifiers may be processed. The purpose is reach measurement and improvement of the platform.

The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Without consent, Mitspiel does not load the Google Analytics tags. You can withdraw your consent at any time via the cookie settings.

12. Meta Pixel

The Meta Pixel is loaded only if you have consented to the "Marketing" category and a Pixel ID is technically activated. It may process page views, interactions, device information, referrer and pseudonymous identifiers. The data may be used to measure advertisements, build audiences and deliver relevant advertising.

The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Without consent, the pixel is not loaded. You can withdraw your consent at any time via the cookie settings.

13. Server-side Mitspiel reach measurement

Independently of external analytics tools, Mitspiel logs selected technical events such as page views, redirects, labelled affiliate clicks, registrations, confirmed newsletter or waiting list sign-ups and organiser enquiries. No real names, email addresses, telephone numbers or addresses are stored in the event table. The processing serves functional monitoring, defence against misuse and aggregated product analysis on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in secure, economical and technically reliable operation.

14. Affiliate links and paid placements

Mitspiel may use its own clearly labelled affiliate links and partner banners. Currently, creatives from the Awin partner network may be displayed for BurdaDirect prize draws. External banner images from Awin are loaded only once you have consented to the "Marketing" category. In that case, Awin and the relevant partner may process technical information such as IP address, referrer, timestamp, browser and device information, and identifiers for reach and commission measurement.

In addition, Mitspiel may display clearly labelled Amazon partner links as a separate purchase recommendation. For these text links, no Amazon product images, prices or Amazon tracking scripts are preloaded on Mitspiel. Only when you click the partner link do you leave Mitspiel and access Amazon.de; there, technical information, the partner identifier used and other data provided for under Amazon's notices may be processed.

When you click a labelled Awin partner link, you are taken to the advertised offer via the Awin redirect. The specific processing is also governed by the notices of Awin and the partner. Third-party affiliate links from source portals are not displayed publicly. Where information is stored on or read from your device, this takes place only with the required consent.

15. Social media profiles

Mitspiel may link to profiles on Facebook, Instagram, Pinterest, Bluesky and other platforms. A mere link does not load any social media plug-ins on Mitspiel. Only when you click it do you leave our website; the terms and privacy notices of the relevant platform then apply. Embedded content or visitor tracking by social platforms is activated only with corresponding consent.

16. Recipients and third-country transfers

Recipients are only bodies that need data to fulfil the purposes described, in particular hosting, email, payment, support, analytics and security service providers, as well as authorities where legally obliged. The necessary agreements pursuant to Art. 28 GDPR are concluded with processors.

Individual providers or sub-processors may process data outside the European Economic Area. In these cases, depending on the provider and the processing, we base the transfer on an adequacy decision, a valid certification under the EU-US Data Privacy Framework or appropriate safeguards such as EU Standard Contractual Clauses. Where necessary, additional safeguards are assessed.

17. Retention period

We store personal data only for as long as it is needed for the respective purpose. Relevant factors include in particular the duration of the contract, account deletion, withdrawal, statutory retention obligations, technical security periods and limitation periods. Data constituting commercial or tax records may regularly be retained for six or ten years respectively. Once the purpose ceases to apply, data is deleted, anonymised or blocked from further processing.

18. Your rights

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw any consent you have given at any time with effect for the future. Users can export key account details and delete their account in the account area.

To exercise your rights, a message to service@mitspiel.com is sufficient. We may request suitable proof of identity where this is necessary to protect your data.

19. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority that is regularly responsible for our company is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Telephone: 0981 180093-0

20. Security and changes

Mitspiel uses technical and organisational measures, including transport encryption, password hashing, access restrictions, encrypted profile fields, logging of security-relevant processes and regular backups. This privacy notice will be updated if functions, service providers or the legal situation change materially. The current version is available on this page.