Privacy Policy

1. Who is responsible

The controller responsible for processing personal data on this website under the EU General Data Protection Regulation (GDPR) is:

Cosmic Stag Games GmbH
Kremmener Straße 2
10435 Berlin, Germany
Managing director: Uli Quasebarth
Email: info@cosmicstag.com

If you have any questions about data protection, just email us at this address.

2. When you visit this website

Whenever you open this website, your browser automatically sends information to the server of our hosting provider. This includes your IP address, the date and time of your visit, the page you requested, the website you came from, and the type and version of your browser and operating system.

We need this data to deliver the website to you and to keep it stable and secure, for example to detect and fend off attacks. The legal basis is our legitimate interest in the secure and reliable operation of our website (Art. 6(1)(f) GDPR). Without this data, the website can't be displayed.

Our hosting provider processes this data only on our behalf and according to our instructions, under a data processing agreement (Art. 28 GDPR). We delete the log data as soon as it's no longer needed for these purposes. If individual entries are needed to investigate a specific security incident, we keep them until the incident has been resolved.

3. Cookies and your consent

A cookie is a small file that a website stores in your browser. Similar technologies, such as local storage, work the same way. We only use them where you have agreed, with one exception: the choice you make in the cookie banner is stored in your browser so that we don't have to ask again on every page. That entry holds no personal data and is kept for twelve months.

When you first open the website, the banner asks whether we may use cookies for statistics and for advertising measurement. Nothing in those two groups loads until you agree, and if you decline, the website works exactly as it does with consent. The legal basis for storing and reading this information is your consent under Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), and for the processing that follows, Art. 6(1)(a) GDPR.

You can change or withdraw your choice at any time with effect for the future: open Cookie settings at the bottom of any page.

4. Google Tag Manager and Google Analytics

If you agree to statistics, we load Google Tag Manager and Google Analytics 4, both services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager collects no data about you by itself. It is the tool we use to load the measurement services you have agreed to, and nothing else.

Google Analytics helps us understand how the website is used: how many people visit, which pages they open, how long they stay, roughly which region they are in, and which website or advertisement brought them here. For this, Google stores cookies in your browser and gives your browser a randomly generated identifier. Google Analytics shortens your IP address before it is used and does not store it. We run Google Analytics with Google's consent mode, so no analytics cookies are set unless you have agreed. The data is deleted after 14 months at the latest.

We have concluded a data processing agreement with Google (Art. 28 GDPR). Google may also process this data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). Even so, authorities in the USA may be able to access such data under certain conditions.

The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). More information is in the Google Privacy Policy.

5. Advertising measurement

If you agree to marketing, we load measurement tags from the platforms we advertise on, again through Google Tag Manager. They tell us which campaign brought you here and whether a visit led to a wishlist or a purchase, so that we know which campaigns are worth running. This involves cookies in your browser, and the platform concerned processes data such as your IP address and the pages you open here. At present this covers Google Ads (Google Ireland Limited). We will name any further platform here before switching it on.

The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG), which you can withdraw at any time with effect for the future.

6. YouTube videos

We show our trailers using YouTube, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The videos use YouTube's privacy-enhanced mode (youtube-nocookie.com) and only load when you press play. Until then, no data is sent to YouTube.

When you press play, your browser connects to YouTube's servers. YouTube receives your IP address, information about your browser and device, and which video you're watching. YouTube can also store information on your device, for example in cookies or local storage, and link what you watch to your Google account if you're signed in.

Google may also process this data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).

The legal basis is your consent, which you give by pressing play (Art. 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG). You can withdraw your consent at any time with effect for the future by deleting the data YouTube has stored in your browser, for example in your browser's settings for cookies and site data.

You can find more information in the Google Privacy Policy.

7. When you contact us

If you email us, we process your email address, your name if you give it, and the content of your message so we can answer you. If your message relates to a purchase or another contract, the legal basis is Art. 6(1)(b) GDPR. Otherwise, it's our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).

We delete your message once your request has been fully dealt with, unless we're legally required to keep it for longer, for example under commercial or tax law.

8. Links to stores, social media and our press kit

This website links to external services such as Steam, the Nintendo eShop, the Xbox Store, Discord, YouTube, Instagram, TikTok, X, Bluesky, Twitch, LinkedIn and our press kit on Notion. These are simple links: no data is sent to these services until you click one. Once you're on their site, the privacy policy of the respective provider applies.

Our links to Steam include campaign tags (UTM parameters) naming this website or the ad campaign that brought you here. These tags don't contain any personal data. Steam uses them to show us summary statistics, such as how many wishlists a campaign led to, and we can't see who clicked.

9. Your rights

You have the right to:

• get information about the personal data we process about you (Art. 15 GDPR)
• have incorrect data corrected (Art. 16 GDPR)
• have your data deleted (Art. 17 GDPR)
• have the processing of your data restricted (Art. 18 GDPR)
• receive your data in a structured, commonly used and machine-readable format (Art. 20 GDPR)
• withdraw any consent you've given at any time, with effect for the future (Art. 7(3) GDPR)

To exercise any of these rights, email us at info@cosmicstag.com. To change your cookie choice, open Cookie settings at the bottom of any page.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the EU country where you live. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin, datenschutz-berlin.de.

10. Changes to this policy

We update this policy whenever our website or the legal requirements change. The current version is always available on this page.