# Privacy policy – Bannerwrath

> Privacy policy of Bannerwrath: which data we process, why, how long we keep it, whether the site uses cookies (it does not) and what rights you have.

Source: https://bannerwrath.com/en/privacy/ · Language: en · Updated: 2026-10-30 · Site: Bannerwrath: Hero Tower Defense (https://bannerwrath.com/)

## Privacy policy

This is a translation of the German original ([Datenschutzerklärung](https://bannerwrath.com/de/datenschutz/)). In case of differences the German text applies.

### 1. Controller

The controller within the meaning of the GDPR is Jan Keiter, Hauptstraße 13, 47877 Willich, Germany, email [info@bannerwrath.com](mailto:info@bannerwrath.com), telephone +49 2156 974 90 70 (see also the [legal notice](https://bannerwrath.com/en/legal-notice/)). We have not appointed a data protection officer because the law does not require it. For any question about data protection you can reach us at the email address above.

### 2. Hosting, domain and email

This site runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data center in Germany. Hetzner processes the data on our behalf (processing under Art. 28 GDPR).

The addresses bannerwrath.com and bannerwrath.de are managed by our domain provider Webgo (webgo.de). Emails to info@bannerwrath.com are also received there and forwarded to the operator's mailbox. Both happen on our behalf.

### 3. Server logs

When you open the site, the server automatically stores: IP address, date and time, requested address, response code, amount of data transferred and the headers of your request (for example browser identification and preferred language). The purpose is secure and stable operation. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). The logs are deleted after 8 days at the latest.

### 4. Language selection

If you open the main address bannerwrath.com without a language path, the server reads the language set in your browser (the “Accept-Language” header) and redirects you to the German, English, Spanish or Dutch site. The value is read only for this redirect and is not stored separately (section 3 applies). No cookie is set. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a user-friendly site). You can change the language at any time in the menu.

### 5. Cookies, local storage, tracking, external services

This site sets **no cookies**, uses no analytics, statistics or advertising services, embeds no social network buttons, maps or videos from third parties and loads no fonts, scripts or images from other servers (all fonts and images are on our server). That is why we do not need a consent banner under section 25 of the German TDDDG and Art. 5(3) of the ePrivacy Directive.

The only access to your device: the privacy notice at the bottom of the page stores in your browser (local storage, key “bw-hinweis”, not a cookie) that you have read it, so that it does not appear on every page again after you click “Got it”. This entry is technically necessary to respect your decision (section 25(2) no. 2 TDDDG), it stays in your browser and is not sent to us. You can reset it via “Privacy notice” in the footer or delete it in your browser settings.

Should we add services in the future that require consent (for example statistics, videos or a Steam widget), we will ask you first and update this policy.

### 6. Protected test area

Access to the test download requires credentials (user name and password). When a file is downloaded, the user name is stored together with the time and the downloaded file in the server log (see section 3). The purpose is to run the closed test and to protect against unauthorized access. The legal basis is Art. 6(1)(b) and (f) GDPR.

### 7. Contact by email or telephone

If you write to us or call us, we process your details to answer your request (Art. 6(1)(b) or (f) GDPR). We delete them as soon as they are no longer needed for that.

### 8. Feedback and replays from testers

Testers can send us data in two ways: through the “Report a bug” form on this site and directly from the game (from test version 10d). We store the personal tester code or, when signing in within the game, the player name you chose (both are pseudonyms; only the operator knows which person they belong to), the time, the game version and the content of the submission.

**From the game:** at the first start the game asks whether you want to take part. Nothing is preselected. If you choose “Just play”, the game does not contact the server. If you agree, the game sends the following to our server in Germany:

- once, to sign in, your **player name** and a random number for this installation (details below);
- after each battle the **replay**, automatically in the background (moves, map, hero, game version);
- **feedback** only when you click “Send” in the game: your text and whatever you switch on with it (a screenshot of the game, log, measurements of your computer, the last replay).

Your Windows user name and email address are not sent, and the log is cleaned beforehand. A screenshot shows what is currently visible in the game, including the name of your hero. Everything is assigned via your player name, and submissions through the form via your tester code. You can switch off the consent at any time in the game under Settings → Test, after which the game sends nothing any more.

**Signing in within the game:** if you take part, you enter a player name. The game sends it to our server together with a random installation number and receives a personal access code in return. With it, all further submissions are assigned to your player name, and you do not have to type anything. We store the player name (it also serves as the folder name for your submissions), a check value of the installation number and a check value of the access code, not the code itself. To protect against abuse we count sign-ins per day and network address; for that we keep only a check value of the address until the end of the day. The player name is personal data: we remove it after 12 months at the latest, and earlier on request, as well as your submissions. Please choose a name you are comfortable with; it does not have to be your real name. As with any web server, our server sees your IP address with every connection; it appears only in the server log (see section 3, deleted after 8 days at the latest). If you only play without signing in, the game does not contact the server.

**Through the form** we additionally store what you enter and all files you attach (for example screenshots, logs, replays). These files can contain personal data, such as the Windows user name in file paths. Please send only what you want to send.

The purpose is to find and fix bugs and to improve the game. We may also evaluate replays to check the balance of the game and to train the AI opponents. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future, and carrying out the test (Art. 6(1)(b) GDPR). We store the data on the server in Germany, do not pass it on to third parties and delete it as soon as it is no longer needed, after 12 months at the latest. On request we delete it earlier. We receive feedback and bug reports through the form or directly from the game, not by email. Once a day a summary of the new reports (tester code, severity, title and beginning of the text, no files) is sent by email to the operator, via the operator's email service (Google Workspace).

### 9. Invitation code, confidentiality agreement and download

When you redeem an invitation code under “Join the test”, we store the name of the invitation (only we know which person it belongs to), the time, the version of the confidentiality agreement you confirmed, your IP address and your personal download link. We also create your tester code for bug reports (a pseudonym). We do not need an email address for this. The purpose is access to the test version, proof that you confirmed confidentiality, and protection against abuse. The legal basis is Art. 6(1)(b) and (f) GDPR. The download link is deleted after seven days, the proof with the IP address after twelve months. During the download the server logs from section 3 apply.

### 10. Signing up by email for the test (waiting list)

If you sign up under “Join the test” in the “No code?” area, we store your email address, the name and the message if you give them, the time and the version of the consent text you agreed to (as proof under Art. 7(1) GDPR). The purpose is to send you an invitation code for the playtest by email. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future, for example by email to [info@bannerwrath.com](mailto:info@bannerwrath.com). We send no newsletter and do not pass the data on. The data is on the server in Germany. To protect against abuse we count requests per day and network address; for that we keep only a check value of the address until the end of the day. We delete your entry 30 days after the invitation, otherwise after 12 months at the latest, immediately on request. The server logs from section 3 also apply. We send the email to you by hand through our email service (Google Workspace).

### 11. Recipients and transfers to third countries

Your data goes only to service providers who process it on our behalf: Hetzner (hosting, server in Germany), Webgo (domain and forwarding of emails to info@bannerwrath.com) and Google Workspace (the operator's email service, used to send invitations and to receive the daily summary). We conclude data processing agreements under Art. 28 GDPR with our service providers. Beyond that we do not pass on or sell any data.

With the email service Google Workspace, a transfer to the USA is possible. It relies on the standard contractual clauses of the European Commission and, where Google is certified for it, on the adequacy decision for the EU-US Data Privacy Framework. Only emails that we send or receive ourselves arrive there, for example your invitation with the code. The game data and files from section 8 stay on the server in Germany.

### 12. Voluntary information and automated decisions

You do not have to provide any personal data to read this site. For the waiting list, redeeming a code and bug reports we need the details named in each case, otherwise we cannot process your request. Everything else is voluntary. The test is aimed at people aged 18 or over; younger people need their parents' consent. There is no automated decision-making, including profiling (Art. 22 GDPR).

### 13. Your rights

For any data protection matter you can reach us at [info@bannerwrath.com](mailto:info@bannerwrath.com). You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR), in particular against processing that we base on legitimate interests (Art. 6(1)(f)). You can withdraw consent you have given at any time with effect for the future (Art. 7(3) GDPR); until withdrawal the processing remains lawful.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example with the authority responsible for us, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de, or with the authority where you live.

### 14. Changes

We update this policy when the site, the game or the law changes. This page is also available in German, Spanish and Dutch; if they differ, the German text applies.

As of: 30 October 2026