1. Who is responsible
This store is operated for the Minecraft server ZenoSMP. The controller responsible for the processing of your data within the meaning of the GDPR is:
ZenoSMP – David Voss
c/o Online-Impressum 11311
Europaring 90
53757 Sankt Augustin
Germany
E-mail: management@zenosmp.de
See our Legal Notice for further details. For questions about a specific order, management@zenosmp.de or Discord usually gets you a faster answer.
2. What we collect and why
Order data. When you buy something we store your Minecraft username, your e-mail address, the items in your order, the prices and discounts (coupon or gift card code), the order number, the payment status and the dates of the order. We need this to deliver your items, to provide support and to keep the accounting records that we are legally required to keep. Legal basis: performance of the contract (Art. 6 (1) b GDPR) and legal obligations (Art. 6 (1) c GDPR).
Login. You log in with your Minecraft username only. There is no password. The username is kept in your session while you use the store.
E-mail address. When you check out you enter an e-mail address. We use it only to send you your receipt and order confirmation, notices about refunds and about your subscription payments, and to answer questions about your order. We do not send newsletters or advertising. The e-mails are sent through our e-mail hosting provider (vweb01.eu), which processes them on our behalf. Legal basis: performance of the contract (Art. 6 (1) b GDPR).
Technical data. Our web server processes your IP address and browser information when you visit the site. This is needed to show the site, to keep it secure and to limit abuse (for example too many requests in a short time). For the abuse protection your IP address is only stored in a one-way hashed form (not readable) for a short time. Legal basis: our legitimate interest in a secure and working store (Art. 6 (1) f GDPR).
Cookies. We only use one technically necessary session cookie. It remembers your basket, your username and a security token and expires after 30 days at most. Because this cookie is strictly necessary to operate the store, it does not need your consent under § 25 TDDDG. We do not use advertising or tracking cookies and no analytics.
3. Payments (Stripe)
Payments are processed by our payment provider Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). The payment form is loaded from Stripe and you enter your card or account details directly there – they never reach or get stored on our server. Stripe processes your payment data (for example your card or account details, the amount, your IP address and device information for fraud prevention) as an independent controller and according to its own privacy policy: stripe.com/privacy. We receive the result of the payment (paid, failed or refunded), the payment method type and a reference number. Legal basis: performance of the contract (Art. 6 (1) b GDPR).
For monthly subscriptions Stripe also stores the payment method you chose so that the monthly payments can be collected until you cancel.
4. Payments with paysafecard (manual check)
Besides Stripe you can pay with a paysafecard. This is not an automatic payment: you enter the 16-digit code of your paysafecard at checkout and a member of our team checks and redeems it by hand. Every paysafecard payment is verified manually, and your order is only completed – and your items are only delivered – after we have confirmed that the card is valid and its value has been credited to us. Until then your order shows as waiting for a manual check; this can take some time.
The paysafecard must be your own, its code must never have been shared with anyone beforehand, and it must not have been used or redeemed anywhere else. Codes that were shared with someone else, or that have already been used, cannot be accepted. If a card is rejected, nothing is charged and you can try again or pay another way.
What we do with the code. The code is stored encrypted, separately from the other order data, and is only shown to authorised members of our team, in the administration area of the store on the page of that order, for the manual check. It is never sent by e-mail or passed on to any other service – except that a member of our team enters it with the issuer of paysafecard to redeem the card, which processes it under its own privacy policy. As soon as we have decided about the card (accepted, rejected, or the order cancelled) the code is erased from our system. We keep a record that a card was submitted (date and outcome, but not the code) together with the order data, plus a one-way fingerprint of the code that cannot be turned back into it and only serves to notice when the same card is submitted twice. We tell you by e-mail when we have received your card and when we could not accept it. Legal basis: performance of the contract (Art. 6 (1) b GDPR) and our legitimate interest in preventing fraud and misuse (Art. 6 (1) f GDPR).
5. Player skins (mc-heads.net)
To show the head or skin of your Minecraft account, your browser loads images from mc-heads.net. Your IP address and the username are transmitted to that service in the process. Legal basis: our legitimate interest in a friendly store (Art. 6 (1) f GDPR).
6. Server status (mcstatus.io)
To show the live player count, our own server – not your browser – asks mcstatus.io for the status of the Minecraft server. No data about you is sent to mcstatus.io in this process.
7. Who gets your data
Apart from Stripe, our e-mail hosting provider and – if you pay with a paysafecard – the card's issuer (paysafecard), which receives the code when we redeem the card, only our hosting provider (who runs the web server) receives the data described above for the operation of the store. We do not sell your data and do not pass it on for advertising.
8. How long we keep it
We keep order data for as long as German commercial and tax law requires (currently up to 10 years for invoice-relevant records under § 147 of the German Fiscal Code, AO), then it is deleted. Data we only need for support is deleted once your request is resolved and any legal retention period has passed. Technical data of the abuse protection is deleted automatically after a short time, and the session cookie after at most 30 days.
9. Your rights
You have the right to information about your data, to correction, deletion, restriction of the processing, data portability and to object to processing that is based on legitimate interests. To use these rights, contact us as described in section 1. You also have the right to complain to a data protection supervisory authority – for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), or the authority where you live in the EU/EEA.