Privacy Policy

Last updated: July 7, 2026

This Privacy Policy explains how we collect, use, and protect personal data when you visit https://moonwhisper.games/ (the “Site”), in accordance with the GDPR and the German TDDDG. The Site is currently informational only — no user accounts, game client, or payments.

1. Who is responsible (the “controller”)

Because Moonwhisper Games is not yet a registered legal entity, the Site is operated, and data processing carried out, solely by:

IT-Klimt (Markus Klimt) — current, sole, and temporary domain and Site holder

Franz-Volk-Str. 5a 77652 Offenburg Germany

Email: [email protected] Phone: +49 781 91906789

“Moonwhisper Games” is not yet an incorporated entity — it is a project currently developed under the sole legal and data-protection responsibility of IT-Klimt. We have not appointed a formal Data Protection Officer, as our size and processing activities do not currently trigger that requirement under Art. 37 GDPR / § 38 BDSG.

2. General information

Unless a more specific retention period is stated below, we retain personal data only until the purpose of processing no longer applies; upon a valid deletion request or withdrawal of consent, we delete your data unless a statutory retention duty applies (e.g. §§ 257 HGB, 147 AO).

Where processing is based on consent (e.g. the newsletter, Section 6), you may withdraw it at any time with effect for the future, informally, by email to [email protected].

This Site uses SSL/TLS encryption for security, recognizable by “https://” and the padlock symbol in your browser.

3. Hosting

This Site is hosted by:

IONOS SE

Elgendorfer Straße 57 56410 Montabaur Germany

A data processing agreement under Art. 28 GDPR is in place with IONOS; servers are located in Germany. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable, secure hosting). No third-country transfer is involved.

4. Cookies, server logs, and Cloudflare

Visiting the public Site does not set any cookies and does not store anything on your device; we use no analytics or marketing cookies. Only the password-protected administration area, which is not intended for visitors, sets a technically necessary session cookie. Legal basis: Art. 6(1)(f) GDPR; no consent is required under § 25(2) TDDDG for strictly necessary cookies.

Our hosting provider and the content delivery network in front of it automatically record server log data (browser type, operating system, referring URL, time of request, IP address) to operate and secure the Site. Legal basis: Art. 6(1)(f) GDPR.

In front of our server (IONOS), Cloudflare, Inc. acts as our DNS provider and content delivery network. Cloudflare processes the IP address and connection data of every visit — which may involve processing outside the EU/EEA, in other countries — to route traffic and protect the Site against attacks; this may also include basic, cookie-free usage statistics (Cloudflare Web Analytics), without cross-site tracking of individual users. Legal basis: Art. 6(1)(f) GDPR. A data processing agreement is in place with Cloudflare, including the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); Cloudflare, Inc. is also certified under the EU-U.S. Data Privacy Framework.

5. Contact forms and job applications

Business inquiries: We provide a contact form for general inquiries. Data you enter (name, email, optional phone number, message, optional attachment) is stored to process your inquiry. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR if your inquiry relates to a prospective contract. Data is deleted once no longer required, at the latest 12 months after final handling, unless statutory retention duties apply.

Job applications / team inquiries: We provide a separate form for unsolicited applications (name, contact details, qualifications, optional attachments such as a CV or work samples). Under German law, applicants are treated as employees for data protection purposes (§ 26(8) BDSG). Legal basis: § 26(1) BDSG in conjunction with Art. 88 GDPR, and Art. 6(1)(b) GDPR.

• Please do not include special categories of personal data (Art. 9 GDPR) in your application unless strictly necessary.
• Your data is used exclusively for the selection process.
• If unsuccessful, we typically retain application data for up to six months after the process concludes (legal basis: Art. 6(1)(f) GDPR, defense against claims under the German AGG), then delete it unless you’ve consented to longer retention (e.g. a talent pool).
• You may request earlier deletion at any time. No automated decision-making under Art. 22 GDPR takes place.

6. Newsletter

We use a double opt-in procedure for our newsletter: after signing up, you receive a confirmation email, and your subscription only becomes active once you click the link inside it. We store your email address and, for evidentiary purposes, the time of sign-up/confirmation and the IP address used. Legal basis: Art. 6(1)(a) GDPR (consent); the evidentiary record is based on Art. 6(1)(f) GDPR.

Newsletter delivery runs entirely on our own server infrastructure (see Section 3, IONOS, Germany); no external email service provider is used, and no data is transferred to third parties or third countries for this purpose. You can withdraw consent and unsubscribe at any time via the link in every newsletter email or by an informal email; we then delete your address from the list.

7. Google reCAPTCHA

Our forms (newsletter, contact, job application) are protected against automated abuse by Google reCAPTCHA, in addition to an invisible anti-spam field (Google Ireland Limited, Dublin, Ireland, and affiliated companies in other countries). This involves sending your IP address, device/browser information, and interaction behavior to Google for evaluation. Legal basis: Art. 6(1)(f) GDPR (protection against spam and automated attacks). Google is certified under the EU-U.S. Data Privacy Framework; we additionally rely on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). More information: https://policies.google.com/privacy.

8. Social media links

The Site links to our profiles on Instagram, X, Discord, and Reddit. These are plain hyperlinks without embedded feeds; visiting our Site does not transmit any data to these platforms. Clicking a link takes you to that platform’s own privacy terms.

9. Recipients and processors

We do not sell personal data to third parties.

10. International data transfers

Where service providers (Cloudflare, Google) process data outside the EU/EEA and in other countries, we rely on the EU-U.S. Data Privacy Framework and, as an additional safeguard, EU Standard Contractual Clauses (Art. 46 GDPR).

11. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent (Art. 7(3)). To exercise these, contact [email protected].

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority currently responsible for us:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg

Postfach 10 29 32 70025 Stuttgart, Germany

https://www.baden-wuerttemberg.datenschutz.de

12. Data security

We use appropriate technical and organizational measures (Art. 32 GDPR) and require our service providers to do the same.

13. Languages

The Site is available in English, German, Spanish, and Chinese. This Policy is provided in English and German; both are authoritative for their respective language version.

14. Changes to this policy

We may update this Policy as needed. The version published on this page is always the current one.

15. Contact

Email: [email protected]