Privacy Policy
Last updated: 22 October 2026
1. Data Controller
- Service provider and data controller
- Lucas Schubert
- Address for service of legal documents
- [Street and building number]
[Postal code and city]
[Country] - ni2website@frostplay.de
2. Website and Hosting
When accessing our website or game servers, technical connection data, including IP addresses and request information, is processed to provide the service and maintain its security and stability.
The website is hosted using infrastructure provided by an external hosting provider in Germany. The hosting provider may process technical data as necessary to provide its services.
The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in operating a secure and reliable service. Any technical access logs are retained for operational troubleshooting and security purposes.
3. Steam Authentication
We use Steam for account authentication. When signing in, you are redirected to Steam, operated by Valve Corporation.
We receive your Steam ID and Steam profile name to identify and manage your account. We do not receive your Steam password.
Processing is based on Article 6(1)(b) GDPR. Steam may process data outside the European Economic Area, including in the United States. For details, see Steam's Privacy Policy .
4. Accounts and Gameplay
We process account identifiers, player names, characters, progression, inventory, transactions and other gameplay-related information necessary to provide NordInvasion II and its features. This includes data received from our game servers.
Where community or communication features are available, we process the information required for those features. Player information may be visible to other users where required by the respective game features.
Processing necessary to provide these services is based on Article 6(1)(b) GDPR. Processing for moderation, abuse prevention and service security is based on Article 6(1)(f) GDPR and our legitimate interest in maintaining fair and secure gameplay.
5. Cookies
We use technically necessary cookies for authentication, session management and website security. These are used in accordance with Section 25(2) TDDDG. Related personal data processing is based on Article 6(1)(b) or (f) GDPR.
We do not use advertising or analytics cookies. Disabling necessary cookies may affect website functionality, including account authentication.
6. Data Recipients
Personal data may be accessible to our hosting provider, Steam and authorised members of the NordInvasion II development team where necessary for operating and maintaining the service.
Some volunteer team members are located in the United States and may access account or gameplay data. The European Commission's adequacy decision for the USA only covers organisations participating in the EU-US Data Privacy Framework, and does not generally cover individual project contributors.
7. Data Retention
Account and gameplay data is retained for as long as needed to provide the associated features. You may request deletion of your account and associated personal data by contacting us.
Personal data is deleted or anonymised when it is no longer required, unless further retention is required by law or justified by legitimate interests, such as resolving disputes or preventing abuse.
Technical logs are retained for as long as needed for troubleshooting and security purposes. Contact enquiries are retained for as long as necessary to handle the respective request.
8. Contact and Your Rights
If you contact us, we process the information you provide to respond to your enquiry. The legal basis is Article 6(1)(b) GDPR for account-related requests and Article 6(1)(f) GDPR for other enquiries.
Under the GDPR, you have rights of access, rectification, erasure, restriction of processing and, where applicable, data portability. You may also object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation.
To exercise your rights, contact us using the details provided above. You also have the right to lodge a complaint with a competent data protection supervisory authority.
Further provider information is available in our Imprint.