Alviran Logo
Join Discord 0
Secure & GDPR Compliant

© 2026 Alviran · Germany

Privacy Policy

Data Protection & Privacy / Datenschutzerklärung

English / EN

Controller: Alviran (Kerim Akgül), Nienkamp 30, 48599 Gronau, Germany • [email protected]

What we process & why

  • Ticket system & orders
    (email address, ticket/order ID, game, region, goal, budget, items/notes, messages you send, delivery information and access/credentials that are necessary to provide the requested digital service).
    Purpose: processing your request, providing the service and communicating with you (performance of a contract, Art. 6(1)(b) GDPR).
  • Payments via Stripe
    (email, payment method details, amounts, currency, invoice IDs, basic metadata, risk/fraud checks).
    Purpose: payment processing and contract fulfilment (Art. 6(1)(b) GDPR) and prevention of fraud/abuse (legitimate interests, Art. 6(1)(f) GDPR).
    Depending on the specific processing, Stripe may act as our processor and/or as an independent controller (e.g., for its own compliance and fraud-prevention purposes).
    Invoices may be generated by Stripe as a hosted invoice page. We configure the content (e.g. description of the service).
  • Payments via PayPal (where offered)
    (email, transaction ID, amounts, currency, payment status, risk/fraud information, and other metadata required to process the payment).
    Purpose: payment processing and contract fulfilment (Art. 6(1)(b) GDPR) and prevention of fraud/abuse (legitimate interests, Art. 6(1)(f) GDPR).
    PayPal may process data as an independent controller for its own compliance and fraud-prevention purposes.
  • Payments via Heleket (cryptocurrency)
    (email address, order/invoice ID, amounts, currency, wallet address, payment status, and metadata required to process the transaction).
    Purpose: payment processing and contract fulfilment (Art. 6(1)(b) GDPR) and prevention of fraud/abuse (legitimate interests, Art. 6(1)(f) GDPR).
    Heleket may process data as an independent controller for its own compliance and fraud-prevention purposes.
  • Transactional emails via SMTP2GO
    (email address, ticket/order ID, payment status, system messages such as “ticket created”, “deposit confirmed”, “final payment confirmed”, “new reply”).
    Purpose: contract fulfilment & customer support (Art. 6(1)(b) GDPR).
  • Access, delivery & security logs
    (IP address, timestamp, requested URL, user-agent, referrer; and limited delivery/access evidence such as the time a ticket was opened or a delivery step was displayed).
    Purpose: operation of the website, security, rate-limiting in the ticket chat, detection of abuse, technical troubleshooting, and defending against fraud/chargebacks (legitimate interests, Art. 6(1)(f) GDPR; where applicable also contract performance, Art. 6(1)(b) GDPR).
    We do not store payment card numbers or full authentication data. We also do not store passwords in system logs.
  • Magic-link access & tokens
    We provide access to your ticket via a unique “magic link” containing a token (parameter t) instead of a classic login.
    Purpose: secure, user-friendly access to your ticket and its messages (performance of a contract, Art. 6(1)(b) GDPR) and protection against unauthorized access (legitimate interests, Art. 6(1)(f) GDPR).
  • Cookies & similar technologies
    We use the following categories:
    • Essential cookies (e.g., session cookies and cookies required for magic-link / token-based ticket access). These are necessary to provide the service.
      Legal basis: Art. 6(1)(b) GDPR and/or Art. 6(1)(f) GDPR; and for storing/accessing information on your device where applicable, Sec. 25(2) TDDDG.
    • Affiliate/referral cookies (e.g. alv_aff) where applicable. These are used to attribute referrals and are set only if you give consent (if implemented on the website).
      Legal basis: Art. 6(1)(a) GDPR; and Sec. 25(1) TDDDG. You can withdraw your consent at any time via the cookie settings (if available on the site).
    We do not use analytics or marketing cookies without your prior consent.
  • Customer dashboard & account
    When you place an order, a customer dashboard account may be created for you automatically (using your email address) so you can view your delivered accounts, track orders and access support features. You will be notified by email when your account is ready.
    Data processed: email address, username (derived from email), hashed password, account-level data (XP, level, reward history, spin history, referral code).
    Purpose: providing the dashboard service and delivering your purchased accounts (performance of a contract, Art. 6(1)(b) GDPR). The rewards/gamification features (XP, levels, weekly spins, referral programme) are provided on the basis of our legitimate interest in customer engagement and retention (Art. 6(1)(f) GDPR).
    You may request deletion of your dashboard account at any time through the “My Data & Privacy” section in the dashboard.
  • Email communications
    We send the following categories of emails:
    • Transactional emails directly related to your order (ticket created, deposit confirmed, final payment confirmed, delivery ready, new reply, account credentials). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
    • Order follow-up emails for pending/incomplete orders (reminders about unpaid tickets, including discount offers to complete your purchase). These are sent on the basis of our legitimate interest in completing initiated transactions (Art. 6(1)(f) GDPR). Each follow-up email contains an unsubscribe link.
    • Marketing & engagement emails such as weekly spin reminders and promotional offers. These are sent only with your consent (Art. 6(1)(a) GDPR; Sec. 7 UWG). You can opt out at any time via the unsubscribe link in every email or through your dashboard notification settings.
  • Abuse prevention & blacklist
    To protect against fraud, chargebacks and abuse, we maintain an internal blocklist of email addresses associated with confirmed abuse cases. Data stored: email address, reason, timestamp, and the staff member who recorded the entry.
    Purpose: prevention of fraud and protection of our business operations (legitimate interests, Art. 6(1)(f) GDPR).
    Blacklist entries are reviewed periodically and retained for up to 24 months unless ongoing risk justifies longer retention. If you believe you have been blocked in error, you may contact us at any time.
  • Full IP addresses for consent records
    By default, all IP addresses are anonymised (last octet removed) across our systems — including access logs, security logs, and account access logs. We store your full IP address only once: when you accept our Terms of Service and Privacy Policy before payment, as part of the consent record.
    Purpose: to prove that valid consent was given before the transaction (legal obligation / legitimate interests, Art. 6(1)(c)/(f) GDPR).
    This full IP is retained for the duration of the applicable retention period for consent records and is not used for any other purpose.

Recipients & international transfers

We use selected service providers as processors or independent controllers:

  • Hosting: our website (including the ticket system) is hosted with a professional provider within the EU.
  • Stripe Payments Europe Ltd. as payment service provider for card and alternative payments.
  • PayPal as payment service provider (where offered).
  • Heleket as cryptocurrency payment service provider.
  • SMTP2GO for sending transactional emails (SMTP / API).

Where personal data is transferred outside the European Economic Area (EEA), we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses in accordance with Art. 46 GDPR.
Data processing agreements are concluded where required by Art. 28 GDPR.

Retention periods

  • Invoices & accounting data: as required by German commercial and tax law (generally up to 10 years).
  • Ticket/chat data: usually up to 12 months after the ticket is closed, unless longer retention is legally required or justified (e.g. legal claims).
  • Access/security logs: generally 30–90 days, unless an incident, abuse prevention or a dispute/chargeback requires longer retention.
  • Dispute/chargeback evidence logs: retained for the duration of the dispute and typically up to 180 days thereafter, unless longer retention is necessary to assert or defend legal claims.
  • Consent records (if cookie consent is used): stored as long as necessary to demonstrate compliance and then deleted/aggregated.
  • Stripe/PayPal/Heleket records: according to the providers’ own legal retention obligations and settings.
  • Blacklist/abuse prevention data: up to 24 months, subject to periodic review; longer where ongoing risk is documented.
  • Dashboard account data: retained until you request deletion of your account. Upon deletion, all personal data is removed except where retention is legally required (e.g. invoices, tax records).
  • Full IP addresses (consent records only): retained for the same period as the consent record they belong to, then deleted.

Your rights

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), subject to the conditions therein. Where processing is based on consent, you may withdraw it at any time (Art. 7(3) GDPR), without affecting the lawfulness of processing before withdrawal.
Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you have the right to object on grounds relating to your particular situation (Art. 21 GDPR).
You may lodge a complaint with the competent supervisory authority, in particular: State Data Protection Authority of North Rhine-Westphalia (LDI NRW).

How to exercise your rights: If you have a dashboard account, you can access, export and request deletion of your data through the “My Data & Privacy” section. We will process your request within 30 days. For all other requests or if you do not have an account, please contact us at the email address above. Certain data (e.g. invoices required by tax law) may be exempt from deletion under Art. 17(3) GDPR.

Provision of data

  • For placing orders and using the ticket system, the provision of certain data (e.g. email, game/region/goal) is contractually required.
  • Without this data, we cannot create a ticket, process your request or provide the service.

No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR in connection with the ticket system. Payment providers may perform risk and fraud checks under their own responsibility.

Security

We apply appropriate technical and organisational measures to protect your data (encryption, access control, backups, etc.). In case of a personal-data breach likely to result in a high risk to your rights and freedoms, we will notify you and the competent authority where required under Art. 33 and 34 GDPR.

Last updated: 6 February 2026

Hey there! 👋 Got questions?

Click to chat with ALVIRAN AI →
ALVIRAN AI
Assistant
Online
AI can make mistakes. Consider verifying important information.