Privacy Policy

1. Data controller

The controller responsible for processing personal data on this website is:

Bibo Jasim
Gatterburgstraße 13
80689 München
Germany
Email: info@hydracheats.com
Support: support@hydracheats.com

No data protection officer has been appointed.

2. Hosting, Cloudflare and server logs

This website is hosted in Germany through Avoro, which is operated by dataforest GmbH, Taunusstraße 52, 65830 Kriftel, Germany. No separate data-processing agreement has currently been concluded beyond the hosting and domain service agreement.

Cloudflare is used for DNS, content delivery, availability and protection against malicious traffic. When the website is accessed, the hosting provider and Cloudflare may process technical connection and security data such as IP address, requested URL, date and time, browser and device information, referrer, routing information and security events. Cloudflare may process data outside the European Economic Area under the safeguards described in its contractual and privacy documentation. Details are available in Cloudflare’s Privacy Policy.

Processing necessary to deliver and secure the website is based on Article 6(1)(f) GDPR. Our legitimate interests are reliable delivery, fraud prevention, error diagnosis and protection against attacks. Our own operational copies of these records are normally deleted within seven days. Provider-side security records may be retained under the provider’s applicable configuration and contractual terms.

3. Contact, orders and email

Before checkout, you must provide an email address and Discord name. We store these details with the order reference, purchased products, prices, discount information, fulfilment status and any delivery key so that we can identify the customer, match the payment and deliver the order. PayPal orders may additionally contain the payer email address returned by PayPal. You can query the latest matching order by providing either its reference or the checkout email address. Delivery keys are shown only when an order is found by reference.

Order and status emails are sent through our own mail service. Order notifications containing customer and order details are also sent to a private Discord channel through a server-side webhook. When you contact us, we process your contact details and message to respond to your enquiry. Processing for contracts and orders is based on Article 6(1)(b) GDPR; other support enquiries may be processed under Article 6(1)(f) GDPR.

Operational order records, Discord messages, support correspondence and webhook messages are normally deleted within seven days. If a support case remains unresolved, the relevant data is retained until the issue is resolved and is then deleted within seven days. Records that must be retained under tax, commercial or other mandatory law are kept for the applicable statutory period.

4. Shopping cart, Google Analytics and Search Console

The shopping cart and your privacy choice are stored in your browser’s local storage. The cart remains available after a page reload until you remove its products or clear browser data. The email address and Discord name entered at checkout are not stored in local storage.

Google Analytics is used only after you select “Accept analytics” in the privacy settings and only when a valid Analytics measurement ID is configured. Google may then process online identifiers, device and browser information, approximate location, visited pages, interactions and timestamps. Advertising signals and ad-personalisation signals are disabled in this website’s Analytics configuration. The legal basis is Article 6(1)(a) GDPR. You can change your choice through “Cookie settings” in the footer. Google may process data outside the European Economic Area under applicable safeguards. Further information is available in Google’s Privacy Policy.

Google Search Console is used by the operator to review indexing and search performance. The verification file or metadata does not itself set cookies. Google provides aggregated search-performance information to the operator.

5. Locally hosted fonts and profile images

The Inter and Space Grotesk fonts and the review profile images are stored on this website’s own server. Your browser downloads these files from our hosting provider. No requests to Google Fonts or the DiceBear API are made to display them. The hosting information in section 2 applies to these requests.

6. PayPal

The PayPal script is loaded when a product is added to the cart. This establishes a connection to PayPal. At checkout, the website sends product identifiers and quantities to our server. The server calculates the price and asks PayPal to create the order. The customer then signs in to PayPal if necessary and confirms payment. After approval, our server captures the order and verifies currency, amount and payment status before delivery.

PayPal (Europe) S.à r.l. et Cie, S.C.A. processes payment, account and technical usage data under its own responsibility. Processing required to carry out the requested payment is based on Article 6(1)(b) GDPR. PayPal may use cookies and process data internationally under its stated safeguards. Details are available in PayPal’s Privacy Statement.

7. Social media links

Discord, TikTok and YouTube are included as links. Clicking a link takes you away from this website. The platforms process data under their own privacy policies. If you message us through these platforms, our contact details and the information about handling enquiries are also relevant.

8. Recipients, international transfers and automated decisions

Depending on the action you take, recipients may include dataforest/Avoro, Cloudflare, Google, PayPal, Discord and our own email service. Some providers may process data outside Germany or the European Economic Area under their applicable contractual safeguards and privacy terms.

We do not make automated decisions that produce legal or similarly significant effects. PayPal independently decides whether it can offer and process a payment through a customer’s PayPal account.

9. Your rights

Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with effect for the future.

If processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time.

You may lodge a complaint with a data protection supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement. For requests concerning your data, use the contact details above.