Last updated: September 30, 2026

Privacy Policy

1. Controller

movieparkmc – Merlin John Goehlich, c/o Online-Impressum #5723, Europaring 90, 53757 Sankt Augustin, Germany.

Email: merlin@moviepark-minecraft.de. You may also use support@moviepark-minecraft.de for support matters. No data protection officer has been appointed where there is no legal duty to do so.

2. Data categories

  • Account data including username, email, language, identifiers, roles, status, login and security data.
  • Minecraft and optional Discord links including UUID, profile name and avatar.
  • Usage and game data including coins, ride counts, quests, permissions, reservations, tickets, training and server events.
  • Contract and payment data including cart, order, configuration, price, payment status, PayPal references, subscriptions, delivery, refunds and disputes. The payment provider generally handles full payment credentials.
  • Communications from support, attachments, email, applications, moderation and voluntary content.
  • Technical data including IP address, timestamps, URL, referrer, browser/device data, session/security identifiers, server and error logs.

3. Purposes and legal bases

  • Account, contract, server features, reservations, shop, delivery, subscriptions, support and refunds: Art. 6(1)(b) GDPR.
  • Commercial, tax, consumer-protection and other legal duties: Art. 6(1)(c) GDPR.
  • Security, fraud and abuse prevention, moderation, evidence, troubleshooting and legal claims: Art. 6(1)(f) GDPR. Our interests are safe, fair and economical operation and protection of the community and rights.
  • Voluntary links, publication and consent-based features: Art. 6(1)(a) GDPR. Consent can be withdrawn prospectively at any time.

4. Required data

Required fields are necessary for the relevant contract, account or feature. Without them the service cannot be provided. Other information is voluntary.

5. Recipients and services

  • Hosting, database, storage, email and infrastructure providers.
  • PayPal when selected; PayPal acts partly as an independent controller.
  • Discord for login, linking or notifications, and Microsoft/Mojang to verify Minecraft names, UUIDs and public profile data.
  • Google Fonts, Google/YouTube, Twitch and other embeds or CDNs when loaded by a page; IP address, browser data and the visited page may be transmitted.
  • Authorities, courts, advisers or other recipients when legally required or necessary for legal claims.

6. Transfers outside the EEA

Some providers, particularly PayPal, Discord, Microsoft, Google and Twitch, may process data outside the EEA. Where required, transfers rely on an adequacy decision, the EU-US Data Privacy Framework, EU standard contractual clauses or a statutory exception. Providers supply further details.

7. Cookies and local storage

Strictly necessary cookies and storage support login, sessions, CSRF protection, security, language and cart. Device access relies on section 25(2) no. 2 TDDDG; subsequent processing relies on Art. 6(1)(b) or (f) GDPR.

Non-essential cookies, storage and consent-requiring external embeds are used only with consent, which can be withdrawn through the offered settings.

8. Social links and measurement

For social-link and QR visits, we process campaign, destination, time, referrer and browser data to measure reach and detect abuse. Reports do not store IP addresses in plain text. The basis is Art. 6(1)(f) GDPR and our interest in measurement and manipulation prevention.

9. Retention

  • Account and game data for the account lifetime and later only for open claims, abuse prevention or legal duties.
  • Contract, booking and payment records until commercial and tax retention periods expire, typically six, eight or ten years depending on the record.
  • Support and moderation data until no longer needed for traceability, security, ban evasion or legal claims.
  • Technical logs generally for a short period, longer only for security incidents or a specific retention reason.
  • Consent evidence until relevant limitation periods expire; rejected applications generally no longer than six months unless another basis applies.

10. Automated decisions

Systems may prioritize reports or temporarily restrict access using clear technical rules. Decisions with legal or similarly significant effects are not made solely automatically unless a statutory exception applies. Human review may be requested through support.

11. Your rights

Subject to statutory conditions, you have rights of access, rectification, erasure, restriction, portability and objection. You may withdraw consent prospectively. You may object to Art. 6(1)(f) processing for reasons relating to your situation and to direct marketing at any time without reasons.

Contact merlin@moviepark-minecraft.de. You may also complain to a data protection supervisory authority.

12. Security and updates

We use appropriate technical and organizational safeguards; no internet service can guarantee absolute security.

We give appropriate notice of material changes. The published version applies.