Privacy policy — RealPool

Deutsche Fassung

The German version is the legally binding one (DE ist maßgeblich). This English text is a non-binding convenience translation of both the general privacy notice and the 8ball-specific addendum.

1) Introduction and controller contact details

1.1 We are glad you are visiting our website and thank you for your interest. Below we inform you about how your personal data is handled when you use our website. Personal data is any data by which you can be personally identified.

1.2 The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is Rafael Wörner, Honigbart Studios, Konrad-Adenauer-Straße 18, 69221 Dossenheim, Germany, tel.: +4915679796569, e-mail: info@realpool.gg. The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

2) Data collection when visiting our website

2.1 When using our website for information only — i.e. when you do not register or otherwise submit information to us — we only collect data that your browser transmits to the server (so-called "server log files"): the website visited, date and time of access, the amount of data sent in bytes, the source/referrer from which you reached the page, the browser used, the operating system used, and the IP address used (where applicable in anonymised form). Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or otherwise used. We reserve the right, however, to check the server log files subsequently if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the "https://" prefix and the lock symbol in your browser bar.

3) Hosting & content delivery network

To host our website and display its contents, we use a provider that delivers its services — itself or through selected sub-contractors — exclusively on servers within the European Union. All data collected on our website is processed on those servers, unless different recipients are named below for specific processing. We have concluded a data-processing agreement with the provider that ensures the protection of our visitors' data and prohibits unauthorised disclosure to third parties.

4) Cookies

To make visiting our website appealing and to enable the use of certain functions, we use cookies — small text files stored on your device. Some are automatically deleted when you close your browser ("session cookies"); others remain on your device longer and allow page settings to be saved ("persistent cookies"). Where cookies also process personal data, processing is carried out pursuant to Art. 6(1)(b) GDPR to perform the contract, pursuant to Art. 6(1)(a) GDPR in the case of consent given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website. You can set your browser to inform you about the setting of cookies and decide individually about their acceptance, or to exclude their acceptance generally. Please note that the functionality of our website may be limited if cookies are not accepted.

5) Contacting us

5.1 When you contact us (e.g. by contact form or e-mail), personal data is processed solely for the purpose of handling and answering your enquiry and only to the extent necessary. The legal basis for processing this data is our legitimate interest in answering your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at a contract, the additional legal basis is Art. 6(1)(b) GDPR. Your data is deleted once the matter has been conclusively resolved and provided no statutory retention obligations apply.

5.2 Brevo — For sending transactional e-mails, i.e. event-driven messages triggered by a specific user action (such as conclusion of a contract, registration or password reset), we use this provider: Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. On the basis of our legitimate interest in effective and user-friendly e-mail communication, we pass on the data you provide when performing such a user action to this provider pursuant to Art. 6(1)(f) GDPR so that it handles the mail dispatch on our behalf. We have concluded a data-processing agreement with the provider that protects our visitors' data and prohibits disclosure to third parties.

6) Comment function

Within the comment function on this website, in addition to your comment, the time the comment was created and the commenter name you chose are stored and published on this website. Your IP address is also logged and stored — for security reasons and in case the person concerned violates third-party rights or posts unlawful content through a comment. We need your e-mail address to contact you should a third party object to your published content as unlawful. The legal bases for storing your data are Art. 6(1)(b) and (f) GDPR. We reserve the right to delete comments if third parties object to them as unlawful.

7) Data processing when opening a customer account

Pursuant to Art. 6(1)(b) GDPR, personal data continues to be collected and processed to the extent required when you provide it to us when opening a customer account. Which data is required for opening the account can be seen from the input mask of the relevant form on our website. You can delete your customer account at any time by sending a message to the controller's address stated above. After deletion of your customer account, your data is deleted, provided all contracts concluded thereunder have been fully processed, no statutory retention periods conflict, and we have no remaining legitimate interest in continued storage.

8) Use of customer data for direct advertising

8.1 Newsletter subscription — If you subscribe to our e-mail newsletter, we send you regular information about our offers. The only mandatory detail for sending the newsletter is your e-mail address; providing further data is voluntary. For newsletter dispatch we use the double opt-in procedure, ensuring you only receive the newsletter once you have expressly confirmed your consent by activating a verification link sent to the address provided. By activating the confirmation link you give us your consent pursuant to Art. 6(1)(a) GDPR; we store your IP address entered by your ISP and the date and time of registration in order to be able to trace possible misuse of your e-mail address at a later point. You may unsubscribe from the newsletter at any time via the link provided for this purpose or by a message to the controller named above.

8.2 Brevo — Our e-mail newsletters and other promotional e-mail communication are sent via this provider: Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. On the basis of our legitimate interest in effective and user-friendly e-mail marketing, we pass on the data you provided on registration to this provider pursuant to Art. 6(1)(f) GDPR so that it handles the mail dispatch on our behalf. We reserve the right — solely on the basis of your express consent pursuant to Art. 6(1)(a) GDPR — to carry out a statistical performance analysis of mail campaigns using web beacons or tracking pixels in the sent e-mails, measuring open rates and specific interactions with the newsletter content. You can revoke your consent to mail tracking at any time with effect for the future. We have concluded a data-processing agreement with the provider.

9) Data processing for contract performance

9.1 To process the contract we work with the service provider(s) below who support us, in whole or in part, in performing concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

9.2 Use of payment service providers — Stripe. One or more online payment methods of the following provider are available on this website: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When you select a payment method of the provider, the payment data you provide during the order process (including name, address, bank and payment card information, currency and transaction number) and information about the content of your order is passed to the provider pursuant to Art. 6(1)(b) GDPR. Your data is passed on solely for the purpose of payment processing with the provider and only to the extent necessary for it.

9.3 Electronic cancellation option for continuing obligations with consumers. Consumers who have entered into contracts on this website for paid continuing obligations (e.g. subscription contracts) have the option to cancel these via an electronic button in accordance with the applicable cancellation periods. Activating the button leads to a confirmation page where the consumer can provide further details about the cancellation, clearly identify themselves and then declare their cancellation electronically. The collection of personal data and its transmission to us is carried out pursuant to Art. 6(1)(b) GDPR and only to the extent necessary for the proper handling of the cancellation; a further legal basis is Art. 6(1)(c) GDPR, as we are legally obliged to provide an electronic cancellation option for such contracts.

9.4 Electronic withdrawal function for distance contracts. Consumers who conclude contracts on this website for which a statutory right of withdrawal exists have the option to declare the withdrawal via an electronic withdrawal function in accordance with the applicable withdrawal provisions. When using the withdrawal function, in addition to details identifying the contract to be withdrawn, further personal information such as the consumer's first and last name and e-mail address must be provided or confirmed. The collection of this information and its transmission to us is carried out pursuant to Art. 6(1)(b) GDPR and only to the extent necessary for the proper handling of the withdrawal; a further legal basis is Art. 6(1)(c) GDPR, as we are legally obliged to provide an electronic withdrawal function for paid consumer distance contracts.

10) Retargeting/remarketing and conversion tracking

10.1 Google Ads conversion tracking. This website uses the online advertising programme “Google Ads” and, within Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). We use Google Ads to draw attention to our offers with advertising material (so-called Google AdWords) on external websites. Based on the campaign data we can determine how successful the individual advertising measures are. Our aim is to show you advertising that is of interest to you, to make our website more interesting for you and to achieve a fair calculation of the advertising costs incurred.

The conversion-tracking cookie is set when a user clicks on an ad placed by Google. Cookies are small text files stored on your device. These cookies usually expire after 30 days and are not used to identify you personally. If you visit certain pages of this website and the cookie has not yet expired, Google and we can recognise that you clicked on the ad and were redirected to this page. Each Google Ads customer receives a different cookie, so cookies cannot be tracked across the websites of Google Ads customers. The information obtained with the conversion cookie, which includes your IP address, is used to compile conversion statistics for Google Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their ad and were redirected to a page carrying a conversion-tracking tag, but they receive no information that identifies users personally. Using Google Ads may also involve the transfer of personal data to the servers of Google LLC in the USA.

Details on the processing triggered by Google Ads conversion tracking and on Google's handling of data from websites: https://policies.google.com/technologies/partner-sites

All processing described above, in particular setting cookies to read information on the device used, takes place only if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the “cookie consent tool” provided on the website.

You can also object permanently to Google Ads conversion tracking setting cookies by downloading and installing the Google browser plug-in available here: https://support.google.com/My-Ad-Center-Help/answer/12155656

Please note that certain functions of this website may not be usable, or only to a limited extent, if you have deactivated the use of cookies. Google's privacy policy: https://business.safety.google/privacy/ and https://policies.google.com/privacy

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

10.2 Reddit tracking pixel. This website uses the conversion-tracking technology of the following provider: Reddit Inc., 420 Taylor Street, San Francisco, CA 94102, USA.

If you reached our website from an ad on the provider's domain, cookies and/or similar technologies (tracking pixels, web beacons, pings or HTTP requests) can be used to trace the success of the ad. For this purpose the tracking technology reads certain device and browser information, possibly including your IP address, in order to record and evaluate user actions we have defined in advance (e.g. completed transactions, leads, searches on the website, views of product pages). This allows statistics on usage behaviour on our website after a redirect from an ad, which we use to optimise our offer.

We have concluded a data-processing agreement with the provider that ensures the protection of our visitors' data and prohibits unauthorised disclosure to third parties.

For transfers of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with the European level of data protection.

11) Rights of the data subject

11.1 Applicable data protection law grants you the following data-subject rights vis-à-vis us as the controller regarding the processing of your personal data, with reference to the cited legal basis for the respective conditions of exercise: right of access (Art. 15 GDPR); right to rectification (Art. 16 GDPR); right to erasure (Art. 17 GDPR); right to restriction of processing (Art. 18 GDPR); right to notification (Art. 19 GDPR); right to data portability (Art. 20 GDPR); right to withdraw consent given (Art. 7(3) GDPR); right to lodge a complaint (Art. 77 GDPR).

11.2 RIGHT TO OBJECT. IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST IN THE COURSE OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS. WHERE YOUR PERSONAL DATA IS PROCESSED FOR DIRECT-MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME; IF YOU DO SO, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT-MARKETING PURPOSES.

12) Duration of storage of personal data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and — where applicable — additionally by the relevant statutory retention period (e.g. commercial and tax retention periods). Where personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent. Where statutory retention periods exist for data processed under Art. 6(1)(b) GDPR, that data is routinely deleted after the retention periods expire, unless it is still required for contract performance or initiation and/or we have a remaining legitimate interest in continued storage. Where personal data is processed on the basis of Art. 6(1)(f) GDPR, that data is stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. Where personal data is processed for direct-marketing purposes under Art. 6(1)(f) GDPR, that data is stored until you exercise your right to object under Art. 21(2) GDPR. Otherwise, stored personal data is deleted once it is no longer necessary for the purposes for which it was collected or otherwise processed, unless the other information in this declaration about specific processing situations provides otherwise.

Additional notes for RealPool

The following notes supplement the general information above with the processing operations specific to the online service RealPool. In the binding German version they are a legally binding part of the privacy policy.

Alpha waitlist and optional newsletter

The following specific information applies to the alpha waitlist and the newsletter offered here. Where it differs from the general information in Sections 8.1, 8.2 or 11, the following information takes precedence for these processing operations. Your statutory data protection rights remain unaffected.

We use your email address and language preference to email you once when the RealPool alpha opens. If you also select the optional newsletter, you receive occasional emails from Honigbart Studios about RealPool news, new features and offers. The two purposes have separate consents. The legal basis for sending the respective messages is Art. 6(1)(a) GDPR. The newsletter is not a requirement for joining the alpha waitlist.

Both consents are confirmed through double opt-in. After your request, we send a confirmation email. It names the purposes for which confirmation was requested. One request can contain both selected purposes. The confirmation link is valid for seven days. It opens a page where you confirm the request by pressing a button. Only this confirmation activates the consents contained in that request. Merely opening the link does not activate them.

We store your email address, language preference, requested purposes and the respective consent status. We also store the times and status of sign-ups, confirmation requests, confirmations and withdrawals. Our evidence records contain hashed confirmation identifiers and the versions of the consent texts, privacy notice and confirmation email template. We also store the technical sending status, an error code where applicable and the message identifier returned by Brevo. In the waitlist and consent records, the IP address and browser identifier (User-Agent) at sign-up and confirmation are stored exclusively as salted hashes. These hashes are pseudonymous personal data.

Operating the confirmation procedure, sending the confirmation email, keeping evidence and preventing abuse are based on Art. 6(1)(f) GDPR. Our legitimate interests are checking whether the email address holder confirmed the sign-up, documenting consent and withdrawal, preventing abusive sign-ups and defending against legal claims.

If the sign-up link contains a referral code (ref), we record it in the waitlist entry. It allows referrals to be attributed within the alpha referral programme and the corresponding rewards to be administered. We store the utm_source channel value from the sign-up link as the source of the sign-up. If it is missing and the link contains an ad platform's click identifier (gclid from Google, rdt_cid from Reddit), we store only the name of the platform as the source. We do not store the click identifier itself. This allows us to identify which channels bring people to the waitlist. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are accurate referral attribution and evaluating our sign-up channels.

To fulfil the promised Founder rewards, we match the email address of a verified game account against the waitlist. Leading and trailing spaces and differences in letter case are disregarded. For the Chalk bonus, this matching considers every existing waitlist entry. For the cosmetic Founder rewards, it considers only entries whose alpha sign-up was confirmed through double opt-in at least once. The legal basis for this matching and granting the promised rewards is Art. 6(1)(b) GDPR. A later withdrawal of alpha or newsletter consent does not change reward eligibility already acquired.

We use Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, as a processor under Art. 28 GDPR for sending emails. This also includes the transactional confirmation emails used for double opt-in. Brevo receives the recipient email address and message contents required for sending, including confirmation and withdrawal links. A data-processing agreement is in place with Brevo.

Retention

Unused confirmation requests are deleted after their seven-day validity period and an additional day. This also applies to superseded or invalidated requests. Deletion takes place during the next cleanup run. Cleanup normally runs every six hours and at server startup.
If consent was never confirmed for an email address, we delete its waitlist entry once no confirmation requests or consent history remain. This normally happens about eight days after the most recent confirmation request.
Confirmed waitlist entries remain stored while needed for the alpha notification or Founder reward matching. We determine the completion of this processing through an operator decision when the alpha notification is sent or the waitlist is closed. There is currently no fixed deletion date.
A confirmed newsletter subscription continues until you withdraw consent or the newsletter is discontinued. Closing the alpha waitlist does not end a separate newsletter consent.
Once neither consent remains active, we retain the waitlist entry, used confirmation requests and consent and withdrawal history as evidence. The legal basis is Art. 6(1)(f) GDPR for defending against legal claims. Retention ends at the end of the third calendar year following the year of the last recorded confirmation or withdrawal event. The timestamps recorded in UTC determine the relevant year. If the last event occurs in 2026, the period ends on 31 December 2029. These records are then deleted together during the next cleanup run, once no unused confirmation request still needs to be retained.

You can withdraw either consent separately at any time with effect for the future. The confirmation email contains purpose-specific withdrawal links. Each link opens a page with a button for withdrawing consent. Merely opening the page does not withdraw consent. You can also email info@realpool.gg. Please specify which consent you wish to withdraw. We then stop sending further messages for that purpose. The other consent remains in place. Withdrawal does not affect the lawfulness of processing based on your consent before withdrawal. Unsubscribing does not immediately delete the entire waitlist entry. The retention periods above apply.

Many email apps also show an "Unsubscribe" button on our emails. Brevo provides this function. If you use it, Brevo blocks further emails from that sender address to you. We read these unsubscribes from Brevo at server start, regularly every six hours and before every confirmation through a valid confirmation link. Because they do not show which purpose you mean, we treat such an unsubscribe as withdrawal of both waitlist consents that rest on a confirmation requested before the unsubscribe. We invalidate confirmation links requested before the unsubscribe. We treat a later new sign-up as a new decision. If this withdraws a consent, we store as evidence the unsubscribe reason Brevo reports, the sender address concerned and the time. Emails about a game account, such as password resets, are sent from a separate sender address. Unsubscribing from a waitlist email does not block them. If you used the unsubscribe function on an account email and want to receive account emails again, write to info@realpool.gg. This does not revive your waitlist consents.

Processing based on Art. 6(1)(f) GDPR is also subject to the right to object under Art. 21 GDPR, as explained in Section 11.2. You can also send waitlist access and erasure requests to info@realpool.gg. A game account is not required.

Cookie consent tool and proof of consent

We currently use the services described in Section 10 (Google Ads conversion tracking, Reddit tracking pixel) only on the home page. You reach the cookie consent tool there via “Cookie settings” in the footer, or directly via open cookie settings. In it you can activate each service separately and deactivate it again at any time. Without your consent none of the services is loaded.

We store your choice in your browser's local storage (localStorage) together with a randomly generated identifier, the version of the consent tool and the time. This storage is strictly necessary to provide the consent tool (Section 25(2) no. 2 TDDDG). We ask again after twelve months.

In addition, we store each decision on our server with this identifier, the version, the choice per service and the time, without an IP address and without any link to a game account. This record serves as proof of consents and withdrawals (Art. 7(1) GDPR). The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest is documenting consents and withdrawals and defending against legal claims. We delete the records for an identifier at the end of the third calendar year after the last decision for that identifier ceased to have effect.

If you have consented, we report your sign-up to the waitlist once as an event (“Lead”) to the activated services. We do not transmit an email address, only a randomly generated event identifier. To avoid reporting the event twice, we place a marker with the time in your browser's local storage. This marker is based on your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) and is valid for twelve months. Once it has expired, or once you have deactivated all services, we remove it on your next visit to the home page or immediately, respectively.

Game replays

For networked matches, the course of play is stored on the server as a replay. The replay contains the deterministic course of the match and a link to the accounts involved. The legal basis is Art. 6(1)(b) GDPR (performance of the usage contract), and additionally Art. 6(1)(f) GDPR for anonymous matches.

Upon an erasure request under Art. 17 GDPR, the link between the replay and your account is removed: the account identifiers in the indexed database are set to "empty" so the replay can no longer be attributed to you. The match itself remains in the corpus for the reproducibility of the game simulation, without personal reference.

Ranking rating (Glicko)

For ranked matches we compute a skill rating using the Glicko procedure (rating value, rating deviation and volatility per account) and a record of the ranked matches played. The legal basis is Art. 6(1)(b) GDPR.

While the rating is computed automatically, it does not constitute an automated decision in an individual case producing legal effects or similarly significant effects within the meaning of Art. 22 GDPR: it merely classifies playing strength within the service and has no legal or comparably significant external effect.

Table chat and moderation

During networked matches, short text messages can be exchanged via the table chat. To protect participants, messages are automatically pre-checked against a wordlist before delivery; messages classified as non-compliant are not delivered. Content-free moderation and restriction records are kept about rejected messages and graduated follow-up measures (action, time, match and sequence reference). Further details on the procedure are set out in section 9 ("Moderation and restriction of content") of the Terms and Conditions.

The legal basis for chat messages is Art. 6(1)(b) GDPR, and for the protective pre-check Art. 6(1)(f) GDPR. Upon an erasure request under Art. 17 GDPR, the content of your chat messages is emptied and the account link is removed from the chat and moderation records; the content-free records remain as evidence without personal reference.

Derived gameplay statistics

From ranked matches we derive gameplay statistics per account (such as features of individual shots and aggregated metrics). Matches from private rooms are not included; for individual accounts the statistical evaluation may be excluded. The legal basis is Art. 6(1)(f) GDPR.

Upon an erasure request under Art. 17 GDPR these statistics are not deleted but pseudonymised: the account link is replaced with a pseudonymous identifier. The data thus remains in the corpus in pseudonymised form, based on Art. 17(3)(d) in conjunction with Art. 89 GDPR (statistical purposes).

Backups

For disaster recovery, encrypted backup copies (database, replays and a technical key value) are kept with an object-storage provider outside the production system: Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany. The backups are encrypted before upload; the provider holds encrypted data only. A data-processing agreement (including EU standard contractual clauses) is in place with the provider. The legal basis is Art. 6(1)(f) GDPR.

Since an erasure in the production system does not immediately reach backup copies already created, erased data may persist in encrypted backups for the duration of the backup cycle and is removed when the cycle is overwritten in due course.

Monitoring

External monitoring is currently disabled; if it is activated, a data-processing agreement will be concluded and an entry added to this privacy policy beforehand.

Recipients and processors

Within the scope of the purposes described above, personal data is passed to the following processors, with each of whom a data-processing agreement is in place: Hetzner Online GmbH (hosting and storage within the European Union), Brevo GmbH (transactional and promotional e-mail dispatch), and Cloudflare Germany GmbH (encrypted backups outside the production system).

Section 10 of the privacy policy above applies to Google Ads conversion tracking and the Reddit tracking pixel. These services are loaded only after your consent.

The payment processing via Stripe Payments Europe Ltd. described in Section 9 of the privacy policy above, and the electronic cancellation option (Section 9.3), relate to the paid offerings (cosmetics shop, supporter membership). Until these are activated, no payment data is processed. Once activated, payment data is transmitted to Stripe solely for the purpose of payment processing.

Exercising your data-subject rights

You can trigger access (Art. 15 GDPR) and erasure (Art. 17 GDPR) for your account directly in the Account area via the buttons there ("Datenkopie anfordern" / request a data copy and "Konto-Löschung beantragen" / request account erasure). For other matters, the contact point listed at /legal/contact is available.