Privacy policy

The controller is Prime Codes GmbH, Pappelallee 78/79, 10437 Berlin, Germany. For privacy questions, contact us at [email protected].

When you visit our website, we process your IP address, date and time, the requested address and information about your browser. This is needed to deliver and secure the website; we briefly derive a country from the IP address to choose language and price region, and we keep short-lived counters per IP address against abusive requests. The legal basis is Art. 6(1)(f) GDPR; our interest is a secure and stable website. The data is stored for 30 to 90 days on servers in Germany.

We also count which pages and products are viewed, how many pages are open right now and how many different visitors come each day. For the visitor count we build a code from the IP address and browser details with a secret key, and it changes every day. Neither the IP address nor you can be derived from it, and the code is deleted after 36 hours at the latest. We store no IP address for this and set no cookies.

We use cookies and your browser’s local storage. Necessary storage is based on Section 25(2) no. 2 TDDDG; the personal data processed with it is based on Art. 6(1)(b) or (f) GDPR. Optional storage requires your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can change it at any time with effect for the future under “Cookie settings”. We do not use analytics or advertising cookies.

For the account, we process your Minecraft name and UUID, your password (as a hash only), your email address if you add one, your rank, details about two-factor login and passkeys, and connections to apps that you approve. For every session we store IP address, browser identifier, approximate location and times. We use the data to provide and secure the account, and we email you about logins and security.

The legal bases are Art. 6(1)(b) GDPR for using the account and (f) for security; our interest is protection against misuse. We keep account data until the account is deleted and session data until the session ends, 30 days at most.

For orders, we process the recipient’s Minecraft name or UUID, the chosen products and the order and payment status. Tebex Limited handles the payment. Tebex processes payment and contact data as an independent controller under its own privacy notice; we do not receive payment data. For regional prices and payment, we send your IP address to Tebex. We email you about payments, refunds and the Gem Pass at the email address you gave Tebex.

The legal basis is Art. 6(1)(b) GDPR, and (f) for protection against misuse. We keep order data for as long as commercial and tax law requires, up to ten years.

For gifts and shared carts, we store the recipient’s name and the products; a shared cart is valid for 7 days. For the welcome gift and for codes, we store Minecraft UUID, name and the time of redemption so that each person can use them only once (Art. 6(1)(b) and (f) GDPR). We keep this data permanently for as long as the one-time limit is meant to apply.

To show you suitable offers, we process details about your account and use, for example rank, past purchases, play time and activity in the shop. This is advertising for our own products based on Art. 6(1)(f) GDPR; our interest is to advertise our products in a fitting way. There is no automated decision with legal or similarly significant effect. You can object at any time. We delete expired or redeemed offers after 120 days. We keep the log of them together with your UUID permanently so that one-time offers do not appear again. We send promotional emails about sales, offers and discount codes to your account’s email address until you switch them off in your account or via “Unsubscribe” in the email (Art. 6(1)(f) GDPR, Section 7(3) UWG). For this we keep a hash of your address on a block list.

If you contact us by email, through Discord or through our forms, we process your details and the content of your message to handle your request. The legal basis is Art. 6(1)(b) GDPR, otherwise (f); our interest is to answer requests. The anonymous report form asks for neither name nor contact details; only share what you want to tell us. We keep messages and reports until they are handled and no duty to keep records remains.

For applications to our team or as a creator, we process the details from the form, for example Minecraft name, age, email address, Discord contact, profile links and your application text. We use them to decide on the application and to talk to you. The legal bases are Art. 6(1)(b) and (f) GDPR and Section 26 BDSG for applications for employment. Only the responsible team lead has access. We keep accepted applications for 90 days from acceptance and delete rejected ones no later than 14 days after the rejection.

We load YouTube videos (Google) and Twitch streams (Twitch) only after your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. The providers receive your IP address, among other things, and can store data on your device. They process the data as independent controllers. When you open links to Discord, Tebex or other services, you leave our website; their privacy notices apply there.

Recipients of your data are our technical service providers, Tebex, Google, Twitch and Discord as far as you use their services, and authorities where we are legally required to. Tebex, Google and Twitch may process data outside the European Economic Area, for example in the United Kingdom or the USA. Transfers rely on an adequacy decision or on standard contractual clauses under Art. 44 et seq. GDPR. You can get a copy of the safeguards on request at [email protected].

We store data only as long as the purpose needs or the law requires. The periods are given with each processing activity.

Giving us your data is necessary for the respective function. Without it, we cannot handle the account, order or application. There is no automated decision-making, including profiling, with legal effect.

You have the right to access, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation, and to advertising at any time. You can withdraw consent at any time with effect for the future.

Write to [email protected] for this. You can also complain to the Berlin Commissioner for Data Protection and Freedom of Information or another supervisory authority.

If you are young, use ordering and application functions only with the consent of a parent or guardian where the law requires it. We answer questions about this at [email protected].

We update this notice when processing or the legal situation changes. The date of the last change is shown above.