Privacy

Privacy notice

1. Controller

The controller responsible for processing personal data on the Cirkit website and Cirkit platform is:
Turbin, Valentin & Pashchenko, Oleh GbR
Sälzerstr. 97
45143 Essen
Germany
Email: info@cirkit.gg

2. Scope and registration

This privacy notice applies to the Cirkit website and the Cirkit platform at app.cirkit.gg. When you register, we inform you about the processing required to use the platform.

Registration is not blanket consent to all processing. Processing required to create an account, perform the contract, and operate game sessions is carried out primarily under Art. 6(1)(b) GDPR. We request separate consent only where it is required, such as for newsletters or non-essential analytics and marketing technologies. Such consent is voluntary and can be withdrawn at any time with effect for the future.

The data requested as required for account creation and game operation are necessary to enter into the contract and use the relevant function. Without these data, we cannot create the account or provide the relevant function.

If you contact us by email or submit an inquiry through the Team Events form, we process the contact details (email address and/or phone number) and event details you provide to respond to your inquiry. We use Resend for the technical delivery of the form (see section 4). The legal basis is Art. 6(1)(b) GDPR for pre-contractual steps and Art. 6(1)(f) GDPR for other inquiries. We delete the information once the inquiry has been fully handled, unless statutory retention obligations or a subsequent contractual relationship require continued storage.

3. Data processing on the Cirkit platform

Depending on how you use Cirkit, we process the following grouped data categories:

  • Account and authentication: email address, name, username, profile image, account and login identifiers, and the time of the last login. We use these data to create, manage, and secure your account under Art. 6(1)(b) GDPR; security measures are also based on Art. 6(1)(f) GDPR. If you voluntarily sign in with Google, we receive the account details Google provides for the sign-in.
  • Game operation and sessions: selected arena, car and team, session times, status, usage data required to operate the game, and results. Processing is required to provide and operate the requested service under Art. 6(1)(b) GDPR.
  • Live streams: vehicle and arena cameras transmit live video without audio. The live image from the arena camera is visible only to players participating in the current game session and gives them an overview of the playing field. The camera is directed exclusively at the arena. Arena staff may exceptionally enter its field of view. A vehicle camera's live image is visible only to the person currently controlling that vehicle. It shows the vehicle's surroundings, so people may unintentionally enter the image. None of the live streams is publicly accessible. The platform does not record live video from vehicle or arena cameras. Processing of players is required to provide the game service under Art. 6(1)(b) GDPR. Other processing is based on our legitimate interest in providing the game under Art. 6(1)(f) GDPR. Signs at the arena provide notice of camera use. Supplementary on-site notices explain the purpose and operation of the live streams. Details of the controller are provided in section 1, information about your rights in section 12, and the privacy contact in section 13.
  • Community: profile name, profile image, club membership, rankings, results, and chat messages. These details are visible to signed-in platform users and are processed for community features you use under Art. 6(1)(b) GDPR. Uploaded club logos are publicly accessible.
  • Communications: email address, language, notification preferences, and the content or reason for a transactional message. We process these data for account-related, security, and contractual communications under Art. 6(1)(b) and (f) GDPR.
  • Promotions and benefits: promotional codes, referrals, bonuses, and their use. The legal basis is Art. 6(1)(b) GDPR where you use the relevant function, and Art. 6(1)(f) GDPR for abuse prevention.
  • Security, operations, and support: IP address, user agent, requested URL, timestamps, request and device identifiers, error data, audit events, and support activity. Our legitimate interest under Art. 6(1)(f) GDPR is the secure, traceable, and reliable operation of the platform and the prevention of fraud and abuse.

4. Recipients and service providers

Within our company, access is limited to persons who need it for operations, security, or support. We also use the following processors and service providers:

  • Clerk, Inc. for user accounts and authentication.
  • Google Ireland Limited for the optional sign-in with a Google account.
  • Google Ireland Limited for delivering web fonts through Google Fonts.
  • Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA, for the technical delivery of Team Event inquiries and transactional emails. Resend processes email content and metadata for this purpose. Email data is retained for 30 days by default; account data, including email metadata, logs, and API records, is stored in the United States. Information about international transfers is provided in section 10. Further information is available in Resend's Data Processing Addendum and Privacy Policy.
  • Supabase, Inc. for storing platform data in AWS region eu-central-2, Switzerland.
  • Hetzner Online GmbH for hosting the platform.
  • Cloudflare, Inc. for storing and delivering public club logos.
  • PostHog, Inc. for the server-side evaluation of necessary feature controls (“feature flags”). A user identifier linked to the account is processed for this purpose. We currently do not use PostHog for product analytics, reach measurement, or session recordings. The legal basis is Art. 6(1)(b) GDPR where the evaluation is required to provide the platform, and Art. 6(1)(f) GDPR based on our legitimate interest in operating the platform securely and in a controlled manner.

5. Newsletter and MailerLite

If you subscribe to the newsletter, your data is sent to MailerLite and stored in a language-specific group. German subscriptions are assigned to the German newsletter group, and English subscriptions to the English newsletter group.

The provider for users in the EEA, United Kingdom, and Switzerland is MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland. MailerLite processes subscriber data as our processor for email marketing. Newsletters are sent through MailerLite and each one contains an unsubscribe link. You can find more information in MailerLite's privacy policy.

6. Website, consent management, and cookies

The Cirkit website and Cirkit platform use Google Fonts for consistent typography. Font files are loaded directly from Google servers. Your browser therefore connects to Google and transmits, in particular, your IP address, the requested URL, browser and device information, and the referrer. According to Google, the Google Fonts Web API does not set cookies and does not use these data to create end-user profiles or for personalised advertising. Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is the consistent and technically reliable presentation of our services. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. You can find further information in the Google Fonts privacy information. Information on possible international transfers is provided in section 10.

We use a locally hosted copy of Silktide Consent Manager for cookie and tracking consent management. The component itself does not transmit data to Silktide. Necessary local storage is required for consent management. Analytics and marketing services are activated only after explicit consent. You can change your choice at any time through the “Cookie settings” link in the footer.

For storing or accessing information on your device, Section 25 TDDDG also applies. We use non-essential cookies, local storage entries, or comparable technologies only after your consent.

  • Necessary: consent storage and technically required local storage entries, including Silktide consent choices such as necessary, analytics, advertising, and initial consent state.
  • Analytics: Google Analytics 4 is loaded only after analytics consent.
  • Marketing: Meta Pixel is loaded only after marketing consent. Google Ads conversion tracking is loaded only after marketing consent if it is configured for this website.

7. Analytics and marketing

PostHog product analytics is currently not enabled in the Cirkit platform. PostHog is used there exclusively on the server for the necessary feature controls described in section 4. The PostHog browser SDK is not loaded.

We use Google Analytics 4 for reach and event measurement after analytics consent. We may use Google Ads conversion tracking after marketing consent if it is configured for this website. For Meta campaigns, the Meta Pixel is used after marketing consent. In the European Economic Area, these services are not loaded before prior consent.

Google Consent Mode v2 is configured with consent denied by default: analytics_storage, ad_storage, ad_user_data, and ad_personalization start as denied and are updated only after consent. Google Analytics is configured with IP anonymization.

Google services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Meta services for users in the European region are provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Data may be transferred to the United States or other third countries in connection with these services. The providers use safeguards such as data processing terms, standard contractual clauses, and/or the EU-U.S. Data Privacy Framework where applicable. You can find more information in Google's privacy policy and Meta's privacy policy.

We do not transmit email addresses or other contact details to Google or Meta through this website.

8. Website hosting

The website is hosted on Vercel. Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Server-side rendering for this website is configured to run in Vercel's Frankfurt region where supported. Static assets may still be delivered through Vercel's global CDN from an edge location close to the visitor. You can find more information in Vercel's privacy policy.

We do not operate our own server-log database for this landing page. Vercel may process technical access data as hosting provider to deliver the website, maintain security, and prevent abuse. This may include IP address, timestamp, requested URL, referrer, user agent, and technical request metadata.

9. Retention

We retain personal data only for as long as it is required for the relevant purpose or statutory retention obligations apply. Account data is retained until the account is deleted; directly identifying data is then deleted or anonymised unless an obligation or overriding reason requires further retention.

Field chat messages are regularly deleted after 24 hours and club chat messages after 90 days. Read platform notifications are deleted by default after 90 days and unread notifications after 180 days. The platform does not record live video from vehicle or arena cameras. Session data and game results are generally retained for the lifetime of the account where required for game history, rankings, and statistics. When the account is deleted, they are deleted or anonymised so that they can no longer be linked to the former user. Anonymised statistics may be retained permanently. Detailed technical session data and control events are generally deleted after 12 months. Data relating to a specific dispute may be retained until it has been finally resolved. Audit logs are generally retained for 12 months, platform access logs for 14 days, and application and error logs for 30 days. Logs relating to a specific security incident may be retained until the investigation and required follow-up measures are complete.

Newsletter data is retained until you unsubscribe, withdraw consent, or make a valid deletion request. Consent settings remain in the browser until changed or the browser data is deleted. A public club logo is deleted when the club is deleted. Cloudflare R2 is restricted to the EU Jurisdiction for these data; versioning of deleted objects is not enabled. Provider data is additionally subject to the settings and retention periods agreed with the relevant provider.

10. International transfers

Some service providers are based in the United States or use subprocessors outside the European Economic Area. Where personal data is transferred to a third country, we rely on an adequacy decision, including the EU-U.S. Data Privacy Framework for certified recipients, or appropriate safeguards such as the European Commission's Standard Contractual Clauses. Further information is available on request. The platform database is operated in AWS region eu-central-2 in Switzerland. The European Commission has adopted an adequacy decision for Switzerland.

11. No automated decision-making

Automated decision-making within the meaning of Art. 22 GDPR does not take place.

12. Your rights

Under the GDPR, you may have rights of access, rectification, erasure, restriction of processing, data portability, and objection. You can withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority in North Rhine-Westphalia is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany. You can delete your account through the account settings. You can exercise access, data export, and other privacy rights by email. We generally respond to such requests within one month.

13. Privacy contact

Please send privacy requests to: info@cirkit.gg.

14. Last updated

Last updated: August 23, 2026. Changes will be published on this page.