The controller responsible for processing on themodbase.com is Ralf Geisthardt, Donaustraße 24, 15827 Blankenfelde-Mahlow, Germany, email: shop@ihr-it-projekt.de. Mods are sold by the respective publishers; we are jointly responsible with them for orders (section 11).
The shop runs on servers operated by Hetzner Online in Germany. For every request we store a shortened IP address (last part removed), the time, the page accessed, the referrer and the browser identifier in order to keep the service running securely (Art. 6(1)(f) GDPR). The logs are deleted after 14 days.
We only use cookies that are technically necessary for the shop, and we do not use any tracking, advertising or analytics services. Fonts and images are loaded from our own server or from our storage at Hetzner (Object Storage in Nuremberg).
| Cookie | Purpose | Duration |
|---|---|---|
| userSession | keeps you signed in | 30 days |
| discord_refresh_token, discord_access_token | connection to Discord after sign-in | 30 days or the lifetime of the Discord token |
| localePublic | selected language | 30 days |
| basket | shopping cart without sign-in | 30 days |
| checkoutPublisherId | ongoing checkout | 1 day |
| passkey_challenge | sign-in with a passkey | 5 minutes |
| commission_ref | attribution of a referral (affiliate link) and whether a discount is active | 30 days |
You sign in with Discord. Discord provides us with your Discord ID, your name, your profile picture and your email address; we update the email address each time you sign in. Optionally, you can link your Steam account (Steam ID and your Workshop mods) or create passkeys (we only store the public key). The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). When you sign in, you accept the Terms and Conditions; we store the time, version and IP address as proof. We keep your account data until you delete your account; a sign-in remains valid for no more than 30 days.
After a purchase, our Discord bot uses your Discord ID to assign the matching roles on the publisher's Discord server.
For an order we process your billing address, the licences ordered and the payment data. Payment is made via Stripe or PayPal; the invoice is issued by the publisher, or via PayPal for PayPal invoices. These providers receive your name, address, email address and order data. We keep invoices and accounting records for 10 years (§147 AO, §257 HGB; Art. 6(1)(c) GDPR).
At checkout you accept the Terms and Conditions and the cancellation policy and request that performance begin immediately; as a result, your right of withdrawal expires. We store these declarations together with the time and the version of the legal texts as proof and confirm them to you by email.
When they start, your game servers report their IP address, port, hostname and the loaded mods so that we can check the licence. Servers remain in your account until you delete them; we delete start logs after 30 days and servers that were never confirmed after 7 days.
If you report a problem with a server, our Discord bot sends the server name, your name, your user ID and your message to the publisher's support channel on Discord.
Reviews appear with your name on the mod page and in the publisher's Discord channel, unless you review anonymously. If you delete your account, your reviews remain without your name. We only show a public profile and your Steam mods if you enable this in your profile.
If you arrive via a referral link, we store the code for 30 days in the commission_ref cookie so that the referrer receives a commission and you may receive a discount. For affiliates we process click counts, commissions and payouts; we keep accounting records for 10 years.
If you give other users access to servers or downloads, we store their Discord ID and the permissions granted until you revoke access.
We and the selling publisher are jointly responsible for orders, licence assignment and support (Art. 26 GDPR). The publisher can see its customers' data (name, email address, licences, servers, invoices) and processes payment through its own accounts; the publisher's privacy policy, linked at checkout, also applies. You can exercise your rights with us or with the publisher.
Discord, Stripe, PayPal, Valve (Steam) and GitHub also process data in the USA. Discord, Stripe, Valve and GitHub are certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission; PayPal bases the transfer on standard contractual clauses and intra-group agreements.
We store email addresses, billing addresses and access keys in encrypted form (AES-256) and sessions only as a hash. The connection is encrypted throughout (HTTPS, TLS for sending email). We log admin access to customer data and delete the log after one year.
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), as well as the right to withdraw consent with effect for the future. In your profile under "Privacy & Data" you can download all your data as a file, sign out on all devices or delete your account; invoices are retained without your name for the statutory retention period. You can lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.
We do not make automated decisions within the meaning of Art. 22 GDPR. Without the data described in sections 4 and 5, we cannot maintain an account or sell a licence.
Last updated: 14 October 2026