Privacy Policy

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

HeadCom — Daniel Schmidt
c/o Online-Impressum 11035 Europaring 90 53757 Sankt Augustin
headcom@gmx.net

This Privacy Policy applies to the HeadCom website, user accounts, player profiles, matchmaking, matches, game servers, chat and private messaging, friends and clans, reports and moderation functions, contact requests and related technical services. HeadCom is exclusively available to persons aged 18 or older. Persons under the age of 18 may not create or use a HeadCom account. HeadCom is currently operated as an open beta service.

HeadCom uses Steam/OpenID for authentication. When you sign in through Steam, HeadCom receives and processes information required to identify your Steam account, in particular your SteamID, public Steam profile name and public profile avatar where available.

HeadCom may use the Steam Web API to retrieve public Steam profile information necessary to operate the account and player profile. HeadCom does not receive your Steam password.

Steam is operated by Valve Corporation. Steam processes personal data independently under its own privacy terms. Valve may process or transfer personal data outside the European Economic Area under the safeguards described in its own privacy information.

Depending on the features you use, HeadCom may process your SteamID, username, avatar, player identifier, country, competitive rating, match statistics and profile information voluntarily entered by you.

Optional profile information may include Discord, FACEIT and hardware information such as CPU, GPU, RAM, monitor, mouse, keyboard, headset and other hardware details.

The purpose is to provide your player profile, competitive services, statistics, social features and account functionality.

To provide matchmaking and competitive matches, HeadCom processes player identifiers, match status, map and veto information, match acceptance information, scores, results, rating changes and related competitive data.

When a match is assigned to a game server, the game server service receives the technical information required to create and operate the match. This may include Steam identifiers, HeadCom player identifiers, the match identifier, selected map, temporary server credentials and server configuration information.

Completed and cancelled matches, competitive results, ratings, rating history, player statistics and relevant match events may be retained as part of the historical competitive record of HeadCom.

These records are not treated as a complete copy of your personal account. Following account deletion, historical competitive records may remain where necessary for the integrity of rankings, statistics, match history, fraud or abuse prevention and other legitimate operational purposes. Personal account information is removed or disconnected from the historical record where legally and technically possible.

HeadCom uses dedicated game-server infrastructure to host competitive matches. Required match and player data is transmitted to the relevant game server so that the match can be started, operated and concluded. The game-server infrastructure may technically process connection data, Steam identifiers and server-side game information required to operate the match.

HeadCom provides communication functions including general chat, match chat and private messages between accepted friends. Messages may be processed and stored for the operation of these functions, abuse prevention and moderation.

General chat messages are technically deleted when they are older than 8 hours during the relevant chat retrieval process. Private messages are technically deleted when they are older than 6 hours during the relevant private-message retrieval process. Because these clean-up processes are triggered by service requests, deletion may technically occur later than the stated age threshold.

Match chat is associated with the relevant match and may remain available as part of the match record unless it is deleted for a specific legal, moderation or operational reason.

If you use social features, HeadCom processes the information necessary to provide them, including friendship relationships, clan memberships, clan invitations, clan activity records and guestbook entries. This information may be visible to other HeadCom users according to the relevant feature's access rules.

HeadCom provides reporting and moderation functions for cheating, griefing, abuse, exploitation, match manipulation, inappropriate communication and other violations of the platform rules.

Reports may contain the identity of the reporting and reported users, the relevant match or content, a copy or snapshot of reported communication, the selected reason, descriptions and moderation information.

Moderation and punishment records may be retained for as long as reasonably necessary to enforce platform rules, investigate abuse, protect the service and resolve disputes or appeals, subject to applicable legal requirements. If a message is reported, a copy or snapshot of the reported communication may remain part of the report or moderation record even after the original chat message has been removed by the normal short-term cleanup process.

When you authenticate with HeadCom, technical request information may include your IP address. The IP address may be used for authentication, security, abuse prevention and protection against fraudulent or unauthorized activity. The IP address received during Steam authentication is used to determine the player's country where technically required; HeadCom does not intentionally store the authentication IP address as part of the player profile.

HeadCom uses the technically necessary headcom_sessioncookie to maintain your authenticated session.

The cookie is HttpOnly, uses secure transport in production and is configured with an appropriate SameSite policy. It is not used for advertising or cross-site behavioural tracking.

The cookie is technically necessary to provide the authenticated HeadCom service expressly requested by the user. Its use therefore falls under the exception in Section 25(2) no. 2 TDDDG and does not require consent.

HeadCom does not currently use advertising cookies or third-party analytics cookies.

HeadCom does not currently use browser local storage to persist personal data, notification data or user profiles. Functional interface state is kept only in the active application state. HeadCom does not use browser local storage for advertising, cross-site tracking or profiling.

If you contact HeadCom through the contact form, HeadCom processes the information you provide, such as your name, email address, subject and message, in order to receive, handle and respond to your request. Depending on the request, the communication may also be retained as necessary to document or resolve the matter. Contact requests are transmitted to the HeadCom contact mailbox using the GMX email service operated by 1&1 Mail & Media GmbH.

HeadCom uses infrastructure provided by netcup GmbH for the technical operation of the website, backend services, database services and game-server infrastructure.

The server infrastructure used by HeadCom for these services is located in Germany. In the course of hosting, technical connection data, IP addresses, server and log data, and other data required for the operation and security of the services may be processed. Processing serves the provision, security and stability of HeadCom and the prevention and investigation of misuse and technical attacks. For hosting, HeadCom uses netcup GmbH as its infrastructure provider. Contact emails are handled through the GMX email service operated by 1&1 Mail & Media GmbH.

Personal data may only be transferred to countries outside the European Economic Area where the applicable legal requirements for such transfers are satisfied. International processing may occur in connection with Steam/Valve services. Such processing is subject to the safeguards and transfer mechanisms described in Valve's own privacy information. HeadCom does not intentionally transfer the account, match and chat database to third countries unless a lawful transfer mechanism applies.

HeadCom retains personal data only for as long as necessary for the respective purposes, unless a longer retention period is required or permitted by law.

General chat messages are technically deleted when they are older than 8 hours during the relevant chat retrieval process. Private messages are technically deleted when they are older than 6 hours during the relevant private-message retrieval process. Because these cleanup processes are triggered by service requests, deletion may technically occur later than the stated age threshold.

Reported-message snapshots, moderation records, punishments and appeals are retained only for as long as reasonably necessary for moderation, enforcement of platform rules, abuse prevention, security, dispute or appeal handling, or compliance with legal obligations.

Session cookies have a maximum lifetime of 30 days. Historical matches, ratings and statistics may be retained beyond account deletion where necessary to preserve competitive records, rankings, statistics, prevent abuse or fraud, maintain security, handle disputes or establish, exercise or defend legal claims.

You can permanently delete your HeadCom account using the account deletion function provided in your dashboard.

Account deletion is irreversible. The account identity and personal account information are deleted where legally and technically possible. Player profile information that is no longer necessary is removed or disconnected.

Historical matches, competitive statistics, rating history and other records may remain where their continued retention is necessary for the integrity of the competitive service, legal obligations, security, abuse prevention or establishment, exercise or defence of legal claims. Where possible, such records are disconnected from the deleted account and may be displayed using a generic designation such as "Deleted User".

Account deletion does not necessarily erase information that HeadCom is legally required or otherwise legally permitted to retain.

Subject to the applicable legal requirements, you may have the right to:

• request access to your personal data;
• request rectification of inaccurate data;
• request erasure of personal data;
• request restriction of processing;
• object to processing based on your particular situation;
• receive personal data in a portable format where applicable;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a competent supervisory authority.

These rights are subject to statutory exceptions and limitations. For example, the right to erasure does not apply where continued processing is required or otherwise permitted under applicable law.

Depending on the specific processing activity, HeadCom relies in particular on Article 6(1)(b) GDPR where processing is necessary to provide and administer requested HeadCom services, including accounts, matchmaking and competitive matches. Article 6(1)(f) GDPR applies, where applicable, to legitimate interests such as platform security, abuse prevention, moderation, enforcement of platform rules and protection of users. Article 6(1)(c) GDPR applies where processing is necessary to comply with a legal obligation. Article 6(1)(a) GDPR applies where processing is based on valid consent.

HeadCom may use automated technical processes for matchmaking, queue management, rating calculations and service operation. These processes do not currently constitute decisions producing legal effects or similarly significant effects on individuals within the meaning of Article 22 GDPR. Moderation and punishment decisions may involve human review according to the applicable platform procedures.

HeadCom implements appropriate technical and organizational measures intended to protect personal data against unauthorized access, alteration, disclosure, loss and destruction. Security measures include authenticated sessions, access controls, server-side authorization, protected service-to-service communication and restricted handling of credentials. No internet-based system can guarantee absolute security.

HeadCom may update this Privacy Policy when the service, processing activities or applicable legal requirements change. The current version published on this page is authoritative for the processing described in it. Material changes will be communicated where required by law.

For questions, requests concerning your GDPR rights or other data-protection matters, contact:

headcom@gmx.net

You also have the right to lodge a complaint with a competent data protection supervisory authority. You may in particular contact the supervisory authority of your habitual residence, place of work or the place of the alleged infringement. For the controller's establishment in North Rhine-Westphalia, the competent authority is in particular the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, E-Mail: poststelle@ldi.nrw.de.