Privacy Policy

1. General

The protection of your personal data is an important concern for us. We treat personal data confidentially and in accordance with statutory data protection regulations and this Privacy Policy.

With the following information, we explain which personal data is processed when using https://elbu.net, for what purposes this happens, on what legal basis the processing is carried out, and what rights you are entitled to as a data subject.

On this website, users can log in, in particular, using their Twitch account. Furthermore, the services offered by this website consist, in particular, of the management and automated delivery of advertisements within livestreams, as well as the analysis, evaluation, and optimization of corresponding advertising measures.

Personal data means any information relating to an identified or identifiable natural person, or any data with which you can be personally identified.

2. Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

elbu UG (haftungsbeschränkt)
Nagelsweg 22
20097 Hamburg

Email: [email protected]

The controller determines, solely or jointly with others, the purposes and means of the processing of personal data.

3. General Information on Data Processing

We process personal data exclusively within the framework of the applicable statutory regulations. This applies in particular to the General Data Protection Regulation (GDPR), national data protection regulations, and other data protection requirements.

The processing of personal data only takes place for the provision of a functional online offering, for the operation of the system for delivering automated advertisements, for the security of our technical systems, to fulfill legal obligations, or to safeguard legitimate interests, to the extent necessary.

In doing so, we adhere to the principles of data minimization and purpose limitation. This means, in particular, that only data required for the respective purpose is processed, and that personal data is not further processed for other purposes without a legal basis.

Furthermore, we implement technical and organizational security measures to protect personal data against loss, manipulation, unauthorized access, or other unlawful processing.

4. General Information on the Legal Bases for Data Processing on this Website

Consent: Insofar as we obtain the consent of the data subject for personal data processing operations, Art. 6 (1) lit. a GDPR serves as the legal basis.

Performance of a Contract: If the processing of personal data is necessary for the performance of a contract or to carry out pre-contractual measures, it is carried out on the basis of Art. 6 (1) lit. b GDPR.

Legal Obligation: Insofar as processing is necessary to fulfill a legal obligation, it is carried out on the basis of Art. 6 (1) lit. c GDPR.

Vital Interests: If processing is necessary to protect the vital interests of the data subject or of another natural person, it is based on Art. 6 (1) lit. d GDPR.

Legitimate Interests: If the processing is necessary to safeguard the legitimate interests of our service or of a third party, and if the interests, fundamental rights, or fundamental freedoms of the data subject do not override the first-mentioned interest, the processing is carried out on the basis of Art. 6 (1) lit. f GDPR.

The specific legal basis applicable in each individual case is set out in the following sections of this Privacy Policy.

5. Technical Provision of the Website

When you access this website, the browser used on your device automatically transmits information to the web server. This information is technically necessary so that the content of the website can be delivered to your device.

In particular, the following data may be processed:

IP address of the accessing device
Date and time of access
Name and address of the accessed file or page
Amount of data transferred
Notification of successful retrieval
Browser type and version
Operating system used
Referrer URL, if transmitted by the browser
Technical error and status information

This data is required to display the website correctly, to establish the connection between the browser and the server, to ensure system stability, and to detect security incidents and abusive usage. Without the processing of this technically necessary information, operation of the website would not be possible.

Furthermore, we reserve the right to evaluate server log files if there are concrete indications of illegal use, technical disruptions, attacks on the infrastructure, or other security incidents.

The processing is carried out on the basis of Art. 6 (1) lit. f GDPR, as we have a legitimate interest in the secure, functional, and economically viable operation of our online service.

Insofar as access to end-device information or technically necessary storage occurs, this is additionally based on Sec. 25 (2) No. 2 TDDDG (technically necessary operations).

5.1 Hosting

This website is operated on servers of Hetzner Online GmbH and OVH Groupe SAS or their affiliated companies within the framework of hosting and infrastructure services.

To provide the website, databases, and technical systems, it may be necessary for personal data to be processed as part of the hosting services.

This includes, in particular:

IP addresses
Connection data
Server log data
Authentication data
Content data processed for technical reasons

The processing is carried out for the purpose of providing a secure, stable, and high-performance online service. The legal basis for this is Art. 6 (1) lit. f GDPR, as we have a legitimate interest in a reliable technical infrastructure.

Insofar as the hosting provider processes personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.

5.2 Use of Cloudflare

To protect and optimize this website, we use services provided by Cloudflare, Inc., 101 Townsend St., San Francisco, California 94107, USA.

Cloudflare provides a Content Delivery Network (CDN), security functions, and protection mechanisms against abusive access and attacks on the server infrastructure. In the process, data traffic between your browser and our website may be routed through Cloudflare's servers.

In particular, IP addresses, connection data, technical header information, security data, and access requests may be processed.

The use of Cloudflare is based on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR, as we have an interest in a secure, fast, and stable provision of our online offering and in protection against attacks and downtime.

Insofar as personal data is transferred to a third country in this context, this is done in accordance with the statutory requirements of Art. 44 et seq. GDPR. Further information on data processing by Cloudflare can be found in Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

6. Purpose and Content of the Service

The website https://elbu.net provides a platform through which Twitch streamers can link their Twitch accounts with our system.

The purpose of this service is in particular:

The authentication and linking of Twitch accounts
The automated management and delivery of advertisements within Twitch livestreams
The analysis of the reach and performance of advertising measures
The statistical evaluation of streaming activities
The provision of key performance indicators (KPIs) and reports
The optimization of advertising campaigns
The creation of anonymized or pseudonymized case studies and performance examples
The documentation and traceability of advertisements placed

To provide these functions, it may be necessary to process personal data of the linked Twitch account.

7. Processing of Twitch Account Data

To use the platform, logging in via Twitch is optionally required. After appropriate authorization by the user, personal data can be retrieved, stored, and processed from the Twitch account.

Depending on the scope of the permissions granted, this may include in particular:

Twitch username
Display name
Twitch ID
Profile picture
Email address (insofar as shared by Twitch)
Channel information and channel description
Follower counts, subscriber counts, and viewer numbers
Streaming times and livestream metadata
Reach and performance metrics
Advertising and campaign data
Analytics and statistical data
Information about advertisements delivered
Further data provided via the Twitch API

This data is processed to provide the functions offered, manage advertising placements, evaluate performance metrics, and enable the use of our service.

The processing is based on Art. 6 (1) lit. b GDPR, insofar as it is necessary to provide the services requested by the user. Insofar as further analyses or statistical evaluations are carried out, the processing is based on Art. 6 (1) lit. f GDPR due to our legitimate interest in the further development, optimization, and economic evaluation of our service.

8. Linking of External Accounts

To use individual functions of our service, it may be necessary to link external accounts with a user account within our system. This applies in particular to accounts of third-party providers such as Twitch, Google, TikTok, or comparable services, provided corresponding integrations are made available.

Within the scope of linking accounts, the following data in particular may be processed and stored:

Unique user identifiers of the respective service
Usernames or display names
Authentication and authorization data
OAuth tokens and refresh tokens
Timestamp of the link
Scope of the permissions granted
Technical administration and log data

This data is stored to ensure permanent authentication, communication with the respective interfaces of the connected services, and the provision and management of the functions offered.

The processing is based on Art. 6 (1) lit. b GDPR, insofar as it is necessary for the performance of the user relationship and the provision of the functions requested by the user.

8.1 Registration and Login via Email Address

To use our service, it is possible to create a user account using an email address and a password. Within the scope of registration and login, the following personal data in particular may be processed:

Email address
Username
Encrypted stored authentication data
Registration and login timestamps
Technical session and security data

The processing is carried out for the purpose of providing a user account, authentication, and ensuring the secure use of our service. The legal basis for this is Art. 6 (1) lit. b GDPR.

8.2 Login via Google

The authentication function of Google can be used to log in. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

As part of the login process, personal data such as user ID, name, profile picture, and email address may be transmitted to us, provided that these have been released by the user.

The processing is carried out exclusively for the purpose of authentication, account management, and provision of the requested functions. The legal basis for this is Art. 6 (1) lit. b GDPR.

Further information on data processing by Google can be found in Google's privacy policy: https://policies.google.com/privacy

8.3 Linking of YouTube Accounts and Use of the YouTube Data API

To use individual functions of our service, a YouTube channel can be linked to a user account within our system. For this purpose, we use the YouTube Data API provided by Google.

Within the scope of linking and authentication, the following data in particular may be processed - insofar as released by the user:

YouTube channel ID
Channel name
Channel profile picture
Channel URL
Publicly available channel information
Authentication and authorization data
Technical administration and session data

Access to YouTube data occurs exclusively with the youtube.readonly permission. As a result, our system receives read-only access to the shared information of the linked YouTube channel. No uploading, editing, deleting, or other modification of content in the YouTube account takes place.

The processing is carried out exclusively for the purpose of authentication, verification of ownership of the linked YouTube channel, and provision of the functions requested by the user. The legal basis for this is Art. 6 (1) lit. b GDPR.

Further information on data processing by Google can be found in Google's privacy policy: https://policies.google.com/privacy

8.4 Login via Twitch

The authentication function of Twitch can be used to log in and use certain functions of our service. The provider is Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, California 94104, USA.

As part of the login and account linking process, personal data may be transmitted to us, provided that it has been released by the user.

This may include in particular:

Twitch ID, username, and display name
Profile picture and email address
Channel information, streaming data, and reach data
Analytics and statistical data
Further information provided via the Twitch API

The processing is carried out for the purpose of authentication, account management, provision of the offered functions, management of advertisement placements, and the statistical evaluation of the provided data. The legal basis for this is Art. 6 (1) lit. b GDPR. Insofar as further evaluations are carried out to optimize and develop our service, the processing is based on Art. 6 (1) lit. f GDPR.

Further information on data processing by Twitch can be found in Twitch's privacy notice: https://www.twitch.tv/p/en-us/legal/privacy-notice/

8.5 Linking of TikTok Accounts

Insofar as users link their TikTok account with our service, personal data may be processed via the interfaces provided by TikTok.

This may include in particular:

TikTok ID, username, and display name
Profile picture and channel information
Reach and performance metrics
Analytics and statistical data
Further information accessible via the provided interfaces

The processing is carried out for the purpose of providing the functions requested by the user, account management, and the statistical evaluation of the provided data. The legal basis for this is Art. 6 (1) lit. b GDPR. Insofar as further evaluations are carried out to optimize and develop our service, the processing is based on Art. 6 (1) lit. f GDPR.

Further information on data processing by TikTok can be found in TikTok's privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en

9. Internal Evaluations, Analyses, and Case Studies

To improve our service and to evaluate the effectiveness of advertising measures, the data collected via the platform may be analyzed.

In particular, the following information may be processed:

Reach metrics and viewer developments
Interaction rates and advertisement deliveries
Advertising performance and campaign results
Streaming activities and other statistical metrics

The data may be used to create internal reports, statistical analyses, performance comparisons, market analyses, and case studies. Wherever possible, such evaluations are carried out in an anonymized or pseudonymized form.

The processing is based on Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the further development, optimization, and economic evaluation of our services.

Insofar as case studies or reference presentations are intended to contain personal information, this is done exclusively on the basis of separate consent pursuant to Art. 6 (1) lit. a GDPR.

Already anonymized or aggregated evaluations, statistics, reports, or case studies that no longer have a personal reference are not affected by a deletion request.

10. Origin of Data

The personal data we process originates in particular from the following sources:

Information provided by the user during registration
Data generated during the use of the website
Data provided through the Twitch interfaces (APIs) following authorization
Technical connection and usage data
Data in connection with the management of advertising campaigns

The processing is carried out exclusively within the framework of the functions provided and the respective permissions granted.

11. Storage Duration (Storage and Deletion)

We store personal data only as long as is necessary for the respective processing purposes or as long as statutory retention obligations exist.

Account data, linking data, and information provided via connected platforms can be stored for the duration of the use of our service, insofar as this is required to provide the functions offered, manage user accounts, execute advertising placements, and provide evaluations and reports.

Statistical evaluations, performance metrics, campaign data, and historical analysis values may remain stored for longer periods, insofar as this is necessary for comparison periods, performance analyses, the documentation of campaigns, or the further development of our service.

Technical server log files are checked regularly and deleted or overwritten once the purpose for storage ceases to apply.

To ensure the availability and recoverability of our systems, regular data backups are created. These may contain personal data and are deleted or overwritten once the purpose of the backup ceases to apply.

Insofar as statutory retention periods exist, deletion takes place after these periods have expired. If legitimate deletion claims are asserted in individual cases, we examine them carefully, taking into account statutory requirements and legitimate interests.

In the event of a justified deletion request or termination of the user relationship, personal data will be deleted, anonymized, or blocked from further processing, unless statutory retention obligations or other legitimate reasons prevent deletion.

Please note:
Data required to ensure the security of our systems, prevent abuse, investigate security incidents, enforce our Terms of Use, or to assert, exercise, or defend legal claims may continue to be stored even after a deletion request, provided there is a legal basis for doing so.

The legal basis for this is in particular Art. 6 (1) lit. f GDPR due to our legitimate interest in the security, stability, and legal protection of our service.

12. Recipients of Personal Data

Recipients of personal data may be:

Administrators and technically responsible persons
Hosting and infrastructure service providers
Analytics and evaluation service providers
Advertising and campaign partners, insofar as this is necessary to perform the respective service
Twitch Interactive, Inc. or affiliated companies within the framework of using the Twitch interfaces

Personal data is only passed on if it is necessary for the performance of a contract, if there is a legal obligation, or if corresponding consent has been given.

12.1 Support Communication / Discord

The communication service Discord can be used for support requests as well as for providing information and update notifications. The use of Discord is voluntary.

As part of the communication, personal data such as username, message content, technical connection data, and timestamps may be processed. Insofar as users voluntarily link their Discord account with their user account on our website, this assignment can be used to process support requests more efficiently and to clearly assign accounts.

The processing is based on Art. 6 (1) lit. b GDPR for processing support requests, and Art. 6 (1) lit. f GDPR due to our legitimate interest in efficient user support.

Discord Provider. When using Discord, the privacy policy of the provider Discord applies additionally. It cannot be ruled out that data is also processed by Discord outside the European Union. Discord's privacy policy can be found here: https://discord.com/privacy

12.2 Sending Emails

We use services of Scaleway S.A.S. to send system-related emails.

In particular, the following data may be processed:

Email address
Timestamps of sending
Technical delivery information
Communication content

The processing is carried out for the purpose of providing account functions, notifications, security information, and communication with users. The legal basis for this is Art. 6 (1) lit. b GDPR and Art. 6 (1) lit. f GDPR.

12.3 Twitch Authentication and Twitch API

We use the authentication and programming interfaces (APIs) of Twitch to log in and use our service.

The provider is Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, California 94104, USA.

As part of the authentication via Twitch, data is exchanged between Twitch and our system. This includes, in particular, account data, identification data, authorization information, and other information released by the user. The processing is carried out for the purpose of authentication, account management, provision of the platform functions, management of advertising placements, and conducting statistical evaluations. The legal basis for this is Art. 6 (1) lit. b GDPR.

Further information on data processing by Twitch can be found at:

https://www.twitch.tv/p/en-us/legal/privacy-notice/

12.4 Transfer of Google and YouTube User Data

Personal data processed as part of logging in via Google or linking a YouTube account is processed and passed on exclusively to the extent necessary to provide our service.

Data received as part of the Google login or the use of the YouTube Data API is stored on our technical infrastructure, which is operated on servers of Hetzner Online GmbH.

Transfer or disclosure of this data takes place exclusively:

to technical service providers and data processors, insofar as this is necessary for the operation of our service
insofar as we are legally obligated to do so, or
insofar as the data subject has expressly consented

Google and YouTube user data is neither sold nor used for our own advertising purposes, nor passed on to uninvolved third parties.

Insofar as certain information is displayed publicly within our service, this is restricted exclusively to the channel name, profile picture, channel ID, and a link to the linked YouTube channel. All other personal data received via Google or the YouTube Data API is processed exclusively internally and is not made publicly accessible.

13. Cookies and Comparable Technologies

Our website may use cookies and comparable technologies. These are small pieces of information that are stored on or read from an end device. They serve primarily to ensure the technical functionality, security, and user-friendliness of the website.

Some of these technologies are only active for the duration of a visit and are automatically deleted after closing the browser. Others can be stored for a longer period until they are deleted or their storage period expires.

Insofar as cookies or comparable technologies are technically necessary for the operation of the website, their use is based on our legitimate interest in a secure and functional provision of the online offering pursuant to Art. 6 (1) lit. f GDPR. Insofar as information is stored on or read from an end device in the process, this is additionally based on Sec. 25 (2) TDDDG.

If non-necessary cookies or comparable technologies are used in the future, this will be done exclusively after prior consent pursuant to Art. 6 (1) lit. a GDPR in conjunction with Sec. 25 (1) TDDDG. Consent granted can be revoked at any time with effect for the future.

You can also set your browser so that you are informed about cookies, allow or reject them individually, and delete cookies that have already been stored.

Please note that if technically necessary cookies are deactivated, individual functions of this website may be restricted.

Technically Necessary Cookies Used

Currently, we exclusively use technically necessary cookies and comparable technologies.

These include in particular:

Session cookies to maintain login sessions
Language cookies to store the selected language setting
Preference cookies to store the currently selected profile or account
Security-related cookies for authentication and abuse prevention

These cookies are required for the operation of the website and cannot be deactivated without restricting the functionality of the service. The processing is carried out on the basis of Art. 6 (1) lit. f GDPR and Sec. 25 (2) No. 2 TDDDG.

14. SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption.

You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

This protects transmitted data from unauthorized access. The use of encrypted transmission serves our legitimate interest in secure communication pursuant to Art. 6 (1) lit. f GDPR.

15. Plugins and Tools

Twitch

This website integrates content from the platform Twitch. The operator of this platform is Twitch Interactive, Inc. (an Amazon group company), 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA.

When accessing a page with embedded Twitch content, a connection to Twitch's servers is established. In the process, personal data such as your IP address and technical usage data may be transmitted to Twitch. In addition, Twitch may use cookies or similar technologies to record user behavior and provide content.

The integration is based on our legitimate interest in an appealing and multimedia presentation of our offering pursuant to Art. 6 (1) lit. f GDPR. Insofar as consent is required, the processing is based on Art. 6 (1) lit. a GDPR in conjunction with Sec. 25 (1) TDDDG.

Further information on data processing by Twitch can be found in Twitch's privacy policy: https://legal.twitch.com/legal/privacy-policy/

16. Your Rights as a Data Subject

Within the scope of the statutory provisions, you are entitled to various rights regarding your personal data.

These include, in particular, the right to access, rectification, erasure, restriction of processing, data portability, as well as the right to object to certain processing operations.

Furthermore, you have the right to revoke consent once given at any time with effect for the future.

To assert your rights, an informal message to the contact address specified in the Legal Notice (Impressum) is sufficient.

We reserve the right to request appropriate proof of identity in the event of justified doubts about your identity in order to protect personal data from unauthorized access.

16.1 Revocation of Your Consent to Data Processing

You can revoke consent already given at any time with effect for the future (Art. 7 (3) GDPR). The lawfulness of the processing carried out up to the revocation remains unaffected by this.

16.2 Right to Object to Data Collection in Special Cases and to Direct Marketing (Art. 21 GDPR)

If personal data is processed on the basis of Art. 6 (1) lit. e or lit. f GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation.

Following a justified objection, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms.

A use of your data for purposes of direct marketing does not currently take place.

16.3 Access, Rectification, and Erasure

Within the scope of the statutory provisions, you have the right at any time to free access to information about your stored personal data, its origin, recipients, and the purpose of the data processing.

You also have the right to demand the rectification of incorrect data or the erasure of personal data, provided that this is not prevented by statutory retention obligations or other legitimate reasons.

16.4 Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data (Art. 18 GDPR).

This right exists in particular if you contest the accuracy of the data, the processing is unlawful, you need the data to assert legal claims, or an objection is being verified.

During the restriction, the data concerned may - apart from being stored - only be processed to a limited extent.

16.5 Revocation of the Twitch Link

Users can revoke the link to their Twitch account at any time.

After revoking the link, no new data will be retrieved via the Twitch interfaces in the future.

Already stored data will be deleted, anonymized, or only stored further to the extent necessary for the performance of a contract, legal defense, prevention of abuse, fulfillment of statutory obligations, or due to legitimate interests.

Other statutory data subject rights, in particular the right to erasure pursuant to Art. 17 GDPR, remain unaffected.

16.6 Right to Lodge a Complaint with a Supervisory Authority

In the event of violations of data protection law, you have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR).

This applies in particular to the supervisory authority of your habitual residence, your place of work, or the place of the alleged violation.

17. Automated Decision-Making

An exclusively automated decision-making process within the meaning of Art. 22 GDPR, which unfolds legal effects or significantly affects data subjects in a similar manner, does not take place.

18. Information on Use by Minors

Our service is generally aimed at persons who meet the requirements for using the respective connected platforms and services. These may include Twitch, Google, TikTok, or comparable third-party providers.

When processing personal data, we take into account that minors require special protection.

Insofar as processing is based on consent in individual cases, minors should only grant this with the consent of their legal guardians, provided this is required under the respective applicable statutory provisions.

We ensure that the processing of personal data is limited to the necessary extent and that no data processing operations are carried out that inappropriately affect the interests, rights, or freedoms of minors.

If we become aware that personal data has been provided by minors contrary to the applicable legal requirements, we reserve the right to delete such data or to restrict the use of individual functions, insofar as this is legally required.

19. Changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy if this becomes necessary due to legal changes, technical developments, or new functions of the service.

The current version published at the time of your visit to this website applies in each case.