German Roleplay - SA-MP German Roleplay - SA-MP UCP

PrivacyUser Control Panel (UCP)

This privacy policy applies to the UCP at https://ucp.german-roleplay.me. General project information is available in the main website privacy policy and the imprint.

1. Controller

The controller responsible for processing personal data in the UCP is:

Kai Gilch
c/o RAHFT Management GmbH
Schwalbenweg 15
15806 Zossen
Germany

Contact
E-mail (project): kontakt@german-roleplay.me
E-mail (management): management@rahft.com

Responsible for content under § 18 Abs. 2 MStV: Kai Gilch (hennerlive), same address. Further details in the imprint.

2. What data we process in the UCP

  • Account data: character name and password hash on login (same database as the game server).
  • Session data: PHP session cookie for UCP sign-in.
  • Game / account information: e.g. level, faction, vehicles, bank — from the shared server database while you are signed in.
  • E-mail address: optional under “Verify e-mail” (see section 3).
  • Technical data: IP address (hashed) for password reset and rate limiting against abuse.
  • Feedback: bug reports and suggestions you submit in the UCP.

3. E-mail address & verification

Purpose: To confirm your e-mail, allow password reset by e-mail, and send security-related UCP notices.

Optional: You do not have to provide an e-mail. Without a verified address, password reset by e-mail is not available.

Process: After saving we send a one-time confirmation link (SMTP). The link and related tokens are stored in the database and deleted after confirmation or expiry (24 hours).

Legal basis: Art. 6(1)(a) GDPR (consent by actively ticking the box when saving) and Art. 6(1)(b) GDPR (providing the account features you request).

Retention: The e-mail remains stored until you change it or your account is deleted. Confirmation tokens are removed after use or expiry.

Withdrawal: You may withdraw consent at any time by removing the e-mail in the UCP or contacting us at kontakt@german-roleplay.me. Processing already carried out remains lawful until then.

4. Donator rank & PayPal payment

Purpose: To process purchases of the virtual Donator rank (Premium) in the UCP.

Which data? Account ID and character name, selected package, order number, order status, timestamps; for PayPal also payment IDs (e.g. order ID, transaction ID) that PayPal sends us after a successful payment.

Payment provider: PayPal (PayPal Europe S.à r.l. et Cie, S.C.A.). When paying you are redirected to PayPal; PayPal’s privacy policy applies there: paypal.com/privacy.

Storage: Order data in zz_ucp_donator_orders; active Premium status in accounts.donater (expiry time).

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (abuse prevention, bookkeeping).

Retention: Order data is stored for the duration of statutory retention obligations or as evidence in case of disputes.

Further contractual information: Terms (Donator purchase).

5. Password reset

For “Forgot password” we check the account name and a verified e-mail. We store a time-limited reset token (about 60 minutes) and send you a link by e-mail. Legal basis: Art. 6(1)(b) GDPR (contract / account administration).

6. Cookies & session

The UCP uses a technically necessary session cookie for login. Without this cookie, sign-in is not possible. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the UCP).

The UCP does not set tracking or marketing cookies.

7. Recipients & hosting

  • Web hosting / server: IONOS (or the host configured in production) — running the UCP files.
  • Game server / database: NexoraHost (or the game-server provider) — shared MySQL database with the SA-MP server.
  • E-mail delivery: IONOS SMTP (noreply@ucp.german-roleplay.me) — system mail (verification, password reset).
  • Payment processing: PayPal — only for Donator purchases in the UCP.

Data processing agreements with service providers exist where required by law.

8. Your rights

Under the GDPR you have, among others, the right to:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)
  • Withdrawal of consent given (Art. 7(3) GDPR)

Contact kontakt@german-roleplay.me or the server team (e.g. Discord). Further contact details are in the imprint.

You also have the right to lodge a complaint with a data protection supervisory authority.

9. Security

We protect UCP access with login, CSRF protection on forms, and rate limiting for sensitive actions. Passwords are not stored in plain text but as hashes (legacy: MD5 as on the SA-MP account).

Last updated: July 2026