Privacy Policy

Version: October 2026

1. Controller

Kicks Department, owner Lion Frankenstein, Klingenstraße 24, 97256 Geroldshausen, Germany, email: info@kicksdepartment.de, phone: +49 152 23959238

2. Data processed and purposes

We process personal data to provide and bill the membership (Art. 6(1)(b) GDPR):

• Discord login (OAuth2): Discord user ID, username, email address and avatar – for sign-in and automatic role assignment on the server.
• Payment data: processed by Stripe; we do not store card or bank details ourselves, only Stripe customer and subscription references plus tier and subscription status.
• Billing data: name, billing address and – for businesses, if provided – the VAT identification number. Stripe collects these at checkout to calculate VAT correctly and issue proper invoices (Art. 6(1)(b) and (c) GDPR).
• Email: your email address for welcome and transactional emails.
• Server logs (hosting): IP address, time and page accessed to ensure operation (Art. 6(1)(f) GDPR).
• Cancellation form (“Cancel contracts here”): name, email address, Discord name or account email, type and date of cancellation – to carry out and confirm the cancellation (Art. 6(1)(b) and (c) GDPR in conjunction with § 312k BGB).
• Discord server: We use tickets for support requests and orders; we process their content (messages, uploaded files) to handle your request (Art. 6(1)(b) GDPR). For moderation (enforcing the server rules, protecting against fraud) we may view and delete messages and warn or remove members (Art. 6(1)(f) GDPR).
• “Verified Seller” role: Enterprise members can submit proof of business registration via a ticket. We check it solely to assign the role (Art. 6(1)(b) GDPR) and delete the ticket containing the proof after the check.
• Keyword pinger, offers and live selling (Discord bot): If you use the keyword pinger, we store your Discord user ID, your keywords and your language setting. To do this, the bot reads new requests in the WTB channels and sends you a direct message when one matches. Offers you send via the bot (model, country, price, note and your Discord name) are forwarded to the requester – by direct message or, from Premium, in a private thread. For Enterprise members we additionally store offers on their requests in our database to create the offer summary. To limit abuse, we count how many pings and offers are sent per hour and store the time of the last announcement in #live-selling (Art. 6(1)(b) GDPR).
• Ratings and reports: When a seller adds a deal in #buyer-refs, we store the seller, buyer, item, time and the buyer's confirmation. Confirmed deals are publicly visible in the channel and shown as a count next to the server name and with requests and offers. Reports submitted via /report (type, description, screenshot, reporting and reported member) and a response from the reported member are stored for review by the team. Single reports remain internal; a notice is only made public after three confirmed reports of the same type within six months, or immediately in the case of confirmed fraud. The legal basis is our legitimate interest and that of our members in safe trading (Art. 6(1)(f) GDPR).

3. Recipients / processors

We use the following service providers, with data processing agreements (Art. 28 GDPR) in place where required:

• Stripe Payments Europe, Ltd. (Ireland) – payment processing, subscription management, invoicing and tax calculation. Stripe may transfer data to the USA based on EU standard contractual clauses or the EU-US Data Privacy Framework.
• Discord Inc. (USA) – OAuth2 login and role management. Transfers based on standard contractual clauses or DPF.
• Supabase Inc. (USA) – database hosting (member data). Data is stored on servers in Frankfurt am Main, Germany; access from the USA is possible based on EU standard contractual clauses.
• Resend (Plus Five Five, Inc., USA) – transactional emails sent via servers in Ireland. Transfers to the USA based on standard contractual clauses or DPF.
• PostHog Inc. (USA) – web analytics, only with your consent (see section 7). Processing on servers in the EU (Frankfurt am Main); transfers to the USA based on EU standard contractual clauses.
• Ticket Tool (third-party Discord bot, tickettool.xyz) – management of support tickets on the Discord server.
• Vercel Inc. (USA) – website hosting including server logs. Transfers based on the EU-US Data Privacy Framework or standard contractual clauses.

4. Retention

We store member data for the duration of the membership. It is deleted automatically 12 months after the membership ends – or after an abandoned purchase. Stripe retains invoice data for up to 10 years due to tax obligations. We keep cancellation notices and our confirmations as evidence until the limitation period expires (3 years). Proof of business registration is deleted after the check. You can delete your keywords at any time with /keyword remove or /keyword clear; otherwise they are deleted together with the rest of your member data. Offers stored for the offer summary are deleted as soon as the request is marked as done, and after 30 days at the latest. Counters used to limit abuse are deleted after 2 hours, timestamps of live selling announcements after 2 days. Confirmed deals are stored for three years, rejected or unconfirmed entries for 30 days. Confirmed time-waster and payment-delay reports are no longer shown after six months and are deleted after twelve months, rejected reports after 30 days. Entries on confirmed fraud are kept permanently to protect our members. You may object to this processing on grounds relating to your particular situation (Art. 21 GDPR).

The details provided at sign-in and purchase are required to conclude the membership; without them, no membership is possible. No automated decision-making including profiling (Art. 22 GDPR) takes place.

5. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Contact info@kicksdepartment.de. You also have the right to lodge a complaint with a supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA).

6. Cookies and browser storage

Without your consent, we only use technically necessary cookies (session and security cookies for login). If you switch between light and dark mode, we store this setting in your browser's local storage (localStorage, key “kd-theme”); it never leaves your device. The legal basis is § 25(2) no. 2 TDDDG. Your choice in the cookie banner is also stored in local storage (key “kd-consent”). Audience measurement only takes place after your consent (section 7).

The payment page is provided by Stripe on its own domain. Stripe sets its own cookies there, among other things for fraud prevention; Stripe's privacy policy applies (stripe.com/privacy).

7. Web analytics with PostHog

If you consent in the cookie banner, we use PostHog to understand how the website is used and to improve it. This processes a random identifier (in cookies and local storage), pages visited, clicks, mouse movements and scroll depth (for heatmaps), time on page, page load times, device, browser, operating system and approximate country or city. The IP address is not stored permanently. Session recordings are disabled. We do not link this data to your Discord account.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via “Cookie settings” in the footer; the lawfulness of processing up to that point remains unaffected. The data is deleted after 12 months at the latest.