Last updated: 10 November 2026 · applies to bunkerbande.de and the member area (ausweis.bunkerbande.de)
This English text is a translation provided for convenience only. In the event of any discrepancy, the German version is the authoritative one.
1. Controller
The controller for the data processing on this website and in the members' portal is:
Bunkerbande association (association under Art. 60 et seq. Swiss Civil Code, Switzerland)
The Swiss Federal Act on Data Protection (FADP) applies, as does - for users from the EU/EEA - the European General Data Protection Regulation (GDPR).
2. Hosting and server logs
Our servers are operated by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Deutschland). When the website is accessed, the web server automatically processes technical access data (IP address, date and time, page accessed, browser identifier). These logs serve exclusively for secure and stable operation (error analysis, defence against attacks) and are automatically deleted after a short time. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
3. Cloudflare (CDN and protection service)
We use Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) as a content delivery network and for protection against attacks. This website's traffic runs through Cloudflare's infrastructure; in the course of this, your IP address is processed. Cloudflare is certified under the EU-U.S. Data Privacy Framework and acts as a processor. Legal basis: legitimate interest in secure, performant operation (Art. 6(1)(f) GDPR).
4. Cookies and local storage
The website bunkerbande.de itself sets no cookies. It only stores your language choice in your browser's local storage (entry bb-lang), which is never sent to our server. The following information in this section concerns the member area.
We use technically necessary cookies only. We do not use tracking or marketing cookies, and our audience measurement works without cookies too (see section 5). You can change your choice at any time via the «Cookie settings» link in the footer.
| Cookie | Domain | Purpose | Duration |
|---|---|---|---|
| bunkerbande_cookie_consent | .bunkerbande.de | Stores your cookie choice | 1 year |
| bunkerbande-session | ausweis.bunkerbande.de | Login session in the members' portal (necessary) | 2 hours |
| XSRF-TOKEN | ausweis.bunkerbande.de | Protection against cross-site request forgery (necessary) | 2 hours |
In addition one value may be stored in your browser’s local storage. It is never sent to our server and serves only to remember your own setting:
| Entry | Purpose | Duration |
|---|---|---|
| plausible_ignore | Only set if you have objected to the audience measurement | until you delete it |
5. Audience measurement (Plausible, self-hosted)
There is currently no audience measurement on bunkerbande.de. This section applies to the member area.
To understand which pages are used, we count page views with Plausible Analytics. The software runs on our own server at Hetzner Online GmbH in Germany. No external analytics provider is involved, and no data is transferred to a third country.
We record the page visited, the referring page, browser and operating system type, device type and the country derived from the IP address. No cookies are set, and nothing is stored on or read from your device. Your IP address is not stored: it only feeds transiently into a checksum used to recognise repeat visits within the same day. The random value used for this is rotated and deleted every 24 hours. Recognition across several days, across devices or across other websites is therefore impossible. Results are evaluated in aggregate only; the data is not combined with other records and not shared with third parties.
Legal basis. Since nothing is stored on or read from your device, neither Art. 45c TCA (Switzerland) nor the consent requirement of Art. 5(3) of the ePrivacy Directive or Section 25 TDDDG applies. The processing rests on our legitimate interest in designing our offering to meet demand (Art. 6(1)(f) GDPR). Under Swiss law (revFADP) no consent is required; we inform you here in accordance with Art. 19 FADP.
Right to object. You can object to the measurement at any time and without giving reasons, via the «Cookie settings» link in the footer and the «Audience measurement» switch there. The objection takes effect immediately and applies per browser and device.
We keep the aggregated results for no longer than 24 months.
6. Fonts
All fonts (Allerta Stencil, Barlow, Barlow Condensed, IBM Plex Mono) are loaded locally from our server. There is no connection to Google Fonts or other external font services.
7. Live data and public lists (website)
The live data shown on the website (number of connected users on TeamSpeak, member counts of Discord and the member area) is fetched and cached server-side by our own services. Your browser only connects to our servers; no personal data of yours is transmitted to third-party services. The occupancy shows plain numbers, no names.
The crew, duty roster and notice board pages read their entries from the member area. Only members who switched it on themselves appear there by name (see section 8.4). The duty roster shows title, game, start and the number of confirmations, no names.
8. Member portal (ausweis.bunkerbande.de)
The member area is intended for persons aged 16 or older.
Use of the portal is voluntary. When you register and use it, we process the following data:
8.1 Login via Steam
Sign-in takes place via Steam (OpenID) of Valve Corporation. In the course of this we receive your public SteamID, your display name and your avatar image. We never see your Steam password. We keep a copy of the avatar image on our server; your browser loads it from us, not from Valve. Legal basis: performance of a contract/membership (Art. 6(1)(b) GDPR).
8.2 Links with Discord, Twitch and TeamSpeak
Optionally, you can link your Discord and Twitch account via OAuth (we store the respective account ID and the display name) and store your TeamSpeak identity. Legal basis: consent (Art. 6(1)(a) GDPR); the link can be removed in the portal at any time.
8.3 Game and activity statistics
- Steam games: Via the Steam Web API we retrieve your public games list and playtimes daily (provided your Steam profile permits this).
- CS2 statistics: Via the public interface of Leetify (Leetify AB, Sweden) we retrieve your CS2 statistics daily and transmit your SteamID for that purpose.
- TeamSpeak voice time: On our own TeamSpeak server we record the online time of linked identities for community statistics.
Legal basis: performance of a contract/membership as well as your consent given through the respective link.
8.4 Public activity display (opt-in)
Whether your activity (e.g. “currently playing”, TeamSpeak presence, Twitch live status) is shown on the community page is something you control yourself via an opt-in setting in your profile. By default, the display is disabled.
The entry in the public crew list is voluntary as well. If you switch it on, bunkerbande.de and your public pass (address in the form ausweis.bunkerbande.de/ausweis/BB-0001) show your display name, your pass number, your function, the date you joined, service bars and sector stamps. Avatar and linked accounts are not shown there. You can switch the entry off at any time; the list entry and the public pass then disappear.
8.5 Events and calendar
When you accept an event we store your RSVP response. The personal calendar subscription link (ICS) contains a random token and is intended for you alone.
8.6 Forms and Discord notifications
Details from team applications are stored for processing. Certain events (e.g. new events) trigger automatic notifications in our Discord server; no personal data going beyond the portal is transferred in the process.
9. Retention and deletion
We store personal data only for as long as is necessary for operating the community:
- Web server logs: 14 days.
- Login session: 2 hours after the last activity. The session includes IP address and browser identifier; we store no IP address with your account.
- Account data, links and statistics: until you delete your account.
- Audit log (who administered what and when): 12 months.
- Backups: deleted data may remain in encrypted backups for up to 12 months. They are not evaluated and are overwritten afterwards.
You can delete your account yourself at any time in the member area under "Konto und Daten"; there you also see everything we store about you. A ban, if any, and the entry in the audit log remain. An informal email is sufficient as well.
10. Your rights
You have the right of access to the data stored about you, to rectification, erasure, restriction of processing, data portability as well as objection to processing based on legitimate interests. You can withdraw consent you have given at any time with effect for the future. To do so, please contact the contact address given above.
You also have a right to lodge a complaint: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU/EEA with your competent data protection supervisory authority.
11. Recipients and disclosure abroad
We do not sell data and pass it on only as far as operation requires:
- A member of the association's board privately provides and operates the servers for the association (processor, under a written agreement).
- Hetzner Online GmbH, Germany: data centre hosting the servers.
- Cloudflare, Inc., USA: delivery and protection of the website (processor).
- Valve Corporation, USA: sign-in via Steam, retrieval of game list and avatar image by our server.
- Discord Inc., USA, and Twitch Interactive, Inc., USA: only if you link the accounts, and for notifications in our Discord.
- Leetify AB, Sweden: retrieval of CS2 statistics by SteamID.
Switzerland and the EU/EEA mutually recognise an adequate level of data protection. For the USA we rely on the recipients' certification under the Swiss-U.S. or EU-U.S. Data Privacy Framework where available, otherwise on standard contractual clauses or on the fact that you initiate the link yourself (Art. 17 para. 1 lit. a FADP, Art. 49 para. 1 lit. a GDPR).
12. Changes
We adapt this privacy policy when our services or the legal situation change. The version published here at any given time applies.