Privacy Policy

1. Controller

Controller within the meaning of the GDPR and other national data protection laws is:

Email: info@joinourserver.com · Full legal notice: /impressum

2. Data on mere visit (server logs)

When you call up our website, the web server automatically records the following data in so-called server logs:

• IP address of the requesting device (truncated/anonymised after 7 days)
• Date and time of the request
• URL called up and HTTP method
• HTTP status code of the response
• Referrer (previously visited page)
• User agent (browser and operating system information)

Purpose: Provision of the website, maintenance of IT security (detection and defence against attacks), error diagnosis.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in the secure operation of the online service).

Retention: a maximum of 7 days; afterwards automated deletion or anonymisation. In the event of a specific security incident, affected entries may be retained longer for the purpose of preserving evidence.

3. Cookies and local storage

We only use technically necessary cookies. A consent banner is therefore not required.

Legal basis: § 25 (2) no. 2 TDDDG (storage is strictly necessary for the service to be usable); Art. 6 (1) lit. f GDPR.

4. Discord login (OAuth)

Login to our platform takes place exclusively via Discord OAuth. We do not operate our own password management. When you click the „Login with Discord" button, you are redirected to Discord, where you consent to the transmission of the following data:

• Your Discord ID (numeric, permanent)
• Your Discord username including discriminator/tag
• Your Discord avatar (image URL)
• Your email address stored at Discord
• Optional (only if expressly granted) the right to add you to a Partner's Discord server (guilds.join scope)

Purpose: Identification and authentication; assignment to Partner communities; display of your avatar/name in the Partner dashboard.

Legal basis: Art. 6 (1) lit. b GDPR (contract initiation /performance). Provider is Discord Inc., 444 De Haro St. Suite 200, San Francisco, CA 94107, USA. Privacy policy: discord.com/privacy.

The transfer to the USA is based on the Standard Contractual Clauses pursuant to Art. 46 (2) lit. c GDPR and on the EU-US Data Privacy Framework, insofar as the recipient is certified.

5. Checkout, payment processing & invoices

When you, as a Member, purchase a paid plan from a Partner, we process the following additional data:

• Invoice data: first name, last name (or company name), postal address (street, postcode, city, country), optionally VAT ID for businesses.
• Payment data: processed exclusively by the payment service provider Mollie. From Mollie we receive only the status (paid / refunded / failed), the payment method (e.g. „creditcard", „paypal"), the Mollie payment ID and optionally the last 4 digits of the credit card for recognition. We do not receive full credit card details or IBANs.
• Invoice PDF: automatically generated for each successful payment and retrievable in the member portal.
• Optional: VAT ID validation via the EU VIES interface for reverse-charge transactions.

Purpose: Contract performance, invoicing, fulfilment of statutory retention obligations (§ 147 AO, § 257 HGB).

Legal basis: Art. 6 (1) lit. b GDPR (contract performance) and Art. 6 (1) lit. c GDPR (legal obligation — tax law retention).

Please note: the contracting party for the paid plan is the respective Partner, not JoinOurServer. JoinOurServer operates the infrastructure and processes the payment via Mollie on behalf of the Partner. For details see Terms Part C.

6. Discord bot (role assignment)

After a successful payment, our Discord bot assigns you the role configured by the Partner on their Discord server. In doing so, only your Discord ID, the server ID and the role ID are exchanged between our server and the Discord API.

Purpose: Automated provision of the paid access.

Legal basis: Art. 6 (1) lit. b GDPR (contract performance with the Partner).

If your subscription ends (cancellation, expired access, failed payment), the role is also automatically removed after the grace period expires. Optionally, the Partner may have configured an additional removal from the server (Discord „kick") on expiry.

7. Email notifications & newsletters

We send transactional emails to the email address stored at Discord, where this is necessary for contract performance: payment confirmations, reminders before trial end, notices of failed charges, cancellation confirmations.

Dispatch: Emails are sent via an SMTP service provider with servers located within the European Union (processor with contract under Art. 28 GDPR).

Legal basis: Art. 6 (1) lit. b GDPR (contract performance).

Community newsletters

Communities (Partners) can use our platform to send newsletters to their own members — for example news, content or offers of that community. Recipients are exclusively people who are or were members of that community; a Partner cannot contact members of other communities.

The respective community, not JoinOurServer, is the controller for the content and dispatch of such a newsletter. We merely provide the technical infrastructure and act as a processor under Art. 28 GDPR. You will find the sender's contact details in the imprint at the end of every newsletter email.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in direct marketing towards existing customers) in conjunction with Section 7 (3) of the German Act Against Unfair Competition (UWG), provided you made a paid booking with that community and have not objected. Without such a customer relationship, emails are sent solely on the basis of your explicit consent under Art. 6 (1) lit. a GDPR, which you may withdraw at any time with effect for the future.

Objection and unsubscribe: Every newsletter email contains an unsubscribe link that works without logging in and takes effect immediately. There you can either unsubscribe from that community's newsletter only, or stop receiving newsletters from all communities on JoinOurServer. No costs arise for you other than transmission costs at base rates. Transactional emails regarding your contract (see above) are unaffected, as we are legally required to send them.

Retention: After you unsubscribe we keep your email address on a suppression list so that you are not contacted again. Former members may continue to receive newsletters from that community as long as they have not objected. Whether such contact is still covered by existing-customer marketing is decided by the community as controller; a period of around 24 months after the last payment serves as guidance.

8. API usage & webhook logs

For Partners we provide a REST API at api.joinourserver.com. Each API call is stored in an audit table:

• API key used (truncated)
• Endpoint called, HTTP method, status code
• IP address of the caller
• User agent
• Timestamp

Likewise, we log incoming webhooks from Mollie and outgoing webhooks to the URL configured by the Partner.

Purpose: Abuse detection, troubleshooting, rate limiting.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in security and diagnosis).

Retention: 90 days, then automatic deletion.

Login log (IP addresses)

On every Discord sign-in we additionally store the IP address of the signing-in device together with a timestamp.

Purpose: account security and abuse/fraud prevention — in particular detecting duplicate accounts created e.g. to circumvent bans, trial periods or waitlists.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing fraud and abuse, cf. Recital 47 GDPR).

Retention: 12 months, then automatic deletion. When an account is deleted, the entries are removed immediately.

9. Recipients / processors

We use the following third parties who process personal data on our behalf or as independent controllers:

Each Partner is in turn a controller for the data of their members and may employ their own processors. The respective Partner informs you separately about their data processing.

10. Transfers to third countries

Insofar as we transfer data to third countries (in particular the USA, in connection with the Discord integration), this is based on:

• the Standard Contractual Clauses of the EU Commission (Art. 46 (2) lit. c GDPR) and/or
• a certification of the recipient under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023).

We point out that, despite these measures, the level of protection in the USA does not necessarily correspond to that in the EU; in particular, authorities may access data without the data subject being informed or having effective legal protection.

11. Retention periods

12. Your rights as a data subject

You have the following rights against us at any time:

• Access (Art. 15 GDPR) — you may demand confirmation as to whether and which personal data we process about you. We provide information on informal request to the email address listed below.
• Rectification (Art. 16 GDPR) — you may demand the correction of inaccurate or the completion of incomplete data.
• Erasure (Art. 17 GDPR, „right to be forgotten") — active members can delete their account themselves at any time via the member portal under „Delete account". Invoice data subject to statutory retention obligations is anonymised, but not physically deleted.
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) — you may request the data concerning you in a structured, commonly used, machine-readable format.
• Objection (Art. 21 GDPR) — you may object at any time, on grounds relating to your particular situation, to processing based on a legitimate interest.
• Withdrawal of consent (Art. 7 (3) GDPR) — with effect for the future.

An informal email to info@joinourserver.com is sufficient to exercise your rights.

Right to lodge a complaint with a supervisory authority

You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The competent authority is that of the federal state where you habitually reside or where the controller is based.

13. Data Protection Officer

Due to the size of the company, we are not obliged to appoint a data protection officer under § 38 (1) BDSG. Please direct data protection enquiries directly to info@joinourserver.com.

14. Updates to this policy

We reserve the right to adapt this Privacy Policy so that it always complies with current legal requirements or to reflect changes to our services, e.g. when introducing new features. The new privacy policy then applies to your next visit.

The current version is always available at joinourserver.com/datenschutz.