Privacy Policy

This is a translation provided for convenience. The German version is legally binding.

Privacy Policy

Thank you for your interest in our online shop. The protection of your personal data is important to us. Below we inform you about the collection and use of personal data when using our website.

1. Controller

The controller responsible for data processing on this website is:

Technischer An- & Verkauf, Holger Seidel
Walter-Felsenstein-Str. 62
12687 Berlin, Germany
Email: info@nextlvl.games
Phone: +49 30 66405610

2. Collection and storage of personal data

When you visit our website, the web server automatically collects the following data, which is technically required to display the website to you (legal basis: Art. 6(1)(f) GDPR):

- IP address of the requesting device
- Date and time of access
- Name and URL of the requested page
- Referrer URL (previously visited page)
- Browser and operating system used
- Name of your internet service provider

This data is evaluated exclusively to ensure the smooth operation of the website and to improve our offering. It does not allow us to identify you personally.

3. Contacting us

If you contact us by email, phone or WhatsApp, the data you provide (e.g. name, email address, content of your enquiry) will be stored in order to process your request. We delete this data as soon as its storage is no longer necessary, or restrict its processing if statutory retention obligations apply. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest).

If you contact us via WhatsApp, your data (phone number, name, message content) is also processed by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Meta may transfer data to the USA. Further information: WhatsApp Privacy Policy.

4. Withdrawal form

If you withdraw from a contract using our withdrawal form, we collect and process the data you provide (first name, last name, email address, order number, scope of the withdrawal, affected items if applicable, and comments) in order to process your withdrawal and to send you an acknowledgement of receipt in accordance with Art. 246a § 4 EGBGB (Introductory Act to the German Civil Code). Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures / performance of a contract) and Art. 6(1)(c) GDPR (legal obligation to confirm the withdrawal).

Bot and spam protection (Cloudflare Turnstile)
To protect against automated abuse and spam submissions, we use the Cloudflare Turnstile service provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, for the withdrawal form. Your IP address, browser and device information are transmitted to Cloudflare and evaluated to determine whether the form was submitted by a human or an automated system. The IP address transmitted by us is also stored in the internal notification about your withdrawal, so that we can take legal action in the event of abusive or fraudulent form submissions (e.g. automated spam). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse and spam). Further information: Cloudflare Privacy Policy.

Sending the confirmation email (Resend)
The acknowledgement of receipt and the internal notification are sent via the Resend service provided by Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. The data you entered in the form (name, email address, order number, scope of the withdrawal, affected items if applicable, and comments) is transmitted to Resend for the purpose of sending the email. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Further information: Resend Privacy Policy.

5. Order processing

To process your order, we collect and process the following data: name, address, email address, phone number (if provided), payment data and order details. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). The data is deleted once the contract has been fully executed and the retention periods under tax and commercial law have expired, unless you have consented to further use.

6. Customer account

You have the option of creating a customer account. The following data is stored: name, email address, shipping address(es), order history and your wishlist. The data is processed to provide the account features and to simplify order processing. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). You can have your customer account deleted at any time via your account settings or by notifying us. Upon deletion, your account data will be removed unless statutory retention obligations prevent this.

Sign in with Google
You can optionally use the "Continue with Google" feature to sign in to your customer account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you choose this feature, you will be redirected to Google and sign in there with your Google credentials. Google then transmits your name, your email address and, if applicable, your profile picture to us. We use this data exclusively to create your customer account or to link you to an existing customer account. We do not receive your Google credentials. Data is only transmitted to Google once you actively click "Continue with Google". Legal basis: Art. 6(1)(a) GDPR (consent). You can remove the connection at any time in your Google account under "Third-party apps and services"; signing in by email remains possible. Further information: Google Privacy Policy.

7. Disclosure of data to third parties

Your personal data is only transferred to third parties to the extent necessary for the performance of the contract. Legal basis: Art. 6(1)(b) GDPR.

7.1 Shopify

Our online shop is operated on the Shopify platform. Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, processes the data arising from the use of the shop on our behalf as a processor (e.g. order data, payment information, IP address, device information). Shopify may process data on servers outside the EU. Further information: Shopify Privacy Policy.

7.2 Shipping provider - DHL

To deliver the goods, we pass on your name and shipping address to Deutsche Post DHL Group, Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany. If you have agreed during checkout to share your email address or phone number for shipment tracking, this data is also passed on based on your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time.

7.3 Payment service providers

Depending on the payment method selected, your payment data is passed on to the respective payment service provider. This is done exclusively for the purpose of processing the payment on the basis of Art. 6(1)(b) GDPR. If a payment service provider carries out a credit check (e.g. for instalment payments), this is done under the sole responsibility of the respective provider.

Credit card (Visa, Mastercard, American Express)
Payments are processed via Shopify Payments / Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Further information: Stripe Privacy Policy.

PayPal
If you pay via PayPal, your payment data is passed on to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If PayPal offers its own financing options (e.g. instalment payments), these are handled between you and PayPal and may require a credit check by PayPal. Further information: PayPal Privacy Statement.

Klarna
If you pay via Klarna, your data is passed on to Klarna AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. If Klarna offers its own financing options (e.g. instalment payments or "Pay later"), these are handled between you and Klarna and may require a credit check by Klarna. Further information: Klarna Privacy Notice.

Shop Pay
Payments are processed via Stripe Payments Europe Ltd. (see above). Shop Pay stores your payment and shipping data for a faster checkout. Further information: Shopify Privacy Policy.

Google Pay
Payments are processed via Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information: Google Privacy Policy.

Apple Pay
Payments are processed via Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Further information: Apple Privacy Policy.

8. Cookies

We use cookies on our website. Cookies are small text files that are stored on your device. Some cookies are technically necessary for the operation of the shop (e.g. shopping cart, login session). These are set on the basis of Art. 6(1)(f) GDPR.

Using our cookie banner, you can decide whether to accept only technically necessary cookies or all cookies. You can change your decision at any time via the "Cookie settings" link in the footer of our website. Technically necessary cookies cannot be disabled, as they are required for the basic functions of the shop.

8.1 Overview of cookies used

Technically necessary (cannot be disabled)

Cookie	Purpose	Duration
Provider: nextlvl Games
session	Login session and shopping cart assignment	Session
cookieConsent	Stores your cookie preferences	30 days
theme	Stores the selected colour scheme (light/dark)	1 year
language	Stores the selected language	1 year
announcement_closed	Remembers that a notice banner has been closed	24 hours
gridPreference	Stores the selected product list view (grid width)	1 year
Provider: Shopify
cart	Shopping cart contents and checkout assignment	14 days

Local storage (LocalStorage) (technically necessary / convenience feature)

Entry	Purpose	Duration
Provider: nextlvl Games
search_history	Stores your recent search terms for faster searching	Permanent (can be deleted manually)
recently_viewed_products	Stores recently viewed products	Permanent (can be deleted manually)

Local storage takes place exclusively in your browser and is not transmitted to our servers. You can delete this data at any time via your browser settings.

Error tracking (legitimate interest pursuant to Art. 6(1)(f) GDPR)

Service	Purpose	Data
Provider: Functional Software, Inc. (EU servers)
Sentry	Detection and resolution of technical errors	Browser, device type, error details (no IP addresses)

You can configure your browser so that no cookies are stored or so that you are asked for confirmation before a cookie is set. Disabling cookies may mean that not all functions of the shop can be used.

9. Shopify Analytics

We use the analytics features integrated into Shopify to statistically evaluate the use of our shop and to improve our offering. Data such as page views, time spent on the site, products viewed, shopping cart contents and the origin of visitors is collected.

Processing takes place exclusively on the basis of your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, the German Telecommunications Digital Services Data Protection Act). If you select only technically necessary cookies in the cookie banner, these analytics features are not loaded and no analytics data is collected. You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer; data collection will then stop immediately. The data is processed by Shopify on our behalf as a processor.

10. Sentry (error monitoring)

We use the Sentry service provided by Functional Software, Inc., 132 Hawthorne Street, San Francisco, CA 94107, USA, to detect and resolve technical errors on our website. When an error occurs, technical data is automatically transmitted to Sentry, including: IP address (anonymised), browser and device information, URL of the affected page and error messages. Processing is based on Art. 6(1)(f) GDPR (legitimate interest in the stability and error resolution of our website). Further information: Sentry Privacy Policy.

11. Embedded videos (YouTube, Vimeo)

Videos from external platforms may be embedded on our product pages. They are only embedded after your explicit consent. No data is transmitted to the respective provider before the video is loaded. A connection to the provider's servers is only established once you actively click "Load video".

YouTube

YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When a YouTube video is loaded, your IP address, device information and cookie data are transmitted to Google. Google may also transfer this data to the USA. Legal basis: Art. 6(1)(a) GDPR (consent). Further information: Google Privacy Policy.

Vimeo

Vimeo is operated by Vimeo, Inc., 555 West 18th Street, New York, New York 10011, USA. When a Vimeo video is loaded, your IP address, device information and cookie data are transmitted to Vimeo. Vimeo may process this data in the USA. Legal basis: Art. 6(1)(a) GDPR (consent). Further information: Vimeo Privacy Policy.

You can withdraw your consent to loading external videos at any time by reloading the page. Consent given only applies to the current browser session.

12. Email newsletter

You can subscribe to our email newsletter to receive information about current offers. The only mandatory information is your email address. We use the double opt-in procedure: after signing up, you will receive a confirmation email with a link that you must click to complete your subscription. Legal basis: Art. 6(1)(a) GDPR (consent).

When you sign up, we store your IP address as well as the date and time in order to be able to verify the subscription. The newsletter is sent via Shopify Email. You can unsubscribe from the newsletter at any time via the unsubscribe link in each issue or by notifying us. After unsubscribing, we will remove your email address from the mailing list.

13. Your rights (data subject rights)

You have the following rights towards us regarding your personal data:

- Right of access (Art. 15 GDPR): You can request information about the personal data we process.
- Right to rectification (Art. 16 GDPR): You can request the correction of inaccurate data.
- Right to erasure (Art. 17 GDPR): You can request the deletion of your data unless statutory retention obligations prevent this.
- Right to restriction of processing (Art. 18 GDPR).
- Right to data portability (Art. 20 GDPR): You can receive your data in a structured, machine-readable format.
- Right to withdraw consent (Art. 7(3) GDPR): You can withdraw any consent given at any time with effect for the future.
- Right to lodge a complaint (Art. 77 GDPR): You can lodge a complaint with a data protection supervisory authority. As a rule, the supervisory authority of your place of residence or of our place of business is responsible.

14. Right to object

Where your personal data is processed on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object pursuant to Art. 21 GDPR if there are grounds relating to your particular situation, or if the objection concerns direct marketing. In the latter case, you have a general right to object without having to state a particular situation. If you wish to exercise your right to object, an email to info@nextlvl.games is sufficient.

15. Data security

During your visit to our website, we use the SSL (Secure Socket Layer) protocol in conjunction with the highest level of encryption supported by your browser. You can tell whether an individual page of our website is transmitted in encrypted form by the padlock icon in your browser's address bar. We also use appropriate technical and organisational security measures to protect your data against manipulation, loss, destruction or unauthorised access.

16. Validity and amendments to this Privacy Policy

This Privacy Policy was last updated in September 2026. We reserve the right to amend this Privacy Policy to adapt it to changes in the legal situation or to changes in the service and data processing. The current version can always be found on this page.