1. Controller
The controller for the data processing on badgebase.de under the GDPR is:
Marco Verch
Scanbox #02223
Ehrenbergstr. 16a
10245 Berlin, Germany
Email: marco.verch@gmail.com
See the imprint for further legal details.
2. Data we collect
a) Server logs
Every page request generates a log entry containing:
- IP address
- Date and time
- Requested URL, HTTP status, referrer, user-agent
- Additionally stored in our
request_logtable: IP, target URL, status, timestamp, traffic source (WEBSITE/EXTENSION).
Purpose: Serving the site, abuse detection, rate limiting, statistics.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
Retention: up to 30 days.
b) Twitch user data
We pull publicly available Twitch data via the official Twitch Helix API and store:
- Twitch ID, login, display name, profile picture
- Broadcaster type (Partner, Affiliate), account creation date
- Cached live-stream status and game category
- Publicly available Twitch badge collections (via GraphQL API)
Purpose: Building collector profiles, leaderboards, comparisons, recaps.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in maintaining a public Twitch fan archive).
Opt-out: Email marco.verch@gmail.com to have your profile removed and set to noindex.
c) Twitch Extension
If you install our Twitch Extension, it sends your Twitch ID to our server so we can return matching badge stats. We do NOT receive subscriptions or private data.
Legal basis: Art. 6(1)(b) GDPR (contract performance).
d) Donations via PayPal
If you donate via our /donate/ button, PayPal handles the transaction. After a successful payment, PayPal sends us an Instant Payment Notification (IPN) with:
- Donor's first and last name (as provided by PayPal)
- PayPal email address
- Transaction ID, amount, currency, payment date
- Optional memo field the donor filled in
This data is forwarded to Billomat GmbH where a monthly collective invoice is created for accounting.
Legal basis: Art. 6(1)(c) GDPR (legal obligation: tax record-keeping).
Retention: 10 years (German tax retention requirement).
e) Cookies
We set the following cookies:
site_lang(first-party, 90 days) — remembers your language.blog_lang(first-party, 90 days) — remembers your blog language.- Google Analytics:
_ga,_ga_G-3F1ZRM0H5L(third-party).
3. Third-party services
Google Analytics 4
Provided by Google Ireland Ltd., Dublin, Ireland. IP addresses are truncated. EU Standard Contractual Clauses apply for US transfers.
Opt-out: tools.google.com/dlpage/gaoptout.
Google Fonts
Fonts are loaded from fonts.googleapis.com; this transfers your IP to Google. Legal basis: Art. 6(1)(f) GDPR.
Twitch Interactive, Inc.
Badge images, profile pictures and the footer live player are loaded from Twitch's CDN (San Francisco, USA). See Twitch Privacy Notice.
7TV
7TV emotes and profile pictures load from cdn.7tv.app and 7tv.io. Privacy: 7tv.app/legal/privacy.
Cloudinary
Fallback profile pictures are hosted by Cloudinary Ltd. (Israel). Privacy: cloudinary.com/privacy.
PayPal
Payment processing by PayPal (Europe) S.à r.l. et Cie, S.C.A. See §2d.
Billomat
Invoicing software by Billomat GmbH & Co. KG, Fürther Straße 244a, 90429 Nürnberg, Germany. Receives donation payment data. Privacy: billomat.com/datenschutz.
All-Inkl (hosting)
Server hosting by ALL-INKL.COM (Germany). Data processing agreement in place. Privacy: all-inkl.com/datenschutz.
Discord Webhooks
Internal operational notifications (e.g. "new badge discovered") are pushed via webhook to Discord Inc. (San Francisco, USA). No personal user data is transferred beyond public Twitch handles in the context of the alert. Privacy: discord.com/privacy.
4. Your rights
Under the GDPR you have the right to:
- Access your stored data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16)
- Erasure (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Object to processing (Art. 21)
- Withdraw consent at any time (Art. 7(3))
- Lodge a complaint with your national data protection authority (Art. 77) — ours: Landesbeauftragte für Datenschutz und Informationsfreiheit NRW, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.
5. Contact and erasure requests
For anything privacy-related, email marco.verch@gmail.com with subject line "Privacy".
6. Changes to this policy
We may update this policy when laws or services change. The current version is always at badgebase.de/datenschutz/.
Last updated: 2026-07-11