Last reviewed: 23 July 2026
Introduction
Protecting your personal data is important to me. I process personal data solely in accordance with the applicable legal requirements, in particular the GDPR, the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).
Controller
Thomas Zwicklhuber
Hauptstraße 43/3, 4542 Nußbach, Austria
Email: tom@medienmacher.biz
Contact requests by form or email
If you contact me through the contact form or by email, I process your email address and message and any information you provide voluntarily, such as your name, company, area of interest and preferred project start, to handle and follow up your request.
Requests submitted through the form are also stored internally as enquiries in the WordPress administration area and delivered by email.
To prevent misuse, the form processes technical verification data comprising a nonce, timestamp, signature, referrer, user agent and a truncated hash derived from the IP address and user agent for rate limiting.
Legal bases: Article 6(1)(b) GDPR for responding to your request and taking pre-contractual steps, and Article 6(1)(f) GDPR for security and misuse prevention. Separate consent is not required to respond to a request that you initiate.
Retention: contact requests are normally deleted automatically after 36 months unless a longer statutory retention obligation applies.
Website quick check by email
If you request the website quick check, I process your email address solely to deliver the requested PDF. The request is not stored as an enquiry in the WordPress administration area and does not trigger automatic follow-up advertising.
To prevent misuse, truncated, non-reversible hashes derived from the IP address and email address are processed for rate limiting for no longer than one hour. The theme does not separately store the delivery email or another copy of the PDF.
Legal bases: Article 6(1)(b) GDPR for fulfilling your request and Article 6(1)(f) GDPR for security and misuse prevention.
Online appointment booking
If you book an appointment through the scheduling tool, I process your name, email address, selected appointment, appointment status and duration, browser time zone and language setting, and the telephone number and message you may provide voluntarily. Random, non-guessable management tokens are stored for secure cancellation and rescheduling links. The information is stored in the WordPress administration area and used to administer the appointment, send confirmation or amendment emails and provide the attached calendar file (.ics).
The legal basis is Article 6(1)(b) GDPR for handling your appointment request and taking pre-contractual steps. To prevent misuse, non-reversible hashes derived from the IP address and email address are used for rate limiting. These verification values are processed temporarily in WordPress transients only: failed attempts for up to 15 minutes, management lookups for up to ten minutes and successful booking or email limits for up to two hours. The raw IP address is not stored with the booking.
Recipients are the processors identified under “Hosting and server logs” and “Email delivery”. Past bookings that were not cancelled are deleted automatically 365 days after the appointment ends; cancelled bookings are deleted no later than 90 days after cancellation unless a statutory retention or evidentiary obligation requires longer storage.
Technically necessary browser storage
This website stores the following settings locally in your browser for reliable operation and to retain your choices:
localStorage: theme for light or dark mode; when optional analytics is configured, mm_cookie_consent for the decision, policy version and expiry; and the namespaces mmf-arena-*, mmf-rpg-*, mmf-cuby-*, mmf-jump-*, mmf-crossfire-*, mmf-tower-* and mmf-cube-*. The browser games use these namespaces to store game state, progress, unlocked content, high scores, player name, language and graphics, audio, control and accessibility settings locally. Cuby World reads selected shared Cuby and Tower progress data to display the world map. The local key mmf-cuby-score-queue retains unsuccessful voluntary leaderboard submissions for a later retry, and mmf-reward retains a locally earned reward until it is redeemed. cdbg stores only a local game debug mode that you deliberately enable. Apart from a leaderboard submission that you initiate, this information remains on your device and no game account is created.
sessionStorage: mm_contact_scroll_y restores the scroll position after the contact form is submitted; mm_contact_prefill and mm_contact_prefill_scope hold contact-form details that you selected for pre-filling; and mm_paket_choice and mm_paket_scope pass your package choice to the contact form.
Cookies: mm_lang and mm_lang_manual store the language you explicitly selected for no longer than one year. mm_lang_prompt remembers for no longer than 180 days that the language notice was dismissed. mm_cuby_player contains a random, signed owner ID for voluntary Cuby leaderboard entries. This technically necessary, JavaScript-protected HttpOnly cookie remains valid for no longer than 400 days. It is set only in connection with the online leaderboard, is not used for audience measurement and is not disclosed to third parties.
These entries do not contain advertising profiles and are not used for personalised advertising.
Legal basis: Article 6(1)(f) GDPR in conjunction with Section 165(3) TKG 2021.
Retention: the choice stored in mm_cookie_consent expires after no more than 180 days and is discarded earlier if the policy version or analytics configuration changes. Other localStorage entries remain until you delete them, reset the relevant game or a technical change replaces the storage format. sessionStorage expires at the end of the browser session. The exact cookie lifetimes are stated above.
Optional web analytics with Matomo
Matomo is loaded only after active consent under Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Without consent, no Matomo script is requested and no analytics data is transmitted.
The theme integration enforces cookieless operation using disableCookies, honours the browser’s Do Not Track setting and does not set Matomo cookies even after consent. Technically necessary usage data, such as an IP address that is truncated or must be truncated on the server, timestamp, requested URL, referrer and browser and device information, is sent to the self-hosted Matomo instance on medienmacher.biz. The Matomo instance must have IP anonymisation enabled, and raw analytics data must be deleted no later than after 13 months.
Your choice is stored for no more than 180 days. You may withdraw consent at any time through “Privacy settings” with effect for the future. No further Matomo data is transmitted after withdrawal.
Newsletter
If you optionally subscribe to the newsletter through the checklist form, your email address and language preference are stored for newsletter delivery on the basis of your consent under Article 6(1)(a) GDPR.
Registration uses double opt-in. After submitting the form, you receive a confirmation email and the subscription becomes active only after you follow its confirmation link.
Newsletter registrations are initially stored locally in WordPress. Unconfirmed registrations are deleted after seven days. After confirmation, the email address, language, source and confirmation time may be synchronised with Brevo. The provider is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. Brevo may be used as a processor only after an agreement under Article 28 GDPR has been concluded and the service has been configured accordingly.
You may unsubscribe at any time through the link included in each issue or by sending me an informal message. After unsubscribing, the record is removed locally and from Brevo, and the local status is deleted completely no later than after 30 days.
Email delivery
Contact, delivery and confirmation emails are sent through the WordPress wp_mail() function and the SMTP connection configured on the production system. The SMTP processor is IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The data processed includes the recipient address, sender, subject, content and, where applicable, the PDF attachment.
Email content, attachments, opening data and click data must not be logged in WP Mail SMTP. A technically necessary delivery status without content or interaction tracking is sufficient for error analysis.
Browser-game leaderboards
After a game on the Apps page, you may voluntarily submit a player name of your choice to a public leaderboard. The submitted name, relevant game values, submission time and a randomly generated pseudonymous owner ID are stored. A short public tag is derived from the owner ID so identical player names can be distinguished. The internal owner ID and its signature are not published, and no IP address, email address or account data is stored with an entry.
The owner ID prevents third parties from overwriting an existing entry merely by reusing the visible player name. It is held in a signed HttpOnly cookie on your device and is not evaluated outside the browser-game leaderboards. If you delete this cookie or change browsers, the server can no longer identify an earlier entry as yours; recovery is not possible without an account.
A temporary technical verification token and strict origin checking are also used to prevent misuse. The number of entries per hour is limited using a truncated IP-address hash. This hash is held transiently for no more than one hour and is not linked to the leaderboard entry.
Legal bases: Article 6(1)(a) GDPR for the voluntary entry and Article 6(1)(f) GDPR for misuse prevention.
Retention: each leaderboard holds no more than the 150 best entries and automatically deletes lower-ranked entries. The owner cookie expires no later than 400 days after it was last renewed. I will remove your entry at any time upon an informal request that identifies the player name and public short tag; see the contact details above.
Voluntary support through PayPal
The Apps page links to an external PayPal payment page for voluntary support of my free browser games. Unless you follow this link, this website does not transmit payment data to PayPal and does not load PayPal cookies or scripts.
When you open the PayPal link, you leave this website. PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg is independently responsible for payment processing. PayPal may process account, contact, transaction, device, security and payment data in particular to provide the payment, prevent fraud and comply with legal obligations.
I receive only the payment information required to allocate and document the voluntary support for accounting purposes, such as the name or PayPal display, amount, currency, time, transaction reference and, where applicable, email address. I do not use this data for advertising or newsletters.
Legal bases: Article 6(1)(b) GDPR for processing the payment you initiated, Article 6(1)(c) GDPR for tax and business-law retention duties, and Article 6(1)(f) GDPR for documentation, accounting and misuse prevention.
Retention: I retain payment and accounting records to the extent required by law. Details of PayPal’s processing are provided in the PayPal Privacy Statement.
Local fonts and assets
Fonts and icons used to display this website are served locally from its own server. Visiting the website does not request resources from Google Fonts CDNs or comparable external font services.
Hosting and server logs
This website is hosted by
IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany as a processor under Article 28 GDPR on the basis of a data processing agreement. When the website is accessed, technically necessary server logs containing the IP address, time, requested URL, transferred data volume, referrer and user agent are processed to maintain stability and security and analyse errors under Article 6(1)(f) GDPR.
Retention: server logs are normally deleted after 14 days unless longer retention is required to investigate a specific security incident.
Recipients
Personal data is disclosed to third parties only to the extent necessary to operate the website
— in particular to IONOS SE as hosting and email processor, Brevo after a confirmed newsletter subscription and, where applicable, the configured Matomo host after consent —
or where disclosure is required by law.
If you provide voluntary support through PayPal, PayPal is independently responsible for payment processing and may disclose data in accordance with its privacy statement, in particular to affiliated companies, service providers, financial institutions, authorities or other recipients.
I do not otherwise transfer personal data to third countries.
Your rights
Subject to the statutory requirements, you have the following rights:
- Access under Article 15 GDPR
- Rectification under Article 16 GDPR
- Erasure under Article 17 GDPR, unless a retention obligation applies
- Restriction of processing under Article 18 GDPR
- Data portability under Article 20 GDPR
- Withdrawal of consent under Article 7(3) GDPR
- Objection under Article 21 GDPR
You may lodge a complaint with the Austrian Data Protection Authority:
Barichgasse 40-42, 1030 Wien, Austria
dsb.gv.at
