Privacy policy

Last updated: 9 November 2026

This privacy policy explains which personal data we process when you visit WANTED SIX or use an account: why, on which legal basis, who receives data, where it is stored, how long we keep it and which rights you have. It describes the platform as it works technically today. Where something is not yet implemented the way we want it to be, we say so openly.

This policy is available in German and in English. Both versions have the same content. If they contradict each other, the interpretation more favourable to you applies. The cookie policy, which lists every cookie and storage entry in detail, the terms of use, the community guidelines and the legal notice also apply.

Summary

• The controller is WKD GmbH in Amstetten, Austria. You can reach us at hello@wantedsix.com or via the contact form.

• You can read WANTED SIX without an account. Accounts are available from age 18; for one we need an e-mail address, a password (or your sign-in with Google), a handle (user name) and a display name.

• The database, sign-in and files are stored in Frankfurt am Main. The website's server functions, however, run in Washington, D.C., USA. Requests to our servers, form inputs, chat and comment texts, image uploads and data exports therefore pass through servers in the USA; for signed-in members this applies to every page view. They rely on the EU-U.S. Data Privacy Framework and standard contractual clauses.

• Google Analytics 4 is active, but it only runs if you have consented to the purpose “Statistics” and to Google Analytics 4 as a service in the cookie settings. No advertising trackers are active: we have technically prepared Google Ads, the Meta Pixel (Facebook and Instagram) and the TikTok Pixel, but they are switched off.

• Our own statistics and YouTube videos only load with your consent. We do not use fingerprinting.

• Profiles are public by default. You can set your profile to private; your handle and display name then remain visible, for example next to your comments.

• Our team cannot read direct messages and crew chats through the platform. They are, however, not end-to-end encrypted. If you report messages, only the excerpt you select goes to moderation.

• Some data remains after an account is deleted: your comments and chat messages (shown as “Deleted account”), your points history, moderation records and consent records, and currently also your e-mail address, your sign-in data and uploaded files. What exactly remains and why is explained in the section “Account deletion”. On request we remove everything we are not required to keep.

• For some data we have set deletion periods, but their automatic deletion is not switched on yet. For other data there is no fixed period yet. We say both openly for each processing activity.

• You can download your data under Data & account. You can request full access, rectification, erasure or object by e-mail; we reply within one month.

Controller and contact

The controller for the processing of personal data on WANTED SIX within the meaning of Art. 4(7) GDPR is WKD GmbH, Arthur-Krupp-Straße 1, 3300 Amstetten, Austria, company register number FN 685687p, register court Landesgericht St. Pölten, e-mail hello@wantedsix.com. WKD GmbH operates WANTED SIX and decides on the purposes and means of the processing. All further company details are in the legal notice.

For privacy matters you can reach us by e-mail, via the contact form or by post at the address above, in German or English.

We have not appointed a data protection officer. Art. 37 GDPR does not require one: our core activities neither consist of large-scale, regular and systematic monitoring of individuals nor of large-scale processing of special categories of personal data or of data relating to criminal convictions and offences. Please send all privacy matters directly to the address above.

How to exercise your rights

You can do a lot yourself in the member area: you change your profile, visibility and notifications in the account settings, and under Data & account you download your data and request the deletion of your account. You can change or withdraw your cookie choice at any time via “Cookie settings” in the footer of the public pages or via the button in the cookie policy.

For everything else, for example full access under Art. 15 GDPR, the rectification of your e-mail address, the erasure of specific data, a restriction or an objection, proceed as follows:

1. Send your request to hello@wantedsix.com or via the contact form. If you have an account, state your handle and ideally write from the e-mail address you registered with.

2. We check that the request really comes from you, so that nobody receives someone else's data. For this we may ask you to confirm the request from your account or from your registered e-mail address. We only ask for the information we need for this check.

3. We reply within one month. For complex or numerous requests this period can be extended by up to two further months; in that case we tell you within the first month and give the reasons (Art. 12(3) GDPR).

4. Handling your request is free of charge. Only for manifestly unfounded or excessive requests may we charge a reasonable fee or refuse to act under Art. 12(5) GDPR.

Legal bases at a glance

For each processing activity we state the legal basis. These are:

• Art. 6(1)(a) GDPR: your consent, for example for statistics, YouTube videos and the newsletter. Storing and reading information on your device that is not strictly necessary is additionally governed by § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).

• Art. 6(1)(b) GDPR: the performance of the contract of use with you, i.e. everything you use as a member.

• Art. 6(1)(c) GDPR: a legal obligation, for example under the Digital Services Act (DSA) for notices of illegal content, the obligation to demonstrate consent, or answering your privacy requests.

• Art. 6(1)(f) GDPR: our legitimate interest. We state which interest applies in each case. You can object to this processing (see “Your right to object”).

• § 165(3) TKG 2021: cookies and storage entries without which the platform or a function you requested cannot work are used without consent.

Processing activities in detail

For each processing activity you will find the same points below: which data, for what purpose, on which legal basis, who receives it, where it is stored, how long we keep it and whether you have to provide it. Two things apply almost everywhere and are therefore only stated here:

• Stored in Frankfurt: our database, sign-in and file storage run at Supabase in Frankfurt am Main (region eu-central-1). Our contracting partner is Supabase Pte. Ltd. in Singapore; access for support and operations is also possible from Singapore and the USA. This relies on standard contractual clauses.

• Server functions in the USA: the website runs on Vercel. Pages, forms and interfaces are processed by server functions in Washington, D.C., USA (region iad1). Whatever you retrieve or submit as a signed-in member therefore passes through the USA before it is stored in Frankfurt. This relies on the EU-U.S. Data Privacy Framework, under which Vercel is certified, and on standard contractual clauses. Where your browser talks directly to Supabase in Frankfurt, we say so for the activity concerned.

1. Visiting the website, hosting and server logs

When you open a page, requests from Europe are usually received by a Vercel location in Frankfurt am Main. Static content comes from Vercel's cache; dynamic content is generated by our server functions in the USA. Our server itself fetches banners, cover images and preview images from Supabase or YouTube and delivers them to you, so your browser does not contact third-party servers for them. Profile pictures and other small avatar images are loaded by your browser directly from our file storage at Supabase. We process search terms only to show results; we keep no search log of our own. Fonts are hosted on our own servers. For the offline page your browser caches some website files via a service worker, without any personal data.

• Data: IP address, time, requested address including search parameters, browser identifier (user agent), referring page, browser language setting, the cookies your browser sends (see the cookie policy) and technical error messages.

• Purpose: Delivering pages, choosing the right language, keeping signed-in sessions current, resizing images, securing operations and detecting errors and attacks.

• Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a secure, fast and working service. For signed-in members additionally Art. 6(1)(b) GDPR.

• Recipients: Vercel Inc. (hosting, delivery, server functions) and Supabase (database, file storage) as processors.

• Location and transfers: Delivery via Vercel's network, for Europe usually Frankfurt am Main; server functions in Washington, D.C., USA (Data Privacy Framework and standard contractual clauses); Supabase in Frankfurt am Main.

• Retention: Vercel and Supabase keep technical logs with connection data. How long they keep them depends on the providers' settings; we do not create our own copies of these logs. Our own code writes only error messages into these logs, no content.

• Do you have to provide it?: Technically necessary. Without this data the website cannot be displayed.

2. Registration and age confirmation

You create an account under “Register”. Your browser sends the details directly to our sign-in service Supabase Auth in Frankfurt; they do not pass through our server functions in the USA. We check whether a handle is still available while you type.

• Data: E-mail address, password (stored only as a hash), handle (3 to 24 characters, cannot be changed later), display name, language, your confirmation that you are at least 18 years old, with its time, and your acceptance of the terms of use, with time and version. Optionally a creator code and, if you arrive via an invite link, the invite code; we also store both codes in the account data of the sign-in service. With statistics consent, our own statistics count pseudonymously that a registration form was started (see section 32).

• Purpose: Creating the account, setting your public identity, proving that you are an adult and accepted the terms, assigning invitations and creator support (see section 25).

• Legal basis: Art. 6(1)(b) GDPR (conclusion and performance of the contract of use); for proof of age and acceptance additionally Art. 6(1)(f) GDPR, our legitimate interest in being able to show that only adults hold accounts and that the terms were accepted.

• Recipients: Supabase as processor. Your handle and display name are publicly visible (see section 9).

• Location and transfers: Frankfurt am Main. The registration page itself is delivered by Vercel.

• Retention: As long as your account exists. What remains after deletion is explained in the section “Account deletion”.

• Do you have to provide it?: E-mail address, password, handle, display name, age confirmation and acceptance of the terms are required for an account; without them we cannot create one. Creator and invite codes are optional. We do not check any ID document.

3. E-mail confirmation and account e-mails

After registration, when you request a confirmation again or when you have forgotten your password, you receive an e-mail with a one-time link. These e-mails are sent by our sign-in service Supabase via our e-mail delivery service Brevo (see section 30). The link is only redeemed on our confirmation page, so that e-mail programs that open links in advance cannot use it up. You currently cannot change your e-mail address yourself; please write to us for that.

• Data: E-mail address, one-time confirmation code, language setting, time of confirmation.

• Purpose: Proving that the e-mail address belongs to you and restoring access.

• Legal basis: Art. 6(1)(b) GDPR.

• Recipients: Supabase and Brevo as processors; your own e-mail provider as recipient of the e-mail.

• Location and transfers: Supabase in Frankfurt am Main; redeeming the link passes through our server functions in the USA.

• Retention: The codes are valid only once. We keep the confirmation of your address as long as your account exists.

• Do you have to provide it?: A confirmed e-mail address is a requirement for some functions, for example voting in challenges and rewards for invitations and creator codes.

4. Sign-in and sessions

You sign in with your e-mail address and password; your browser sends both directly to Supabase Auth in Frankfurt. After that a session cookie keeps you signed in. Under Account security you can end all sessions on other devices.

• Data: E-mail address, password (only to compare it with the stored hash), time of last sign-in; per session the IP address, browser identifier, timestamps and whether a second factor was used. The session cookie contains access keys with your user ID, your e-mail address and your account details, for Google sign-in also the name and picture address from your Google account.

• Purpose: Signing you in and keeping you signed in, managing sessions and detecting misuse of your account.

• Legal basis: Art. 6(1)(b) GDPR; for IP address and browser identifier Art. 6(1)(f) GDPR, our legitimate interest in protecting accounts against unauthorised access. The session cookie is strictly necessary (§ 165(3) TKG 2021).

• Recipients: Supabase as processor; Vercel, because every page request of a signed-in member carries the session cookie and our server functions check it.

• Location and transfers: Session data in Frankfurt am Main; the session cookie containing your e-mail address goes to our server functions in the USA with every page request.

• Retention: The cookie can last up to 400 days and is deleted when you sign out. There is currently no automatic deletion period for session data in the database; it can be kept until your account is deleted. On request we delete old sessions earlier.

• Do you have to provide it?: Required to use your account. We currently do not show a list of your sessions; you can get information about them on request.

5. Forgotten password and password change

If you have forgotten your password, we send you a link via Supabase (see section 3). When you open it, our server sets a cookie for 30 minutes that only contains your user ID and shows that this browser opened the link. You then send your new password to our server function, which passes it on to Supabase. If you change your password in the settings, you first confirm your current password; both go directly from your browser to Supabase.

• Data: E-mail address, one-time link, your user ID in the recovery cookie, new password (stored only as a hash).

• Purpose: Restoring access and changing your password.

• Legal basis: Art. 6(1)(b) GDPR; the cookie is strictly necessary (§ 165(3) TKG 2021).

• Recipients: Supabase, Brevo and Vercel as processors.

• Location and transfers: When you reset via the link, the new password passes through our server function in the USA before it is stored as a hash in Frankfurt. A change in the settings goes directly to Frankfurt.

• Retention: The recovery cookie is valid for 30 minutes and is deleted once the password is set or when you sign out. The password hash is kept as long as your account exists.

• Do you have to provide it?: Optional; without recovery you cannot replace a forgotten password.

6. Sign-in with Google

Instead of using your e-mail address and password, you can register and sign in with your Google account. You then sign in at Google, and Google sends the result to us via Supabase Auth. The first time, you choose your handle and display name, confirm your age and accept the terms of use. We pre-fill the display name with the name from your Google account; we do not use your Google profile picture. If an account with the same e-mail address already exists, the Google sign-in is automatically linked to that account.

• Data: From Google: e-mail address and whether Google has verified it, name, address of your Google profile picture and your Google account ID. Supabase stores these details as identity data and in the account details that are also contained in the session cookie.

• Purpose: Sign-in without a separate password, pre-filling the display name.

• Legal basis: Art. 6(1)(b) GDPR.

• Recipients: Google (Google Ireland Limited or Google LLC) is itself responsible for the sign-in at Google; the Google privacy policy (opens in a new tab) applies. Supabase processes the data as our processor.

• Location and transfers: Supabase in Frankfurt am Main; the exchange of the sign-in code passes through our server functions in the USA. Google may process data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.

• Retention: As long as your account exists. There is currently no button to unlink Google; on request we unlink it. After an account deletion the Google identity data currently remains stored until you ask us to remove it (see section 37).

• Do you have to provide it?: Optional. You can also register with an e-mail address and password.

7. Steam verification

We do not offer sign-in with Steam. As a member you can, however, verify a Steam account under Connections. For this we redirect you to Steam, where you sign in with Valve. Steam sends us a confirmation, which our database server double-checks directly with Steam.

• Data: Your SteamID (a 17-digit number), time of verification, visibility of the link; for the process short-lived check values that we store only as hashes. We do not retrieve your Steam profile name or Steam avatar.

• Purpose: Showing a Steam account as verified on your profile.

• Legal basis: Art. 6(1)(b) GDPR.

• Recipients: Valve Corporation (USA) is itself responsible for the sign-in at Steam; Valve's privacy policy (opens in a new tab) applies. Your verified SteamID is publicly visible on your profile by default.

• Location and transfers: Stored in Frankfurt am Main. The return from Steam passes through our server functions in the USA; the double-check is sent by our database server in Frankfurt to Steam in the USA. It contains only the details Steam itself issued and only happens when you start the verification.

• Retention: The SteamID until you remove the link or your account is deleted. Check values older than one day are deleted whenever a Steam verification is started next.

• Do you have to provide it?: Optional. You change the visibility per link and can remove the link at any time.

8. Two-factor sign-in

Under Account security you can additionally protect your sign-in with an authenticator app (time-based one-time codes) and add a second device as a backup. There are no recovery codes. The QR code for the set-up is generated by Supabase; we do not use a third-party QR service.

• Data: Secret key of the factor, name with set-up time, status, times of the last check; per session whether the second factor was used.

• Purpose: Protecting your account. Team members who have set up a second factor only receive administrative rights after signing in with that factor.

• Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR, our legitimate interest in secure accounts.

• Recipients: Supabase as processor.

• Location and transfers: Frankfurt am Main; the set-up runs directly between your browser and Supabase.

• Retention: Until you remove the factor. After an account deletion the factors currently remain stored until you ask us to remove them.

• Do you have to provide it?: Optional. If you lose all registered devices, our support helps you after checking your identity; please write to us.

9. Profile and visibility

Your profile is public by default, and all sections are visible. Under Privacy you set it to private, hide individual sections and decide who may follow and message you. You change the content under Edit profile.

• Data: Handle, display name, profile picture, banner, “About me” text (up to 500 characters), language, visibility settings, follow and direct-message settings, account status, “member since” (month and year), level and rank, creator badge.

• Purpose: Your identity in the community and control over what others see.

• Legal basis: Art. 6(1)(b) GDPR.

• Recipients: With a public profile all visitors, including those without an account: always handle, display name, profile picture, banner, “member since”, level, rank and creator badge, plus, depending on your settings, “About me”, follower counts and lists, gaming accounts, equipped rewards and crew. With a private profile your handle and display name remain visible, for example next to comments; members of your crew still see you in the member list. Public profiles may be indexed by search engines once we open the platform to search engines; private profiles are never opened for indexing. For the team see “Recipients at a glance”.

• Location and transfers: Stored in Frankfurt am Main; processed via our server functions in the USA (see above).

• Retention: As long as your account exists; on account deletion the profile is pseudonymised.

• Do you have to provide it?: Handle and display name are required, everything else is optional. You cannot change your handle after the set-up.

10. Profile pictures, banners and image processing

When you upload a profile picture or banner, the file first lands in a non-public folder. Our server checks the actual file format and size, orients the image, resizes it and saves it again as a WebP file. In doing so it removes all metadata such as camera data or location details and then deletes the uploaded original file.

• Data: The image file, which may show you or other people, and its storage path.

• Purpose: Displaying your profile.

• Legal basis: Art. 6(1)(b) GDPR.

• Recipients: The finished image is stored in public storage and can be retrieved by anyone who knows its address; the address contains your user ID. Supabase and Vercel as processors.

• Location and transfers: Processing takes place in our server function in the USA; storage is in Frankfurt am Main.

• Retention: As long as the image is in use. If you replace or remove an image, the old file currently remains stored and retrievable via its address; this also applies after an account deletion. On request we delete such files.

• Do you have to provide it?: Optional.

11. Gaming accounts

Under Connections you can add up to ten gaming accounts, for example on PlayStation, Xbox, Steam, Epic or other platforms. We do not check these details, except for the Steam verification (section 7).

• Data: Platform, gamertag, ID or link, optional label, visibility, verification status.

• Purpose: Showing others where to find you when playing.

• Legal basis: Art. 6(1)(b) GDPR.

• Recipients: Newly added gaming accounts are publicly visible on your profile by default, as long as your profile is public and you do not hide the section. You change the visibility per entry.

• Location and transfers: Stored in Frankfurt am Main; processed via our server functions in the USA (see above).

• Retention: Until you remove the entry; on account deletion all gaming accounts are deleted.

• Do you have to provide it?: Optional.

12. Follows and blocks

You can follow other members and block members. A block prevents new follows, replies, likes and direct messages in both directions; existing follows and comments remain. You see and lift your blocks under Privacy.

• Data: Who follows whom and since when; whom you have blocked and since when.

• Purpose: Social connections in the community, notification about new followers, protection against unwanted contact.

• Legal basis: Art. 6(1)(b) GDPR; following is limited to 50 actions in ten minutes, based on Art. 6(1)(f) GDPR, our legitimate interest in preventing spam.

• Recipients: The person you follow is notified. Follower and following lists and their counts are public unless the profile is private or the section is hidden; private profiles do not appear in other people's lists. Only the member concerned sees the exact time of a follow. Only you see whom you have blocked; the blocked person is not notified, but sees in a conversation you share, or when trying to message you, that a block is in place between you.

• Location and transfers: Stored in Frankfurt am Main; processed via our server functions in the USA (see above).

• Retention: Until you unfollow or lift the block; on account deletion follows and blocks are deleted in both directions.

• Do you have to provide it?: Optional. Under Privacy you can rule out new followers completely.

13. Comments and likes

As a member you can comment on and like editorial articles and creator content. Comments are plain text with at most 2,000 characters.

• Data: Comment text, reference (article, reply to a comment), times of creation, editing and deletion, status; for likes, what you liked and when.

• Purpose: Public discussion; notifying the person you reply to and, where applicable, the creator whose content you comment on, in each case without the comment text.

• Legal basis: Art. 6(1)(b) GDPR; for the limit of five comments per minute Art. 6(1)(f) GDPR, our legitimate interest in preventing spam.

• Recipients: Comments are visible to all visitors, with handle and display name, and with a public profile also with your profile picture. For likes only the total count is public, not who liked.

• Location and transfers: Stored in Frankfurt am Main; comment texts pass through our server functions in the USA when sent and displayed.

• Retention: There is no automatic deletion period. If you delete a comment, it is hidden for everyone at once; the text currently remains stored in our database, and on request we delete it permanently. If you edit a comment, the old text is overwritten. Likes are deleted when you remove them. What happens after an account deletion is explained in section 37.

• Do you have to provide it?: Optional.

14. Direct messages and crew chats

You write direct messages to individual members; crew chats take place in your crew's channels. You decide under Privacy who may message you; by default only members you follow and who follow you. Depending on your setting, others can send you a request with exactly one message, which you accept or decline.

• Data: Message text (up to 2,000 characters), sender, timestamps, edit and deletion marker, participants and status of requests, read status and muting; for crew channels the channel name and minimum role.

• Purpose: Private communication between members and within crews.

• Legal basis: Art. 6(1)(b) GDPR; for abuse limits (such as 30 messages per minute and 20 new conversations per hour) Art. 6(1)(f) GDPR, our legitimate interest in preventing spam.

• Recipients: Direct messages are read only by the two participants. Crew channels are read by the crew's current members with a sufficient role; new members also see earlier messages of a channel, and anyone who leaves the crew loses access immediately. Our team, including the operator and admins, cannot read other people's chats through the platform. Notifications about new direct messages never contain the text.

• Location and transfers: Stored in Frankfurt am Main. Message texts pass through our server functions in the USA when sent and every time they are retrieved. For live updates your browser connects directly to Supabase in Frankfurt; only identifiers travel this way, no texts.

• Retention: There is currently no automatic deletion period for chat histories. If you delete one of your messages, its text is removed and a placeholder remains. You can edit a message for 15 minutes; the old text is overwritten. Whole conversations cannot be deleted. If a crew is dissolved, its channels are archived and the messages remain stored.

• Do you have to provide it?: Optional.

Chats are transmitted encrypted, but they are not end-to-end encrypted. Anyone who technically operates the database and has direct access to it could view them. So please do not share passwords or other sensitive data in chats.

If you report messages, you select up to 20 messages of a conversation yourself. Only this selection goes to moderation as an unchangeable copy, with the text, sender handle and time of each message; in a crew channel it may contain messages from several members. The copy is kept even if a message or an account is deleted later. Only team members with a separate permission for chat evidence can see it, and every access is logged. More on this in section 26.

15. Notifications

In the member area we inform you about new followers, messages, crew and creator events, challenges, rewards, events and security matters. Under Notification preferences you choose per area whether you want them on the website and by e-mail. Security notices, for example about deletion requests or moderation decisions, cannot be switched off.

• Data: Type and time of the notification, identifiers and handles of the members or content involved, read status; for moderation decisions the statement of reasons; your settings per area. If e-mail delivery is switched on for an area (always for security notices), we also queue the notification with its full content for e-mail delivery.

• Purpose: Informing you about what happens in your account.

• Legal basis: Art. 6(1)(b) GDPR; for communicating moderation decisions additionally Art. 6(1)(c) GDPR in conjunction with Art. 17 DSA.

• Recipients: Only you. Notifications never contain the text of messages or comments.

• Location and transfers: Stored in Frankfurt am Main; processed via our server functions in the USA (see above).

• Retention: There is currently no automatic deletion period; notifications are deleted with the account. Notifications queued for e-mail delivery currently remain stored with their content, such as the reasons for a moderation decision, without a fixed period, also after an account deletion (see section 30).

• Do you have to provide it?: By default, notifications on the website are on (except for marketing) and by e-mail off (except security notices). We do not send e-mail notifications yet, because the sending of platform e-mails is limited to test addresses of our team for the time being (see section 30).

16. Crews

Members can found crews, join them, apply, be invited, leave and dissolve them. A crew's leadership (owner, crew admins and officers) manages members, roles, applications and invitations. Each crew has its own chat channels (section 14).

• Data: Crew profile (name, tag, descriptions, logo, banner, platforms, languages, region, time zone, play style, links, status); membership with role and join date; history of joining and leaving with the type of ending; applications with your answers to the crew's questions (up to 1,000 characters per answer), decision and reason; invitations; a crew log of management actions such as role changes or removals with reason.

• Purpose: Crew directory, member management, permissions within the crew, access to the crew channels, participation in crew challenges and traceability for the crew leadership.

• Legal basis: Art. 6(1)(b) GDPR.

• Recipients: Profiles of active crews are public. The public member list shows handle, display name, profile picture, role and join date only for members with a public profile who have not hidden their crew; the others are only counted. Crew members see the full list. Applications and answers are visible to the owner, crew admins and officers; the crew log to the owner and crew admins. If moderation restricts a crew, the reason appears in the crew log.

• Location and transfers: Stored in Frankfurt am Main; processed via our server functions in the USA (see above).

• Retention: Memberships end when you leave, are removed or the crew is dissolved. The history, applications, invitations and the crew log currently remain stored without a fixed period, also after a dissolution. For the details of rejected applications a period of 90 days has been set; its automatic deletion is not switched on yet. Dissolved crews remain stored as dissolved, with texts, logo and banner.

• Do you have to provide it?: Optional. Answering a crew's questions is voluntary; do not enter passwords or ID details there.

17. Creator application

You apply for the creator programme via the creator application. The team reviews the application and your channels manually; you answer follow-up questions on the application page.

• Data: Profile name, focus, introduction (up to 1,000 characters), one to six links to your channels on YouTube, Twitch, TikTok, X, Instagram or Kick, time of your confirmation of the creator guidelines; questions from the team and your answers, status, decision with reason and the deciding person. The team also sees your handle, display name, profile picture and the number of earlier applications.

• Purpose: Deciding on admission as a creator; observing the waiting period of 14 days after a rejection or revocation.

• Legal basis: Art. 6(1)(b) GDPR (steps prior to and performance of participation in the creator programme).

• Recipients: You and team members with permission to review creator applications. We do not automatically retrieve your channels when you apply.

• Location and transfers: Stored in Frankfurt am Main; processed via our server functions in the USA (see above).

• Retention: Without a fixed period, also after rejection or withdrawal. For the details of rejected applications a period of 90 days has been set; its automatic deletion is not switched on yet. Open applications are withdrawn on account deletion, but not deleted.

• Do you have to provide it?: Optional; without an application there is no admission as a creator.

18. Creator page, creator content and creator statistics

As an admitted creator you design your creator page in the Creator Studio and publish clips, edits, screenshots, guides and posts yourself. The team does not approve posts in advance, but can hide them with a reason in case of violations; it does not change texts or media. Images are re-encoded and stored without metadata, like profile pictures (section 10).

• Data: Creator page (address, which is also your creator code, display name, focus, description, profile picture, banner, up to six channel links, linked YouTube channel, page layout, verification with date, status); content (title, summary, tags, cover image, text, YouTube video, up to 12 images, language, status, moderation note) and every saved version; aggregated view counts of your page and content.

• Purpose: Your public presence as a creator, publishing your content and a reach overview for you.

• Legal basis: Art. 6(1)(b) GDPR.

• Recipients: The creator page and published content are visible to all visitors as long as your profile is public and your creator status is active, including handle, description, channel links, YouTube channel, verification date, creation date and follower count. Images are stored in public storage. View counts in the Creator Studio come only from visitors who consented to statistics and show no individuals; we do not show exact values from 1 to 4.

• Location and transfers: Stored in Frankfurt am Main; image processing and display via our server functions in the USA.

• Retention: Without a fixed period. You can unpublish or archive content, but not delete it yourself; earlier versions remain stored. On request we delete content permanently. If your creator status is revoked, the page and content are no longer public. On account deletion we additionally clear the details of the creator page; the page address, the content and its image files currently remain stored, and the images can still be retrieved via their direct address.

• Do you have to provide it?: Optional.

19. Creators' YouTube channels and YouTube data

Creators can link a YouTube channel in the Creator Studio. Our server then regularly retrieves public information about the channel and its latest videos via Google's interface (YouTube Data API). We load data on official trailers in the same way. We do not technically check whether the channel really belongs to you; a channel can only be linked to one creator.

• Data: Channel ID or handle; retrieved from Google: channel title, handle, channel image, the latest uploads, video titles, publication date, duration, thumbnail, status as well as view and like counts. We do not retrieve subscriber counts.

• Purpose: Showing the latest videos on the creator page, in the creator area of the home page and with the trailers.

• Legal basis: Art. 6(1)(b) GDPR towards creators; for official trailers Art. 6(1)(f) GDPR, our legitimate interest in informing about the game.

• Recipients: Google receives our API key as well as channel IDs, handles and video IDs, but no visitor data. We show the retrieved details publicly, including view and like counts.

• Location and transfers: Our server function in the USA sends the requests to Google; Google LLC is certified under the EU-U.S. Data Privacy Framework. Storage is in Frankfurt am Main.

• Retention: Cached channel and video data has no fixed period and is updated regularly. If you remove the link or your account is deleted, we delete the channel entry; video data already retrieved and the handle entry currently remain in the cache. Technical retrieval logs are deleted automatically after two days.

• Do you have to provide it?: Optional.

20. Events, RSVPs and waiting lists

You can RSVP to or decline official events and events by creators. If an event is full, you go on the waiting list and move up automatically in the order of registration. Deadlines for registering and cancelling are shown with each event. If you create an event as a creator, its details are public.

• Data: Your RSVP, cancellation or waiting-list place with time and, where applicable, the time you moved up; reminders sent. For your own events as a creator: title, description, banner, times, online link and capacity.

• Purpose: Managing places, processing the waiting list, reminding you 24 hours and 1 hour before the start and informing you about cancellations or postponements.

• Legal basis: Art. 6(1)(b) GDPR.

• Recipients: Only the numbers are public. For official events, team members with permission to manage events see who has RSVPed (handle, display name, profile picture for public profiles, timestamps), including private profiles. Creators only see numbers for their events.

• Location and transfers: Stored in Frankfurt am Main; processed via our server functions in the USA (see above).

• Retention: RSVPs remain stored without a fixed period, also after the event. The reminder log is deleted automatically after 180 days. On account deletion we cancel future participations; past ones remain stored.

• Do you have to provide it?: Optional; without an RSVP there is no participation.

21. Progress: XP, Season Points, Wanted Tokens, Season Pass, rewards and boosts

For activities on WANTED SIX you receive experience points (XP), Season Points (SP) and Wanted Tokens (WT) according to fixed rules. You can only redeem WT in the rewards catalog for digital items such as banners, badges or an XP boost. They cannot be bought, paid out or transferred and have no cash value. The Season Pass is free.

• Data: Every credit and debit with type, occasion, time and ruleset; balances, level and rank; receipts for claimed tiers and rewards; limits per period; redeemed and equipped rewards; boosts with activation and expiry; the days on which you were active (date only); corrections by the team with a reason, which you see in your history.

• Purpose: Crediting points fairly and traceably, enforcing limits, calculating levels and ranks and providing rewards. The active days also count as a requirement for rewards from invitations and creator codes (section 25).

• Legal basis: Art. 6(1)(b) GDPR; for keeping the history after an account deletion Art. 6(1)(f) GDPR, our legitimate interest in a tamper-proof and verifiable points system.

• Recipients: Level and rank always appear on your public profile; equipped rewards are visible as long as you do not hide the “Equipped rewards” section. Team members with permission for corrections or rewards see the history.

• Location and transfers: Stored in Frankfurt am Main; processed via our server functions in the USA (see above).

• Retention: Without a fixed period; the history is kept even after an account deletion.

• Do you have to provide it?: Arises automatically when you use the functions.

22. Daily missions and question of the day

Daily missions are small daily tasks, for example checking in, discovering a new article or answering the question of the day. For the discovery task an article is marked as read when you mark it yourself or, while such a task is running, when it has been visible for 20 seconds or you have scrolled past 60 percent. You can answer the question of the day once a day.

• Data: Your missions with progress, completion and claim; events such as check-ins, articles marked as read (which article and when), challenge registrations and submissions; your answers to the question of the day with the chosen answer, right or wrong, and time.

• Purpose: Calculating mission progress and crediting rewards. Completed missions also count towards rewards from invitations and creator codes.

• Legal basis: Art. 6(1)(b) GDPR.

• Recipients: Only you. The team sees the mission templates, not your progress.

• Location and transfers: Stored in Frankfurt am Main; processed via our server functions in the USA (see above).

• Retention: Without a fixed period; the data is kept even after an account deletion.

• Do you have to provide it?: Optional.

23. Rankings and Hall of Fame

The rankings show players by XP, the Season Board by Season Points and the Hall of Fame the top three of a season. They are calculated from your progress data.

• Data: Position, handle, display name, profile picture, XP, level and rank or Season Points; in the Hall of Fame type, place, score, title and date.

• Purpose: Competition in the community.

• Legal basis: Art. 6(1)(b) GDPR.

• Recipients: All visitors, including those without an account. Only active public profiles appear in the rankings; private, suspended or deleted profiles appear as a placeholder or not at all. Team members can hide entries with a reason, but do not change any numbers.

• Location and transfers: Stored in Frankfurt am Main; processed via our server functions in the USA (see above).

• Retention: Rankings are recalculated continuously. Hall of Fame entries are kept permanently; with a private or deleted profile they appear without your name.

• Do you have to provide it?: You appear automatically as long as your profile is public. You can only remove yourself by setting your profile to private; hiding individual profile sections is not enough.

24. Challenges, evidence and voting

In challenges you register alone or with your crew, submit an entry with evidence, and the team evaluates it. Some challenges end with a community vote. There are no entry fees or stakes. We currently award no cash or physical prizes; if we offer any, separate participation terms will apply in advance.

• Data: Registration (you or your crew, who registered, status, withdrawal or disqualification with reason) and the crew's line-up; submission with text (up to 2,000 characters), up to three links and up to ten evidence files (images or videos up to 25 MB) as well as every saved version; evaluation with notes, scores, follow-up questions and the evaluating person; result and place; your vote in community votes.

• Purpose: Enabling participation, having performances checked and evaluated by people, recording results and ensuring fair votes.

• Legal basis: Art. 6(1)(b) GDPR; for checking the participation and voting requirements and preventing manipulation additionally Art. 6(1)(f) GDPR, our legitimate interest in fair competitions.

• Recipients: Evidence files are stored in non-public storage. Only you and team members with evaluation permission can see them, in each case via links that expire after five minutes; every access by the team is logged. In challenges with a vote, the text and links of approved submissions are public during the vote, without your name if your profile is private. Results are public, also without your name if your profile is private. In votes only the overall result is public, not who voted for what. The crew leadership sees its crew's registration.

• Location and transfers: Stored in Frankfurt am Main. Evidence images are checked, re-encoded and stored without metadata in our server function in the USA. Your browser uploads videos unchanged directly to the storage in Frankfurt; their metadata, such as recording location or device, is retained.

• Retention: Without a fixed period, also after an account deletion. You cannot delete evidence files yourself; on request we delete them as soon as they are no longer needed for the evaluation or a dispute.

• Do you have to provide it?: Optional. You can vote with a confirmed e-mail address and an account that is at least seven days old; you cannot vote for yourself or your own crew.

25. Invitations and creator codes

With your personal invite link you can invite friends (Invite friends). You can also support a creator at registration or within 30 days afterwards by entering their creator code (Support a creator). The person who invited you or whom you support receives WT if the new member meets certain requirements. There is no money involved.

• Data: Your invite code; for invited members, who invited them, time of registration, status and qualification deadline; the creator you support with start, changes and status; credited and pending WT; to recognise a person, a hash value (SHA-256) of your normalised e-mail address. For the matching we also take into account the e-mail addresses of sign-ins linked to the account, such as Google.

• Purpose: Crediting rewards and preventing abuse: a person should only be invited once and only trigger a creator reward once, also via second accounts or after deleting and re-registering. For qualification we automatically check whether the e-mail address is confirmed, the account is at least seven days old, you were active on at least three different days and completed at least two missions within 30 days.

• Legal basis: Art. 6(1)(b) GDPR for participation and crediting; Art. 6(1)(f) GDPR for the hash value, matching and retention, our legitimate interest in protecting these programmes against multiple rewards and abuse.

• Recipients: Inviters only see numbers, no names. Creators only see aggregated numbers of their supporters, no names or handles; with very few supporters, however, a creator may be able to infer who supports them. Individual assignments are only visible to team members with permission to review abuse; if an assignment is reversed because of abuse, the beneficiary is told the reason.

• Location and transfers: Stored in Frankfurt am Main; processed via our server functions in the USA (see above).

• Retention: Without a period. We keep the hash value and history permanently so that the rules also work after an account deletion. Such a hash value is not anonymous: anyone who knows your e-mail address can recreate it.

• Do you have to provide it?: Optional. You can change your chosen creator after 30 days at the earliest; ending the support completely is not provided for.

26. Reports, moderation, sanctions and appeals

As a member you report comments, creator content, articles, profiles, crews, creator events, challenge submissions and chat messages directly on the platform. Anyone can report illegal content, even without an account: via the contact form or by e-mail to hello@wantedsix.com, stating the exact address of the content, an explanation of why it is illegal, your name and e-mail address (except for child sexual abuse material) and a statement that your information is correct and complete to the best of your knowledge. You receive a confirmation of receipt and information about our decision.

Decisions on reports and measures are made by people in our team or by the operator; only the order in which reports are handled is set automatically. Affected members receive every measure with a statement of reasons. You can appeal once against an active sanction, in your account settings; the team reviews the appeal again. You can also turn to a certified out-of-court dispute settlement body under Art. 21 DSA or to the courts; details are in the terms of use.

• Data: For reports: the reporting person, reason, details (up to 1,000 characters), the content and account concerned; for reports without an account name, e-mail address and details. In the case: status, priority, number of reports, handling person, decision with reasons and the history of all steps. For sanctions: type (warning or suspension), start, end, reasons, lifting. For appeals: your text (10 to 2,000 characters), decision and reasons. For reported chat excerpts see section 14.

• Purpose: Handling reports, hiding or sanctioning illegal content and violations of the terms of use and community guidelines, informing affected members of the reasons, reviewing appeals, recognising repeat violations and documenting decisions.

• Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 to 18 DSA (handling notices, statements of reasons, notification of certain criminal offences); Art. 6(1)(b) GDPR for enforcing the terms of use; Art. 6(1)(f) GDPR, our legitimate interest in a safe community, in traceable decisions and in defending against legal claims.

• Recipients: Team members with moderation permission see cases including the identity of the reporting person; the reported person does not learn who reported them. Team members are not shown cases that concern themselves; this does not apply to the operator. If we suspect a criminal offence that threatens the life or safety of persons, we inform the competent law enforcement authorities (Art. 18 DSA).

• Location and transfers: Stored in Frankfurt am Main; processed via our server functions in the USA (see above).

• Retention: For closed moderation cases a period of 180 days has been set, longer in case of a dispute; its automatic deletion is not switched on yet. We currently keep sanctions, appeals and reported chat excerpts without a fixed period, also after an account deletion, in order to recognise repeat violations and document decisions.

• Do you have to provide it?: Reporting is voluntary; up to ten reports per hour are possible. For notices of illegal content we need the details listed above to be able to review them.

27. Administrative log

We log important actions of the team and the system, for example moderation decisions, sanctions, changes to team permissions, changes to events, the handling of contact requests, data exports and deletion requests.

• Data: Acting person, action, object concerned, reason, state before and after the change, time. The log contains no private chat texts; access to reported chat excerpts is recorded with identifiers only.

• Purpose: Traceability and control of administrative actions, protection against misuse of team permissions, proof towards affected persons and authorities. The entries on data exports also serve to limit exports to three in ten minutes.

• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in controlled and verifiable administration; insofar as our accountability under Art. 5(2) GDPR is concerned, Art. 6(1)(c) GDPR.

• Recipients: Only team members with the relevant permission.

• Location and transfers: Frankfurt am Main.

• Retention: No fixed period has been set yet; the entries are kept even after an account deletion.

• Do you have to provide it?: Arises automatically.

28. Contact form, tips and bug reports

Your messages reach us via the contact form, Send a tip and Report a bug. We do not send an automatic confirmation of receipt by e-mail. We inform our team about new messages with an e-mail to our mailbox; it only states the type of message and a short reference, not its text and not your address. We do not publish tips automatically.

• Data: Type of message, subject, text (up to 4,000 characters), for tips and bug reports optionally the address of the page concerned; your e-mail address (required for the contact form when you are not signed in, otherwise optional); your user ID if you are signed in; language and a rough device class (such as desktop or mobile); handling status, handling person and internal notes.

• Purpose: Handling and answering your request, checking tips for our editorial team, fixing bugs.

• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in handling requests and improving the platform; for requests about your account Art. 6(1)(b) GDPR; for privacy requests and notices of illegal content Art. 6(1)(c) GDPR.

• Recipients: Team members with permission for contact requests. We send replies to you by e-mail from our mailbox; our e-mail provider then also processes your address and the content.

• Location and transfers: Stored in Frankfurt am Main; the forms pass through our server functions in the USA.

• Retention: For handled messages a period of 365 days after the last handling has been set; its automatic deletion is not switched on yet. On account deletion your messages currently remain stored.

• Do you have to provide it?: Optional. Without an e-mail address we cannot reply to guests.

29. Protecting forms against abuse

To prevent mass abuse of forms, we limit how often they can be used. This applies to contact messages, tips and bug reports from guests, to the newsletter sign-up and to storing cookie consents.

• Data: For forms used by guests and for the newsletter sign-up, your IP address (for IPv6 only the /64 network) is processed in memory only. From it and the current date the server forms a hash value with a secret key that changes daily; only a further hash of it is stored, with a timestamp. For limits per e-mail address or account we also store hash values of your e-mail address or user ID.

• Purpose: Preventing spam and abuse.

• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in working forms without spam.

• Recipients: Nobody; there is no view of these values.

• Location and transfers: The hash value is formed in our server function in the USA; storage is in Frankfurt am Main.

• Retention: We delete all counters automatically after one day at the latest, and the values derived from the IP address usually after one hour.

• Do you have to provide it?: Technically necessary to use the forms.

30. Newsletter and platform e-mails

You only receive the newsletter with your explicit consent and only after you have confirmed your sign-up via a link in a confirmation e-mail (double opt-in). You can optionally tell us which platforms you play on, so that we can pick content that suits you. Via the personal settings link in every newsletter e-mail or, if the address belongs to your account, in your notification preferences you can change language and platforms or unsubscribe at any time. We send the newsletter and the platform's e-mails, i.e. confirmations, notifications and notices to our team, via the e-mail delivery service Brevo; platform e-mails first pass through our own queue. Sending is currently limited to test addresses of our team: no newsletters, newsletter confirmations or notification e-mails go to other addresses yet, so a newsletter sign-up remains unconfirmed for the time being. The e-mails for registration, confirming the account address and passwords (sections 3 and 5) are not affected.

As soon as you have confirmed your sign-up, we transfer your e-mail address with language, platform details, status, time of consent, origin of the sign-up (newsletter page or account area) and your personal settings link to our newsletter list at Brevo and keep these details up to date automatically. If you unsubscribe, we remove you from the list. Brevo's own unsubscribe link in newsletter e-mails, permanent delivery failures and complaints block your address at Brevo for all marketing e-mails from our Brevo account; we regularly adopt such blocks as an unsubscription. We do not lift a block automatically, not even after a new sign-up; we check that by hand.

• Data: E-mail address, language, optional platform details, status (pending, confirmed, unsubscribed), origin of the sign-up, your user ID if the address matches your account's confirmed address, hash values of the confirmation code and of your settings link, version of the consent text, times of sign-up, confirmation and unsubscription, number of sign-up attempts, how you unsubscribed, state and time of the sync with Brevo, time of a deletion request. At Brevo: e-mail address, membership of our newsletter list, the newsletter details named above, block notes and delivery and unsubscribe events; links in platform e-mails currently pass through a Brevo redirect that records whether a link was clicked. In the queue: recipient address, template, placeholders such as display name or links, delivery status; notification e-mails only state the type of notification, never its content, and notices to our team only the type of an enquiry and a short reference.

• Purpose: Sending the newsletter, picking content by language and platform and proving your consent; syncing unsubscriptions and blocks between WANTED SIX and Brevo; delivering platform e-mails; informing our team about new enquiries.

• Legal basis: Newsletter including platform details: Art. 6(1)(a) GDPR; proof of consent and implementing unsubscriptions: Art. 6(1)(c) in conjunction with Art. 7(1) and (3) GDPR; notification e-mails: Art. 6(1)(b) GDPR; notices to our team: Art. 6(1)(f) GDPR, our legitimate interest in handling enquiries promptly.

• Recipients: Brevo SAS (Paris, France) as processor for the newsletter list and sending (see “Processors”). In WANTED SIX, team members with newsletter permission only see shortened addresses, and platform details per sign-up and as totals; whoever manages our Brevo account sees the full details there.

• Location and transfers: Stored with us in Frankfurt am Main; sign-up, settings page and sync pass through our server functions in the USA. Brevo stores data in the EU (France, Germany, Belgium); under Brevo's terms, processing outside the EEA by Brevo, its affiliates or sub-processors is possible, based on standard contractual clauses or, for the USA, the EU-U.S. Data Privacy Framework.

• Retention: The confirmation link is valid for 72 hours. For unconfirmed sign-ups a period of 30 days has been set, for queue entries 90 days after sending, cancellation or final failure; their automatic deletion is not switched on yet. After you unsubscribe, the entry with your address and the unsubscribe note currently remains stored without a fixed period; at Brevo your contact remains outside our list with the note “unsubscribed” and the details last transferred (language, platforms, settings link, date of consent). On request we delete the entry with us and remove the newsletter details at Brevo; on your express wish we additionally delete the Brevo contact with your e-mail address itself, unless it is stored for another offering of WKD GmbH.

• Do you have to provide it?: Optional, including the platform details. You can unsubscribe at any time via the settings or the unsubscribe link in every newsletter e-mail or in your notification preferences.

31. Cookie settings and proof of consent

On your first visit we ask which optional purposes you consent to: statistics and YouTube videos, as well as marketing if a corresponding provider has been set up. “Necessary only” and “Accept all” are equally accessible; under “Settings” you choose individually, also per provider. You change or withdraw your choice at any time via “Cookie settings” in the footer of the public pages or via the button in the cookie policy. An earlier choice remains valid for statistics and YouTube; an earlier consent to the external map no longer has any effect, because we no longer embed an external map. Marketing and all third-party providers stay off until you explicitly choose them.

• Data: In the cookie w6_consent: version, chosen purposes, granted providers, time. As proof in our database: version, purposes, providers, time and, if you are signed in, your user ID. We do not store your IP address, browser identifier or device characteristics for this.

• Purpose: Applying your decision and being able to prove it.

• Legal basis: The cookie is strictly necessary (§ 165(3) TKG 2021). The proof is based on Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.

• Recipients: Nobody except our processors.

• Location and transfers: The proof passes through our server functions in the USA and is stored in Frankfurt am Main.

• Retention: The cookie is valid for 180 days; after that we ask again. We keep proofs as long as we need to be able to demonstrate that consent was given or withdrawn; no fixed maximum period has been set yet. Proofs of signed-in members are kept even after an account deletion.

• Do you have to provide it?: Making a choice is voluntary. Without a decision everything optional stays switched off.

32. Our own statistics

With your consent to “Statistics” we count page views with our own system. Without consent your browser sends no statistics data. The statistics are pseudonymous, not anonymous.

• Data: Per view: the type of page as a general template (not the exact address), language, device class (mobile, tablet or desktop, derived from the window width), domain of the referring website, a campaign parameter (utm_source), on detail pages the object viewed (on creator pages the creator's identifier) and the event “registration started”. Your browser creates a random identifier that is stored only for this tab (w6_aid); the server stores only a hash of it combined with a random value that changes daily. Your browser reads the referring page and campaign parameter of the first view before consent, but keeps them in memory only and sends them only after you consent. We do not store IP addresses, browser identifiers or user IDs in the statistics.

• Purpose: Understanding reach by page type, source and device; aggregated view counts for creators.

• Legal basis: Art. 6(1)(a) GDPR and § 165(3) TKG 2021. Filtering out bots based on the browser identifier relies on Art. 6(1)(f) GDPR, our legitimate interest in reliable numbers; the browser identifier is only checked for this, not stored.

• Recipients: Team members with statistics permission only see aggregated numbers; creators only see the numbers for their own pages and content. No disclosure to third parties.

• Location and transfers: The data passes through our server functions in the USA and is stored in Frankfurt am Main.

• Retention: We delete the daily random values automatically after two days; after that, visits can no longer be linked across several days. For individual events a period of 30 days has been set; its automatic deletion is not switched on yet. We keep daily totals without personal reference without a time limit. The tab identifier ends with the tab and is deleted immediately if you withdraw consent.

• Do you have to provide it?: Optional. You can use the website fully without consent.

33. YouTube videos and thumbnails

We embed videos via youtube-nocookie.com. Before your consent you see a placeholder; our server fetches thumbnails of trailers and creator videos from YouTube and delivers them to you itself, so your browser does not connect to Google. After your consent to “YouTube videos”, the player loads automatically on pages with a video, and your browser loads thumbnails in the video area directly from YouTube. A video only starts when you play it; the trailer on the home page only loads the player after a click.

• Data: When the player and the thumbnails in the video area load: your IP address, browser identifier, the address of our website as origin and information the player stores on or reads from your device.

• Purpose: Playing videos.

• Legal basis: Art. 6(1)(a) GDPR and § 165(3) TKG 2021.

• Recipients: Google Ireland Limited. We are jointly responsible with Google for the embedding and the transmission to Google; Google alone is responsible for any further processing (Google privacy policy (opens in a new tab)).

• Location and transfers: Google may process data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.

• Retention: We do not store anything in this process. Google decides how long it keeps data. If you withdraw consent, we remove the player immediately.

• Do you have to provide it?: Optional. Without consent, embedded videos stay hidden.

34. Map of Leonida

We operate the interactive map ourselves. The map image and place data come from the community database GTADB (map.gtadb.org, CC BY 4.0); we store them ourselves. Our server retrieves new place data via GitHub, and no data about you is transmitted in the process. Your browser loads map images, photos and place data from WANTED SIX itself and from our storage at Supabase in Frankfurt am Main; as with every page view, this involves technical data such as your IP address (section 1). The map does not include any third-party content or services and therefore loads without consent. Without an account, only your browser stores your own places, favourites, routes and your unit (see the cookie policy); we receive nothing unless you move the places into your account yourself. With an account we process:

• Data: favourites (up to 500), your own places with name, position, optional note and time (up to 300) and saved routes with name and waypoints (up to 50); for place suggestions the place's name, position and category, your optional note (up to 280 characters), your account, the time as well as the review status, time and reason of the decision.

• Purpose: providing your places, favourites and routes on all your devices; reviewing place suggestions and adding accepted places to the public map. Only the place's name, position and category are published, not your account and not your note.

• Legal basis: Art. 6(1)(b) GDPR; for the limit of ten suggestions in 24 hours Art. 6(1)(f) GDPR, our legitimate interest in protection against spam.

• Recipients: only you see your favourites, your own places and routes. Team members with permission for the map see place suggestions with your handle and your note.

• Location and transfers: stored in Frankfurt am Main; when you load, save or send something, the data passes through our server functions in the USA (section 1).

• Retention: there is no automatic deletion period. Favourites, your own places and routes are kept until you delete them, at the latest until your account deletion is carried out (a pending deletion request alone does not delete anything). Open place suggestions are deleted at that point; for decided ones we remove the link to your account, your note and the reason; the name, position, category, review status and the times remain stored without any link to you. The team's decision with its reason remains in the administrative log (section 27), without any link to you. Accepted places remain part of the public map.

• Do you have to provide it?: Optional. The map works fully without an account; your own places then stay on your device. Place suggestions require an account.

35. Audience measurement with Google Analytics 4 and prepared advertising measurement

We have technically prepared four services with which we could measure how visitors find WANTED SIX and whether our advertising works: Google Analytics 4, Google Ads, the Meta Pixel (for advertising on Facebook and Instagram) and the TikTok Pixel. Only Google Analytics 4 is active, and only with your consent. Google Ads, the Meta Pixel and the TikTok Pixel are not active: no script of these providers is loaded and no data goes to them. For Google Analytics 4, and for any other of these services should we switch it on, the following rules are binding:

• A service only runs if it is explicitly listed in the cookie settings and you have consented both to the purpose (statistics for Google Analytics 4, marketing for the others) and to the individual provider. Before your consent nothing is loaded and no request is sent to the provider. An earlier consent never covers a newly added provider.

• We only report page views on public pages whose address does not identify a member and carries no private input: not on profile, crew or creator pages, not in search, not when resetting a password or confirming an e-mail address, and never in the member area. Members can still appear on the reported pages, for example in rankings or next to comments. Query parameters of the page address are not passed to the providers, except campaign parameters and ad click identifiers (such as utm_source, gclid, fbclid or ttclid).

• Apart from page views we only report these steps: registration started and registration submitted (both to Google Analytics 4 only), registration completed (only once the e-mail address is confirmed; to Google Analytics 4 with whether the registration was made by e-mail or with Steam), creator application submitted and event registration.

• We use no server-side transmission (such as the Conversions API or Events API), no automatic matching of form inputs (advanced matching), no hashed e-mail addresses and no fingerprinting.

• If you withdraw consent, the services stop immediately, we delete their cookies on our domain and reload the page. We cannot delete cookies on the providers' own domains; you remove those in your browser.

• The legal basis is your consent in each case (Art. 6(1)(a) GDPR and § 165(3) TKG 2021). We do not base transfers on Art. 49 GDPR in this context.

The following applies to the individual services (for Google Ads, the Meta Pixel and the TikTok Pixel if activated):

Google Analytics 4

• Provider and role: Google Ireland Limited as our processor.

• Data: page views (address without query parameters except campaign parameters such as utm_source; on the first page of a visit the domain of the referring website), the steps listed above, browser and device information, language, screen resolution, an approximate location derived from the IP address and cookie identifiers. The IP address is transmitted to Google, but according to Google it is not stored by Google Analytics. Google signals and advertising features are switched off.

• Cookies on our domain: _ga and _ga_ with an appended identifier, according to Google up to 2 years. If you confirm a registration after consenting to Google Analytics 4, we also set w6_conversion: it only contains the step and the way you registered (e-mail or Steam), no identifier, and is reported and deleted on your next visit to a public page, at the latest after 24 hours.

• Retention at Google: event and user data 2 months (aggregated reports are not affected).

• Third country: Google may process data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google's terms additionally provide for standard contractual clauses.

Google Ads

• Provider and role: Google Ireland Limited as an independent controller.

• Purpose: measuring whether registrations, creator applications or event registrations result from Google ads, and remarketing, i.e. showing you relevant ads on Google later.

• Data: page views, the steps listed above, click identifiers from ads, browser and device information, IP address and cookie identifiers.

• Cookies on our domain: _gcl_au and other _gcl cookies, according to Google 90 days. Google may additionally set cookies on its own domains.

• Retention: decided by Google as an independent controller (Google privacy policy (opens in a new tab)).

• Third country: as for Google Analytics 4.

Meta Pixel (Facebook and Instagram)

• Provider and role: Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland. We are jointly responsible with Meta for the collection and transmission of the data on our website (Art. 26 GDPR); the details are governed by the joint controller agreement provided by Meta (Controller Addendum). Meta alone is responsible for any further processing. You can exercise your rights against us and against Meta.

• Purpose: measuring whether visits, registrations, creator applications or event registrations result from advertising on Facebook or Instagram, and showing you relevant ads there.

• Data: page views (PageView) and the events CompleteRegistration, SubmitApplication and EventRegistration, page address, referring page, IP address, browser information, cookie identifiers and click identifiers from ads.

• Cookies on our domain: _fbp and _fbc, according to Meta 90 days. Meta may additionally set cookies on its own domains.

• Retention: according to its terms, Meta keeps event data for up to two years.

• Third country: Meta may transfer data to Meta Platforms, Inc. in the USA; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework, and Meta additionally refers to standard contractual clauses (Meta privacy policy (opens in a new tab)).

TikTok Pixel

• Provider and role: TikTok Technology Limited (Ireland) and TikTok Information Technologies UK Limited. According to TikTok, it processes the data as a joint controller with us; we would be jointly responsible with TikTok for the collection and transmission on our website. You can exercise your rights against us and against TikTok.

• Purpose: measuring whether visits, registrations, creator applications or event registrations result from advertising on TikTok, and showing you relevant ads there.

• Data: page views and the events CompleteRegistration, SubmitForm and EventRegistration, page address, IP address, browser information, timestamps, cookie identifiers and click identifiers from ads.

• Cookies on our domain: _ttp, ttcsid and ttclid, according to TikTok up to 13 months from the last use. TikTok may additionally set cookies on its own domains.

• Retention: decided by TikTok according to its terms.

• Third country: according to TikTok, data is stored on servers in the USA, Malaysia and Singapore; companies of the TikTok group in other countries receive limited remote access. TikTok bases these transfers on standard contractual clauses (TikTok privacy policy (opens in a new tab)).

36. Links to other websites

Links to other websites, for example to Rockstar Games, Discord or creators' channels, only transmit data to the provider concerned, in particular your IP address, when you click them. The provider concerned is responsible for the processing on those websites.

37. Account deletion

You request the deletion of your account under Data & account. If you lead a crew with other members, you first hand over the leadership or dissolve the crew. This is how the deletion works:

1. Request: your public profile is no longer visible immediately, and your account is restricted. You can still sign in, download your data and withdraw the request as long as it has not been processed. We store an optional reason (up to 1,000 characters) with the request.

2. Processing: the operator carries out the deletion manually; our target is no more than 30 days.

3. Execution: we pseudonymise your profile: the handle is replaced by “deleted_” and a string derived from your user ID, the display name by “Deleted account”; the “About me” text and the references to profile picture and banner are removed, and the profile becomes private. Gaming accounts, follows, likes, blocks, notifications and their settings, the map's favourites, your own places and routes, open place suggestions as well as all sessions are deleted; for decided place suggestions the link to your account, the note and the reason are removed; sign-in is blocked permanently. Crew memberships end (a crew that you lead alone is dissolved), open applications and invitations are closed, the creator status ends and the creator page is cleared, future event RSVPs are cancelled, newsletter subscriptions are unsubscribed and team permissions are revoked.

What currently remains after execution, and why:

• Sign-in data: your e-mail address and the hash of your password in the sign-in system, for Google sign-in the Google identity data (name, e-mail address, picture address, account ID) and any two-factor factors you set up. We keep the e-mail address to prevent abuse, for example to recognise attempts to evade suspensions; the other sign-in data is currently not technically deleted along with the account.

• Content that concerns others: your comments remain publicly visible and your chat messages readable for the other participants, in each case as “Deleted account”, so that discussions and conversations remain understandable. Reported chat excerpts, your crew applications with answers, the crew history, entries in the crew log and the texts, logo and banner of a crew dissolved in the process also remain stored.

• Proof: moderation cases, your reports, sanctions, appeals, the administrative log, consent records, the times of your registration, age confirmation and acceptance of the terms of use, and your deletion request with its reason, so that we can document decisions and consents, defend ourselves against legal claims and recognise repeat violations.

• Points and competition: XP and WT history, receipts, rewards, boosts, active days, missions, answers to the question of the day, challenge participations, submissions, evidence files, votes and results as well as Hall of Fame entries (without your name), so that points, rankings and competitions remain consistent.

• Invitations and creator codes: the hash value of your e-mail address, the invitation and support history, credited WT and the assignment of your registration to a code, so that re-registering does not lead to multiple rewards.

• Creator data: the address of your creator page, your creator applications, your content with all versions (hidden) and cached YouTube video data.

• Files: uploaded profile pictures, banners and images in creator content currently remain in public storage and can be retrieved via their direct address; evidence files remain in non-public storage.

• Forms, e-mails and events: contact messages, tips and bug reports with your e-mail address, the unsubscribed newsletter entry (at Brevo, where applicable, the contact with the note “unsubscribed”), notifications queued for e-mail delivery, e-mail queue entries and past event RSVPs.

This data remains linked to the pseudonymised identifier of your account. Pseudonymisation is not anonymisation: we can still attribute it to your former account. If you want us to remove more, write to us at hello@wantedsix.com. We then also delete sign-in data, files, comment texts and all other entries that neither a legal obligation nor an overriding legitimate interest requires us to keep, and tell you what remains and why. Copies in backups disappear once the backup period has expired (section 39).

• Data: Your request with timestamps, status, optional reason and the decision.

• Purpose: Carrying out your deletion request.

• Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 17 GDPR; for keeping the data listed above Art. 6(1)(f) GDPR, our legitimate interest in being able to provide proof, in understandable conversations, in defending against legal claims and in preventing abuse, and for consent records and DSA procedures Art. 6(1)(c) GDPR.

• Recipients: Team members with permission for privacy requests see the request including your reason; only the operator can carry out the deletion.

• Location and transfers: Stored in Frankfurt am Main; processed via our server functions in the USA (see above).

• Retention: The request remains stored as proof; no fixed period has been set yet.

• Do you have to provide it?: Optional.

38. Data export and access

Under Data & account you can download a JSON file with the main data about your account at any time, also during a suspension or a pending deletion request. Other members only appear in it with their user ID and handle.

• Included: e-mail address with confirmation, registration and last sign-in times, all profile details and settings, gaming accounts, follows in both directions, blocks, likes, comments, notification settings, the latest 1,000 notifications, XP and WT history with receipts, rewards, boosts, active days, consent records, deletion requests, challenge participations, submissions with the paths of the evidence files, votes, your form submissions, newsletter entries and map data (favourites, your own places, routes, place suggestions).

• Not included yet: chats, crew data, creator data, event RSVPs, missions, answers to the question of the day and season data, reviews and earlier versions of challenge submissions, Hall of Fame entries, moderation data, invitations and creator codes, sign-in identities (such as Google), sessions, two-factor factors, entries queued for e-mail delivery, administrative log entries and the files themselves.

• Full access: you can get everything the export does not contain on request under Art. 15 GDPR by e-mail to hello@wantedsix.com, within one month.

• Data: The data listed above; in addition we record every export with its time.

• Purpose: Access and data portability (Art. 15 and 20 GDPR).

• Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 15 and 20 GDPR; for the record Art. 6(1)(f) GDPR, our legitimate interest in preventing mass retrieval (at most three exports in ten minutes).

• Recipients: Only you; team members with permission for privacy requests see that and when you exported.

• Location and transfers: The export is created in our server function in the USA and sent to your browser.

• Retention: We do not store the file itself. The record remains in the administrative log (section 27).

• Do you have to provide it?: Optional.

39. Backups

According to our database provider Supabase, a backup of the database is created daily for our plan and the backups of the last seven days are kept. Uploaded files are not included.

• Data: The entire content of the database at the time of the backup.

• Purpose: Restoring data after technical faults, errors or attacks.

• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in the availability and integrity of the data; at the same time a security measure under Art. 32 GDPR.

• Recipients: Supabase as processor.

• Location and transfers: According to Supabase in the same region as the database, i.e. in Frankfurt am Main.

• Retention: Seven days. Deleted data may therefore still be contained in a backup for up to seven days before it is overwritten.

• Do you have to provide it?: Arises automatically.

Retention at a glance

We keep data only as long as we need it for the purpose concerned or are legally required to keep it. Not all deletion periods run automatically yet: for some data we have set periods whose automatic deletion is not switched on yet. We will switch it on before the platform's public launch; until then this data may be kept longer. For other data there is no fixed period yet; there we state the criterion. On request we delete earlier, unless an obligation prevents it.

Accounting records subject to a statutory retention obligation of seven years (§ 132 of the Austrian Federal Fiscal Code, BAO) do not currently arise at WANTED SIX, because the platform is free and processes no payments.

Where data comes from that you do not provide yourself

Most data you provide yourself, or it arises when you use the platform. We receive some data about you from others (Art. 14 GDPR):

• Other members: reports about your content or account, messages to you, follows, invitations to a crew, decisions of the crew leadership on your application and entries in the crew log.

• People without an account: notices of illegal content via the contact form or by e-mail that may concern you.

• Our team: moderation decisions, sanctions, evaluations of challenge submissions, decisions on creator applications and corrections to the points history.

• Whoever invites you: the invite code you registered with.

• Google: for sign-in with Google the account data listed in section 6; for linked YouTube channels public channel and video data via the YouTube Data API.

• Steam (Valve): the confirmation of your SteamID.

• Brevo: whether your address is blocked at Brevo, for example after unsubscribing via Brevo's unsubscribe link, a permanent delivery failure or a complaint (section 30).

Recipients at a glance

We do not sell personal data. Only the following parties receive data, in each case to the extent described above.

Processors

These service providers process data on our behalf and according to our instructions. Data processing agreements under Art. 28 GDPR are in place with them as part of their contract terms.

Supabase's sub-processors include Amazon Web Services (hosting) and Supabase, Inc. in the USA (support). The standard contractual clauses are part of the published data processing agreements of Vercel (opens in a new tab) and Supabase (opens in a new tab). Brevo's data processing agreement is Appendix 3 of its terms of service (opens in a new tab). We answer enquiries from our e-mail mailbox; the provider of this mailbox therefore also processes your e-mail address and the content of the messages.

Independent controllers

• Google (Google Ireland Limited, Google LLC) for sign-in with Google and for further processing when YouTube videos are played.

• Valve Corporation for signing in at Steam as part of the Steam verification.

• Google Ireland Limited for Google Ads, if activated.

Via the YouTube Data API, Google also receives the channel and video identifiers listed in section 19, but no visitor data.

Joint controllers

• Google Ireland Limited for embedding YouTube videos and the transmission to Google (section 33).

• Meta Platforms Ireland Limited as well as TikTok Technology Limited and TikTok Information Technologies UK Limited for the collection and transmission by their pixels, if activated (section 35).

Where responsibility is joint, you can exercise your rights against us and against the partner concerned. For the joint phase, we are responsible for informing you and obtaining your consent before any data goes to the partner; the partner alone is responsible for any further processing.

The public and other members

Public content such as profiles, comments, crew pages, creator pages and content, rankings and challenge results can be seen by every visitor. Other members also see what you write to them or share in your crew.

Within WANTED SIX

Within the team, only people who need access for their task get it, and only with a permission granted for that purpose; every permission is checked in the database, and administrative actions are logged. Team members with permission to manage users see profile details even if you have hidden them, as well as account status, the number of your comments, reports and sanctions, the day of your last activity and any pending deletion request. Only the operator and people with permission for privacy requests see the e-mail address of your account; an e-mail address you enter in a form is also seen by the people who handle such requests. Nobody in the team can read private chats through the platform.

Authorities and courts

We only disclose data to authorities and courts if we are legally obliged to or if it is necessary to establish, exercise or defend legal claims (Art. 6(1)(c) or (f) GDPR). These can be: law enforcement authorities if a criminal offence threatening the life or safety of persons is suspected (Art. 18 DSA), or on a court or official order; KommAustria as the Digital Services Coordinator in Austria if it requests information under the DSA; courts; the data protection authority in the course of proceedings.

Transfers to countries outside the EU

Some recipients are located in countries outside the EU or EEA or process data there. For the USA there is an adequacy decision of the European Commission for companies certified under the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795). Otherwise transfers rely on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Because the Data Privacy Framework is legally contested, we also name the standard contractual clauses that Vercel, Google and Meta additionally provide for in their terms.

You can also obtain a copy of the standard contractual clauses that apply to our service providers from us on request.

Automated decisions

We do not make decisions that produce legal effects concerning you or similarly significantly affect you solely by automated means (Art. 22 GDPR). People decide on reports, sanctions, appeals, creator applications and the evaluation of challenge submissions.

The following run automatically according to fixed rules: calculating XP, levels, ranks and rankings, credits for missions and the Season Pass, checking whether invitations and creator support meet the requirements for WT, including matching whether two accounts belong to the same person, eligibility to vote, moving up on waiting lists, the end of time-limited suspensions and the order in which the team handles reports. These processes only concern points without cash value or organisational matters. Abuse limits and length checks are technical safeguards, not decisions about you. If you think a result is wrong, write to us and we will check it manually.

Minors

The community functions of WANTED SIX are aimed at adults. Accounts are only available from age 18; you confirm this yourself at registration, and no ID check takes place. The Austrian age limit of 14 for consenting to information society services (§ 4(4) of the Austrian Data Protection Act, DSG) is therefore irrelevant for accounts. Anyone can read public pages without an account. If you have indications that an account belongs to a minor, please write to us.

Data security

We protect your data with technical and organisational measures under Art. 32 GDPR, including:

• Connections to the website are encrypted via HTTPS (TLS); browsers are instructed to use only encrypted connections (HSTS).

• The website and browsers access the database only through vetted functions that check the permission on every call; direct table access is blocked.

• Team permissions are granted individually; anyone who has set up a second factor only receives administrative rights after using it. Administrative actions are logged.

• We store passwords as well as confirmation, unsubscribe and check codes as hashes; confirmation and unsubscribe links are held in plain text only in the e-mail queue until the e-mail has been sent or discarded.

• Uploaded images are re-encoded and stripped of metadata (videos uploaded as challenge evidence excepted); evidence files are stored in non-public storage and can only be retrieved via short-lived links.

• The database is backed up daily.

There are limits too: chats are not end-to-end encrypted, and images in public storage can be retrieved by anyone who knows their address. Nobody can guarantee absolute security. If we detect a personal data breach, we act in accordance with Art. 33 and 34 GDPR and inform the data protection authority and, where there is a high risk, you as well.

Your rights

• Access (Art. 15 GDPR): whether and which data we process about you, with purposes, recipients, retention and source, as well as a copy.

• Rectification (Art. 16 GDPR): you change profile details yourself; we make changes to your e-mail address and other corrections on request.

• Erasure (Art. 17 GDPR): via Data & account or on request, unless an obligation or an overriding legitimate interest requires us to keep the data.

• Restriction of processing (Art. 18 GDPR): for example while the accuracy of data is disputed.

• Data portability (Art. 20 GDPR): data you have provided to us and that we process by automated means on the basis of your consent or the contract, in a common, machine-readable format; the JSON export covers a large part of it, and you receive the rest on request.

• Objection (Art. 21 GDPR): see the following notice.

• Withdrawal of consent (Art. 7(3) GDPR) and complaint to a supervisory authority (Art. 77 GDPR): see below.

How to exercise these rights is explained in the section “How to exercise your rights”.

Your right to object

Right to object under Art. 21 GDPR: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. Where we process data for direct marketing, you can object at any time without giving reasons; we will then no longer process it for that purpose. Send your objection informally to hello@wantedsix.com or via the contact form.

Withdrawing consent

You can withdraw consent at any time with effect for the future, as easily as you gave it: cookie consents via “Cookie settings” in the footer of the public pages or via the button in the cookie policy, the newsletter via the settings or unsubscribe link in every newsletter e-mail or in your notification preferences. The lawfulness of processing carried out before the withdrawal remains unaffected.

Complaint to the data protection authority

If you believe that we do not process your data lawfully, you can lodge a complaint with a data protection supervisory authority. In Austria this is the Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, phone +43 1 52 152-0, e-mail dsb@dsb.gv.at, www.dsb.gv.at (opens in a new tab). You can also contact the supervisory authority in the EU member state where you live or work or where the alleged infringement took place. We would, however, appreciate it if you contacted us first so that we can resolve the matter.

Changes to this privacy policy

We update this policy when the platform, our service providers or the legal situation change, in particular before we switch on a new service, open the sending of e-mails to everyone or switch on automatic deletion periods. The version published here with its date applies.