Please note: This is a translation of the German version. Only the German version is legally binding.

Introduction

The protection of your personal data is important to us. This page explains which data we process on the websites listed above: for the website itself, your 5data user account, signing in via auth.5data.de and the forum.

Services you sign in to with your 5data account have their own privacy policy. For the dating platform new-lvl.dating, the privacy policy of new-lvl.dating applies (German only).

Data controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is 5data, represented by state-certified technician David Mohrig.

Contact
Staatl. gepr. Tech. David Mohrig
Dannenwalder Weg 72
13439 Berlin
Germany

Mail: datenschutz@5data.de
Phone: +49 1578 823 6076

Supervisory authority

The competent authority for data protection matters is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59-61, 10555 Berlin, Germany

Contact
Mail: mailbox@datenschutz-berlin.de
Web: www.datenschutz-berlin.de

Hosting

The websites are hosted by ALL-INKL.COM - Neue Medien Münnich in Germany. All personal data described here is stored on the host's servers. We have concluded a data processing agreement with the host in accordance with Art. 28 GDPR; the host processes the data only on our instructions and does not pass it on to third parties.

Server log files

When you visit our websites, the following data is recorded:

• Date and time of access
• Name of the requested file
• Page from which the file was requested
• Status of the access
• Browser and operating system version used
• Full IP address of the user
• Amount of data transferred

The log files serve system security and stability, in particular the defence against attacks. The legal basis is our legitimate interest in the protection and functionality of our websites pursuant to Art. 6 (1) (f) GDPR. The data is not combined with other personal data and is deleted automatically after 30 days at the latest.

Cookies

We only use cookies that are strictly necessary: to keep you signed in, to remember your language and to protect forms against misuse. We do not use cookies for analytics or advertising. The legal basis is § 25 (2) no. 2 TDDDG and our legitimate interest in providing our services without errors (Art. 6 (1) (f) GDPR). You can view and delete cookies in your browser at any time; without them, however, you cannot sign in.

User account (account.5data.de)

For your 5data user account we store:

• your email address and your password (only as a non-reversible hash),
• your language, the status of your account and your roles and permissions,
• the invitation code you registered with,
• if you use two-factor authentication, the secret it requires and your recovery codes.

We send messages about your account to your email address, for example to confirm your registration, to reset your password or security notices. The legal basis is the provision of your account (Art. 6 (1) (b) GDPR).

To protect accounts against attacks, we store sign-in attempts (time, IP address, email address entered, type and result) for 30 days. The legal basis is our legitimate interest in the security of the accounts (Art. 6 (1) (f) GDPR).

We store the data of your account until you delete it; you can do so at any time in your user account.

Signing in to other services (auth.5data.de)

You can use your 5data account to sign in to services that 5data has approved for this (for example new-lvl.dating or the forum). You always enter your password at 5data only; the service never receives it. After you sign in, we pass on to the service – depending on what it requests and what is shown on the sign-in page – your user ID, your email address and your roles and permissions. While you are signed in, the service asks us whether your account is still valid.

For this we store which services you have allowed to sign you in, the access tokens issued (valid for one hour, renewable for one month) and a log of sign-ins (time, IP address, service; for failed attempts also the email address entered). The log serves security purposes and is deleted after 30 days at the latest. The legal bases are Art. 6 (1) (b) GDPR (sign-in) and Art. 6 (1) (f) GDPR (protection against misuse).

What a service does with this data is described in its own privacy policy, which is linked on the sign-in page.

Participation in the closed alpha test (NDA)

To take part in the closed alpha test of new-lvl.dating, you confirm in your user account that you have read the project's non-disclosure agreement (NDA). As proof, we store the confirmation status, the project and the time of confirmation with your user ID.

The legal basis is Art. 6 (1) (b) GDPR, as the confirmation is a prerequisite for participation, and Art. 6 (1) (f) GDPR in conjunction with Art. 7 (1) GDPR for the proof. The data is deleted as soon as it is no longer required for this purpose, at the latest when your user account is deleted.

Newsletter

You only receive the newsletter if you subscribe to it in your user account. For this we use your email address and, as proof, store the time and IP address of subscribing and unsubscribing. We do not track whether you open a newsletter. The legal basis is your consent (Art. 6 (1) (a) GDPR); you can withdraw it at any time via the link in every newsletter or in your user account.

Discussion/support forum

Our forum is based on the Flarum forum software and runs on our server. When you use the forum, personal data such as IP address, user name and email address is processed as far as this is necessary to use the forum.

The forum uses several extensions (plugins):

• FriendsOfFlarum OAuth: You can optionally sign in to the forum with our own OAuth provider auth.5data.de. In this case personal data (e.g. name, email address, user ID) is transmitted by the provider. This sign-in option is used exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR.
• FriendsOfFlarum Polls: When you take part in polls, your votes are stored internally to prevent multiple participation and to display the result correctly. They are not passed on to third parties.
• FriendsOfFlarum Terms: We store the time and content of your consent to our terms of use and privacy policy. This serves as proof of your consent pursuant to Art. 6 (1) (f) GDPR in conjunction with Art. 7 (1) GDPR (accountability).

External resources (e.g. emojis, web fonts or scripts) may be loaded via content delivery networks (CDNs). In doing so, your IP address may be transmitted to the respective provider. This is based on our legitimate interest in the secure and fast operation of the forum (Art. 6 (1) (f) GDPR).

The data collected about you in the forum is kept until you delete your account. Posts, polls and votes you have created are not deleted and remain in anonymised form. Only your user name and any signature you created are removed.

Disclosure of data

We only transfer your personal data to third parties if this privacy policy says so (for example to services you sign in to with your 5data account), if you have consented (Art. 6 (1) (a) GDPR), if there is a legal obligation (Art. 6 (1) (c) GDPR) or if it is necessary to establish, exercise or defend legal claims (Art. 6 (1) (f) GDPR). Service providers such as our host, which also sends our emails, work on our behalf in accordance with Art. 28 GDPR.

Data security

In accordance with Art. 32 GDPR we take appropriate technical and organisational measures to protect your data. All connections to our websites are encrypted (TLS).

Storage period

Unless a period is stated above, we delete data as soon as it is no longer required for its purpose or you have withdrawn your consent or effectively objected. Statutory retention periods (e.g. under commercial and tax law) remain unaffected.

Your rights

With regard to your personal data, you have the following rights:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR),
• lodging a complaint with a supervisory authority (Art. 77 GDPR), for example the one named above.

Right to withdraw or object

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) (f) GDPR, you can object pursuant to Art. 21 GDPR on grounds relating to your particular situation. You can object to direct marketing at any time without giving reasons.

For withdrawal, objection and all other rights, an email to datenschutz@5data.de is sufficient.

Statutory obligations

Providing your data is voluntary. Without an email address and a password, however, we cannot provide you with a user account.

Automated decision-making

There is no automated decision-making or profiling pursuant to Art. 22 GDPR.

Changes

We reserve the right to adapt this privacy policy if the legal requirements or our services change. The current version applies to your visit.

Status of this privacy policy: 10/31/2026