This version describes the website pestbound.com, which is hosted by Hetzner. Google Analytics and Meta Pixel are not currently activated. The sections about these services explain their intended use after configuration and consent. The specific retention period for server logs will be added once the Hetzner configuration has been checked.
1. Controller and contact details
The controller is Patrick Hackl, HACKLWORKS, Vogelkammweg 3, 94518 Spiegelau, Germany. For privacy enquiries, requests to exercise your rights or questions about this policy, please email info@hacklworks.de.
This policy covers visits to this informational website. It does not describe processing within the game, a game server or a Steam account. The actual processing carried out by future game and server services will be explained separately.
2. Website delivery, hosting and server logs
Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, is the web hosting provider for pestbound.com. The email infrastructure for info@hacklworks.de is also hosted by Hetzner. Accessing a website requires processing your IP address and technical connection data. Depending on the server configuration, access or error logs may also contain the time of access, the file or page requested, the amount of data transferred, HTTP status, browser and operating system information, and the referring page where supplied by your browser.
The purpose is to deliver the website and detect and resolve errors and attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to provide a secure, reliable website. Hetzner acts as a processor for processing carried out on our instructions. The required data processing agreement under Article 28 GDPR must be concluded before the service is put into operation.
Logs are retained only for as long as necessary to maintain operations, investigate errors or examine a specific security incident. The actual retention period and server location depend on the Hetzner product and configuration and have not yet been finally determined. A specific retention period will be published once these settings have been checked.
Provider information: Hetzner Privacy Policy.
3. Contact by email
If you email us, we process your email address, your name where provided, the content of your message, any attachments and technical delivery information. We use this information solely to handle your enquiry and the related correspondence. For enquiries relating to a contract, the legal basis is Article 6(1)(b) GDPR. For other enquiries, it is Article 6(1)(f) GDPR, based on our legitimate interest in responding to valid requests.
Hetzner processes messages as part of providing the email service. Messages are deleted once the enquiry has been fully resolved and no statutory retention duties or legitimate reasons to preserve specific legal claims remain. Where messages constitute business or tax records subject to retention requirements, the applicable statutory duty determines the retention period; the legal basis is Article 6(1)(c) GDPR. Please do not send sensitive documents that are unnecessary for your enquiry.
4. Images, videos, fonts and external links
Images, font files and gameplay videos are served with the website itself. Video playback does not embed an external YouTube or Vimeo player. Fonts are not loaded from Google Fonts or another external font service. Loading these files is part of the website’s technical delivery.
Links to Kickstarter and, later, Steam lead to separate services. Displaying these links alone does not cause our website code to send visitor data to those platforms. Only when you follow a link do you access the respective provider’s service, where its own privacy information applies. Purchases, pledges and payments are not processed on this website. Further information: Kickstarter and Steam.
5. Cookie settings and consent
Optional statistics and marketing services may be loaded only after you have separately consented. You can enable either category independently or reject both. The website remains usable without consent. No cookieless measurement requests are sent to these services before consent either.
Once optional services have been configured, our local consent management stores your selection, the time of your decision, a version identifier and the configuration of the offered services under pestbound_consent_v1 in your browser’s Local Storage. Your selection remains valid for a maximum of 180 days. This storage allows us to respect your decision. The legal basis for the necessary access to your device is Section 25(2), point 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the basis for processing personal data is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR. This module does not transmit your selection to an external consent provider. If browser storage is blocked, your decision applies only to the current page view.
Optional access to your device is based on Section 25(1) TDDDG, and the subsequent processing of personal data on Article 6(1)(a) GDPR. You can withdraw your consent at any time through , with effect for the future. Withdrawal does not affect the lawfulness of processing carried out beforehand. On withdrawal, the relevant services are blocked and associated cookies accessible to the website code are deleted. This does not automatically delete data already held by a provider; you may exercise the rights described below in relation to that data.
6. Google Analytics — prepared, not yet active
We intend to use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. After you consent to “Statistics”, the service may process page views, timestamps, a pseudonymous browser identifier, device and browser information, language and an approximate geographical location. Google uses IP addresses for purposes including technical processing and location estimation. According to Google, individual IP addresses are not logged or stored in GA4. This does not mean that all measurement data is completely anonymous.
The prepared integration records page views. It does not transmit form entries or use a custom User-ID. Google Signals and advertising personalisation are disabled in the website code. URL query parameters and fragments are not included in the page address sent to Analytics. The purpose is to evaluate use of the website and its reach. The sole legal basis is your consent.
Analytics uses cookies including _ga and _ga_…. The website code is prepared for a maximum cookie lifetime of 180 days, without renewing that period on each visit. The separate retention period for user and event data in the Analytics account must be set before activation and added here. Aggregated reports are not automatically subject to that same period. Recipients include Google and, where applicable, its service providers. The applicable data processing agreement must be concluded for processing on our behalf.
Further information: EU data processing in GA4, Analytics cookies and Google Privacy Policy.
7. Meta Pixel — prepared, not yet active
We intend to use Meta Pixel, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. After you consent to “Marketing”, the pixel may transmit your page visit, the URL accessed, timestamps, IP address, browser and device information, and cookie or other online identifiers to Meta. Meta may associate this information with an existing Facebook or Instagram account. The purpose is to evaluate advertising campaigns and reach interested people on Meta services.
The prepared website integration sends only the “PageView” event. Advanced matching of contact details and a server-side Conversions API are not implemented. Automatic event detection and advanced matching must also remain disabled in the Meta account unless they have been separately reviewed and described. The cookies and lifetimes used by the final pixel configuration must be checked against that configuration and added here before activation.
Where the collection and transmission of event data fall under Meta Business Tools, the provider’s terms provide for joint controllership under Article 26 GDPR for the operations described there. The relevant agreement must be concluded before use. You may exercise your privacy rights against either us or Meta. Meta determines any further use for its own purposes under its own terms. In the course of ordinary campaign evaluation, we receive statistical reports rather than a complete list of individual visitor profiles.
Further information: Joint Controller Addendum, Meta Privacy Policy and Meta Cookies Policy.
8. Recipients and transfers outside the EU
Only people and service providers who need personal data for the relevant purpose are granted access. Further disclosure may occur where required by law or necessary to establish, exercise or defend specific legal claims.
Google and Meta may also process data through affiliated companies in the United States or other countries. In addition to the legal basis for processing, such transfers must meet the requirements of Articles 44 et seq. GDPR, for example through an applicable adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses and any necessary supplementary measures. Before activation, the actual recipients, any relevant certification and contractual safeguards must be checked. Cookie consent is not treated as a blanket substitute for that review. Once the services have been configured, you may request information about, or a copy of, the applicable safeguards from us.
9. Your rights
Subject to the applicable legal conditions, you have the right to access your personal data, request its rectification or erasure, restrict processing and receive data portability. You can withdraw consent at any time with effect for the future. Where necessary to handle a request, we may ask for reasonable information to verify your identity.
Right to object: Where we rely on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then stop processing the data concerned unless we demonstrate compelling legitimate grounds that override your interests and rights, or the processing serves legal claims. You may object at any time, without giving reasons, to processing for direct marketing, including related profiling.
You may lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, workplace or an alleged infringement. For private organisations in Bavaria, one point of contact is the Bavarian State Office for Data Protection Supervision. You do not have to contact us before making a complaint.
10. Voluntary choices, security and changes
Technically necessary connection data is required to deliver the page. Use of optional statistics and advertising services, and contacting us, are voluntary. We may be unable to answer an enquiry without the information needed for a response. We do not make decisions on this website based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR. Advertising profiling that Meta may carry out after consent is a separate matter.
The website is delivered over an encrypted HTTPS connection. Access permissions and safeguards must be appropriate to the data involved. No newsletter, web contact form, external video embeds or additional advertising pixels are currently implemented. If such features are added, or recipients, purposes or retention periods change, this policy will be updated before their use and new consent will be obtained where necessary.