Data Privacy Policy

Data Privacy Policy

Last updated: 22.06.2026

Borna Smital (sole proprietorship)
operating as ManasMods
Lütticher Straße 155, 52074 Aachen, Germany
Email: contact@manasmods.com

This privacy policy explains how personal data is processed in connection with this website and related services (Tebex, Patreon, Discord, YouTube, Twitch).

This website is used exclusively for the presentation of ManasMods.
All personal data processed in connection with payments, purchases, or communication are handled exclusively through external, GDPR-compliant third-party providers.

Tebex Ltd.
All purchases, donations, and payments related to our Minecraft servers are processed through Tebex Ltd.
ManasMods does not process payment data directly.
Legal basis: Contract performance in accordance with Art. 6(1)(b) GDPR
Data transfers: governed by Standard Contractual Clauses (SCCs)
Data processed: name, email address, IP address, in-game username, transaction amount

Patreon Inc.
Memberships and support payments are handled through Patreon Inc.
Patreon acts as an independent data controller under the GDPR.
Legal basis: Contract performance in accordance with Art. 6(1)(b) GDPR
Agreement: Patreon Creator Privacy Promise (DPA)
Data processed: username, email address, membership tier, shipping address (if applicable)

PayPal Europe S.à r.l.
Payments to contractors are processed via PayPal, which acts as an independent data controller under the GDPR.
Data processing is carried out in accordance with PayPal’s privacy policy.

Discord, YouTube & Twitch
Community interactions and communication occur via these platforms.
They act as independent controllers and process data according to their own privacy policies:

• Discord Privacy Policy
   
• YouTube Privacy Policy
   
• Twitch Privacy Policy
   

This website uses only technically necessary cookies that are required for proper operation and functionality.
These include, for example:

• Session cookies to maintain navigation and security
   
• Cookies for storing language or display preferences
   
• Security cookies for protection against misuse (e.g. CSRF protection)
   

These cookies do not contain personal data that allow direct identification and are automatically deleted when the browser is closed.
Legal basis: Art. 6(1)(f) GDPR in conjunction with § 25(2) TTDSG (legitimate interest in secure and functional operation of the website)
Purpose: ensuring technical functionality, stability, and system security
Retention period: only for the duration of the session

When visiting this website, certain technical information is automatically stored in so-called server log files.
The following data may be collected:

• IP address
   
• Date and time of access
   
• Accessed pages or files
   
• Browser type and version
   
• Operating system used
   
• Referrer URL (previously visited page)
   

This information is used exclusively for technical monitoring, security, and troubleshooting.
No combination with other data or profiling takes place.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in system security and fault prevention)
Retention period: Log files are automatically deleted after a short period (usually under 90 days).

No analytics, tracking, or marketing cookies are used.
Third-party tools such as Google Analytics or Meta Pixel are not implemented.

When connecting to our Minecraft servers, certain data are automatically processed for technical operation, security, and moderation purposes.
The following data may be collected:

• Minecraft username and UUID
   
• IP address and connection timestamps
   
• Chat messages and in-game interactions (for moderation and anti-cheat purposes)
   
• Playtime, statistics, inventory data, and progression
   

Purpose: ensuring server functionality, preventing abuse, maintaining fairness, and enforcing community rules.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure and fair multiplayer network).
Retention period: technical log data are automatically deleted or anonymized after a maximum of 90 days.
Disciplinary records (e.g., suspensions or bans) may be retained longer if necessary for the investigation of abuse cases.
Recipients: server hosting partners LilyPad (United Kingdom) and Hetzner (Germany) under Standard Contractual Clauses pursuant to Art. 46 GDPR.

If you contact us via the contact form provided on this website, the data you enter will be processed.

This includes in particular:

• Name 
• Email address 
• Message content 
• Any files submitted (attachments) 

The data is processed solely for the purpose of handling your request and any necessary follow-up communication.

Legal basis:
Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries)

The data will not be shared with third parties unless this is necessary to process your request.

Storage:
The data is stored either on the server of this website or within the associated email system.

Retention period:
The data will be deleted once your request has been fully processed, unless legal retention obligations apply.

This website uses Google reCAPTCHA (provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to protect the contact form against spam and automated abuse.

reCAPTCHA analyzes user behavior (e.g., mouse movements, keystrokes, browser metadata, and IP address) to distinguish humans from bots. This data is transmitted to and processed by Google.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in protecting this website from automated misuse.

Data transfers: As Google LLC is based in the United States, data may be transferred to the US. Such transfers are carried out under Standard Contractual Clauses pursuant to Art. 46 GDPR.

For more information, see Google's Privacy Policy: https://policies.google.com/privacy

Data submitted through the contact form is typically forwarded to and processed within an email inbox.

For this purpose, Microsoft (e.g. Microsoft 365 / Outlook) is used as a data processor.

Processing is carried out solely on our behalf and on the basis of a data processing agreement in accordance with Art. 28 GDPR.

Data may also be processed in third countries (e.g. the United States). In such cases, data transfers are based on Standard Contractual Clauses pursuant to Art. 46 GDPR.

ManasCosmetics is a cosmetic content system used on Minecraft servers. How cosmetic data are handled depends on how and where the software is run:

On our own Minecraft servers: When you use cosmetic features on servers operated by ManasMods, the following data are processed for functionality:

• Minecraft UUID (to associate cosmetics with your account)
• Equipped cosmetic items and active cosmetic slots
• Saved cosmetic presets and loadout configurations
• Cosmetic entitlement records (which cosmetics you have unlocked or purchased)

Purpose: providing, rendering, and synchronizing cosmetic content; saving cosmetic configurations; and verifying entitlement to purchased or restricted items.

Legal basis: Art. 6(1)(f) GDPR for freely available cosmetic functionality, and Art. 6(1)(b) GDPR for content linked to a purchase.

Storage: Cosmetic data on our servers are stored locally within the respective server instance. These data are not transmitted to ManasMods as a separate recipient and are not centrally collected, aggregated, or used for any purpose beyond operating the cosmetic features on that server.

Important: software used on third-party servers. Where the ManasCosmetics software is installed and operated by independent third parties on their own Minecraft servers, those server operators determine independently how cosmetic data are stored and processed (for example, locally or in a database of their own choosing). In those cases, the respective server operator is the data controller for any such processing. ManasMods does not receive, collect, or have access to cosmetic data from third-party servers and is not responsible for the data processing carried out by independent operators.

Retention period: On our servers, cosmetic configuration and entitlement data are retained while your account remains active on our network. Purchase-linked records required for accounting are retained per the statutory periods in Section 9.

Personal data such as name, Discord tag, PayPal address, and billing information are processed for the administration of staff and contracted work.
Legal basis: contract performance (Art. 6(1)(b) GDPR) and legal recordkeeping obligations (Art. 6(1)(c) GDPR)
Storage: data are stored in Google Drive (Ireland) with encryption and two-factor authentication.
Retention: 10 years in accordance with § 147 AO and § 257 HGB.

Services such as Patreon, PayPal, and Discord may process data outside the EU (e.g., in the United States or the United Kingdom).
These transfers are carried out only under recognized safeguards, particularly Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.

All accounts (Google, Patreon, Tebex, Discord) are protected by two-factor authentication (2FA).
Access to personal data is restricted exclusively to Borna Smital.
Data are only shared with third parties on a valid legal basis.
This website uses SSL/TLS encryption for secure data transmission.

Under the GDPR, you have the following rights:

• Access to your stored data (Art. 15)
   
• Rectification of incorrect data (Art. 16)
   
• Erasure (“right to be forgotten”, Art. 17)
   
• Restriction of processing (Art. 18)
   
• Data portability (Art. 20)
   
• Objection to processing (Art. 21)

•  Withdrawal of consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal (Art. 7(3))
   

You also have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law (Art. 77 GDPR).

Supervisory Authority:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
P.O. Box 20 04 44
40102 Düsseldorf
Website: https://www.ldi.nrw.de

To exercise your rights, please contact: privacy@manasmods.com

Business and payment records are retained in accordance with legal requirements for up to 10 years and are then deleted or anonymized.

This privacy policy may be updated in response to legal, organizational, or technical changes.
The most current version is always available on this website.

Last updated: 22.06.2026