Privacy Policy (Datenschutzerklärung)

2. Hosting & Server Log Files (STRATO GmbH vServer in Germany)

Our website is hosted directly (without any intermediate external Content Delivery Network such as Cloudflare in front of the website) on a Virtual Server (vServer) operated by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The server location is exclusively in Germany.

When you access our website, our web server automatically collects and stores technical information in server log files that your browser transmits automatically. These include: IP address of the requesting device (with the last octets anonymized/masked at the reverse-proxy level for privacy protection), browser type and version, operating system used, referrer URL (previously visited page), hostname of the accessing computer, requested URL, HTTP status code, transferred data volume, and the exact time of the server request.

This data is processed on the legal basis of Art. 6 (1) lit. f GDPR (DSGVO). Our legitimate interest lies in ensuring the technically error-free presentation, stability, and security of our website, as well as defending against cyber attacks (e.g., DDoS or brute-force attempts). This data is not merged with other data sources and is automatically deleted after no more than 14 days. We have concluded a Data Processing Agreement (DPA / AVV) with STRATO GmbH in accordance with Art. 28 GDPR.

3. Contact via E-Mail (STRATO Webmail) & Contact Form

When you contact us by e-mail (at info@bestclashdecks.com), your e-mail and the personal data you provide (e-mail address, name if provided, and message content) are processed and stored via the e-mail servers (STRATO Webmail) of our hosting provider STRATO GmbH in Germany.

When you use our on-site Contact Form, the data you enter (Name [optional], E-Mail Address [required], Subject [required], Message [required], and submission timestamp) is transmitted via encrypted connection, stored in our PostgreSQL database on our STRATO vServer in Germany, and made available in our protected internal Admin area solely for processing your inquiry. To protect the form against automated spam, we use strictly privacy-friendly local mechanisms (local honeypot field, submission timing check, and in-memory hashed rate limiting); we explicitly do NOT use external Google reCAPTCHA.

The legal basis for processing is Art. 6 (1) lit. b GDPR (pre-contractual or contractual measures) or, in all other cases, Art. 6 (1) lit. f GDPR (our legitimate interest in responding quickly and efficiently to inquiries addressed to us). The data will be deleted from our database as soon as your inquiry has been conclusively resolved and provided no statutory retention obligations apply.

4. Clash Royale API & External Image Assets (RoyaleAPI CDN / GitHub / Supercell)

5. Cookies, LocalStorage & Consent Management (§ 25 TDDDG)

Our website uses a locally self-hosted consent management tool (Orestbida CookieConsent) as well as essential cookies and browser LocalStorage. Strictly necessary storage entries are used to save your language preference across our 21 supported languages, your cookie consent status (cookie "cc_cookie", stored for 6 months), and your locally saved favorite decks (LocalStorage key "bestclashdecks_favorites", which never leaves your browser). The legal basis for these strictly necessary storage operations is § 25 (2) No. 2 TDDDG in conjunction with Art. 6 (1) lit. f GDPR.

All non-essential analytics and advertising cookies and scripts (Google Analytics 4, Microsoft Clarity, and Google AdSense) are strictly blocked by default and are only loaded after you have given your active, explicit consent (Opt-In pursuant to § 25 (1) TDDDG in conjunction with Art. 6 (1) lit. a GDPR). You can modify or revoke your consent at any time with effect for the future via the "Cookie Settings" link in the footer or by clicking the button below:

6. Web Analytics with Google Analytics (GA4)

Provided you have given your explicit consent via our cookie banner, this website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Without your prior active consent (Opt-In), the Google Analytics script is blocked and no data is transmitted to Google.

Google Analytics uses cookies (such as "_ga") to analyze how users interact with our website. In Google Analytics 4, IP anonymization ("anonymize_ip") is enabled by default: your IP address is truncated by Google within member states of the European Union or the European Economic Area before storage. User-level data associated with cookies is automatically deleted after no more than 14 months.

The legal basis is exclusively your consent pursuant to § 25 (1) TDDDG and Art. 6 (1) lit. a GDPR. You may revoke your consent at any time via "Cookie Settings" in the footer, which immediately disables tracking and deletes analytics cookies. Data transfers to Google LLC in the USA are safeguarded by the EU-US Data Privacy Framework (DPF), under which Google LLC is certified (Art. 45 GDPR), as well as EU Standard Contractual Clauses (SCC).

7. User Behavior & Heatmaps with Microsoft Clarity

Provided you have given your explicit consent via our cookie banner, this website uses Microsoft Clarity, operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA). Without your active opt-in consent, Microsoft Clarity is blocked and not loaded.

Microsoft Clarity captures anonymized interaction metrics such as mouse movements, clicks, scroll depth, and pseudonymized session recordings to generate heatmaps and help us improve usability. All input fields and sensitive user text are automatically masked before transmission. Clarity uses cookies such as "_clck" and "_clsk". The legal basis is exclusively your consent pursuant to § 25 (1) TDDDG and Art. 6 (1) lit. a GDPR, which you can revoke at any time in the footer ("Cookie Settings"). Microsoft Corporation is certified under the EU-US Data Privacy Framework (DPF) and additionally relies on EU Standard Contractual Clauses (SCC).

8. Online Marketing & Advertisements with Google AdSense

Provided you have given your explicit consent in the "Marketing & Advertising" category via our cookie consent banner, this website integrates Google AdSense to finance our free website offering. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Without your prior active consent (strict Opt-In), the AdSense script (adsbygoogle.js) is not loaded and no connection to Google ad servers (googlesyndication.com or doubleclick.net) is established.

Google AdSense uses cookies (such as "__gads", "__gpi", "IDE", "DSID"), web beacons (invisible tracking pixels), and DoubleClick technologies to serve personalized or non-personalized advertisements, limit ad frequency per user (frequency capping), measure ad effectiveness, and prevent click fraud. The following data is processed: IP address, device and browser information (user-agent, operating system, screen resolution), referrer URL, interactions with advertisements (clicks and impressions), and online identifiers / cookie IDs.

The legal basis for loading Google AdSense and storing/reading advertising cookies is exclusively your explicit consent pursuant to § 25 (1) TDDDG and Art. 6 (1) lit. a GDPR (DSGVO). You may revoke your consent at any time with effect for the future via the "Cookie Settings" link in the footer, which prevents AdSense from loading and deletes advertising cookies. Data transfers to Google LLC in the USA are based on Google LLC’s active certification under the EU-US Data Privacy Framework (DPF) pursuant to Art. 45 GDPR as well as EU Standard Contractual Clauses (SCC).

9. External Links to Social Media Platforms (YouTube, Twitch, X, Instagram, TikTok)

Our website—in particular on the Featured Pro Player pages—contains links to the external social media platforms YouTube, Twitch, X, Instagram, and TikTok. These are exclusively simple static external hyperlinks (no embedded social media plugins, widgets, or auto-loading iFrames). Therefore, merely visiting our website does not transmit any personal data to these social media networks. Data is only transmitted to the respective platform if you actively click on one of these external links.

10. SSL / TLS Encryption

For security reasons and to protect the transmission of confidential content (such as inquiries you send to us via our Contact Form), this website uses modern SSL/TLS encryption (HTTPS). You can recognize an encrypted connection by the "https://" prefix and the lock icon in your browser address bar.

11. Your Data Subject Rights under GDPR & Right to Object

• Right of Access (Art. 15 GDPR): You have the right to request confirmation as to whether personal data concerning you is being processed and to receive information about this data free of charge.
• Right to Rectification (Art. 16 GDPR): You have the right to demand the immediate correction of inaccurate or completion of incomplete personal data.
• Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): You have the right to request the immediate deletion of your personal data unless statutory retention obligations apply.
• Right to Restriction of Processing (Art. 18 GDPR): You have the right to request the restriction of processing of your personal data under the statutory conditions.
• Right to Data Portability (Art. 20 GDPR): You have the right to receive data that we process automatically on the basis of your consent or in fulfillment of a contract in a structured, machine-readable format.
• Right to Withdraw Consent (Art. 7 (3) GDPR): You have the right to withdraw any consent once given at any time with effect for the future (e.g., via "Cookie Settings" in the footer or by e-mail to info@bestclashdecks.com).
• Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence or of the place of the alleged infringement (e.g., LDI NRW in Düsseldorf, Germany).