Privacy Policy

1. Controller and contact

This privacy notice applies to GTA 6 Updates at dailygta6.com, an independent editorial fan website. Christoph Hahn is the controller for personal data processing. Please use the contact details below for privacy enquiries and to exercise your rights.

2. Hosting, server logs and DNS

Vercel Inc. hosts this website. Requests involve processing the IP address, requested URL, time, browser/device information and technical connection or error data. This supports delivery, stability, security and troubleshooting. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is providing a reliable and secure information service.

No exclusively EU-based processing is promised for Vercel. According to the current operator configuration, the domain is managed through Cloudflare. The publicly registered name and mail servers on 23 September 2026 belong to IONOS. Domain management does not mean that all website traffic is routed through Cloudflare.

DNS resolution may involve the domain name, time and technical information about the requesting DNS resolver. This makes the website reachable under Article 6(1)(f) GDPR. Domain administration primarily involves the domain administrators’ contact details.

3. Contact and email forwarding

There is currently no contact form on the website. You can contact contact@dailygta6.com or call us. The email link opens your email application; it does not submit form data to a website API. We process your sender address, message and attachments, plus your name, company, phone number or other details if you provide them.

Email for the contact address is delivered through IONOS. Enquiries are forwarded to Google Workspace/Gmail and Proton Mail mailboxes for processing. The receiving providers also receive the forwarded content and attachments. Depending on forwarding rules, copies may exist in several mailboxes. These contact emails are not configured to be stored in the website database.

The purpose is to handle and answer your enquiry and conduct business correspondence. Article 6(1)(b) GDPR applies to contractual or pre-contractual enquiries; other enquiries rely on Article 6(1)(f) GDPR and our interest in communicating with readers, interested persons and business partners. Additional information is voluntary.

4. Google Workspace, Proton Mail and Brevo

Google Workspace/Gmail receives forwarded enquiries and is used to handle them. The provider is Google Ireland Limited. This is not a Google Analytics integration or a Google login on this website.

Proton Mail is also a forwarding destination and is used to handle correspondence. The provider is Proton AG in Switzerland. Proton identifies Switzerland, Germany and Norway as locations for storing its mail data. This does not promise that every processing operation occurs exclusively in Switzerland or that every forwarded email is end-to-end encrypted.

According to the operator, Brevo is used for contact and email communication outside the website. This may involve a name, email address, message content and technical delivery information when the particular communication is handled through Brevo. No contact or newsletter form on this website is automatically connected to Brevo. This does not mean that every incoming enquiry is shared with Brevo.

The provider overview lists both Brevo entities: Brevo GmbH in Germany and Sendinblue SAS in France. The contracting entity and recipient for a particular service depend on the applicable agreement. Listing both entities does not mean that every message is shared with both.

5. Providers and recipients

This overview distinguishes website operation, communication and domain management. Forwarding contact emails concerns people who contact us, not every website visitor. For the database functions described as prepared below, transmission depends on actual activation.

6. Supabase: our editorial system and prepared data functions

Supabase is implemented for this GTA project: database, editorial authentication and public image storage. The configured project is in the EU West (Ireland) database region. The check on 23 September 2026 showed that the public website still serves bundled starter content without an active Supabase connection and that editorial login is not yet configured.

With an active connection, processing covers editorial accounts and sessions, articles with author names, translations, sources and images, and public website settings. Additional enabled functions may store newsletter registrations and pseudonymous abuse-prevention counters. There is no public visitor registration, commenting, payment processing or customer data workspace.

Editorial operation, publishing and security rely on Article 6(1)(f) GDPR. Published content and images are public; editorial accounts, newsletter addresses and request counters are access-restricted. An EU database region does not exclude processing by support or subprocessors outside the EU.

7. Newsletter: no current signup or delivery

No newsletter signup form is currently displayed. The code contains a prepared registration function but no double opt-in, confirmation email or newsletter delivery. Synchronisation of these registrations with Brevo is not implemented. There is therefore no claim of an active newsletter service.

If the prepared function is activated, it requires explicit consent and stores the email address, signup time, status, consent version and personal unsubscribe token in Supabase. The legal basis would be Article 6(1)(a) GDPR. Transmission and storage require a configured connection. Before email delivery is enabled, the actual procedures and notices will be updated.

For existing registrations, unsubscribing is provided through the personal link with confirmation or by contacting the controller. Technical unsubscribe changes the status to “unsubscribed”; it does not automatically delete the record. The editorial administrator can delete it entirely. The link contains a personal token that may appear in browser history and technical logs. The website code does not implement email open or click tracking.

8. Cookies and local storage

The Silktide consent manager is loaded locally from this website. It does not send your choices to Silktide. Local storage contains stcm.gta6-updates.consent.essential and stcm.gta6-updates.hasConsented. These remember the essential category and your acknowledgement, contain no advertising ID and have no automatic expiry. You can delete them through your browser’s site-data settings.

Storing your expressly selected preferences relies on Section 25(2)(2) TDDDG and, where personal data is involved, Article 6(1)(f) GDPR to respect your choice. Optional analytics or marketing categories are not enabled.

When editorial login is enabled, Supabase authentication cookies are required. The SDK default permits cookie lifetimes of up to 400 days; renewal and logout can change this. Server-side session validity is separate. The requested login relies on Section 25(2)(2) TDDDG and Article 6(1)(f) GDPR. Ordinary readers do not need these login cookies.

9. Abuse prevention, article counters and search

With the database connection enabled, shared counters limit login to ten attempts per 15 minutes, registrations to five per hour, unsubscribe requests to 30 per hour and article-counter requests to 60 per minute. Repeated visits to the same article are not counted again within 30 minutes. A secret-protected value derived from the IP address and function identifier is stored, rather than the raw IP in the counter table. These values are pseudonymous, not categorically anonymous.

Values are removed after their time window expires when the next rate-limited request occurs; there is no scheduled deletion job. Only an aggregate count remains for each article. The purposes are abuse prevention and a basic popularity display under Article 6(1)(f) GDPR. Google Analytics, Plausible, PostHog, advertising networks and comparable tracking SDKs are not integrated.

Global search processes the query on our own server. The query appears in the URL and may therefore appear in browser history and hosting logs. There is no dedicated search-history table or external search provider. Directory filters run in the browser. Article 6(1)(f) GDPR supports providing the requested search.

10. YouTube, external links and sharing

YouTube videos are embedded through youtube-nocookie.com only after you choose “Agree & load video”. Your IP address, device information and usage data may then be transmitted to Google Ireland Limited and other Google companies, including outside the EU. This relies on consent under Article 6(1)(a) GDPR and, where required, Section 25(1) TDDDG. The choice applies only to the individual video and page visit. Closing the video ends the embed but does not recall data already transmitted.

Source and sharing links to other websites, X, Reddit or WhatsApp do not load social-media scripts. Clicking them opens the destination, where that provider’s notices apply. “Copy link” writes the article URL to your clipboard after your click.

11. International transfers

Depending on the service, data may be processed outside the European Economic Area, notably in the USA, Singapore or Switzerland. Where required, the safeguards provided in the applicable provider agreements, particularly standard contractual clauses under Article 46 GDPR, or applicable adequacy decisions under Article 45 GDPR are relied on. An EU address or database region does not automatically mean exclusively European processing. Information about applicable safeguards is available in provider notices or from the controller.

12. Retention and deletion

Enquiries and email copies are retained as needed to handle the matter and maintain necessary correspondence. They are then deleted unless statutory retention duties or specific legitimate grounds, such as defending claims, require retention. Deletion must also consider copies in forwarding mailboxes. No single fixed period is promised for all messages or provider logs.

Technical logs are retained according to operational, troubleshooting and security needs and provider settings. Editorial accounts and content remain until administrative deletion. Deleting an article does not automatically remove uploaded image files. Newsletter registrations currently have no automatic deletion period; unsubscribe and complete deletion are different actions. Expiry and deletion of verification values and browser storage are described in sections 8 and 9. Backup copies may remain until their scheduled overwrite.

13. Your rights, objections and withdrawal

Subject to the legal conditions, you may request access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20). Contact contact@dailygta6.com. A proportionate identity check may be needed to handle your request.

You may withdraw consent at any time for the future; earlier lawful processing remains unaffected. You may object to processing under Article 6(1)(f) GDPR on grounds relating to your particular situation (Article 21 GDPR). You have an unconditional right to object to direct marketing.

You may complain to a data protection authority, particularly where you normally live, work or where the suspected infringement occurred (Article 77 GDPR). For the controller in Berlin, the Berlin Commissioner for Data Protection and Freedom of Information is a contact point.

Berlin Commissioner for Data Protection and Freedom of Information

14. Changes

This notice is updated when services actually used or data flows change. This website does not make solely automated decisions with legal or similarly significant effects.