Privacy

1. Controller and Contact

Aalborg Heating & Cooling Systems ApS
Hjulmagervej 55, 9000 Aalborg, Dänemark
Data protection contact: hello@aalborg-hcs.com

aalborg hc systems · Privacy ↗

2. Playing and Saving Results

You can play without an account or email address. We store your entered name (a nickname is possible), your voluntary company information, the selected game character, play time, calculated result, timestamp, and a random game ID. The character selection serves display purposes in the game, allowing the round to be evaluated. Processing for providing the game you requested is based on Art. 6(1)(b) GDPR. Game processes are processed during result verification; individual movements are not stored permanently.

Selecting 'Consent to all' activates the explicitly named options together. Under 'Select individually / Details', you can choose and deselect options independently. Nothing is pre-selected. Cookie/statistics consent remains separate.

3. Voluntary Ranking

Only if you consent before starting the game will your name, voluntary company information, selected game character, and result appear in the public daily ranking, including on the public ranking screen (Art. 6(1)(a) GDPR). Email addresses are not displayed there. Use a nickname that does not allow conclusions about you. Under 'My Data', you can delete the entry to stop future publication.

4. Result via Email, Contact, and Voluntary Draw

If you provide an email address, you request delivery of your game result. You also explicitly consent to being contacted by aalborg hc systems via email regarding thermal storage. Without an email address and this consent, you can still play. We store the email address encrypted, language, timestamp, text version of contact consent, and delivery timestamp. Contact consent is based on Art. 6(1)(a) GDPR. Delivery of the requested result serves game provision under Art. 6(1)(b) GDPR. Draw participation is requested separately. You can withdraw your consent under 'My Data' by deleting the entry or contacting the data protection officer.

Participation is only offered once a draw is set up and open. Your email address and voluntary company information are then used solely for execution and winner notification. The basis is your separate consent under Art. 6(1)(a) GDPR. We store the timestamp and version of consent as proof. No newsletter subscription occurs. You can withdraw consent at any time with effect for the future by deleting your participation under 'My Data' or contacting the data protection officer. Processing done until then remains lawful. After withdrawal, further consideration for the draw is not possible.

5. Sessions and Technical Data

For game flow, protection against forged requests, and management, we use a technically necessary session cookie. The session ends at the latest after 30 minutes without activity. Login passwords are stored as Argon2id hashes; company information, draw contacts, and session contents are stored encrypted. We do not load external fonts or use external analysis or advertising services. Language selection and entered participant data are not stored permanently in the browser. A technical limit on repeated requests uses short-term hashed IDs. When connecting to the hosting provider, your IP address is technically processed; its logging and deletion deadlines must be agreed with the operator before publication.

Voluntary Visit Statistics

Only with your explicit, separate consent (Art. 6(1)(a) GDPR and, where applicable, § 25(1) TDDDG), we capture a random visitor ID, input status of name and voluntary email, timestamps of inputs, start and end of the game, leaving the page or last activity, device type, browser and version, operating system, game and browser language, screen and view size, time zone, and referring source without path or search parameters. The statistics serve to improve the game and evaluate drop-off points. Unsubmitted names and email addresses are not recorded. Completed game results can be assigned to the consented visit. Additionally, we store IP address and full browser fingerprint encrypted for at most 7 days. No location tracking or device fingerprinting occurs. Visit data is deleted after 30 days. Without consent, no visit statistics occur, and you can play fully. Via 'Cookies' at the top of the game, you can refuse or withdraw at any time; this deletes current visit statistics and stops collection. Already saved game results and separate contact consents remain unaffected and can be deleted under 'My Data'. When switching to the next person, it asks again. An incomplete round is considered a drop-off after leaving the page or 5 minutes without activity. Statistics include only consenting visits and allow no confirmed person assignment before a completed round. Statistics data and exports are accessible only to authorized administrators.

6. Retention Period

Game results are deleted after 90 days. The email address stored for result delivery and contact, along with consent and delivery proof, is removed from the game result after 30 days. Draw contacts are deleted at the latest 30 days after the stated registration deadline or together with the associated result, whichever occurs first. Technical game IDs are removed after 24 hours. Logs of administrative actions are retained for at most 90 days. Automatic cleanup must be performed regularly on the server. You can delete your result and contact data yourself beforehand. For backup copies, the operator's documented backup and deletion procedure applies; this must be defined before publication.

7. Recipients and Hosting

The application is intended for operation on EU web hosting selected by the operator. Unpublished company information and draw contacts are visible only to authorized persons in the protected administrative area. Hosting provider, location, data processing agreement, and the mail service used for result and contact emails must be specifically named by the operator before publication. The game application requires no AI or other external cloud connection.

8. Your Rights

You have the right to information, rectification, deletion, restriction of processing, and data portability within legal limits, as well as to withdraw consent. If processing is based on legitimate interests, you have a right to object under Art. 21 GDPR. You can complain to a competent data protection supervisory authority. No automated decision-making with legal or similarly significant effect occurs.

Under My Data, you can retrieve, download, and delete the last completed round of your current session. In the result email, the link 'My Data' leads directly to the associated information. Keep this email secure and do not share the personal link. When switching to the next person, session access is reset. Without a session or email link, contact the data protection officer; appropriate evidence may be required for assignment.