Privacy policy
Information pursuant to Art. 13 GDPR
This English version is provided for convenience. Only the German version is legally binding.
1. Controller
Martin Kaufmann, sole proprietorship “DERKAUFMANN IT-Service” (brand BrezelStudios)
Großwilfersdorf 19/3
8263 Großwilfersdorf
Austria
Phone: +43 (0) 664 255 7441
Email: hallo@brezelstudios.com
Website: brezelstudios.com
2. General information on data processing
We process personal data exclusively in accordance with the GDPR, in particular the principles of lawfulness, purpose limitation and data minimisation. This website works without user accounts and without tracking. Personal data is only processed when the pages are technically accessed and when you contact us (contact form, email or phone).
3. Hosting
This website is hosted by: digitalnova GmbH, Krottendorfer Straße 9a/9, 8052 Graz, Austria. As part of its service the hosting provider processes personal data (e.g. IP addresses in server log files). According to the provider, processing takes place on servers in Austria. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.
Legal basis: Art. 6(1)(f) GDPR – legitimate interest in providing our website securely, reliably and efficiently.
4. Access data / server log files
The server automatically records: IP address or host name, date and time of the request, pages and files accessed, browser type and version, operating system and the referrer URL. This data is used solely for system security, stability and troubleshooting. Retention period: 30 days, after which it is deleted automatically by the hosting provider. Legal basis: Art. 6(1)(f) GDPR.
5. Cookies and local storage
This website does not set cookies. Only our games (section 8) store your progress, settings and – if you play online – your player name and a random player ID in your browser's local storage. This is technically necessary for the game you have opened (Section 165(3) TKG 2021, Austrian Telecommunications Act); consent and a cookie banner are therefore not required. You can remove this data at any time in your browser settings (clear site data); your progress will be lost.
6. Contacting us
If you contact us by email or phone, we process the information you provide (e.g. name, email address, phone number, content of your enquiry) in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering). The data is deleted once your enquiry has been dealt with and no statutory retention obligations apply.
7. Contact form
If you use the contact form, we process what you enter – name, email address and message, and optionally phone number and topic – solely in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR (enquiry about a possible assignment, pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering other enquiries). Separate consent is not required.
Your details are sent as an email via the mail server of our provider digitalnova GmbH (Graz, servers in Austria) to our mailbox; a data processing agreement pursuant to Art. 28 GDPR is in place with the provider. The form contents are not stored on the web server itself. If your enquiry is unremarkable, we send you a confirmation of receipt to the email address you provided.
Spam protection: To fend off automated spam submissions, we check every submission technically (time stamp, fields invisible to humans, assessment of the content). For this purpose we briefly process your IP address: for abuse limits (number of submissions per hour, block after repeated bot attempts) we only store it as a non-reversible checksum and delete it after 24 hours at the latest. To detect duplicate submissions we store a checksum of the message, not the text, for 14 days. If a submission is rejected or flagged as suspicious, we log the time, the shortened IP address (for IPv4 without the last group of digits), the result of the check, the length of the message and the browser identifier (user agent), but no form contents. Technical sending errors are logged without email addresses. These logs are deleted automatically after 30 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure form free from abuse). The form does not set cookies and does not embed any external services (such as captcha providers).
Deletion: We delete your enquiry once it has been dealt with and no statutory retention obligations apply (for example if it results in an assignment).
8. Games and apps
Our browser games run at brezelstudios.com/games/ on the same server as this website (section 3). They do not load content from third parties and show no advertising in the browser. Without online features, all game data stays on your device (section 5).
Online leaderboards (e.g. Buschenschank Gaudi, Workbench Tycoon, Fuse Stack, Masterpiece): if you submit a result, we store the player name you choose, a random player ID, your score or time and the date – no IP addresses. Please use a nickname rather than your real name. Legal basis: Art. 6(1)(b) GDPR (taking part in the leaderboard at your request). Entries remain as long as the leaderboard is kept; we will delete your entry on request to hallo@brezelstudios.com.
Playing online with friends (Masterpiece, Fuse Stack, Schnapsen): for the duration of a match, the server stores the chosen name, the player ID, the table or match code and the game state in order to connect the devices. Open tables and presence information expire automatically after a short time (minutes). Legal basis: Art. 6(1)(b) GDPR.
Direct connection in Masterpiece: for the online duel, the game connects both devices directly (WebRTC). To do so, your browser asks a Google STUN server (stun.l.google.com, Google Ireland Ltd. / Google LLC, USA) for your public IP address, and your opponent receives this IP address for the connection. This only happens when you start or accept an online duel. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR.
Separate privacy information applies to our apps; it is linked in the app and in the respective store listing.
9. External links
This website links to external services, in particular itch.io, ko-fi.com, rotronik.at, firmenfreund.at, turza.at and derkaufmann.at. Data (e.g. your IP address) is only transmitted to the respective provider when you click a link; content from these providers is not embedded in our pages. With itch.io, data may be transferred to countries outside the EU. The operators of the linked pages are solely responsible for the data processing there.
10. Fonts
All fonts are stored locally on our server. There is no connection to servers of external providers such as Google Fonts.
11. Web analytics / tracking
No analytics or tracking tools are used on this website. User behaviour is not analysed and no profiles are created.
12. Data security
This website uses TLS encryption. We use technical and organisational measures to protect your data against loss, manipulation and unauthorised access.
13. Your rights
In principle you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), withdrawal of consent (Art. 7) and objection (Art. 21 GDPR).
If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority: Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at.
Version 1.2 – last updated: 27 October 2026