Privacy policy

Controller

The controller responsible for data processing on this website and in the Nishinija community is:

René Ickert, Nishinija Productions
Address: see Legal notice
Email: info@nishinija.de

No data protection officer has been appointed, as the legal requirements for this are not met. Please send any data protection questions directly to the address above.

Scope and terms

This policy applies to

• the website nishinija.de (German and English),
• our Discord server including our bots,
• our game servers (Minecraft network, VNyan server and time-limited projects such as Palworld, ARK or The Forest),
• community events, and
• the connection of our talents' channels to our platform.

“Personal data” means any information relating to you as an identifiable person – for example your name, your Discord name, your IP address or your voice. We use terms such as “processing” or “controller” as defined in the General Data Protection Regulation (GDPR).

Legal bases at a glance

• Consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG): e.g. Google Analytics, loading embedded streams and videos, recordings in the community.
• Contract and pre-contractual steps (Art. 6(1)(b) GDPR): e.g. taking part in the community, game servers and events under our community terms, working with talents, applications.
• Legal obligations (Art. 6(1)(c) GDPR): e.g. retention obligations or requests from authorities.
• Legitimate interests (Art. 6(1)(f) GDPR): e.g. secure and stable operation of the website and servers, preventing abuse, moderating the community. We always weigh our interest against yours.
• Strictly necessary storage on your device (Section 25(2) No. 2 TDDDG): e.g. storing your cookie choice or your colour scheme.

Hosting, servers and logs

Hosting

We operate the website, databases, mail server, Discord bots and game servers ourselves on a rented server from netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. The server is located in a data centre in Nuremberg (Germany). netcup only processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Our domain and name resolution (DNS) are also managed by netcup.

Website server logs

When you visit the website, our web server automatically processes:

• IP address,
• date and time of the request,
• requested address and amount of data transferred,
• status code (e.g. “found” or “error”),
• referrer (the previously visited page, if your browser sends it), and
• browser, operating system and device type (user agent).

This is necessary to deliver the website, find errors and fend off attacks (Art. 6(1)(f) GDPR). Server logs are deleted after 14 days at the latest, application and error logs after 30 days at the latest. Exceptions only apply for as long as a specific security incident needs to be investigated.

Encryption and security

The website is only available via encrypted connections (HTTPS/TLS). Administrative access is additionally only possible through an encrypted VPN. Stored platform access keys (see “Channel connection”) are encrypted.

Backups

We regularly back up the website, databases and game worlds. Backups are stored on the same server and are overwritten on a rolling basis after 30 days at the latest. Deleted data may therefore still be contained in a backup until this period expires; it will not be restored from there except to recover from an outage.

Cookies, local storage and consent

We only use a few cookies or entries in your browser's local storage. We set strictly necessary entries (e.g. your cookie choice, your colour scheme) without consent (Section 25(2) No. 2 TDDDG). Everything else – in particular Google Analytics – only after you agree (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

Our consent banner is our own solution and runs entirely on our server; no data is passed to third parties. We store your choice in the cookie nx_consent for six months, after which we ask again. A complete list can be found on the page Cookies and storage.

Withdrawal: You can withdraw or change your consent at any time with effect for the future – via the “Cookie settings” link in the footer of every page.

Google Analytics (only with consent)

If you agree under “Statistics”, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This tells us which pages are visited and how often, how visitors find us and how we can improve the website.

Data processed: pseudonymous identifiers (cookies _ga and _ga_…), pages viewed and interactions, date and time, approximate location (country/region, derived from the IP address), device and browser information, referrer. According to Google, IP addresses of users in the EU are not stored. We have disabled Google signals and advertising features.

Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent, Google Analytics is not loaded.

Recipients and transfers to third countries: Google processes the data as our processor. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR).

Retention: The cookies are stored for up to 2 years. Analytics data at Google is automatically deleted after 2 months.

Withdrawal: at any time via “Cookie settings”. We then delete the Analytics cookies in your browser. More information: Google Privacy Policy.

Live status and real-time connection

So that you can see which of our talents is live without reloading, your browser opens a persistent connection (WebSocket) to our own server. Only the technical data that also arises during a normal page visit is processed (see “Website server logs”). No cookies are set and no data is passed to third parties.

Our server retrieves the live information itself from Twitch, YouTube and Kick. No data about you is transmitted to these platforms in the process.

Embedded streams and videos (two-click solution)

On talent profiles and in news articles we show live streams, videos and clips from Twitch, YouTube and Kick. These are only loaded when you click the preview image. Preview and profile images are stored on our own server; merely viewing the page does not create a connection to the platforms.

By clicking, you consent to the content being loaded (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The provider then receives in particular your IP address, device and browser information and the address of the page on which the content is embedded. The provider may set its own cookies and – if you are signed in there – link the request to your account. We have no influence on this.

• Twitch: Twitch Interactive, Inc., 350 Bush Street, San Francisco, CA 94104, USA. Twitch Privacy Notice
• YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We embed YouTube in privacy-enhanced mode (youtube-nocookie.com). Google Privacy Policy
• Kick: Kick Streaming Pty Ltd, Melbourne, Australia. Kick Privacy Policy

Third countries: Twitch and Google may transfer data to the USA; where the providers are certified under the EU-US Data Privacy Framework, the transfer is based on the adequacy decision (Art. 45 GDPR). There is no adequacy decision for Australia; the transfer to Kick is based on your explicit consent given by clicking (Art. 49(1)(a) GDPR). There is a risk that authorities there may access the data and that your rights may be harder to enforce.

Links to social media profiles (e.g. X, Bluesky, Instagram) are simple links. You only leave our website when you click them.

Contact by email

If you email us, we process your address, your name (if provided) and the content of your message to handle your request (Art. 6(1)(b) GDPR for enquiries about our services, otherwise Art. 6(1)(f) GDPR). Our mail server runs on our own server at netcup. We delete messages once your request has been dealt with and no retention obligations apply, usually after 12 months at the latest.

Applications, forms and event registrations

If you apply as a talent or register for an event through our website, we process the information from the form – e.g. name or stage name, contact details, channel links, reach, content category and your introduction. We store the data in our database on our server and use it exclusively to process your application or registration (Art. 6(1)(b) GDPR).

We delete rejected applications no later than 6 months after our decision, and event registrations no later than 3 months after the event. If we start working together, the following section applies. When you submit a form, a strictly necessary security cookie is set to prevent abuse.

Note: We do not currently offer a newsletter. Before we launch one, we will update this policy; sign-up will then only be possible with your explicit confirmation (double opt-in).

Talents: profiles and channel connection

This section concerns the content creators we work with (“talents”).

Public channel data

For the profile pages we process the information talents give us (e.g. stage name, fact sheet, images, stream schedule, links) as well as publicly available channel data from Twitch, YouTube and Kick: channel name, profile picture, follower or subscriber count, channel creation date, partner or affiliate status, live status, title and category of current streams, and public videos, streams and clips with title, view count and preview image. We store profile and preview images locally on our server so that visitors do not have to connect to the platforms. The legal basis is our agreement with the talent (Art. 6(1)(b) GDPR).

Authorisation via Twitch and Google

For certain features (e.g. automatic milestones from the follower or subscriber history), a talent can grant us access to their channel via an authorisation page:

• Twitch: scope moderator:read:followers – read access to the followers of their own channel (number and time of following).
• YouTube / Google: scopes youtube.readonly (read access to channel and videos) and yt-analytics.readonly (read access to channel statistics, in particular subscribers gained and lost per day).

We never receive passwords. We store the access keys issued by the platforms encrypted on our server. We use the data exclusively to display the figures and milestones on the talent's profile. We do not use it for advertising, do not pass it on to third parties and do not use it to train AI models.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By granting access, the YouTube Terms of Service and the Google Privacy Policy also apply.

Revoking access: at any time on Twitch under Settings → Connections, on Google under Google Account → Third-party apps & services, or by emailing us. After revocation or the end of our collaboration, we delete the access keys immediately and the retrieved channel data within 30 days, unless the talent wishes the profile to remain as an archive.

Discord server

Our community meets on a server on Discord (for users in the EEA: Discord Netherlands B.V., Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands). Your Discord account and Discord's own processing are governed by the Discord Privacy Policy; data may be transferred to the USA.

As the server operator we process – partly together with Discord – the following data:

• username, display name, avatar and Discord ID,
• roles, join date, your acceptance of our rules and your decision on recordings (with timestamp),
• messages, reactions and content you share on the server, as well as your presence in voice channels,
• moderation data (reports, warnings, timeouts, bans with reason and time) and tickets to the team.

Bots: For moderation, roles and community features we use the bot MEE6 and our own bots. Our own bots run on our server in Nuremberg and only store what they need to function (e.g. Discord ID, roles, moderation notes, link to your player name for the server whitelist). MEE6 processes data in accordance with the MEE6 Privacy Policy. Automatic moderation may delete messages or impose short timeouts; there is no automated decision with legal effect within the meaning of Art. 22 GDPR – every permanent sanction is reviewed by a human.

Legal bases: participation under our community terms (Art. 6(1)(b) GDPR), moderation and protection of the community (Art. 6(1)(f) GDPR), recordings (consent, see below).

Retention: Messages remain until you or we delete them. We keep moderation notes for up to 12 months after the last incident, and for permanent bans until they are lifted. We keep proof of your consent to recordings for as long as recordings featuring you are used, and for up to 3 years afterwards so that we can demonstrate consent.

Game servers

For our Minecraft network, the VNyan server for VTubers and time-limited game projects (e.g. Palworld, ARK, The Forest) we process:

• player name and platform identifier (e.g. Minecraft UUID, Steam ID),
• IP address and the time and duration of your connections,
• chat messages, commands and in-game actions (e.g. breaking and placing blocks, trading, combat) where they are logged,
• game progress (e.g. inventory, progress, buildings), and
• whitelist entries and their link to your Discord account.

On the VNyan server, the avatar and motion data required for the connection is also transmitted in real time, but not stored permanently.

Purposes and legal bases: providing the servers (Art. 6(1)(b) GDPR); protection against cheating, griefing and attacks, investigating rule violations and restoring damaged game worlds (Art. 6(1)(f) GDPR).

Retention: We delete connection logs containing IP addresses after 30 days at the latest, and action and chat logs after 90 days at the latest. Game progress is kept until the end of the respective project or a reset of the game world; on request we will delete your game data earlier. We keep ban entries until the ban is lifted.

Your accounts with Microsoft/Mojang, Steam or other gaming platforms are governed by their own privacy policies.

Recordings in the community

Our talents stream and produce content – including together with the community. Your voice, your user or player name, your avatar or in-game character, your chat messages and your in-game actions may be recorded when you are in voice channels on our Discord server, on our game servers or at community events.

Use: live streams, saved streams (VODs), clips, short videos and videos on platforms such as Twitch, YouTube, Kick, TikTok and Instagram, including where this content is monetised. The content is then publicly available worldwide.

Legal basis: your consent (Art. 6(1)(a) GDPR, for images additionally Section 22 KUG), which you actively give when joining our Discord server or before taking part in a game server or event. Participants aged 16 to 17 additionally need the consent of their parents or guardians.

Recording-free areas: Voice channels marked as recording-free are not recorded. If you do not want to be recorded, you can continue to use these areas.

Withdrawal: You can withdraw your consent at any time with effect for the future – via a ticket on Discord or by email. From then on you will no longer be recorded. On request, we will edit or remove content that has already been published, as far as this is technically possible and reasonable (e.g. by cutting or muting the relevant part). Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Details are set out in our community terms.

Children and young people

Anyone may visit our website. Taking part in the community, game servers and events is only permitted from the age of 16; until the age of 18 only with the consent of a parent or guardian. If we learn that data of a person under 16 is being processed without the required consent, we will delete it.

Recipients of your data

We only pass on personal data where this is necessary for the purposes described, you have consented, or we are legally obliged to do so. Recipients may include:

• our hosting provider netcup (processor),
• Google (if you consent to Google Analytics, as processor),
• Discord and MEE6 (when using our Discord server),
• Twitch, Google/YouTube and Kick (when loading embedded content after your click; as publishing platforms for recordings),
• authorities, where we are legally obliged.

We do not sell data and do not use it for personalised advertising.

Retention at a glance

Data	Retention
Website server logs	14 days
Application and error logs	30 days
Backups	30 days (rolling)
Cookie choice (nx_consent)	6 months
Google Analytics data	2 months at Google, cookies up to 2 years
Emails	until resolved, usually max. 12 months
Rejected applications	6 months after decision
Event registrations	3 months after the event
Discord moderation notes	12 months after the last incident or until a ban is lifted
Game servers: connection logs (with IP)	30 days
Game servers: action and chat logs	90 days
Game progress	until end of project or reset
Proof of recording consent	as long as recordings are used, then up to 3 years
Talents' access keys	until revoked or end of collaboration

Statutory retention obligations remain unaffected.

Your rights

You have the right at any time to

• access the data we hold about you (Art. 15 GDPR),
• rectification of incorrect data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

An informal message to info@nishinija.de is all it takes. To make sure we do not disclose data to unauthorised persons, we may ask you to confirm your identity (e.g. via your Discord account).

Right to lodge a complaint

You can also lodge a complaint with a data protection supervisory authority, in particular in the state or member state where you live. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
www.ldi.nrw.de

Obligation to provide data

You are not obliged to give us any personal data. However, without the technical connection data we cannot deliver the website, and without the information mentioned it is not possible to take part in the community, game servers, events or applications.

Changes to this policy

We update this policy when our services or the law change – for example when the shop, a newsletter or new services are added. The version published here applies; you can find the date at the top under “Last updated”. If a change requires your consent, we will ask you again beforehand.