PRIVACY POLICY

The controller for the processing of personal data on this website is Virtual Competition Organisation GmbH, Lindwurmstraße 88, 80337 München, Germany, represented by its managing directors Florian Haasper and Andreas Pavelic.

Phone: +49 (0) 89 / 45 23 509 – 11
Email: info@vco-esports.com
Privacy enquiries and rights requests: dataprotection@vco-esports.com

Further company information is available in our imprint.

Personal data means information relating to an identified or identifiable person, including contact details, account identifiers, IP addresses and technical connection data. We process these data to provide and secure our website, respond to enquiries and meet legal obligations.

The applicable legal framework includes the General Data Protection Regulation (GDPR) and German data protection law. The legal bases for individual activities are described below. Where processing is necessary to comply with a legal obligation, Article 6 (1) (c) GDPR applies.

We use Replit, Inc., United States, to host this website, its API and associated storage. When a page, image or API resource is requested, the hosting infrastructure processes technical connection data such as the IP address, access time, requested resource, browser and operating system information, referrer information and response status.

These data are processed to deliver content, maintain the availability and reliability of the website and detect or investigate misuse and security incidents. The legal basis is Article 6 (1) (f) GDPR; our legitimate interest is the secure and reliable operation of the website.

Information about Replit’s processing, service providers and contractual safeguards is available in its Privacy Policy (opens a new tab) and Data Processing Agreement (opens a new tab). International transfers are addressed in section 11 below.

If you contact us, we process the information you provide, such as your name, email address, telephone number, company and the contents of your message, to answer your enquiry and any related follow-up questions. The contact page uses email links; it does not submit a contact form to this website.

The legal basis is Article 6 (1) (b) GDPR where your enquiry concerns entering into or performing a contract with you. For other enquiries, Article 6 (1) (f) GDPR applies; our legitimate interest is to handle communications addressed to us appropriately.

Correspondence is retained while needed to handle the enquiry and any related contractual or legal matters. Data are deleted when no longer needed, unless statutory retention requirements or another lawful reason for retention apply.

This website does not embed Google Analytics, Meta advertising pixels or social-media tracking plugins. Technical access data are processed by the hosting infrastructure as described in section 3; this is separate from the optional external video player described in section 8.

Authentication features in the sign-in and administration area may use cookies or browser storage to establish and protect a session. Public pages do not load the Clerk authentication components. Access to or storage of information on your device that is strictly necessary to provide a service you expressly request is covered by § 25 (2) TDDDG. For non-essential access or storage, § 25 (1) TDDDG requires consent. The GDPR legal bases for the associated processing of personal data are described in the relevant sections.

You can manage cookies and browser storage in your browser settings. Blocking necessary authentication storage may prevent sign-in from functioning.

The “Big Shoulders Display” and “IBM Plex Sans Condensed” fonts are hosted locally. Loading these fonts does not establish a connection to Google Fonts or another external font provider.

Images supplied through our own website and storage are delivered via our hosting infrastructure. Editorial content can also contain images hosted by external providers. When such an image is displayed, its hosting provider receives the technical connection data needed to deliver it, including your IP address and browser information. The legal basis is Article 6 (1) (f) GDPR; our legitimate interest is the presentation of our editorial content.

We display selected public posts from VCO’s Instagram profile. Our server retrieves the posts and their preview images through the Instagram interface and serves cached previews through this website. We do not embed an Instagram iframe or tracking plugin. Loading these previews does not send your browser’s IP address to Instagram; the necessary delivery data are processed by our hosting infrastructure.

The legal basis for presenting these posts is Article 6 (1) (f) GDPR; our legitimate interest is to show current VCO competition and communication content. Public post captions, dates and images are used for this presentation. You do not need to sign in to Instagram to view the previews.

If you follow a post or profile link, Instagram processes data under its own terms. For users in the European Region, the service is provided by Meta Platforms Ireland Limited, Dublin, Ireland. See the Instagram Privacy Policy (opens a new tab).

Some pages offer an optional YouTube player. Before you select “Load YouTube video”, the video feature does not load a player, thumbnail or other resources from YouTube or Google. Its notice is generated locally. You can read the page without loading the video.

By selecting the loading button, you consent to establishing the connection needed to display the video. The legal basis is Article 6 (1) (a) GDPR and, where non-essential device storage or access takes place, § 25 (1) TDDDG. The privacy-enhanced player is loaded from youtube-nocookie.com; playback does not start automatically.

The privacy-enhanced mode is not anonymous. YouTube / Google receives technical data such as your IP address, browser information and the requested video, and may process usage information or use cookies and browser storage when the player is used. If you are signed in to a Google account, Google may associate activity with that account. For users in the EEA, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing can also involve Google entities in the United States.

The loading choice applies only to that video in the current page view. To stop further player activity, leave or reload the page without loading the video again. You can remove any stored provider cookies using your browser settings. Withdrawal does not affect the lawfulness of processing before withdrawal and cannot recall data already transmitted. You can also direct consent-withdrawal requests to our privacy contact.

A direct YouTube link is available as an alternative to the embedded player. See Google’s Privacy Policy (opens a new tab) for information about YouTube processing and privacy settings.

We use Clerk, Inc., United States, for account authentication and session management. Public content can be read without an account. Creating an account does not by itself grant permission to edit this website.

Account and session data can include names, email addresses, user identifiers, authentication information, IP addresses, device information and security logs. Clerk is loaded only when you open the sign-in, account creation or administration area. Technical connections to Clerk can occur there before an active sign-in. Ordinary visits to public pages do not initialise Clerk. Cookies or browser storage may be used to manage and protect authentication sessions.

The legal basis is Article 6 (1) (f) GDPR; our legitimate interest is secure authentication, access control and protection of the administration area. Account data are retained for as long as the account is needed; security and session data may be retained where necessary to protect the service or meet legal obligations. If you choose an external identity provider during sign-in, that provider also processes data according to its own privacy information.

More information is available in Clerk’s Privacy Policy (opens a new tab) and Data Processing Addendum (opens a new tab).

Ordinary links to social profiles, the photo archive, competition websites and other third-party services do not load the linked service merely because the link is displayed. When you follow a link, the target service processes connection data and its own privacy information applies.

If you visit VCO’s profiles on social platforms or interact with their content, the platform operator may process account, communication and usage data. Our influence over that platform processing is limited. This is distinct from the server-delivered Instagram previews and optional YouTube player described above.

Recipients can include our hosting and storage providers, authentication providers and their subprocessors, communication service providers handling your enquiries, and the external services you choose to use. Information may also be disclosed where required by law or necessary to establish, exercise or defend legal claims.

Replit and Clerk are US providers. Their infrastructure or subprocessors can process personal data outside the EU or EEA. International transfers are subject to Articles 44–49 GDPR. The providers’ published processing terms describe transfer mechanisms: Replit’s DPA incorporates European Commission Standard Contractual Clauses; Clerk’s DPA describes the EU–US Data Privacy Framework and Standard Contractual Clauses where applicable.

The provider documents linked above contain further information on those safeguards. You can contact us to request information about the safeguards relevant to your data. External platforms such as Google and Meta describe their own recipients and international processing in their privacy notices. Countries outside the EEA may have different data protection standards, including different rules on access by public authorities.

We retain personal data only while necessary for the purpose for which they were collected, or where statutory retention obligations or the establishment, exercise or defence of legal claims require continued retention. Data are deleted or anonymised once these grounds cease to apply.

For technical logs and security data, the relevant criteria are the need to deliver and protect the service, investigate incidents and comply with the applicable provider retention arrangements. For correspondence, the criteria are the completion of the enquiry and any resulting contractual or statutory obligations. For accounts, the criteria are the duration of the account and any continued security or legal requirements.

Subject to the applicable statutory conditions, you have the following rights:

• Access to your personal data (Article 15 GDPR).
• Rectification of inaccurate or incomplete data (Article 16 GDPR).
• Erasure of your data (Article 17 GDPR).
• Restriction of processing (Article 18 GDPR).
• Data portability (Article 20 GDPR).
• Objection to processing (Article 21 GDPR).
• Withdrawal of consent at any time with future effect (Article 7 (3) GDPR).

Withdrawal does not affect the lawfulness of processing carried out before withdrawal. To exercise your rights, contact dataprotection@vco-esports.com or use the postal address in section 1.

There is no obligation to provide personal data merely to read public content beyond the connection data necessary to deliver it. Information needed to answer an enquiry or authenticate an account is necessary for those respective services. We do not use this website to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Where processing is based on Article 6 (1) (f) GDPR, you may object at any time for reasons relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

If personal data are processed for direct marketing, you may object to that processing at any time. No particular form is required; you can contact the privacy address above.

You have the right to lodge a complaint with a data protection supervisory authority, including in the member state of your habitual residence, place of work or the alleged infringement (Article 77 GDPR).

For VCO as a company based in Bavaria, the competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). Information and its complaint service are available at BayLDA (opens a new tab).

We use HTTPS to encrypt transmission of this website and access controls to restrict its administration functions. No internet service or email transmission can guarantee complete protection against every risk.

We update this notice when the website, the services used or legal requirements change. The version published on this page applies.

Last updated: 2 October 2026.