Legal · GDPR
Privacy
Last updated · 13.10.2026
This privacy policy explains which personal data NovaCry processes when you visit novacry.com or book a lesson, why, and what rights you have. We process personal data in line with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Austrian Data Protection Act (DSG).
1. Controller
Andi Löscher, trading as NovaCryAm Ring 7, 8010 Graz, Austria
Email: novacryofficial@gmail.com
Phone: +43 660 5765331
We have not appointed a data protection officer, as we are not required to.
2. What we process, why, and on which legal basis
Visiting the website
When you open a page, the server receives the data your browser sends automatically: IP address, date and time, the page requested, referrer, browser type and operating system. This is needed to deliver the site, keep it secure and defend it against attacks. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
Our own pages set no cookies and use no tracking or advertising tools. The one exception is the booking calendar, described below. Fonts are hosted on our own server, so no font provider receives your data.
Booking a lesson
Bookings run through TidyCal. The booking calendar on our home page loads automatically when you scroll towards the booking section, so you can see available times without an extra click. It loads TidyCal’s widget script from its content delivery network (bunny.net), which receives your IP address. When the calendar loads or you book, TidyCal processes your IP address, your name, email address, the time you choose and anything you write in the booking form. Inside the calendar, TidyCal also loads its own tools, currently Google Tag Manager, Microsoft Clarity (usage analytics) and Stripe, and may set cookies. TidyCal is responsible for these; see the TidyCal privacy policy.
Showing the calendar is based on our legitimate interest in offering online booking without extra steps (Art. 6(1)(f) GDPR). We use the booking data to schedule and hold your lesson and to contact you about it. Legal basis: performance of a contract and steps before entering into one (Art. 6(1)(b) GDPR). Name and email address are required to book; without them we cannot provide the lesson.
Payments
If you pay during booking, the payment is processed by Stripe, the payment provider in the booking form. We receive the payment confirmation, but never your full card or account details. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legal obligation to keep accounting records (Art. 6(1)(c) GDPR).
Lessons
For the lesson itself we process what you share with us: your in-game name, gameplay recordings (VODs), and notes on your progress. Lessons take place online via a voice and screen-sharing service we agree on with you (usually Discord). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Contacting us
If you use our contact form, email us or message us on Discord, we process your message and contact details to answer you. Messages from the contact form are delivered to our inbox by Brevo. The form is protected against spam by Cloudflare Turnstile, which checks your browser and IP address when the contact page loads; it sets no tracking cookies. Legal basis: performance of a contract or steps before one (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
Usage statistics
We count page views with Umami, a cookieless analytics tool. It records the page, referrer, browser, device type and country, but sets no cookies and does not store your IP address, so you cannot be identified or followed across sites. Legal basis: our legitimate interest in understanding which pages are used (Art. 6(1)(f) GDPR).
We do not use automated decision-making or profiling.
3. Processors and recipients
We only share personal data with service providers that need it for the purposes above. Each processes it under a data processing agreement (Art. 28 GDPR) or as an independent controller under its own privacy policy.
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery, security, spam protection (Turnstile) | USA / global |
| TidyCal | Booking calendar and booking emails | USA |
| BunnyWay d.o.o. (bunny.net) | Delivers TidyCal’s widget script | EU (Slovenia) / global |
| Stripe Payments Europe Ltd. | Payment processing | EU (Ireland) / USA |
| Google Ireland Ltd. (Gmail) | EU / USA | |
| Discord Inc. | Voice and screen sharing during lessons | USA |
| Sendinblue SAS (Brevo) | Delivering contact-form messages | EU (France) |
| Umami | Cookieless usage statistics | EU |
We also pass data to public authorities or our tax advisor where the law requires it.
4. Transfers outside the EU
Some providers above process data in the USA. Transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, where the provider is certified, or otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
5. How long we keep data
- Booking, payment and invoice records: seven years, as required by Austrian tax law (§ 132 BAO).
- Lesson material (VODs, notes): until our lessons have ended, then deleted within six months unless you ask us to keep it.
- Messages: as long as needed to deal with your enquiry, then deleted unless they belong to a contract.
- Server logs: kept by Cloudflare for a short period for security purposes.
6. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). Where processing is based on your consent, you can withdraw it at any time without affecting what happened before.
To exercise your rights, email novacryofficial@gmail.com.
You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.
7. Children
Our lessons are aimed at players aged 16 and over. If you are younger, please book with the consent of a parent or guardian.
8. Links to other sites
Our site links to YouTube and Discord. These links are plain links: nothing loads from those services until you follow them, and their own privacy policies then apply.
9. Changes
We update this policy when our services or the law change. The date at the top shows the current version.