Privacy Policy

1. Controller

ZR Consulting, Christophstr. 5, 80538 Munich, Germany — represented by Zoran Roso. Contact: info@achievo.gg. Full details in the Imprint.

2. What Achievo does

Achievo runs achievement campaigns for games: you sign in with a gaming identity, complete quests (e.g. wishlist a game, watch a trailer, answer a quiz, scan a QR code at an event booth) and earn points and rewards. To verify quests we need to process certain data about your linked gaming accounts.

3. Data we process

Account & sign-in. When you sign in via Steam, Discord, Google, Twitch, Xbox (Microsoft) or Epic Games we receive and store: the provider's user ID, your display name / username, avatar URL and — depending on the provider — your e-mail address. We never receive your passwords. Legal basis: performance of contract (Art. 6 (1) b GDPR).

Quest verification. Depending on the quests of a campaign we query, via the provider's official APIs: Steam wishlist status, game ownership, playtime and in-game achievements for the campaign's games; Discord server membership for the campaign's server; video-watch progress; quiz, poll and prediction answers; referral counts; QR-scan events; and content you actively submit for UGC quests (images/videos with an optional note). Legal basis: performance of contract (Art. 6 (1) b GDPR).

Profile & preferences. Points, unlocked quests, reward claims, decorations, and — if you complete the optional onboarding questionnaire — your genre, platform and play-frequency preferences and favourite games. Preferences drive recommendations and are used in anonymized, aggregated audience statistics for campaign partners; partners never receive your identity. Legal basis: contract and, for the questionnaire, consent (Art. 6 (1) a GDPR), revocable in your profile.

First-party analytics. Campaign pages measure views, sessions and clicks with an anonymous, cookie-free beacon operated by us. No cross-site tracking, no advertising profiles. Legal basis: legitimate interest (Art. 6 (1) f GDPR) in measuring campaign performance.

Third-party campaign tags. Individual campaign pages may embed third-party tags of the campaign's publisher (e.g. Google Analytics 4, Meta Pixel, TikTok Pixel). These only load after you accept them via the consent bar on that page (Art. 6 (1) a GDPR; § 25 TDDDG). You can decline; the page works fully without them.

Payments (business customers). Publishers, agencies and companies paying for campaign packages or promotional bookings are processed by Stripe Payments Europe Ltd. (Ireland); we receive payment status and invoicing data, never full card numbers. Legal basis: contract and legal obligations (Art. 6 (1) b, c GDPR — e.g. tax retention periods).

E-mail. Transactional e-mails (team invites, approvals, receipts) are sent via Resend. If you subscribe to a newsletter, you can unsubscribe at any time.

4. Processors & hosting

We use Supabase (database, authentication, file storage — hosted in the EU, eu-central-1/Frankfurt), Vercel Inc. (web hosting/CDN, USA), Stripe (payments), Resend (e-mail) and DeepL SE (machine translation of campaign content, no player data). Where processors operate outside the EU/EEA, transfers are safeguarded by EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. Quest verification necessarily involves requests to the respective platform's API (Valve, Discord, Google, Twitch, Microsoft, Epic) under that platform's own privacy policy.

5. Retention

Account and campaign data are kept while your account exists; you can delete your account at any time in your profile, which removes or anonymizes your personal data. UGC submissions are deleted after campaign review cycles end. Payment and invoicing records are retained for the statutory commercial and tax periods (up to 10 years, §§ 147 AO, 257 HGB). Anonymous analytics contain no personal data and are kept indefinitely.

6. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and to withdraw any consent with effect for the future. Contact us at the address in section 1. You may also lodge a complaint with a supervisory authority; competent for us is the Bavarian Data Protection Authority (BayLDA, Ansbach).

7. Minors

Achievo is intended for users aged 16 and over. We do not knowingly process data of younger children; sign-in requires an account with one of the supported platforms, which apply their own age rules.

8. Changes

We will update this policy when the platform's data processing changes and adjust the effective date above. Material changes are announced on the portal.

Also available: Imprint / Impressum