Privacy policy

This is a translation for your convenience. The German version is the authoritative one.

1. Controller

Biro Systems UG (haftungsbeschränkt) i.G.
Raiffeisenalle 6a, 82041 Oberhaching, Germany
E-mail: info@tac-spiel-online.de
Web: biro-systems.com

2. General

TAC Online is a browser game. The site uses no analytics or tracking tools, shows no advertising and embeds no third-party content (such as fonts, maps, videos or social media plug-ins). We process personal data only to the extent described below and needed by the game.

3. Hosting and server log files

The game is operated at STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. A data processing agreement under Art. 28 GDPR is in place with the provider.

When the site is accessed, technically necessary data arise (including IP address, date and time, address requested, browser type), which may be recorded in server log files. This serves the secure and stable operation. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the technical provision and security of the service.

4. User account

You need an account to play. We store:

• your user name (visible to other players),
• your e-mail address (not visible to other players),
• your password only as a non-reversible check value (salted scrypt hash), never in plain text,
• the time of registration and whether the e-mail address has been confirmed.

We use the e-mail address only to confirm your account and to let you log in. After registration we send you a single e-mail with a confirmation link that is valid for 48 hours. We send no newsletters or advertising. The legal basis is Art. 6(1)(b) GDPR (providing the game you signed up for).

Your account is kept until you delete it. You can do that yourself at any time in the game: in the account menu at the top right under “Delete account”, confirmed with your password. User name, e-mail address, password check value and all logins are then deleted immediately; in the game statistics your name is replaced by “(gelöscht)”. You can also write us an e-mail to the address above.

5. Cookie and browser storage

After you log in, the game sets exactly one cookie:

• tac-session – keeps you logged in for up to 30 days. It contains only a random identifier, cannot be read by scripts and becomes invalid when you log out.

The game also keeps a few technical details in your browser's storage (local storage and session storage): your user name, the table you are seated at, a random seat identifier per table, your language choice and short-lived notices for the display. These stay in your browser and only serve to put you back in your seat after a reload or a lost connection.

Cookie and browser storage are strictly necessary to operate the game (§ 25(2) no. 2 TDDDG, Germany); consent is not required for them. There are no cookies for analytics or advertising.

6. Playing

While you play, your browser sends your moves to the server over an encrypted connection. Your user name is visible to all logged-in players: in the overview of waiting rooms and running games, at the table and to spectators.

The server stores the state of tables and games so that a game can continue after an interruption, and keeps a log of the moves of each game with the user names. The logs are used for troubleshooting and are deleted automatically after 30 days. The legal basis is Art. 6(1)(b) GDPR and, for troubleshooting, Art. 6(1)(f) GDPR.

7. Game statistics

For each finished game we store the user names of those involved, the result and counters about the course of the game (for example cards played). This produces the statistics you can open in the game. Other logged-in players can also view a player's statistics. The legal basis is Art. 6(1)(b) GDPR.

8. Error reports and wishes

Through the account menu you can report an error or send us a wish. We then store your text together with your user name, the time and the table you are currently at, and also receive the report by e-mail. We use this only to find the error or consider the wish. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving the game. Please do not put confidential information into a report.

9. Recipients

We do not pass your data on to third parties. Only we have access, together with the hosting provider and the e-mail service used to send the confirmation e-mail, both acting as processors. Data are not transferred to countries outside the EU.

10. Contacting us by e-mail

If you write to us, we process the details you give (for example name, e-mail address, content of the message) to deal with your request. The legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR. The data are deleted as soon as they are no longer needed and no statutory retention duties apply.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6(1)(f) GDPR (Art. 21). To exercise them, contact the address above.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the one responsible for our seat: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

12. Encryption

The game is delivered exclusively over an encrypted connection (HTTPS/TLS).

As of: October 2026