This is a translation. The German version is the binding one.
Privacy Notice for the Anime Kultur Account
This is a translation. The German version is the binding one.
STATUS: DRAFT of 2026-09-29, third revision. Not approved. Have it reviewed by a lawyer before publication.
Version: 2026-10-01
This notice explains which data we process for the Anime Kultur Account, what we do it for and which rights you have. For the individual services you sign in to with your account, their own privacy notices apply.
1. Who Is Responsible
Responsible for the processing of your data in the Anime Kultur Account is
Anime Kultur e.V.
Wattstr. 59
12459 Berlin
Represented by the board: Michael Klement, Abdulkadir Aslan, Cuong Tran
Phone: +49 (0)30 530 27 210
E-mail: info@animekultur.de
For all questions about data protection and for exercising your rights, you can reach us at: info@animekultur.de
2. How the Account Is Structured
Anime Kultur e.V. manages your sign-in centrally. Some of the services you sign in to are operated by other companies, for example by AKV Events GmbH. These companies are legally separate from the association.
- The association stores only what is needed for your sign-in.
- A service stores only what it needs for its purpose, for example your orders. Its operator is responsible for that itself.
- No service knows your password.
3. Which Data We Process
3.1 Data You Give Us
| Data | Required | Purpose |
|---|---|---|
| E-mail address | yes | Sign-in, confirmation, password reset, important notices about the account |
| Password | yes | Sign-in. We store it only as a non-reversible hash and cannot read it ourselves |
| Username | no | Sign-in with username, display in services |
| First name, last name | no | Form of address and prefilling in services |
| Date of birth | no | Checking age limits in services |
| Profile picture | no | Display in services |
| Preferred language | derived from the language in which you register and sign in | Display and e-mails in your language. Services receive it only with your consent, like the other profile data |
| Time zone | derived from your browser's setting at registration and sign-in, changeable in the profile | Times in e-mails and in the account in your time zone. Services receive it only with your consent, like the other profile data |
3.2 Data That Arises During Use
| Data | Purpose | Retention period |
|---|---|---|
| Time and version of your consent to the Terms of Use | Proof of the conclusion of the contract | until the account is deleted, then 3 years from the end of the year of deletion |
| Your consents to the transfer of data to services: service, operator, released data, time | Proof, display under "Connected services" | until the account is deleted, then 3 years from the end of the year of deletion |
| Signed-in devices: name of the device, IP address at sign-in, time of last use, service | Display under "Signed in at" in your account, signing out individual devices and services, detecting stolen sign-ins | until sign-out, at most 30 days after the last use |
| Settings per service, for example light or dark display | Each service shows you your choice, also on another device | until you change them or delete the account |
| Failed sign-ins: IP address, time, encrypted identifier of the login name | Protection against trying out passwords | 15 minutes, deletion at the latest one hour afterwards |
| One-time links from e-mails | Confirmation of the e-mail address and of a new e-mail address (24 hours), password reset (60 minutes), cancelling a deletion (7 days) | until expiry or use, deletion at the latest one hour afterwards |
| Settings for two-factor authentication: secret of the authenticator app (encrypted), backup codes (only as a checksum), switch for the code by e-mail | Protection of your account | until you remove them or delete the account |
| Passkeys: public key, identifier, counter, the name you assign, type of device | Sign-in with passkey, also without a password | until you remove the passkey or delete the account |
| Short-lived verification values (challenges) for passkeys and started sign-ins via Discord, with IP address and name of the device | each response from your device or from the provider is valid only once | 5 or 10 minutes respectively, deletion at the latest one hour afterwards |
| Identifier of your account at Discord | Sign-in via Discord, on request transfer to services like the other profile data | until you remove the link or delete the account |
| Time and type of each successful sign-in with IP address, device and service | Tracing in case of abuse, help for support | 7 days, like the server logs |
| Actions of our admins on your account, e.g. blocking or resetting two-factor authentication, with time and acting person | Proof that our admins do not abuse their rights | 1 year |
| Requirement of two-factor authentication by a service | Protection of accounts with special roles | until the service withdraws it |
| Server logs with time, IP address, requested address and error message | Operation, troubleshooting, detecting attacks | 7 days. If there are indications of an attack or abuse, we keep the affected entries for up to 30 days. If the investigation takes longer, we extend this period |
| Figures without reference to a person, e.g. sign-ins per day | Evaluation of utilisation | unlimited, because they do not identify any person |
We do not create usage profiles and do not use your data for advertising.
When there are changes to the security of your account, for example to two-factor authentication, to your passkeys or when resetting the password, we send you a notice by e-mail. This way you notice if someone else has been at your account. These e-mails cannot be unsubscribed from; they are part of the protection of the account.
4. Legal Bases
| Processing | Legal basis |
|---|---|
| Provision of the account, sign-in, e-mails about the account | Art. 6 para. 1 letter b GDPR, performance of the contract for the account |
| Transfer of profile data to services of other companies | Art. 6 para. 1 letter a GDPR, your consent on the consent screen |
| Sign-in via Google, Discord or Apple | Art. 6 para. 1 letter a GDPR, your consent by choosing this sign-in |
| Protection against abuse, blocking after failed attempts, detecting stolen sign-ins, server logs | Art. 6 para. 1 letter f GDPR, our legitimate interest in secure operation |
| Retention of evidence | Art. 6 para. 1 letter f GDPR, our legitimate interest in defending against and enforcing claims |
| Fulfilment of legal obligations | Art. 6 para. 1 letter c GDPR |
You can withdraw a consent at any time with effect for the future.
5. Transfer to Services
5.1When you sign in to a service with your account, this service receives a unique identifier of your account and the information whether and how strongly your sign-in was additionally secured.
5.2If another company operates the service, we show you before the first sign-in which company that is and which further data it receives, for example your e-mail address. We only transmit this data once you agree. Each service receives only the data it needs for its purpose.
5.3If a service later requires further data, we ask you again.
5.4You can see your consents in your account under "Connected services". There you can revoke them at any time. After the revocation we no longer transmit any data to the service and end your sign-in there.
5.5Data that a service has already received is held by its operator. The operator is responsible for it itself. Whether and when it deletes the data is stated in its privacy notice. You can also exercise your rights directly towards the operator.
5.6No service receives your password.
6. Service Providers
We use service providers that process data on our behalf and according to our instructions. AKV Events GmbH operates the account for us. For this purpose it uses further service providers with our consent. Data processing agreements are in place with all of them.
| Service provider | Task | Data |
|---|---|---|
| AKV Events GmbH, Helmholtzstr. 23, 12459 Berlin, Germany | Technical implementation and operation of the account | all data of the account |
| OVH GmbH, Oskar-Jäger-Straße 173/K6, 50825 Köln, Germany. Location of the server: Roubaix, France | Operation of the servers, on behalf of AKV Events GmbH | all data of the account |
| Positive Group Deutschland GmbH (rapidmail), Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau, Germany | Sending of e-mails, on behalf of AKV Events GmbH | e-mail address, content of the e-mail |
All data of the account is processed in the European Union.
Checking new passwords against known data breaches. When you set or change a password, we check whether it appears in known data breaches at other services. For this we use the "Pwned Passwords" service of Have I Been Pwned (Superlative Enterprises Pty Ltd, Australia). Your password never leaves our server: we compute a hash of the password and send only its first five characters. The service replies with a few hundred possible hash remainders, and the comparison takes place on our server. The service learns neither your password nor your name, your e-mail address or your IP address; it only sees the address of our server. No personal data is transferred. The legal basis is our legitimate interest in the security of your account (Art. 6(1)(f) GDPR). If the service is unavailable, the check is skipped.
7. Sign-In via Google, Discord or Apple
7.1Instead of using a password, you can sign in via an account at Discord, and later also at Google or Apple. This is voluntary.
7.2If you choose this sign-in, we redirect you to the respective provider. You sign in there. We do not learn your password at the provider.
7.3From the provider we receive a unique identifier of your account there and your e-mail address confirmed there. We store the identifier so that we recognise you at the next sign-in. If you do not have an account yet, we create it with this e-mail address and still ask you for a confirmation by e-mail. If the address belongs to an existing account, we only link the two once you sign in with your password.
7.4The provider learns that and when you sign in with us. What it does with this information is stated in its privacy notice.
| Provider | Company |
|---|---|
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland | |
| Discord | Discord Netherlands B.V., Schiphol Boulevard 195, 1118 BG Schiphol, Niederlande |
| Apple | Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Irland |
7.5The providers belong to companies based in the USA. It is possible that data is also processed there. Discord Inc. is certified under the EU-US Data Privacy Framework, checked on 13/10/2026. For Google and Apple we check this before introducing the sign-in and complete this paragraph.
7.6You can remove a link at any time in your account. Set a password beforehand so that you can continue to sign in.
8. Cookies
On account.animekultur.de we use only cookies that are technically necessary. They serve neither analysis nor advertising. No consent is required for them. We do not embed any content from third-party servers.
| Cookie | Purpose | Duration |
|---|---|---|
| Session | keeps you signed in during the sign-in and afterwards in your profile, signed, readable only by our server | 30 minutes during a sign-in, in the profile until sign-out, at most 30 days |
| Language | remembers the language you chose | one year |
| Display | remembers whether you chose the light or the dark display | one year |
9. How Long We Store Your Data
9.1We store the data of your account as long as the account exists.
9.2When you delete your account, we delete your data. Excluded is data that we must retain due to legal obligations or that we need as evidence. We delete this data after the respective period has expired.
9.3Accounts whose e-mail address is not confirmed are deleted after 7 days.
9.4We create backups of our database. They are kept for 30 days. For that long, deleted data may still be contained in them. We use backups only to restore data after a disruption.
9.5When you delete your account, you confirm this with your password and, if set up, with your second factor. After that we end all your sign-ins, and all services of the association immediately hide your data. You then have a reflection period of 7 days. During this time you can reverse the deletion via the link in our e-mail or by signing in again. After the 7 days we instruct each service to delete your data. Data that an operator must retain by law, for example invoices, is blocked by the operator for any other use and deleted after the statutory period has expired. As soon as all services have confirmed the deletion, we delete your account. The same reflection period applies if you only have your data deleted at a single service. Your account then remains in place.
9.6After the deletion, only a record of the deletion remains with us: your former identifier, the times, which services have deleted, and the evidence of your consents to the Terms of Use and to the transfer of your data. This record contains neither your name nor your e-mail address. We keep it for 3 years from the end of the year of deletion in order to be able to defend against claims (Art. 17 para. 3 letter e GDPR).
9.7In justified cases, for example in the case of unlawful content or at your express request to our support, an administrator can skip the reflection period and have your account deleted immediately. We will inform you about this by e-mail.
10. Are You Obliged to Give Us Data
Without an e-mail address and a password we cannot create an account for you. All other details are voluntary.
11. Your Rights
You have the right
- to obtain information about your data (Art. 15 GDPR),
- to have incorrect data rectified (Art. 16 GDPR),
- to have your data erased (Art. 17 GDPR),
- to have the processing restricted (Art. 18 GDPR),
- to receive your data in a common format (Art. 20 GDPR),
- to object to the processing as far as it is based on our legitimate interest (Art. 21 GDPR),
- to withdraw a consent at any time for the future (Art. 7 para. 3 GDPR).
Write to us at info@animekultur.de for this. We reply without undue delay, at the latest within one month (Art. 12(3) GDPR).
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
12. Automated Decisions
We do not make decisions that are carried out exclusively by automated means and have legal consequences for you. The temporary block of sign-in after too many failed attempts ends by itself. A human always decides on the blocking of an account.
13. Changes to This Notice
We adapt this notice when our processing or the legal situation changes. You can find the current version at account.animekultur.de. We will inform you about material changes by e-mail.
Version of 2026-10-01