Updated: July 2026
This Privacy Policy explains which personal data is processed when you visit and use our websites, newsletter functions, game information, user accounts, support services and community features.
This Privacy Policy applies in particular to:
This Privacy Policy will be updated accordingly when technical features are expanded, new services are introduced or the providers we use change.
The controller responsible for data processing is:
Özgür Ergezgin
acting under the business name Upgrade Force Systems
Kollwitzstr. 76
10435 Berlin
Germany
Email: [email protected]
The following additional email address is available for player support relating to Legends Unchained®:
We process personal data only to the extent necessary to provide our websites, manage newsletter subscriptions, handle enquiries, provide user accounts, maintain account security, conduct game and support communications, provide community features or safeguard legitimate interests.
Personal data means any information relating to an identified or identifiable natural person. This may include in particular:
We take care to process only the data required for the relevant purpose.
Our websites are provided through Cloudflare Pages.
The provider is:
Cloudflare, Inc.
101 Townsend St
San Francisco, CA 94107
USA
When our websites are accessed, Cloudflare may process technically necessary data. This may include in particular:
This processing takes place in order to deliver our websites technically, ensure their security and stability, detect attacks, prevent misuse and ensure reliable operation.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in providing our websites securely, reliably and efficiently.
Cloudflare may also process data outside the European Union or the European Economic Area, particularly in the USA. According to Cloudflare, it uses appropriate safeguards for such transfers, in particular standard contractual clauses or other transfer mechanisms provided for by law.
Further information about data processing by Cloudflare can be found in Cloudflare’s Privacy Policy:
https://www.cloudflare.com/privacypolicy/
Information about data processing on our behalf by Cloudflare can be found here:
https://www.cloudflare.com/cloudflare-customer-dpa/
We store our own server logs only to the extent technically necessary or required for security, error analysis and the prevention of misuse. The retention period depends on technical requirements, security purposes and legal obligations. Data is processed only for as long as necessary for the purposes stated.
If you contact us by email, we process the data you provide. This may include in particular:
The data is processed in order to handle and respond to your enquiry.
For general business enquiries, processing is based, depending on the content of the enquiry, on Article 6(1)(b) GDPR if the enquiry relates to a contract or pre-contractual measures, or on Article 6(1)(f) GDPR if there is a legitimate interest in handling the enquiry.
For support enquiries relating to Legends Unchained®, processing takes place in order to handle the relevant support matter, analyse errors, communicate with the user and ensure the proper operation of the game.
The data is deleted once the enquiry has been fully resolved and there are no statutory retention obligations or legitimate reasons for further storage.
Where contact forms, support forms, error reports or similar input options are offered on our websites, we process the data entered there in order to handle the relevant enquiry.
This may include in particular:
The data is processed in order to handle the enquiry. Depending on the content of the enquiry, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR.
Our legitimate interest lies in handling enquiries, analysing errors, improving our services and preventing misuse.
Our websites may offer the option to subscribe to newsletters.
These may include the following newsletters in particular:
The newsletter may be integrated in particular on the “Games” subpage of upgradeforcesystems.de and on legendsunchained.de.
For newsletter subscriptions, we process in particular:
Subscription takes place using a double opt-in procedure. This means that after entering your email address, you receive an email containing a confirmation link. Your email address is added to the active newsletter distribution list only after you confirm this link.
Processing is based on your consent under Article 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future. You can use the unsubscribe link in every newsletter email or send us a message at [email protected].
Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
Where a game reward, bonus, gold, in-game benefit or similar promotion is offered for subscribing to the newsletter, additional data may be processed in order to verify eligibility and prevent rewards from being granted more than once.
This may include in particular:
Processing takes place in order to run the relevant promotion and correctly assign the reward to the game account.
The legal basis is Article 6(1)(b) GDPR insofar as processing is necessary to run the promotion or provide the reward. Insofar as processing serves to prevent misuse, the legal basis is Article 6(1)(f) GDPR.
Our legitimate interest lies in preventing multiple subscriptions, fraud and unauthorised rewards.
Consent to receive the newsletter remains voluntary. A 50 Gold or other newsletter reward earned after successful double opt-in remains redeemable even if you unsubscribe later; rewards already granted will not be withdrawn.
We use Resend for the email transport and technical delivery of our newsletters.
The provider is:
Resend (Plus Five Five, Inc.)
2261 Market Street #5039
San Francisco, CA 94114
USA
Resend is used exclusively for email transport and technical delivery and acts as our processor. We manage records of consent and recipient, subscription, confirmation and unsubscribe statuses ourselves using Supabase; Resend does not manage this data.
In this context, Resend may process the following data in particular:
Open and click tracking is currently disabled.
Processing is based on your consent under Article 6(1)(a) GDPR and is also carried out for the technical delivery of the newsletter.
We have entered into a data processing agreement with Resend under Article 28 GDPR. As the provider is a US company, personal data may be processed in, accessed from or transferred to the USA. The data processing agreement and the EU Standard Contractual Clauses (EU SCCs) included in it serve as safeguards. Our selected sending region of Ireland does not necessarily exclude access from or transfers to the USA.
Further information about data processing by Resend can be found here:
Privacy Policy: https://resend.com/legal/privacy-policy
DPA: https://resend.com/legal/dpa
Where newsletter analytics features are used, we may be able to determine whether a newsletter was opened and which links were clicked. This helps us improve our newsletters and make their content more relevant.
The following data may be processed in particular:
Where personalised newsletter analytics features are used, this takes place only on the basis of your consent under Article 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future, in particular by unsubscribing from the newsletter.
Where no personalised newsletter analytics are used, only technically necessary delivery information is processed, for example whether an email was delivered or rejected.
Where user accounts, registrations, beta access or game accounts are offered on legendsunchained.de or within Legends Unchained®, we process the data required to create and manage the account.
This may include in particular:
Passwords are not stored in plain text. They are protected using appropriate technical methods.
Processing takes place in order to create, manage and use the user account and to provide the game and community features.
The legal basis is Article 6(1)(b) GDPR insofar as processing is necessary to provide the user account and game services. Insofar as data is processed for security, the prevention of misuse and error analysis, the legal basis is Article 6(1)(f) GDPR.
Where user profiles, public profiles or community features are offered, players may voluntarily provide additional information about themselves.
This may include in particular:
Providing this information is voluntary. It is used to design the player profile, provide community features and display information voluntarily selected by the player to other players.
Where profile details are made public, they can be seen by other players and visitors. Therefore, please do not provide any information that should not be publicly visible.
Processing is based on Article 6(1)(b) GDPR insofar as the information is required to use profile or community features. Where information is entirely voluntary, processing is based on your consent under Article 6(1)(a) GDPR or on your requested use of the relevant profile feature.
You can generally change or delete voluntary profile details yourself where the feature technically allows this. Alternatively, you can contact us to request a change or deletion.
Our profile fields, biography features and community areas are not intended to collect special categories of personal data.
Please do not enter particularly sensitive data in profiles, biography text, messages, clan descriptions or public areas, especially information about:
If such information is nevertheless published or submitted voluntarily, we may remove or restrict it in the interests of community safety, moderation or account management.
Where rankings, clan lists, PvP results or public profiles are offered, certain game-related information may be displayed publicly.
This may include in particular:
We do not generally publish email addresses, IP addresses, passwords, 2FA data or security-related account data in public rankings.
Processing takes place in order to provide the game and competition features.
The legal basis is Article 6(1)(b) GDPR insofar as public rankings and game displays form part of the game. There is also a legitimate interest under Article 6(1)(f) GDPR in transparent and fair competition features.
Where Legends Unchained® offers game-related features, data required to provide the game, save game progress, display rankings and manage game mechanics may be processed.
This may include in particular:
Processing takes place in order to provide the game services, display rankings, manage progress and rewards, enforce game rules, analyse errors and prevent misuse.
The legal basis is Article 6(1)(b) GDPR insofar as processing is necessary to provide the game. For security, fairness and measures to prevent misuse, the legal basis is Article 6(1)(f) GDPR.
Where community features are offered, users may create content or interact with other users.
This may include in particular:
Public content may be visible to other users or visitors. Private messages or non-public content are not displayed publicly, but may be processed in connection with support, reports of misuse, security checks or legal obligations.
Processing takes place in order to provide community features, moderate content, enforce rules and prevent misuse.
The legal basis is Article 6(1)(b) GDPR insofar as processing forms part of the community feature. For moderation, the protection of other users and the prevention of misuse, the legal basis is Article 6(1)(f) GDPR.
Where user accounts, logins or protected areas are offered, strictly necessary cookies, session tokens or comparable technologies may be used.
Their purposes include in particular:
Strictly necessary cookies and comparable technologies are used only to the extent required to operate the service.
The legal basis for the associated data processing is Article 6(1)(b) GDPR insofar as it is necessary for the performance of a contract, and Article 6(1)(f) GDPR insofar as we have a legitimate interest in a secure and functional service.
Where two-factor authentication is offered or used, we process the data required to set up, use and manage two-factor authentication.
Depending on the method selected, this may include:
Two-factor authentication serves to protect your account against unauthorised access.
The legal basis is Article 6(1)(b) GDPR insofar as two-factor authentication forms part of the account and security features. There is also a legitimate interest under Article 6(1)(f) GDPR in the security of user accounts, game progress, rankings, rewards and personal data.
Recovery codes and 2FA secrets are processed using technical safeguards.
If you use password recovery, we process the data required to reset the password securely.
This may include in particular:
Password reset tokens are valid for a limited time and are invalidated after they expire or are used.
Processing takes place in order to restore access to the account and protect the user account.
The legal basis is Article 6(1)(b) GDPR insofar as processing is necessary to manage the user account. Insofar as security logs are processed, the legal basis is Article 6(1)(f) GDPR.
Technical security data may be processed in order to protect our websites, user accounts and game systems.
This may include in particular:
Processing takes place in order to detect and prevent attacks, fraud, spam, manipulation, unauthorised access, account misuse and technical faults.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the security, stability and integrity of our systems, websites, game accounts, rankings and community features.
If you contact support or report an error, we process the information you provide.
This may include in particular:
Processing takes place in order to handle your enquiry, analyse errors, improve the game and communicate with you.
The legal basis is Article 6(1)(b) GDPR insofar as the enquiry relates to a user account, game service or contract. Otherwise, the legal basis is Article 6(1)(f) GDPR.
Please do not submit particularly sensitive data to support unless it is required to handle your enquiry.
Where beta registration, pre-registration or a waiting list is offered, we process the data required to manage that registration.
This may include in particular:
Processing takes place in order to manage the beta registration or pre-registration, communicate about the launch, allocate access and provide information about relevant updates.
The legal basis is Article 6(1)(b) GDPR insofar as registration serves to take pre-contractual measures or provide access.
Where newsletters or promotional information are also sent, this takes place only on the basis of your consent under Article 6(1)(a) GDPR.
At present, no payments are processed through our websites unless expressly stated otherwise.
If paid content, subscriptions, in-game purchases, supporter packages or other payment features are offered in the future, this Privacy Policy will be supplemented in advance.
It will then include in particular information about the payment service providers used, payment data processed, legal bases, recipients and retention periods.
Our websites may contain links to external websites, social media profiles or other services, for example:
Simply visiting our websites does not transmit data to these providers through ordinary external links. Data processing by external providers begins only when you click the relevant link and open the external website.
From that point onwards, the privacy policies of the relevant provider apply.
We currently do not use active social media plugins that transmit data to social networks as soon as our websites load, unless expressly indicated otherwise.
If embedded videos, social media feeds, tracking pixels or similar external content are used in the future, this Privacy Policy will be updated accordingly. Where consent is required, it will be obtained before activation.
At present, our websites use only strictly necessary cookies, session tokens or comparable technologies where required for login, security, language settings, form protection or proper operation.
We do not use non-essential cookies for advertising, tracking or personalised analytics without prior consent.
If analytics, marketing or tracking technologies are used in the future, this will take place only after appropriate information has been provided and, where required, consent has been obtained.
At present, the following tracking or advertising technologies are not used unless expressly stated otherwise:
If such services are integrated in the future, this Privacy Policy will be supplemented in advance and any required consent will be obtained.
Personal data may be transferred to technical service providers where this is necessary to operate our websites, newsletters, game services, support features, community features or security features.
Recipients may include in particular:
Personal data is not disclosed for advertising purposes or sold.
Where service providers process personal data on our behalf, corresponding data processing agreements are concluded or the service provider’s relevant data processing terms are incorporated into the contract.
In individual cases, personal data may be processed outside the European Union or the European Economic Area, particularly where service providers used by us are established or have technical infrastructure in third countries.
In such cases, we ensure that appropriate safeguards are in place, for example:
This applies in particular to internationally active infrastructure providers such as Cloudflare.
We store personal data only for as long as necessary for the relevant purpose or where statutory retention obligations apply.
For newsletter data:
Newsletter data is stored for as long as you remain subscribed to the newsletter. After you unsubscribe, the data is deleted or blocked unless further storage is required to demonstrate consent or defend against claims.
For user accounts:
Account data is generally stored for as long as the user account exists. After the account is deleted, personal data is deleted or anonymised unless legal obligations or legitimate reasons require further storage.
For voluntary profile details:
Voluntary profile details and biography text are generally stored for as long as the profile exists or until you delete the information yourself or request its deletion, unless legitimate reasons require further storage.
For support enquiries:
Support data is deleted once the enquiry has been fully resolved, unless statutory retention obligations or legitimate interests require further storage.
For security logs:
Security logs are stored only for as long as necessary to detect, investigate and prevent misuse, attacks or technical faults.
For game and ranking data:
Game-related data is stored for the duration of the user account or for as long as necessary for game operation, fairness, rankings, reward management or the traceability of game events.
When you visit our websites, technically necessary access data is processed so that the websites can be delivered.
Subscribing to the newsletter is voluntary. However, a newsletter cannot be sent without an email address.
Creating a user account is voluntary unless it is required for particular areas of the game. Without the necessary account data, certain features, game areas or support services cannot be used.
Voluntary profile details such as a biography, favourite country, favourite food or age group are optional. The game can generally be used without this information unless it is required for a specific optional community feature.
Activating two-factor authentication is voluntary unless it is required for certain features for security reasons.
No automated decision-making, including profiling within the meaning of Article 22 GDPR, currently takes place.
Where automated security mechanisms are used, for example to detect unusual login attempts or prevent spam, they serve technical security purposes and do not lead to legal or similarly significant decisions without further review.
Our services are not specifically directed at children under the age of 16.
If you are under 16, you should submit personal data, in particular newsletter subscriptions, user account registrations, profile details or support enquiries, only with the consent of your parent or legal guardian.
If we become aware that a child’s personal data has been processed without the required consent, we will delete that data unless there is a legal obligation to retain it.
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.
These may include in particular:
Within the scope of the legal requirements, data subjects have the following rights:
To exercise these rights, it is sufficient to send a message to:
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.
This applies in particular to:
Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
Where personal data is processed on the basis of Article 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.
If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for processing or the processing serves the establishment, exercise or defence of legal claims.
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.
The competent authority for Berlin in particular is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
Germany
Email: [email protected]
We may amend this Privacy Policy if technical features, services used, legal requirements or organisational processes change.
The current version is available on our websites.