Privacy Policy
Responsible Body:
One Step Ahead UG (haftungsbeschränkt)
Schlangenstr. 13
33607 Bielefeld
Deutschland
Email: support@thenn-os.de
Management: Marcel Klemme
1. Data Protection at a Glance
General Information
These notices explain how personal data is processed at THENN·OS. Personal data is information relating to an identified or identifiable person.
Data Collection on This Website
Who is responsible for data collection on this website?
One Step Ahead UG (haftungsbeschränkt) is responsible for the processing for its own purposes described here. Its contact details are shown above. Your tennis school is generally responsible for training and participant data; we process it on the school’s instructions.
How do we collect your data?
You provide data to us when, for example, you create an account, send a request or enter a booking.
Necessary technical data is processed for operation and security. Optional analytics starts only with the relevant consent. Individual purposes and conditions are described below.
What do we use your data for?
We process necessary data for access, contract administration and secure operation. Optional analysis of your usage is separate and requires explicit consent. We do not sell your data.
What rights do you have regarding your data?
Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction, data portability and objection. You can withdraw consent at any time with effect for the future. Details and how to lodge a complaint are in the section “Your rights”.
2. Hosting and Content Delivery Networks (CDN)
External Hosting
This website is hosted by external service providers (hosters). The personal data collected on this website is stored on the hosters' servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and other data generated through a website.
Hosting is carried out for the purpose of fulfilling contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of secure, fast, and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR).
We use the following hosters:
- Application Server: STRATO GmbH, Germany
- Database & Cache: Ubicloud (auf Hetzner), Server location: 🇩🇪 Germany
- Email & Domain: ALL-INKL.COM - Neue Medien Münnich, Germany
3. General Information and Mandatory Disclosures
Data Security
Communication between your browser and our production web services is encrypted using HTTPS/TLS.
We use password hashing, HttpOnly cookies for sessions and role-based access checks.
Retention Period & Backups
We keep personal data only for as long as it is needed for its purpose. Necessary consent, withdrawal and privacy notice records are retained during the relevant processing and generally for three full calendar years after the end of the year in which that processing ended. Our own platform contract records are retained during the contract and generally for three full calendar years after the end of its termination year; qualifying commercial or business correspondence is retained for six years after the end of the year of receipt or dispatch. Invoices and accounting vouchers are generally retained for eight years, and accounting books and annual statements for ten years, starting from the applicable statutory date. A minimal record of completed deletion is retained for no more than three years from completion. A specifically applicable longer statutory duty or the necessary preservation of evidence in a documented legal dispute may extend the period for affected records. These records are restricted from other uses. Health values themselves are removed promptly on withdrawal or when their purpose ends. Data belonging to your tennis school is retained under its documented instructions; its return or deletion instruction applies when the processing service ends.
Backup Retention Policy:
After contract termination or account deletion, active data is returned or deleted according to its purpose and the controller's documented instruction. Consent and withdrawal evidence, as well as necessary platform contract and accounting records, may remain separately for their applicable periods. Technically separate backups follow the documented backup cycle; this notice does not promise a blanket period. If data is restored, effective deletions are applied again.
Right to Object (Art. 21 GDPR)
Important Notice:
If we process data under Art. 6(1)(e) or (f) GDPR, you can object at any time on grounds relating to your particular situation. You can object to processing for direct marketing at any time without giving reasons. To do so, write to support@thenn-os.de.Delete Account
Use "Delete account" under Settings → Privacy to request deletion of your active account data. Your account is suspended immediately; you can cancel the request for 14 days. Permanent account deletion can take place afterwards. Health information is removed when you request deletion and is not restored with the account. Statutory records and necessary consent, withdrawal and contract evidence remain separately for limited periods.
4. Data Collection on This Website
Cookies & local storage
Our websites use so-called "cookies" and the local browser storage (LocalStorage).
We use technically necessary cookies/storage entries:
- Access token (in memory): Used for your login and held in the browser's memory.
- HttpOnly Cookies: Used to renew your session (refresh token).
- Persistent login ("Remember me"): When you choose “Remember me”, the refresh cookie uses a rolling lifetime of up to 30 days and an absolute limit of 90 days from sign-in. Without this choice, the browser cookie ends when the browser closes and the server-side session expires after no more than 24 hours.
- thennos_oauth_browser (HttpOnly cookie): Binds your browser to the Google or Apple sign-in you started. The cookie is deleted after the callback and becomes invalid after no more than 10 minutes. For Apple's cross-site POST callback it is set to SameSite=None and Secure.
- thennos_oauth_2fa_handoff (HttpOnly cookie): Takes you from a successful Google or Apple sign-in to the two-factor check already enabled for your account. The cookie is deleted after use and becomes invalid after no more than 5 minutes.
- thennos_cookie_consent_v2 (localStorage): Stores your versioned Google Analytics decision for six months. The entry contains no user ID.
- _ga / _ga_<ID> (cookies): Pseudonymous browser and session identifiers from Google Analytics. Only after consent; expiry no later than 13 months after they are first set.
Legal basis: We use technically necessary cookies and storage entries under Section 25(2)(2) TDDDG. Google Analytics is activated only after your separate consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
5. Product Analytics by THENN·OS
Type and Purpose of Processing
Optional product analytics helps One Step Ahead UG (haftungsbeschränkt) improve usability and technical performance of THENN·OS. It is off by default and starts only after your explicit consent. It then records:
- Active, idle and total usage time and a session identifier held in memory
- Access mode: browser or installed app (PWA)
- Coarse page and interaction events, repeated or unsuccessful clicks and technical timings; no message content, health information or payment details
Controller and distinction from your tennis school
One Step Ahead UG is the controller for this product analytics. Your tennis school receives neither individual records nor personal evaluations from it. It is not used to evaluate playing ability or training performance. It is separate from data processed on behalf of your school; section 2 of the DPA describes the respective roles.
Recipients & Visibility
Only authorized platform administrators at One Step Ahead UG may access these evaluations. No external analytics or advertising services are used for this purpose. Data is stored in the platform infrastructure in Germany, provided by our hosting and database service providers.
Legal Basis & Retention Period
The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. A session identifier is held in your browser memory; server-side events are associated with your user ID and organisation. Events are deleted in the daily cleanup after 90 days. Necessary consent and withdrawal evidence is retained separately under the evidence retention rules above. Necessary security logs are separate.
Voluntary consent and withdrawal
You can give or withdraw consent at any time for the future under Profile settings → Privacy → Product analytics. You can use the app without consenting. Withdrawal stops collection and deletes analytics events associated with your user ID in the current organisation. You can also contact support@thenn-os.de. Optional analytics stays off for minors and accounts without confirmed adult status.
5a. Google Analytics on public pages
Purpose and scope
With your explicit consent, we use Google Analytics 4 to understand how our public pages are used and which predefined demo and contact buttons are clicked. Signed-in areas, automatic app page views, scroll tracking, heatmaps and session recordings are excluded. Google processes in particular:
- Views of explicitly approved public pages with a sanitized page path and page title
- Views of the pricing page and clicks on predefined demo and contact buttons
- Traffic source only when it matches a predefined channel such as Google, LinkedIn or newsletter
- IP address during transmission and the approximate location derived from it. Google states that it does not log or store the IP address
- Device type, operating system, browser, language, screen resolution and timestamp
- Pseudonymous browser and session identifiers in the _ga and _ga_<ID> cookies, plus automatically generated session and interaction metadata
Provider and recipients
The provider and recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data in the United States. Depending on the processing, such transfers are covered by the EU-US Data Privacy Framework and Google's standard contractual clauses. We enable the technical Production gate only after accepting Google's data processing terms and verifying the documented privacy settings.
Excluded data and functions
We send no names, contact details, user or organization IDs, roles, health, family, training, booking, financial, message or form content to Google. Raw URLs, dynamic IDs, tokens, fragments and other URL parameters are not transmitted; only fixed, approved channel values may be derived from UTM source and medium. Google Signals, ads personalization, remarketing, User-ID and Google Ads links remain disabled.
Legal basis, consent and withdrawal
The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. We use Basic Consent Mode: before your consent, the Google Analytics script is not loaded and no Google Analytics request is sent. You can withdraw your decision at any time via ‘Privacy settings’; we then stop collection and delete accessible Google Analytics cookies.
Retention
The _ga and _ga_<ID> cookies expire no later than 13 months after they are first set and are not extended on later visits. Event and user data in Google Analytics is retained for 14 months; the local consent decision for six months.
6. Internal Communication (Messages)
Type and Purpose of Processing
The platform offers an internal messaging function through which coaches, managers, and players within an organization can communicate. The following data is processed:
- Sender and recipient of the message
- Subject and content of the message
- Time of sending and reading
Legal Basis
Processing is based on Art. 6(1)(b) GDPR (contract performance) to enable communication between coaches and players within the context of training operations.
Access by the Operator
The platform operator is entitled to inspect message content and, if necessary, delete it in the event of justified suspicion of violations of the terms of use or reports of illegal content.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse and protecting users from illegal content).
Retention Period
Messages are stored for their communication purpose. School communications follow the documented instructions and privacy notices of the responsible school. Deleting an account does not automatically delete every message for every participant immediately: necessary evidence or other people’s rights may require limited further retention. Erasure requests are assessed under Article 17 GDPR.
7. Special Categories of Personal Data (Art. 9 GDPR)
Type and Purpose of Processing
You can voluntarily provide health information where it is necessary for safely organizing training, for example relevant injuries or allergies.
Processing is carried out exclusively for the following purposes:
- Individual adaptation of training plans to avoid overexertion
- Consideration of health limitations in competition planning
- Emergency management (e.g., allergies for first responders)
Legal Basis
Voluntary health information requires separate explicit consent under Article 9(2)(a) GDPR. For minors, the acting representative’s authority is checked. General use of the platform does not depend on providing voluntary health information.
Circle of Recipients
Access is limited to appropriately authorized people at your school as needed, and to us and appropriately bound service providers to operate the platform under instructions. This does not authorize advertising use or AI training.
Retention Period and Revocation
You can withdraw your consent at any time in your profile settings. After withdrawal or when the training purpose ends, health values are promptly removed from the active data set. Necessary consent and withdrawal records are retained separately during processing and generally for three full calendar years after the end of the year in which processing ended; they contain no health values. The justified exceptions described above apply only to the affected records.
8. Season Surveys
Type and Purpose of Processing
Through public survey links, tennis schools and sports organizations can collect training preferences from their members. The following data is collected:
- Name and email address (for identification and verification)
- Phone number (optional, for follow-up questions)
- Training preferences (preferred days, times, group size, etc.)
- Answers to individual questions from the respective organization
Legal Basis
The responsible tennis school must state its purposes and legal bases in the form. Acknowledging a privacy notice is not consent. Any necessary voluntary consent is obtained separately; health information also requires the relevant additional conditions.
Recipients of Data
The organization offering the survey is the controller. It receives the responses intended for its training planning. THENN·OS processes them on its behalf.
THENN·OS — platform of One Step Ahead UG (haftungsbeschränkt), HRB 46189, Schlangenstraße 13, 33607 Bielefeld, Germany acts as a data processor pursuant to Art. 28 GDPR and provides the technical infrastructure.
Retention Period
The responsible organization determines and explains the retention needed for training planning. You can withdraw consent to that organization at any time for the future. Data based solely on that consent is then deleted unless another legal basis supports limited further retention. Necessary withdrawal evidence is retained separately for a limited period.
Double Opt-In
Where the form requires email verification, we send a confirmation link. Information necessary for that process may be stored temporarily before confirmation.
9. Additional Features & Third Parties
Public trial-session booking
When you request a trial session through a tennis school's public page, that tennis school processes your information as controller. THENN·OS provides the form and appointment management as processor. When embedded, the form is technically loaded from app.thenn-os.de.
Data processed: Name, email address, telephone number, selected appointment and source of the booking link; for children's appointments, the child's name and date of birth are also processed. We also record when you acknowledged the linked privacy information. No public free-text field is provided, and health data is not intended for booking.
Recipients: Authorized staff of the relevant tennis school and One Step Ahead UG (haftungsbeschränkt) as technical processor. Transactional email is sent through All-Inkl in Germany.
Legal basis: Art. 6(1)(b) GDPR for pre-contractual steps taken at your request. Confirming the privacy information records that you have read it; it is not consent to the processing required for booking.
Retention: Unconfirmed requests are deleted automatically 30 days after the confirmation link has expired. For confirmed, cancelled or completed trial sessions, the name, email address, phone number and any child details are deleted 6 months after the appointment; only data without personal reference remains for the tennis school's statistics. If the tennis school transfers your details into a customer account, the retention periods of that account apply from then on. The tennis school can delete your request earlier at any time. Further details are given in the tennis school's linked privacy notice.
No audience measurement in the form: Google Analytics is technically blocked on trial-session pages. We do not store analytics events or analytics session identifiers there. The coarse source of the booking link may be stored as part of the booking.
Optional sign-in with Google or Apple
You may voluntarily sign in with Google or Apple. The buttons are served locally from our server, so no provider connection is made before you choose one. A first-time link is possible only through a personal, time-limited invitation and an exactly matching verified email address. Any two-factor method already enabled for your account remains active.
Data processed: The selected provider processes the authorization data technically required for sign-in, including client ID, callback address, state, nonce and PKCE values, and the openid email scope. THENN·OS receives a stable provider identifier and the verified email address; names and profile data are not requested. We store the provider, a hash of its identifier, linkage and validation timestamps, and Apple's private-email forwarding status. For Apple, the complete token response received after a successful exchange (ID, access and refresh token) is additionally stored together, identity-bound and encrypted with AES-256-GCM. It is used only for the required revocation and daily grant validation and is neither logged nor included in data exports. Google tokens are not stored persistently.
Recipients: Google Ireland Limited or Apple Distribution International Ltd., depending on your selection. The providers process the data for their identity service under their own terms. See the Google Privacy Policy and Apple Privacy Policy for more information.
Legal basis: Art. 6(1)(b) GDPR for providing the sign-in method you selected. The technically necessary short-lived cookies are set under § 25(2)(2) TDDDG. A provider connection is made only after you select the corresponding sign-in option.
International transfers: Google and Apple may also process data outside the European Economic Area, particularly in the United States. Where no adequacy decision applies, the providers describe the safeguards they use in the linked privacy notices, including standard contractual clauses under Art. 46 GDPR.
Retention and revocation: The OAuth attempt becomes invalid after 10 minutes and is then removed by a cleanup running every minute; on callback it is atomically removed before the token exchange. The 2FA handoff expires after no more than 5 minutes. The provider link remains until final account deletion or a revocation reported by the provider. If Apple reports revoked consent or deletion of the Apple Account, we remove the Apple link and its sessions and block further messages to the known relay address. An Apple-only account is also scheduled for local deletion; independently usable password or Google access remains available. A tenant- and user-bound pseudonymous suppression and revocation record is retained only until final local account deletion and is then deleted with it. After your own deletion request, your account is first suspended reversibly for 14 days; only then is the Apple credential revoked with the provider and deleted locally. Apple notification receipts without a user identifier are retained for replay protection for no more than 90 days.
Web Push Notifications
Web push notifications are enabled only after your consent (Article 6(1)(a) GDPR). Delivery uses a technical device endpoint of your browser’s push service, such as Google, Apple or Mozilla. This endpoint is not necessarily anonymous. The service may receive connection data and, depending on the provider, process it outside the EEA. You can disable notifications in browser or device settings. Contact support@thenn-os.de for information about the services and transfer bases used in your case.
Google Fonts (Local)
We have stored fonts locally on our own server. No connection to Google servers takes place.
Email Sending via All-Inkl
For sending transactional emails, we use the SMTP servers of our hoster All-Inkl in Germany. Before dispatch, the email passes through our own automation infrastructure (self-hosted n8n, server location Germany); its execution logs, which contain the email content, are deleted after 7 days. For every email we keep a delivery log with the recipient address, template, time and delivery status. We delete the subject and content of the email from this log after 30 days and the remaining log entry after 12 months.
Payment Processing (Stripe)
We use Stripe (Stripe Payments Europe Ltd., Dublin, Ireland) for payments. When you make a payment, the required payment data is transmitted to Stripe. THENN·OS stores no complete credit card data.
Processed data: Payment processing involves sending Stripe your name, email address, billing address, VAT ID where applicable, and contract, invoice and payment information. You enter the payment details required for your chosen payment method with Stripe.
Recipient: Stripe Payments Europe, Limited, Ireland. Stripe also processes data in the USA. For transfers to Stripe, LLC, its Data Transfers Addendum gives priority to the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses. See Stripe’s privacy notice for further information about recipients and processing purposes.
Legal basis: Art. 6(1)(b) GDPR (contract performance) for payment processing; Art. 6(1)(c) GDPR (legal obligation) for tax-related retention.
Retention: Invoices and accounting vouchers are generally retained for eight years; books and annual accounts for ten years, and commercial correspondence for six years. Periods generally begin at the end of the relevant calendar year. Applicable statutory extensions, for example during tax proceedings, remain possible. Data is deleted once the retention basis no longer applies.
Personal support
You can use the optional support chat to contact the platform operator directly. Without an account, you start the chat by entering your name; contact details for follow-up questions are optional. You receive replies directly in THENN·OS.
Data processed: Message content, timestamps and a session ID. Without an account, also the name required to start the chat and optional contact details; when signed in, the name and email address from your account. In addition, a coarse page path without parameters or identifiers and coarse information on device type, operating system, browser and access mode (browser or installed app). Device type, operating system and browser are derived from the browser identifier; the full browser identifier is not stored for this purpose. The access mode is determined separately by the chat window and transmitted to us. The data is processed in THENN·OS to handle your request. Without an account, after your first successfully sent message your browser stores only the conversation ID in local storage, and our server sets the cookie “support_session_token” (HttpOnly, limited to the support interface) so that only your browser can access the conversation. Your name and contact details are not stored in the browser.
Recipient: The platform operator handles your support requests in THENN·OS.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing efficient customer support). The use of the chat is at your own initiative. We use the conversation ID and the support cookie under Section 25(2) No. 2 TDDDG because they are required for the chat you use.
Retention period: Chat sessions without further activity are archived in THENN·OS after 30 days. Once the last activity is more than 90 days ago, they are deleted in the next daily clean-up. The locally stored conversation ID is valid for at most 30 days from the last successfully sent message; the support cookie expires 30 days after the server issues it and is not extended with every message. You can delete both at any time in your browser settings.
Technical error diagnosis and incident alerting
We process incident data to detect, group and resolve technical errors in the backend and frontend and to alert platform operations quickly. This processing is not used to monitor the performance or behavior of users or coaches.
Processed data: Only for signed-in users, the verified user and organization assignment from the authentication context (user ID, organization ID, role and, where applicable, impersonation status), plus technical metadata such as incident reference/fingerprint, status/code, cleaned path, build, user agent, language, time zone, access mode, viewport and timing data. With a real client error, up to 20 technical breadcrumbs buffered briefly in the browser (up to 5 minutes) may also be sent: coarse page area, generic click/UI action type, and API family, method, outcome/status and duration. No input values, form data, request/response contents, URL parameters or fragments, names, messages or headers are captured. The server validates and reduces these breadcrumbs again before storing them in the incident record. Error message, error name, stack and component-stack data are server-side redacted before storage. Browser reports without verified authentication are not stored as incidents.
Recipients and access: Error details and user associations are accessible only to authorised platform administrators in the internal error overview. For important errors, Telegram receives a general operational notification with a fixed link to the error overview. Incident identifiers, error details and user associations are not sent to Telegram.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operational security, error analysis and rapid remediation); Art. 6(1)(b) GDPR additionally applies to the technical service component.
Retention: Error records are deleted in the daily cleanup after 30 days since their last occurrence.
Sticky Smash
Sticky Smash is a tennis game by THENN·OS. You can play it in three ways: as a guest, with a personal Sticky Smash account or with your THENN·OS login. This section explains which data is processed in each case. The controller is One Step Ahead UG (haftungsbeschränkt), named above.
Playing as a guest
As a guest you do not need an account. Your game progress stays only locally in your browser and is not transmitted to us. It has no fixed retention period; you remove it completely by deleting the site data for the game in your browser. Your local progress will then be lost.
Personal Sticky Smash account (16 and over)
A personal account lets you save your game progress across devices. An account is voluntary and only available from the age of 16. Your year of birth is only checked in your browser; we only receive and store the statement “at least 16 years old”. Younger players play as guests.
Data: your email address as login address, a password verifier (Argon2id hash, never the plain-text password), account and session identifiers, security tokens for sign-in and browser binding, and your game progress (XP, unlocked skins and campaign progress). We do not need your name, phone number, postal address or date of birth for this.
Purpose: We set up your account, sign you in securely, store your game progress and send you the emails required for the account, for example to confirm your address or reset your password. These account emails are not advertising.
Legal basis: Art. 6(1)(b) GDPR for the account, sign-in and game progress; Art. 6(1)(f) GDPR for abuse protection and security logs, based on our legitimate interest in a secure service; Art. 6(1)(c) GDPR in conjunction with Art. 15, 17 and 20 GDPR for export and deletion.
Export and deletion: In your account you can download a JSON export or delete your account after confirming your password. Once deleted, your access ends immediately. An account created later with the same address will not get your old game progress back.
Playing with your THENN·OS login
If you sign in to the game with your THENN·OS login, your game progress is stored by the THENN·OS operator with your THENN·OS profile. Your tennis school cannot see this progress. The legal basis is Art. 6(1)(b) GDPR, providing the game feature you use.
Under Profile → Privacy you can export or delete your game progress. If your tennis school deletes your profile, the game progress stored with it is deleted as well.
Game progress is only stored via your THENN·OS login if your profile contains a date of birth and you are at least 16. No game progress is stored for child or junior profiles. You can play as a guest instead.
Processing on the game server
Abuse protection: When the game checks your sign-in status or starts a sign-in, the game server derives a check value (SHA-256 hash) from your IP address. It uses this value to limit how many browser entries and sign-in attempts can come from one connection. The IP address itself is not stored for this purpose. The check value is deleted together with the browser entry, that is after at most 24 hours without sign-in and, after a sign-in, when the game session ends, at the latest after 30 days. The counters for sign-in attempts use time windows of at most one hour. With further requests, the same check value may be used again. Expired counters are removed by the next successful cleanup run, which takes place every minute. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a secure service.
Recordings of multiplayer matches: The game server technically records every round of an online match in order to investigate connection and display errors. It stores the course of the game, your in-game inputs, the selected skins and rackets, and technical measurements of your view such as ping and positions. The recordings contain no IP addresses, cookies, invitation codes, browser identifiers or freely entered text. They are deleted after at most 7 days, or earlier once the storage limit of 2 GiB is reached. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in stable multiplayer operation.
Cookies and browser storage
For sign-in, sessions and your local game progress we use the following strictly necessary cookies and storage entries. They are not used for advertising or analytics.
__Secure-sticky-browser: Browser binding in the game: 24 hours, after sign-in until the session ends.__Secure-sticky-flow: Assignment of the sign-in process in the game: 10 minutes.__Secure-sticky-session: Game session: at most 30 days; signing out ends it earlier.__Host-thennos-account-browser: Browser binding of the account pages: 24 hours, after sign-in until the session ends, at most 30 days.__Host-thennos-account: Personal account access: 15 minutes, renewable while the session is valid.__Host-thennos-account-refresh: Renewal of access: at most 30 days.stickysmash.account-sync.v1: Local sync of your game progress with the account (localStorage), until you delete the site data.stickysmash.campaign.v1: Local campaign progress (localStorage), until you delete the site data.stickysmash.progression: Local game progress (IndexedDB) with XP, matches played, wins and unlocked skins, until you delete the site data.
Legal basis: These entries are strictly necessary for the service you request (Section 25(2) No. 2 TDDDG).
Retention
The following information on account deletion applies to your personal Sticky Smash account. For your school profile, the procedure described above applies.
- When you delete your account, your login address and password verifier are deleted immediately.
- The remaining account and game data is removed by an automatic clean-up that runs every 10 minutes.
- At THENN·OS, account and game sessions are removed seven days after revocation or the absolute end of the session in the next successful cleanup run. Expired sign-in flows, browser entries and abuse-prevention counters are removed seven days after they expire.
- Separate rules apply on the game server: a cleanup run that takes place every minute deletes ended or expired game sessions as well as expired browser entries, sign-in flows and abuse-prevention counters without any additional period.
- As proof of deletion we keep only the account ID for 400 days, so that we can apply the deletion again after a restore from a backup.
- Database backups are kept for at most 180 days. Other, technically separate backups follow the documented backup cycle. After a restore, deletions made in the meantime are applied again.
- Execution data of our email delivery service is deleted after at most 7 days. Our server's log files and stored security events are deleted by a daily cleanup run after 90 days; only the proof of deletion mentioned above is kept for 400 days. The output logs of the server containers are rotated by size and thus continuously overwritten; there is no fixed period in days for them.
Questions about Sticky Smash and your rights can be sent to support@thenn-os.de. Your rights are also described in the section “Your rights”.
10. Your rights
Access, rectification, erasure and restriction
Subject to the GDPR, you have rights of access (Article 15), rectification (Article 16), erasure (Article 17) and restriction of processing (Article 18), for example while we check accuracy that you have disputed. You also have rights to data portability (Article 20) and objection (Article 21). You can withdraw consent at any time for the future (Article 7(3)); this does not affect the lawfulness of prior processing. Contact support@thenn-os.de. Your school is responsible for data we process on its behalf; we support the school and forward relevant requests. These rights do not expire when your contract ends.
Right to Complain to the Supervisory Authority (Art. 77 GDPR)
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place of the alleged infringement.
Competent Supervisory Authority:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
Website: www.ldi.nrw.de
Right to Data Portability (Art. 20 GDPR)
Under Article 20 GDPR, you can receive and transfer data you provided that is processed automatically on the basis of consent or a contract in a commonly used machine-readable format. An account data export is available in Settings → Privacy → Data export. Contact support@thenn-os.de for further requests.
Last updated: 17 October 2026