Privacy Notice

1. General and Scope of Application

In this data protection notice, we would like to inform you about which personal data we collect and how we use and share this data when you visit our website, register for the challenges, or participate in other activities, such as sweepstakes, from medion.

2. Controller

The controller is medion GmbH, Am Zehnthof 77, 45307 Essen.
You can also contact the data protection officer via the e-mail address: datenschutz@medion.com

3. Categories of processed data and purposes of processing:

We collect, store, and process the following categories of personal data:

When registering and participating in challenges

• Name
• Date of birth
• Email address
• Discord profile (optional)
• Phone number
• Address
• Nickname / Username
• Steam name / PS name (for online participation)
• Password

When registering for the newsletter

• Email
• Name
• Date of birth
• Phone number (when registering for the WhatsApp newsletter)

When participating in sweepstakes (e.g. collection of experience points or Erazer Coins for redemption in the Erazer Reward Shop)

• Name
• Date of birth
• E-mail address
• Phone number
• Address

When logging in/registering Erazer profile

• Name
• Date of birth
• Email address
• Nickname / Username
• Password

The following briefly explains why we collect the aforementioned data:

First and last name: 
First and last name are used for the clear assignment of all other data. This also allows us to ensure that only natural persons are active as users and participate in the activities. Furthermore, we want to make sure that players always participate in compliance with the rules and exclude players from registering multiple times under different pseudonyms.

Nickname / Username: 
The nickname is your freely chosen pseudonym. It is fully visible to all other users and thus the name under which you appear publicly. The choice of nickname should comply with good manners and not violate legal provisions (e.g. it must not be discriminatory towards others). If this is not the case, the user’s account may be blocked.

Discord Username: 
You can enter your Discord username in your user profile. If this is the case, you will receive access via the Discord link to the official ERAZER Discord and will have access to the corresponding exclusive information and communication channels. For challenge support, it is also important that we can quickly and easily identify which player we are communicating with. Your Discord username is fully visible to all other users.

Discord Inc. is a company based in the USA that operates the communication platform Discord. As already mentioned, we use Discord as our main communication medium for the Challenge YR2V. The interface with Discord allows us to automatically link accounts on our website with the corresponding Discord profiles. In this context, we refer to the privacy notices of Discord, which apply if you want to use their services: https://discord.com/privacy

Epic Name: 
To track your participation in the YR2V Challenge, you must provide your "Epic Name". This refers to the unique username associated with the Epic Games account. It serves as player identification in multiplayer games and on the Epic Games platform, similar to a gamertag. Your Epic Name is fully visible to all other users.

Date of Birth: 
This is primarily used to verify age for games with age restrictions or to check eligibility to participate in activities. The date of birth is also used for statistical evaluations.

Phone Number: 
The telephone number is optional and serves communication regarding the activities, e.g. for relevant information or check-in requests.

Password: 
For your registration or user account, you set a password that gives you exclusive access to your user profile and protects it from access by third parties. This password is not known to us; it is stored in encrypted form in our databases.

After creating a user account, you also have the option to change or reset your password.

Email Address: 
The e-mail address is required to register for activities, newsletter, or create the account and is used for account-related communication, e.g. to reset the password or verify the account.

Image and video recordings as part of the YR2V tournament series 

As part of participation in the YR2V Challenge as well as the associated live final, we create image and video recordings of the participants. These recordings include, among others, game scenes, livestreams, webcam recordings, and group photos. They serve tournament documentation and public relations (e.g. highlight clips, social media).

Processing is based on Art. 6 (1) lit. f GDPR (legitimate interest). For targeted individual recordings, a separate consent will be obtained if required in accordance with Art. 6 (1) lit. a GDPR.

4. Legal Bases

The legal basis for the processing of your data is the GDPR, in particular:

• Art. 6 I a. GDPR, insofar as we have your consent to process personal data for specific purposes (e.g. registration for the newsletter or medion Challenge, analysis of data for marketing purposes), the lawfulness of this processing is based on your consent. The given consent can be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of the data processed up to the withdrawal.
• Art. 6 I b. GDPR, insofar as processing is necessary for carrying out the marketing campaign and for the performance of our contractual obligations.
• Art. 6 I f. GDPR: we process your data on the basis of our legitimate interests. These include the provision of services or information you request, the execution of technical and administrative functions of the website, the management of your user account and associated settings, the sharing of information with organizers of the challenge or service providers for the challenge you participate in, and contacting you regarding your participation in the challenge.

5. Recipients

Recipients of your personal data are exclusively those employees of the company who need this information to perform their duties or to handle the specific activity (need-to-know principle).

Affiliated companies as well as service providers, vicarious agents, and partners selected and commissioned by us (who, for example, support us in carrying out the activity, logistics companies, IT service providers, web hosting, technical service providers) may also receive data for these purposes.

medion GmbH has taken all necessary legal and contractual measures to ensure the protection of your personal data within the framework of the legal provisions.

6. Data Transfers to Third Countries or International Organizations

We generally process your personal data only within the EU. A data transfer to entities in countries outside the European Union (so-called third countries) only takes place insofar as it is necessary for the execution of your orders, is required by law, or you have given us your consent. However, medion uses service providers for certain tasks who in turn may use service providers that have their headquarters, parent company, or data centers in a third country. According to Art. 45 GDPR, transfer is permissible if the European Commission has decided that a third country ensures an adequate level of protection. We comply with these requirements and ensure that your data is only transferred to countries that provide an adequate level of data protection or where we have agreed on appropriate safeguards for the protection of your data. For this purpose, we mainly use standard contractual clauses if no adequacy decision is available.

7. Retention Periods

Personal data will be stored as long as the purpose requires it, we are legally obliged to retain it, or other legal reasons justify further processing. Personal data will be deleted as soon as the purpose of processing ceases to exist or a reason for erasure pursuant to Art. 17 (1) GDPR applies (e.g. withdrawal of a given consent) and no exception to the erasure obligation pursuant to Art. 17 (3) GDPR applies.

8. Your Rights as a Data Subject

According to the GDPR, you as a data subject are entitled to the following rights:

• Right to information (Art. 15 GDPR):
  You have the right to request confirmation as to whether personal data concerning you is being processed; if this is the case, you have the right to information about this personal data and to the information specified in detail in Art. 15 GDPR.
• Right to rectification (Art. 16 GDPR):
  You have the right to request the rectification of inaccurate personal data concerning you and, where applicable, the completion of incomplete data without undue delay.
• Right to erasure (Art. 17 GDPR):
  You have the right to request the erasure of your personal data without undue delay, provided that one of the reasons listed in detail in Art. 17 GDPR applies.
• Right to restriction of processing (Art. 18 GDPR):
  You have the right to request the restriction of processing if one of the conditions listed in Art. 18 GDPR applies, e.g., if you have objected to processing, for the duration of the verification by the controller.
• Right to data portability (Art. 20 GDPR):
  In certain cases listed in detail in Art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format and the right to have this data transmitted to another controller.
• Right to object (Art. 21 GDPR):
  If data is collected on the basis of Art. 6 (1) f) (data processing for the protection of legitimate interests), you have the right to object to the processing at any time for reasons arising from your particular situation. We will then no longer process the personal data, unless there are demonstrably compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR):
  According to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your data violates data protection regulations.

9. Withdrawal of consent

You can withdraw your consent to the processing of personal data at any time with effect for the future. Please note that the withdrawal only applies to the future. Processing carried out before the withdrawal is not affected.

10. Obligation to provide data

You are neither legally nor contractually obliged to provide us with personal data. However, if you wish to use our services, the provision of personal data may be necessary for the performance of the contract. Without this data, we may not be able to provide the desired service.

11. Cookies

We use cookies on our website. Cookies are small text files that are stored on your device (PC, smartphone, tablet, etc.). They help us to make our services more user-friendly, effective, and secure.

Cookies serve different purposes. Some cookies are necessary to ensure the basic functionality of the website (so-called "essential cookies"). Other cookies allow us to analyze user behavior or to display personalized advertising.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies in certain cases or in general, and activate the automatic deletion of cookies when closing the browser.

Please note: Disabling cookies may limit the functionality of this website.

12. Web analytics services

To improve and optimize our offers, we use web analysis tools. These tools allow us to evaluate user behavior and gain valuable information for the further development of our website and our services.

13. Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyze your use of our website.
The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. We use IP anonymization, so your IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA.

Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. Google uses this information on our behalf to evaluate your use of the website, compile reports on website activity, and provide us with other services related to website and internet usage.

The IP address transmitted by your browser within the scope of Google Analytics is not merged with other data from Google.

You can prevent the storage of cookies by selecting the appropriate settings in your browser software; however, please note that in this case, you may not be able to use all functions of this website to their full extent.

You can also prevent the collection of data generated by the cookie and related to your use of the website (incl. your IP address) by Google as well as the processing of this data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout.
 

For more information on terms of use and data protection, please visit:
https://marketingplatform.google.com/about/analytics/terms/us/ 
https://policies.google.com/privacy?hl=en 

14. Google Tag Manager

We use the Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a solution that allows marketers to manage website tags via an interface. The Tag Manager itself (which implements the tags) is a cookie-less domain and does not collect any personal data.

The tool ensures the triggering of other tags, which in turn may collect data. Google Tag Manager does not access this data. If deactivation has been carried out at the domain or cookie level, it remains in place for all tracking tags implemented with Google Tag Manager.

15. Google Ads

We use Google Ads from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ads is an online advertising program that enables us to place advertisements in the Google search engine and the Google advertising network.

Within Google Ads, we use conversion tracking. When you click on an ad placed by Google, a conversion tracking cookie is set. These cookies lose their validity after 30 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the ad and was redirected to this page.

Each Google Ads customer receives a different cookie. The cookies cannot be tracked across the websites of Google Ads customers. The information collected with the help of the conversion cookie is used to create conversion statistics for Google Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information with which users can be personally identified.

If you do not wish to participate in tracking, you can object to this use by deactivating the Google conversion tracking cookie via your internet browser under user settings. You will then not be included in the conversion tracking statistics.

More information on Google Ads and Google conversion tracking can be found in Google's privacy policy: https://policies.google.com/privacy

16. ActiveAgent

We use Active Agent, a service of ADITION technologies AG, Oststraße 55, 40211 Düsseldorf, Germany. Active Agent serves us as a Demand Side Platform (DSP).

Information processed includes: internet connection (internet provider, connection speed, latency), browser (type, version, language, and information about how the browser handles cookies), device (operating system, language settings, brand, device identification numbers, mobile advertising ID, and device IP address), visited website/app (type and category of website, domain or app name, technical information about the website including referrer URL, and date/time of visit), user behavior on the website (viewed content, duration of view, apps used), advertising media (which ads were displayed, whether the advertisement was clicked, the advertiser’s website visited, or the advertised app downloaded), user decisions regarding processing operations, and location information.

Data processing, including setting cookies, is carried out with your consent based on Art. 6 (1) lit. a GDPR. You may revoke your consent at any time without affecting the lawfulness of the processing carried out based on consent prior to the revocation.

More information can be found at: https://www.adition.com/datenschutz-plattform/

17. Facebook

This is a tracking technology offered by Meta and used by other Meta services such as Facebook Custom Audiences. It is used to track interactions of visitors with websites (“events”) after they click on an ad displayed on Facebook or other services provided by Meta (“conversion”).

Processing companies: 
Meta Platforms Ireland Ltd. 
4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland
Data Protection Officer

Data Processing Purposes:

• Marketing
• Retargeting
• Tracking acceptance
• Analytics
• Advertising
• Conversion tracking
• Personalization

Used technologies: 
This list contains all technologies used by this service to collect data. Typical technologies are cookies and pixels placed in the browser.

• Cookies
• Data attributes
• Pixel-specific data: HTTP header & optional parameters

Collected data: 
This list contains all (personal) data collected by or through this service:

• Facebook User ID
• Browser information
• Usage data
• Device information
• Device Operating system
• Device ID
• Non-sensitive custom data
• Referrer URL
• Pixel ID
• Location information
• Pixel-specific data
• User behavior
• Viewed ads
• Viewed content
• Interactions with ads, services, and products
• Clicked elements
• Marketing information
• IP address
• Visited pages
• Facebook cookie information
• Usage/click behavior
• User Agent

Legal Basis: 
Art. 6(1)(a) GDPR — Consent

Place of Processing: 
European Union

Retention Period: 
Data will be deleted as soon as it is no longer required for processing purposes. Interactions recorded on websites are stored for no longer than two years.

Transfer to Third Countries: 
Data may be transferred to countries that do not provide adequate data protection, e.g.

• Singapore
• United States of America
• United Kingdom

Data Recipients:

• Meta Platforms Ireland Ltd.
• Meta Platforms Inc.

Data Protection Officer Contact: 
https://www.facebook.com/help/contact/1650115808681298

Additional information and opt-out:

• Opt-out link: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen
• Privacy policy: https://www.facebook.com/privacy/explanation
• Cookie policy: https://www.facebook.com/policies/cookies

Joint responsibility:

According to Art. 26 GDPR, we and Meta Platforms Ireland Ltd. are jointly responsible for the processing of your data. The essential agreement can be accessed here: https://www.facebook.com/legal/controller_addendum 

18. Reddit

We use a conversion tracking and remarketing tool, the Reddit Conversion Pixel, provided by Reddit Inc., 548 Market St. #16093 San Francisco, California 94104, USA. For Europe, Reddit Ireland Limited (Reddit EU Data Inquiries, 70 Sir John Rogerson's Quay, Dublin 2, Ireland) is responsible.

The Reddit pixel allows Reddit to determine you as a target audience for displaying ads (so-called “Reddit Ads”) through your visit to our online offer. The collected information is transmitted to Reddit (“Customer Audiences”). The data collected is anonymous and does not allow conclusions about the identity of users.

The use of the Reddit pixel and storage of “conversion cookies” only takes place if you have consented to the use of cookies and similar procedures. The legal basis is Art. 6 (1) a and Art. 49 (1) a GDPR. You may revoke your consent at any time.

More information on the use of cookies by Reddit Ads: 
https://www.redditinc.com/policies/cookies

Data processing by Reddit: 
https://www.redditinc.com/policies/privacy-policy

19. Amazon

Amazon Europe Core SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg processes your personal data based on your consent via the Amazon Advertising Pixel for campaign reports, conversion tracking, click events, and targeted advertising outside our websites (retargeting).

We do not receive personal data from Amazon but only anonymized campaign reports on website audiences and ad performance. You can opt out of interest-based ads from Amazon via:

• Amazon ad preferences: https://advertising.amazon.com/legal/ad-preferences?ref=a20m_us_fnav_l_adprf
• Digital Advertising Alliance: https://optout.aboutads.info/?c=2&lang=EN
• Your Online Choices: https://www.youronlinechoices.com

More information: https://www.amazon.com/gp/help/customer/display.html?no-deId=GX7NJQ4ZB8MHFRNJ

20. Outbrain

This website uses technology from Outbrain Inc. (“Outbrain”, 39 W 13th Street, New York, NY 10011, USA). This enables targeted advertising to internet users who have already shown interest in our offerings on partner pages or allows the collection of data.

The technology relies on cookie-based analysis of user behavior. Ads appear only on Outbrain ad spaces, either on Outbrain Engage or the Outbrain Extended Network. You can opt-out at: https://www.outbrain.com/legal/privacy#privacy-policy

21. Taboola

This website uses Taboola’s Content Discovery Technology to recommend further online content that may interest you. Taboola collects information about your device and behavior on this website (and other partner sites) via cookies and similar technologies.

More information: https://www.taboola.com/de/policies/datenschutzerklaerung

Opt-out: https://accessrequest.taboola.com/access

22. Ad Up

Tracking from Ad Up, a technology and service provider of Axel Springer Teaser Ad GmbH, is integrated on our websites. It collects anonymized and/or pseudonymized data to allow interest-based advertising.

Ad Up uses cookies for conversion tracking to evaluate ad and keyword effectiveness.

More information: https://www.adup-tech.com/datenschutz/

Opt-out: Use the “Activate Opt-Out Cookie” button on the website to deactivate Ad Up cookies in your browser.

23. TikTok Pixel
We use the TikTok Pixel from TikTok Technology Limited for analyzing and optimizing advertising campaigns. According to Art. 26 GDPR, we and TikTok are joint controllers.

Legal basis: Your consent according to Art. 6 (1) a GDPR.

TikTok receives data collected by the pixel (e.g., IP addresses and usage behavior). Data may also be transferred to third countries (e.g., USA, China). TikTok uses standard contractual clauses to ensure an adequate level of data protection.
More information on data processing, legal basis, and your rights: TikTok Privacy Policy
Contact TikTok DPO: https://www.tiktok.com/legal/report/DPO/en 

Date: September 2025