Privacy Policy

Privacy Policy

Last updated: October 18, 2026

Andreea Grigore und Andrei Grigore GbR (“us”, “we”, or “our”) operates the website theinfernalist.com (the “Website”). This Privacy Policy explains which personal data we process when you visit the Website or contact us, why we do so, on which legal basis, and which rights you have under the EU General Data Protection Regulation (GDPR) and German data protection law.

We do not sell your personal data, and we do not use or share it with anyone except as described in this Privacy Policy.

1. Data Controller

The controller within the meaning of Art. 4 No. 7 GDPR is:

Andreea Grigore und Andrei Grigore GbR
Am Klosterberg 19
86678 Ehingen
Germany
Email: info@grigoregbr.de

Further details are in our Imprint. We are not required to appoint a data protection officer.

2. What Personal Data Is

Under Art. 4 No. 1 GDPR, personal data is any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

3. Overview: What We Collect

Information you give us. If you contact us by email or through our contact form, we process the information you provide, usually:

    • Name
    • Email address
    • The content of your message, and any other details you choose to include (for example hardware and software information when you report a technical problem)

Information collected automatically (“Device Information”). When you visit the Website, certain technical information is processed, such as:

  • Your IP address
  • Information about your web browser and operating system
  • Date and time of access, and your time zone
  • The pages you view
  • The website or search terms that referred you to the Website (referrer)
  • Information about cookies and similar technologies stored by your browser

Some of this information is technically necessary to show you the Website. Anything beyond that (statistics and embedded videos) is only collected if you consent (see sections 7 and 8).

You are not legally or contractually required to provide personal data. Without the technically necessary Device Information, however, we cannot display the Website, and without your contact details we cannot answer your enquiry. We do not use automated decision making or profiling within the meaning of Art. 22 GDPR.

4. Legal Bases

We process personal data on the following legal bases:

  • Your consent (Art. 6 (1) lit. a GDPR)
  • Performance of a contract or steps taken at your request before entering into a contract (Art. 6 (1) lit. b GDPR)
  • Compliance with a legal obligation (Art. 6 (1) lit. c GDPR)
  • Our legitimate interests (Art. 6 (1) lit. f GDPR), which we name in each section below

Storing information on your device, or accessing information already stored there (for example cookies or local storage), only takes place with your consent under § 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), unless it is strictly necessary to provide the Website you have requested (§ 25 (2) No. 2 TDDDG).

5. Hosting and Server Log Files

Where we store data. The Website is hosted by our hosting provider Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany (privacy policy). The Website and its data are stored on servers in a Contabo data center in the EU (Lauterbourg, France). We have concluded a data processing agreement with Contabo in accordance with Art. 28 GDPR.

Access logs. Each time the Website is accessed, the server automatically records general log data (“server logs”): the IP address, date and time of access, the requested page or file, the referrer URL, the browser type and version, the operating system, and the amount of data transferred. Without this data it would in some cases be technically impossible to deliver the Website. The data is also needed for security purposes, in particular to detect and investigate attacks or misuse.

Error logs. If a technical error occurs, an error log is created with similar data (including the IP address and the time of the error), so that we can identify and fix problems with displaying the Website as quickly as possible.

Legal basis: Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the secure, stable, and error free operation of the Website. Retention: log files are deleted after 7 days at the latest, unless a specific security incident requires us to keep individual entries longer as evidence. You have the right to object to this processing (see section 16).

6. Cookies and Similar Technologies

Cookies are small text files that your browser stores on your device. Similar technologies, such as local storage, work in a comparable way. We distinguish between:

  • Strictly necessary cookies, which are required for the Website to work or to remember your consent choices. They are used without consent under § 25 (2) No. 2 TDDDG.
  • Statistics and marketing cookies, which are only set after you have given your consent under § 25 (1) TDDDG and Art. 6 (1) lit. a GDPR.

A complete list of the cookies we use, with their names and storage periods, is on our Cookie Policy page. You can also set your browser to refuse cookies or to notify you when a cookie is set. If you block all cookies, some parts of the Website may not work properly.

Consent management (Complianz). We use the WordPress plugin Complianz to ask for and record your consent. Your choices are stored in cookies on your device (for example cmplz_consented_services, cmplz_statistics, cmplz_marketing, cmplz_banner-status) for up to 365 days. This data is not sent to Complianz or any other third party. Legal basis: Art. 6 (1) lit. c GDPR in conjunction with Art. 7 (1) GDPR (we must be able to show that consent was given), and § 25 (2) No. 2 TDDDG.

WordPress. If you log in to the administration area (only relevant for us as site operators), WordPress sets technically necessary cookies such as wordpress_test_cookie and wordpress_logged_in_*. Ordinary visitors are not affected.

Fonts. All fonts used on the Website are hosted locally on our own server. No connection to Google or any other font provider is made to load fonts.

Withdrawing or changing your consent. You can withdraw or change your consent at any time with effect for the future by clicking the “Manage consent” button at the bottom of every page, or in the consent section of our Cookie Policy. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

7. Web Analytics: Google Analytics 4

If you have consented to the “Statistics” category, we use Google Analytics 4, a web analytics service. The provider for users in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Scope of processing. Google Analytics uses cookies (_ga and _ga_*, stored for up to 2 years) that allow us to analyse how the Website is used. The following data is collected:

  • The pages you visit and how you navigate the Website
  • Interactions such as scrolling, clicks on external links (including clicks on links to our Steam store page, which we measure as a separate “steam_click” event), file downloads, video engagement, and site searches
  • Approximate location (country, region, city)
  • Technical information about your browser and device (for example language settings, screen resolution, operating system)
  • The referrer URL (the website that sent you to us)
  • Date and time of your visit

Google Analytics 4 does not log or store IP addresses. For visitors from the EU, the IP address is used only briefly to derive approximate location data and is then discarded.

We have switched off Google Signals and the sharing of Analytics data with other Google products and services. We do not use Google Analytics for advertising, remarketing, or personalised ads.

Purpose. On our behalf, Google uses this information to evaluate your pseudonymous use of the Website and to compile reports on Website activity. We use these reports to understand which content is of interest to visitors and to improve the Website.

Recipient. Google Ireland Limited acts as our processor. We have accepted Google’s data processing terms in accordance with Art. 28 GDPR.

Transfer to third countries. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on July 10, 2023 (Art. 45 GDPR).

Retention. Event data linked to cookies or user identifiers is automatically deleted after 14 months.

Legal basis and withdrawal. The legal basis is your consent under Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. You can withdraw your consent at any time with effect for the future via the “Manage consent” button. You can also prevent collection by Google Analytics by installing Google’s browser add-on.

More information: Google Analytics terms and Google privacy policy.

8. Embedded YouTube Videos

We embed videos from YouTube on the Website. The provider for users in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The videos are blocked by default and replaced by a placeholder image stored on our server. A video is only loaded after you have consented to the “Marketing” category or clicked the placeholder to accept it. Only then does your browser connect to YouTube’s servers. Your IP address, device and browser information, and the page you are visiting are transmitted to Google, and YouTube may set cookies on your device (for example YSC, VISITOR_INFO1_LIVE, PREF). If you are logged in to a Google account, YouTube may link your viewing to that account. Google processes this data under its own responsibility.

Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Legal basis: your consent under Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. You can withdraw it at any time via the “Manage consent” button. More information: Google privacy policy.

9. Login Security: Jetpack Brute Force Protection

To protect the Website against automated attacks on the login page, we use the brute force protection feature of the WordPress plugin Jetpack. The provider is Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA; for users in Europe, Aut O’Mattic A8C Ireland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland.

When someone tries to log in to the administration area, the IP address of that login attempt (and technical details of the request) is sent to Automattic’s servers and checked against a database of known malicious IP addresses, so that suspicious attempts can be blocked. Ordinary visitors who do not attempt to log in are not affected. Jetpack’s statistics feature (Jetpack Stats) is switched off.

Data may be transferred to Automattic Inc. in the USA. Automattic Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Legal basis: Art. 6 (1) lit. f GDPR. Our legitimate interest lies in protecting the Website and its data against unauthorised access. You have the right to object (see section 16). More information: Automattic privacy policy.

10. Contact by Email or Contact Form

Business inquiries and feedback. If you contact us by email or through the contact form on our Imprint page, we process the information you provide (usually your name, email address, and message, plus a phone number if you choose to give one) in order to handle your enquiry and get back to you.

The contact form is provided by Jetpack Forms. Submissions are stored in the database of our own website on Contabo’s servers in the EU (France) and are forwarded to us by email. We do not use reCAPTCHA.

Technical customer support. If you report a technical problem with our game or the Website, additional hardware and software information you send us (for example your operating system, graphics card, or error messages) helps us recreate the problem, provide in depth technical support (for example after a crash or error), and respond to your enquiry.

Legal basis: Art. 6 (1) lit. b GDPR if your enquiry relates to a contract or to steps before entering into a contract; otherwise Art. 6 (1) lit. f GDPR, our legitimate interest in answering enquiries and supporting players. Retention: we delete your data once your enquiry has been fully handled, unless statutory retention obligations apply (for example under German commercial and tax law, §§ 147 AO and 257 HGB, for business correspondence). Contact form submissions are deleted from the website database after 6 months at the latest.

11. Recipients and Service Providers

We use carefully selected service providers to operate the Website. They only receive personal data to the extent necessary for their task, and processors may only use it on our instructions (Art. 28 GDPR). The recipients are:

  • Contabo GmbH (hosting, servers in the EU), see section 5
  • Google Ireland Limited / Google LLC (Google Analytics and YouTube, only with your consent), see sections 7 and 8
  • Automattic (Jetpack login protection), see sections 9 and 10

We will also disclose personal data where we are legally required to do so, for example to authorities or courts (Art. 6 (1) lit. c GDPR).

12. Transfers to Third Countries

Some of the services listed above are provided by companies in the USA. For companies certified under the EU-US Data Privacy Framework, the European Commission has adopted an adequacy decision (July 10, 2023), so transfers to them are based on Art. 45 GDPR. Google LLC and Automattic Inc. are certified. Where a recipient is not certified, transfers take place only on the basis of the EU Standard Contractual Clauses (Art. 46 (2) lit. c GDPR).

13. How Long We Store Personal Data

We store personal data only for as long as necessary for the purposes described in this policy. The specific periods are stated in each section above (server logs: 7 days; Google Analytics: 14 months; consent cookies: up to 365 days). In addition, there may be minimum retention periods stipulated by applicable law (for example commercial and tax law), which we have to comply with. Once these periods expire, the data is deleted.

14. Links to Other Sites

The Website contains links to websites that we do not operate, for example our Steam store page (Valve), our Discord server, our Kickstarter campaign, and our support page on Buy Me a Coffee. These are plain links: no data is transmitted to these providers when you merely view our Website. Only when you click a link are you taken to the third party’s site, which then processes your data under its own responsibility.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third party sites or services. We strongly advise you to review the privacy policy of every site you visit.

15. Social Media

Andreea Grigore und Andrei Grigore GbR maintains an online presence for the game The Infernalist on various social media platforms, including X, YouTube, Facebook, Instagram, Reddit, Minds, and Discord. The Website only links to these profiles; no social media plugins, embedded posts, or tracking pixels are used on the Website.

Any information you disclose on those platforms is public information, and you should be careful when deciding to share personal information there. When you visit our profiles, the platform operators process your data under their own privacy policies. For our Facebook and Instagram pages, we and Meta Platforms Ireland Limited are jointly responsible for the statistics (“Page Insights”) that Meta provides to page operators (Art. 26 GDPR); details are in Meta’s Page Insights Controller Addendum. You can also contact us with questions about our profiles.

16. Your Rights

You have the following rights regarding your personal data:

  • Access (Art. 15 GDPR): to request confirmation whether we process your data and a copy of it, including the purposes, recipients or categories of recipients, and storage period
  • Rectification (Art. 16 GDPR): to have incorrect data corrected or incomplete data completed
  • Erasure (Art. 17 GDPR): to have your data deleted, as far as no legal obligation requires us to keep it
  • Restriction of processing (Art. 18 GDPR): to have the processing of your data restricted
  • Data portability (Art. 20 GDPR): to receive data you provided to us in a structured, commonly used, machine readable format, or to have it transmitted to another controller
  • Withdrawal of consent (Art. 7 (3) GDPR): to withdraw any consent you have given at any time with effect for the future; for cookies, use the “Manage consent” button
  • Objection (Art. 21 GDPR): see the highlighted notice below
  • Complaint to a supervisory authority (Art. 77 GDPR): see below

To exercise any of these rights, please send an email to info@grigoregbr.de. This is free of charge.

Right to object (Art. 21 GDPR)

Where we process your personal data on the basis of our legitimate interests (Art. 6 (1) lit. f GDPR), for example server log files, login protection, or answering enquiries, you have the right to object to this processing at any time, on grounds relating to your particular situation. We will then no longer process your data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise, or defence of legal claims. To object, simply email info@grigoregbr.de.

Right to lodge a complaint. You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
https://www.lda.bayern.de

17. Do Not Track

Please note that the Website does not change its data collection practices in response to a Do Not Track signal from your browser. Statistics and marketing technologies are only used if you give your consent in our cookie banner.

18. Security

We use technical and organisational measures to protect your personal data, including encrypted transmission (HTTPS) for the entire Website. However, no method of transmission over the Internet or method of electronic storage is 100% secure, so we cannot guarantee absolute security.

19. Children’s Privacy

The Website is not directed at children under the age of 16 (“Children”).

We do not knowingly collect personal data from children under 16. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that a child under 16 has provided us with personal data, we will delete it immediately.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example when we change the Website or when the law changes. The current version is always available on this page, with the date of the last update shown at the top. We recommend reviewing this Privacy Policy periodically.

21. Contact Us

If you have any questions about this Privacy Policy or about how we handle your data, please contact us:

Andreea Grigore und Andrei Grigore GbR
Am Klosterberg 19, 86678 Ehingen, Germany
Email: info@grigoregbr.de