The short version
As long as you do not consent to advertising, this site behaves like this: no advertising cookies, no connection to ad networks, no external fonts, no external analytics service. One technically necessary cookie from the security network in front of the site is still set — see below. There is no user account, no contact form and no newsletter. A cookie-free reach measurement of our own does run — what it counts is described below.
If you do consent, the ad network Adsterra loads advertising and may set cookies and process data about you. What exactly is described below. You can withdraw your consent with one click at any time — the "Cookie settings" link sits in the footer of every page.
The legal pages themselves (legal notice, this policy) are excluded from advertising: nobody should be tracked while reading how their data is processed.
Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Nikolas Gottschalk
Sonnenhof 150
53119 Bonn
Deutschland
Email: contact@azerothbase.com
Server log files
When you open this site, your browser automatically transmits data that the hosting provider stores in log files:
- the address requested
- date and time of the request
- amount of data transferred and HTTP status code
- the previously visited page (referrer), if your browser sends it
- browser type and version, and operating system
- the IP address
Purpose: delivering the site, operational security and troubleshooting.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in operating the website securely and without errors.
Retention: log files are deleted after 7 days. The IP address is not combined with other data and is not used to identify individuals.
This processing happens regardless of your advertising choice — without it the site could not be delivered at all.
Hosting and delivery
The website runs on Laravel Cloud, operated by Laravel Holdings, Inc., Mohnton, Pennsylvania, USA, on Amazon Web Services infrastructure. In front of it sits a content delivery network operated by Cloudflare, Inc., San Francisco, USA, through which all requests pass.
Both process the access data described above on our behalf under Art. 28 GDPR.
Transfers to third countries: both providers are based in the USA. This is based on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR; both are additionally certified under the EU-US Data Privacy Framework. A residual risk remains: US authorities could access data without a remedy fully meeting European standards being available.
Security network cookie
Cloudflare sets a single cookie when you open the site, __cf_bm, with a
lifetime of 30 minutes. It distinguishes human visitors from automated
requests and thereby fends off attacks and abusive access. It carries no
identifier that would allow your behaviour to be tracked across websites, and
it is not used for advertising or analytics.
This cookie is set regardless of your advertising choice — including when you decline, and including on this page. It is strictly necessary for operation under § 25(2)(2) TDDG and therefore needs no consent; the processing relies on Art. 6(1)(f) GDPR and our legitimate interest in operating the site securely.
Reach measurement
We count how often each page is requested and whether the request came from a human or a bot. This runs without cookies, without an ad network and without storing IP addresses — there is no connection to any external analytics service.
What is stored: daily counters on our own server only — number of views per page, browser or bot name, language version, hour of access and, if your browser sends one, the domain of the referring site (not the full URL, so that search terms are not stored).
What is not stored: your IP address, the full user agent, the full referrer URL.
Recognition: to count how many distinct visitors a day had, we derive an identifier from IP address and user agent during the request. Its salt changes daily, so it cannot be followed across two days, and the corresponding file is deleted after 2 days. After that only numbers without any personal reference remain.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is understanding which content gets read and how much of the traffic is bots. § 25 TDDG does not apply because no information is stored on or read from your device.
Objection: you may object to this processing under Art. 21 GDPR at any time — an informal email to contact@azerothbase.com is enough.
Advertising (Adsterra)
Only with your consent. Before you agree, no script from the ad network is loaded; the site does not connect to it at all.
Provider: AD MARKET LIMITED ("Adsterra"), Christaki Kranou 49, Germasogeia, 4041 Limassol, Cyprus. Privacy policy: https://adsterra.com/privacy-policy/
Ad formats on this site: banners in different sizes depending on screen width, a popunder (opens an additional browser window on your first click) and a "Social Bar" (ad elements displayed at the edge of the screen).
Data processed: IP address, browser type and version, operating system and device information, language setting and time zone, the URL requested and the referrer, interactions with the ad (impressions, clicks, dwell time) and identifiers stored in cookies or your device's local storage.
Purposes: delivering and billing advertising, frequency capping (so the same ad does not appear constantly), fraud detection, reach measurement, and selecting ads that may match your behaviour.
Legal basis: your consent under Art. 6(1)(a) GDPR. For storing and reading information on your device, additionally § 25(1) TDDG.
Retention: the network's cookies expire at different times, as a rule after one year at the latest. Details are in Adsterra's cookie policy: https://adsterra.com/cookies/
Further recipients: Adsterra brokers ads from advertisers and further advertising partners, who may set and read identifiers of their own. We have no influence over and no insight into their processing.
Transfers to third countries: Adsterra is based in Cyprus (EU) but also processes data outside the European Economic Area, among others in the United Arab Emirates. This is based on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR. For some of those countries no adequacy decision by the Commission exists. A residual risk therefore remains: local authorities could access data without a remedy meeting European standards being available. By consenting you expressly accept that risk (Art. 49(1)(a) GDPR).
Withdrawing consent: at any time via the "Cookie settings" link in the footer. No advertising is loaded afterwards. The lawfulness of processing up to the withdrawal is unaffected (Art. 7(3) GDPR). Cookies already set by the ad network can be deleted through your browser settings.
Storing your choice
So that you are not asked again on every page view, we store your decision in
your browser's local storage under the key azb-consent. Only the decision
itself, a timestamp and a version number are stored — no identifier that makes
you recognisable.
This storage is strictly necessary under § 25(2)(2) TDDG to provide the service you asked for and therefore needs no consent of its own. It remains until you withdraw it or clear your browser data. If purposes or providers change, we raise the version number and ask again.
Fonts
The fonts used (Cinzel and Inter) are stored on our own server and served from there. No connection is made to Google Fonts or any other external provider.
External links
This site links to external sources such as Blizzard, Wowhead and YouTube. Those links only become active when you click them. Only then does the respective provider receive your IP address and can set its own cookies. No third-party content (videos, maps, social media buttons) is embedded in the site in a way that would transmit data on page load.
Your rights
You have the right at any time to:
- access the data stored about you (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object to processing based on legitimate interests (Art. 21 GDPR)
- withdraw consent with effect for the future (Art. 7(3) GDPR)
An informal email to contact@azerothbase.com is enough for any of these.
Right to lodge a complaint
If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the one in the German state where the controller is based, or the authority where you reside.
Automated decisions and profiling
We do not make automated decisions producing legal effects within the meaning of Art. 22 GDPR. The ad network may select ads based on your behaviour, which is profiling within the meaning of Art. 4(4) GDPR; it has no legal effect and does not similarly significantly affect you. It only happens after your consent and ends when you withdraw it.
Changes
If the site changes technically — by adding another ad network, a search function or a contact form — this policy will be updated and consent obtained again. The date above shows the current version.