Privacy Policy

1. Controller

The data controller responsible for the processing described here is:

There is no statutory obligation to appoint a Data Protection Officer for this Service, and none has been appointed. You can reach the controller directly with any privacy question at the address above.

2. Summary at a glance

• We collect only what we need to run the Service.
• We do not use third-party analytics, advertising, or tracking cookies.
• We do not sell your data, and we do not share your email address with other users.
• Our infrastructure is hosted in the EU (Hetzner, Germany). Transactional email is sent through Resend (USA) under appropriate safeguards.
• You can access, correct, export, or delete your data at any time.

3. What data we process, why, and on what legal basis

4. Cookies and similar technologies

We currently use only strictly necessary cookies and local storage, set by the underlying technologies we rely on. These are required to keep you logged in and to protect the Service against common attacks. Under § 25(2) TDDDG and the relevant EU guidance, strictly necessary cookies and storage do not require consent, and we do not display a cookie banner.

We do not use third-party analytics, advertising, social-media tracking, or fingerprinting.

5. Recipients and processors

We share personal data only with the following processors, each engaged under a data-processing agreement as required by Art. 28 GDPR:

We do not sell or rent personal data, and we do not transfer it to anyone else except where legally required (for example, in response to a binding order from a competent authority).

6. Visibility of your data to other users

• Your username, avatar, biography, country, social profile links, and any contest submissions are visible to other users and visitors of the Service.
• Your email address is never shown to other users or to contest organizers.
• Your first and last name are visible to other users if you provided them during sign-up or in your profile.
• Comments you post on submissions, along with your username as the author, are visible to other users and visitors.
• Individual reactions are never attributed to you publicly — other users and visitors see only aggregate counts, not who reacted.

If a contest involves a prize, the Contest Administrator is responsible for collecting any shipping address directly from the winner — we do not transmit user addresses on their behalf.

7. Retention

We retain personal data only as long as we need it:

• Account and profile data: for as long as your account exists. When you delete your account, this data is deleted from active systems automatically.
• Contest submissions (images and their descriptions): retained as part of the contests they belong to even after you delete your account, in order to preserve the integrity of completed contests. The submitter attribution is removed so the images can no longer be linked to your identity. If you object to this, delete submissions manually before deleting your account.
• Comments and reactions: deleted automatically when you delete your account.
• Server logs: retained for 90 days, then deleted automatically.
• Encrypted backups: kept on a rolling basis for 7 days, then overwritten. Data deleted in production may persist in backups until the rolling window expires.
• Email-sending records held by Resend: Resend retains email-sending records for up to 90 days after termination of our agreement with them, in line with their DPA

We may retain specific data longer where mandatory legal retention obligations apply (for example, tax-related records for donations), in which case the data is restricted to that purpose.

8. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15),
• rectify inaccurate or incomplete data (Art. 16),
• request erasure of your data (Art. 17), subject to the retention exceptions above,
• request restriction of processing (Art. 18),
• receive your data in a portable format (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• withdraw consent at any time for processing based on consent, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).

To exercise any of these rights, write to contact@brickcontests.com. We will respond within one month (extendable by two further months for complex requests, as permitted by Art. 12(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, place of work, or place of the alleged infringement. The competent authority for the Operator is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18 91522 Ansbach, Germany (https://www.lda.bayern.de) .

9. Automated decision-making

We do not use automated decision-making (including profiling) that produces legal or similarly significant effects on you within the meaning of Art. 22 GDPR.

10. Security

We apply reasonable technical and organizational measures appropriate to the nature, scope, and risk of the processing — including TLS encryption in transit, encryption of backups at rest, password hashing, restricted server access, and regular updates of our software stack. No system on the internet is perfectly secure; if we become aware of a personal-data breach that creates a risk to your rights, we will notify the competent authority and, where required, affected users in accordance with Art. 33 and 34 GDPR.

11. Children

The Service is intended for teen and adult LEGO fans from the age of 13. Younger children should not register. If you become aware that a child has provided personal data without appropriate consent, please contact us and we will delete the account.

12. Changes to this Policy

We may update this Privacy Policy when the way we process data changes. We will publish the updated version on this page and update the “Last updated” date. Material changes will be announced through the Service or by email.