Privacy Policy

1. Controller

The controller for personal data processed on this website is:

NeoGeo New Media GmbH
Friedenstraße 39
25335 Elmshorn
Germany

Phone: +49 4121 8025-0
Email: kontakt@neogeo.com

2. Data Protection Officer

We are not legally required to appoint a data protection officer at this time. For privacy matters, please use our general contact above or write directly to datenschutz@neogeo.com.

3. Legal bases for processing

We process personal data only where a legal basis under Art. 6 (1) GDPR applies:

• Art. 6 (1) lit. a GDPR — consent
• Art. 6 (1) lit. b GDPR — performance of a contract or pre-contractual measures (in particular our recruiting process)
• Art. 6 (1) lit. c GDPR — compliance with a legal obligation
• Art. 6 (1) lit. f GDPR — legitimate interests (in particular, secure operation of the website and abuse prevention)

4. Cookieless website and device access (§ 25 TTDSG)

On www.neogeo.com we do not set any cookies requiring consent and we do not embed third-party content that stores persistent identifiers on your device. No cookie banner is therefore required. Strictly necessary access — such as short-lived session storage used to protect a form submission against bots — is exempt from consent per § 25 (2) no. 2 TTDSG.

5. Website operation and server logs

Our site runs on Cloudflare, Inc.. For every request, the platform automatically logs technical data such as a timestamp, the requested resource, HTTP status code, user agent and the IP address of the requesting system.

Purpose	Legal basis	Retention
Technical delivery and operation of the website	Art. 6 (1) lit. f GDPR	at most 90 days
Abuse prevention and DDoS protection (WAF, rate limiting)	Art. 6 (1) lit. f GDPR	at most 90 days

For rate-limit purposes we store pseudonymized IP addresses: the IP is hashed with a salt (SHA-256) before storage. Re-identification without the salt is not possible.

6. Contact form

When you send us a message via /en/contact, we process your input to handle your inquiry.

Data	Purpose	Legal basis	Retention
Name, email, message	Handling of the inquiry	Art. 6 (1) lit. a and lit. b GDPR	until fulfilled, max. 24 months

Email delivery is handled by Resend (EU region). To defend against automated submissions we use Cloudflare Turnstile, which does not use persistent tracking cookies — only short-lived session state required for the challenge itself.

7. Application form

If you apply via /en/apply, we process the data you enter and the CV PDF you upload for the purpose of running our recruiting process.

Data	Purpose	Legal basis	Retention
Name, email, phone, position, message	Recruiting	Art. 6 (1) lit. b GDPR, § 26 BDSG	6 months after rejection; taken into personnel file if hired
CV (PDF, max. 10 MB)	Recruiting	Art. 6 (1) lit. b GDPR, § 26 BDSG	automatic deletion after 210 days

Your CV is uploaded from your browser directly to an object-storage bucket (Cloudflare R2, EU region). The upload link is individually signed per application and valid for only five minutes.

Automatic retention-compliant deletion (210 days = 6 months + a 30-day buffer for timely complaints under the German General Equal Treatment Act, AGG) is configured at the storage-layer.

8. Website analytics (Cloudflare Web Analytics)

We use Cloudflare Web Analytics to measure how our site is used. This is a cookieless, usage-based statistics method: no cookies are set and no persistent identifiers are stored in your browser. Measurement happens server-side using aggregated metrics such as page views, referrer categories, device type and country.

Purpose	Legal basis	Retention
Reach measurement and optimisation of our content	Art. 6 (1) lit. f GDPR (legitimate interest)	max. 6 months, aggregated

9. Processors and recipients

We use carefully selected service providers who act for us on the basis of data-processing agreements (Art. 28 GDPR):

Provider	Location	Service	Info
Cloudflare, Inc.	USA (EU edge)	Hosting, WAF, DNS, Turnstile, R2, Web Analytics	DPA
Resend, Inc.	USA (EU region)	Transactional email	DPA

10. Transfers to third countries

Our processors are US-based. Transfers to the USA happen only with appropriate safeguards under Art. 44 et seq. GDPR, in particular the EU Standard Contractual Clauses per Implementing Decision (EU) 2021/914 and additional technical measures (pseudonymization, encryption in transit and at rest). A transfer impact assessment (TIA) has been performed and is reviewed at least annually.

11. Your rights

You have the right, at any time, to:

• request information about the data stored about you (Art. 15 GDPR),
• request rectification of inaccurate data (Art. 16 GDPR),
• request erasure of your data, subject to statutory retention obligations (Art. 17 GDPR),
• request restriction of processing (Art. 18 GDPR),
• receive your data in a structured, common format or have it transferred (Art. 20 GDPR),
• object to processing based on legitimate interest (Art. 21 GDPR),
• withdraw a given consent at any time with effect for the future (Art. 7 (3) GDPR).

To exercise your rights, please contact datenschutz@neogeo.com. We respond to requests within one month; in complex cases this may be extended by up to two additional months (Art. 12 (3) GDPR).

12. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority at any time (Art. 77 GDPR). The authority competent for us is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98
24103 Kiel, Germany
www.datenschutzzentrum.de

13. Changes to this policy

We update this policy when the legal situation or our processing changes — for example when adding a new processor. The current version is always available at /en/privacy. Material changes are communicated on our home page.