Privacy Notice
Information on personal-data processing by the MapLink public website, My MapLink customer portal, license service and administration interfaces.
1. Controller / Verantwortlicher
Christopher Szinek
Schulz-Straßnitzkigasse 7
1090 Vienna
Privacy contact: support@maplink.at
This notice is intended to provide the information required particularly by Articles 12–14 GDPR and § 165(3) Austrian TKG 2021 where terminal-device storage/access is used.
2. Hosting and public website delivery
Hosting is provided by ALL‑INKL.COM – Neue Medien Münnich, Inhaber René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. As part of normal hosting, technical connection/server data can be processed to deliver and secure the site. Where the host processes data on the controller’s instructions, it acts as a processor under Article 28 GDPR.
| Typical data | IP address, timestamp, requested resource, HTTP status, user agent and technical connection/log data depending on the hosting configuration. |
|---|---|
| Purposes | Website delivery, availability, error analysis, attack/abuse prevention and technical security. |
| Legal basis | Article 6(1)(f) GDPR (legitimate interest in secure and reliable operation) and, where the request directly provides a contracted/requested service, Article 6(1)(b) GDPR. |
| Retention | According to the operational/security need and hosting configuration. Data no longer required for these purposes or legal claims is deleted/anonymised in accordance with the applicable retention process. |
3. My MapLink accounts
| Data | Email address, display/community name, password hash, account status, email-verification timestamps, last login and security settings. |
|---|---|
| Purpose | Account creation, authentication, customer self-service, license ownership and account recovery. |
| Legal basis | Article 6(1)(b) GDPR for requested account/license services; Article 6(1)(f) GDPR for account security and abuse prevention. |
| Retention | For the account/service relationship and afterwards only where needed for legal retention, security, entitlement history or establishment/exercise/defence of legal claims. |
4. Authentication, TOTP and recovery
Passwords are stored only as cryptographic password hashes. If TOTP is enabled, the authentication secret is protected by the portal’s security design and recovery codes are stored one-way where possible. Password-reset tokens and email-verification tokens are random, time-limited and invalidated after use/expiry.
5. Licenses and MapLink installations
| Data | License ID/entitlements/status, issued customer email, installation ID, activation ID, one-way machine-fingerprint hash, cluster ID, MapLink version, activation-token hash, first/last-seen timestamps and revocation state. |
|---|---|
| Purposes | Issue/administer entitlements, enforce activation/server limits, create signed license leases, permit customer self-service, prevent abuse and investigate licensing incidents. |
| Legal basis | Article 6(1)(b) GDPR (license/service performance) and Article 6(1)(f) GDPR (license security, fraud/abuse prevention and service integrity). |
| Minimisation | The portal is designed to receive/store a one-way machine-fingerprint hash instead of the raw fingerprint and hashes license/activation secrets when plaintext recovery is unnecessary. |
6. License and administration audit logs
Security-sensitive customer, license and administrator actions can be recorded with actor/account reference, action, IP address, timestamp and structured event details. They support incident investigation, change traceability, fraud/abuse prevention and defence of legal claims. Legal basis: Article 6(1)(f) GDPR. Production license/audit records may be retained longer than ordinary web logs where needed to preserve entitlement history and security evidence; data is removed/anonymised when those purposes and applicable legal-retention needs end.
7. Transactional email
When SMTP is enabled, MapLink sends account verification, password-reset and operational/security messages through the configured mail provider. The recipient address, message content and delivery metadata are processed for that purpose. Legal basis: Article 6(1)(b) GDPR where necessary to provide the requested service, and Article 6(1)(f) GDPR for account/security notifications. This transactional mechanism is not used as a legal basis for unsolicited marketing.
8. Support communications
If you contact support, the controller processes the contact details, message content, relevant version/error information and any files/logs you voluntarily provide to answer the request, troubleshoot the service and document security/reliability issues. Legal basis is Article 6(1)(b) GDPR for service-related support and Article 6(1)(f) GDPR for technical/security support. Do not send passwords, private signing keys or unnecessary personal data in logs.
9. Cookies and browser storage
Authenticated areas use strictly necessary session/security cookies for login state and CSRF protection. These cookies are configured with Secure, HttpOnly and SameSite protections and are not used for cross-site advertising. Under § 165(3) TKG 2021, consent is not required for terminal storage/access that is strictly necessary to provide a service explicitly requested by the user. The current portal does not use advertising, behavioural analytics or social-tracking cookies. The complete cookie inventory, storage periods and preference controls are documented in the Cookie & Storage Policy.
10. Fonts and external content
MapLink is designed to serve Rajdhani from maplink.at after the administrator installs the local font package. Website visitors should not need to contact Google Fonts or another font CDN merely to render the page. The one-time administrator-initiated font installation, if used, is a server-side retrieval and does not expose individual visitor browser requests to the font provider. If future analytics, embeds or third-party media are added, this notice and any required consent mechanism must be updated before activation.
11. Protected downloads, EULA acceptance and updates
Human-facing MapLink downloads are provided through My MapLink. To control licensed distribution, the portal processes the customer/account reference, license used for the download, release channel and version, EULA version and terms hash, acceptance timestamp, IP address, a one-way hash of the browser user-agent string, short-lived one-time download-ticket data and download-event timestamps. These records support contract performance, entitlement enforcement, security, abuse prevention and proof of the accepted license terms (Article 6(1)(b) and, for security/evidence, Article 6(1)(f) GDPR). The public site may read signed release metadata from updates.maplink.at. The Windows updater verifies signed metadata and package integrity independently; its future authenticated update-distribution integration is documented separately from customer web downloads.
12. Backups
Personal data contained in the portal database can also exist in protected backups for disaster recovery. Backups must be access-controlled and retained only for the defined recovery/legal period. Deletions in the live database can therefore take effect in backups only when the relevant backup expires or is securely overwritten; restored backups must re-apply legally required deletions where applicable.
13. Recipients and processors
Data is disclosed only where necessary for hosting/mail/service operation, processing on the controller’s behalf, security/claims, legal obligations or valid consent. Core website hosting is provided by the hosting provider named above. MapLink does not sell customer portal data to advertisers.
14. International transfers
The core hosting described above is in Germany/EU. If a future processor or integrated service results in a transfer to a third country, the controller will document the applicable GDPR Chapter V transfer mechanism and update this notice before that processing is enabled.
15. Your GDPR rights
Subject to the statutory conditions, you can request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and object to processing based on legitimate interests (Art. 21). Where processing is based on consent, consent may be withdrawn for the future without affecting prior lawful processing. Contact: support@maplink.at.
You also have the right to lodge a complaint with a supervisory authority. For an Austrian controller: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, Austria.
16. Requirement to provide data
Required account/license identifiers are necessary to provide the requested account or licensing function. Without them, the corresponding service cannot be provided. Optional profile/security fields are identified as such.
17. Automated decisions
The portal does not use solely automated decision-making that produces legal or similarly significant effects within the meaning of Article 22 GDPR. Technical license validation applies predefined entitlement/security rules; support/admin review remains possible.
18. Children
MapLink is an administration/licensing service intended for DayZ server operators and is not designed as a service directed at children. If the commercial offering later targets consumers/minors, age-related consent and consumer requirements must be assessed separately before such use.
19. Security measures
Measures include HTTPS, secure session cookies, CSRF protection, password hashing, TOTP 2FA, one-way hashing of license/activation secrets, scoped database access, rate limits, security headers and protected configuration/signing keys. No internet service can guarantee absolute security; suspected incidents should be reported promptly.
20. Official privacy-law references
21. Changes and version
This notice is updated when processing purposes, processors, product features or legal requirements materially change. The currently published version applies to the website processing described here.
Last updated: 31 August 2026.