LEGAL Data processing & GDPR

Privacy Policy

This privacy policy explains how we handle personal data when you visit our website.

Note: This is an English translation provided for convenience. The legally binding version is the German original. In case of any discrepancy between the German and English versions, the German text prevails.

1. Controller

The party responsible for data processing on this website is:

Kevin Schulz
Talstraße 35
57648 Unnau, Germany
Email: info@fraglab.de

2. General information

We take the protection of your personal data very seriously and treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

The use of our website is generally possible without providing personal data. Where personal data (e.g. name or email address) is collected on our pages, this is always on a voluntary basis. This data will not be passed on to third parties without your express consent.

3. Hosting

This website is hosted by:

ALL-INKL.COM — Neue Medien Münnich
Inh. René Münnich
Hauptstraße 68
02742 Friedersdorf
Germany
all-inkl.com

The hosting provider processes personal data of our visitors (e.g. IP addresses in server log files) as part of its activity. A data processing agreement (DPA) has been concluded with the provider in accordance with Art. 28 GDPR. The servers are located in Germany; data is not transferred to third countries.

The use of the hosting provider is based on our legitimate interest in providing the website reliably, securely and quickly (Art. 6 (1) (f) GDPR).

4. Server log files

When you visit this website, our hosting provider automatically collects information in so-called server log files, which your browser automatically transmits. These are:

This data is not merged with other data sources. Data is collected on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in the technically error-free presentation and optimisation of this website — the server log files must be recorded for this purpose. The data is deleted after a maximum of 7 days, unless security incidents require longer storage.

5. Cookies

This website does not currently use any tracking or marketing cookies. Technically non-essential cookies are also not set. Should this change (e.g. by integrating an analytics or newsletter tool), you will be asked for your consent in advance via a cookie banner (Art. 6 (1) (a) GDPR in conjunction with § 25 TDDDG).

5a. Anonymous live chat

On the homepage there is a chat box where you can write messages without logging in. A server-side PHP file (chat.php) stores only three pieces of information per message: your chosen nickname (freely selectable, not your real name), the message text (max. 200 characters) and the timestamp.

What is NOT stored: no IP addresses, no cookies, no session IDs, no user-agent strings. There is no way to attribute an individual message to a person — the chosen nickname is stored locally in your browser (localStorage) so it is pre-filled for your next message; it leaves your device only as part of the respective sent message.

Storage period: All messages are automatically deleted after 24 hours. There are no backups, no archiving, no analysis.

Email notification to the operator: When a message is sent, an automatic email containing the nick, timestamp and message text is sent to info@fraglab.de. This serves only the purpose of timely moderation (detecting spam, insults, illegal content). The email contains no IP address, no user agent and no other metadata — only what you have entered yourself. Mail volume is limited to a maximum of 6 emails/hour; further messages are stored but not additionally mailed.

Right to early deletion: Should a message need to be removed earlier than the auto-delete, please report it to info@fraglab.de. We will remove it immediately.

Legal basis: Art. 6 (1) (f) GDPR. Legitimate interest: providing visitors with the option to leave anonymous feedback and exchange.

5b. Anonymous usage counter

On the homepage we show a small banner with daily totals of our tool usage (e.g. "Today on FragLab: 12 PCs built, 7 crosshairs created, 4 stats tracked, 23 tool views"). For this, a server-side PHP file (counter.php) counts six values per day in a JSON file:

What is NOT stored: no IP addresses, no cookies, no server-side session IDs, no user-agent strings, no history/tracking data. There is no way to attribute an individual visit or action to a person — the server only increments global daily counters. At day change the counters reset to 0; there is no history.

SessionStorage to prevent double counting: So that the tool view counter is not incremented again on every page reload (F5), your browser places a small marker (e.g. fl_v_pc-builder_2026-04-29) in so-called SessionStorage. SessionStorage is not a cookie: data remains exclusively local in your browser, is not transmitted to our server and is automatically deleted when the tab is closed. Identification or recognition of your person via this is not possible.

Legal basis: Art. 6 (1) (f) GDPR (display of aggregated, non-personal usage statistics). For the SessionStorage marker additionally § 25 (2) (2) TDDDG, since local storage is strictly necessary to ensure correct counting.

5c. Faceit Tracker (player lookup tool)

On the subpage /tools/faceit-lookup.html we provide a tool with which publicly available Faceit statistics and Steam profile information for Counter-Strike 2 players can be retrieved (e.g. ELO, K/D ratio, headshot rate, VAC/Game-Ban status, CS2 playtime). Merely visiting the tool page does not transmit any data to third parties — data transmission only occurs when you actively enter a search term and click "Lookup".

What data is transmitted on a search?

To whom is data transmitted?

What do we store ourselves? On our server we cache the public profile data returned by Faceit/Steam for the searched player for a maximum of 10 minutes in a JSON file (to reduce API requests). We do not store: your IP address, your user agent, your search history, cookies or session IDs. Attribution of search queries to a specific person is not possible for us.

Data transfer to third countries: Cloudflare has subscribed to the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR). For Valve Corporation, transmission — to the extent triggered via avatar images — is based on standard contractual clauses (Art. 46 GDPR). Faceit Limited (UK) and jsDelivr (Poland) are located in countries with an adequacy decision or within the EU.

Legal basis: Art. 6 (1) (f) GDPR. Legitimate interest: providing a free lookup tool for the CS2 community that, for purely technical reasons, must use external data interfaces.

Trademark and affiliation notice: FragLab is not affiliated with Faceit Ltd. or Valve Corporation. "Faceit" and "Steam" are registered trademarks of their respective owners; their logos are used exclusively for functional identification of the respective external services.

5d. Twemoji flags (jsDelivr CDN)

On several pages of this website (in particular the pro settings overview /pros/, the individual player profile pages under /pros/<name> and the Faceit Tracker) we display small country flag symbols next to player names. These are loaded as SVG images from the open-source icon set Twemoji, since Windows browsers cannot render native Unicode flag emojis.

What is transmitted? As soon as a page with flag symbols is loaded, your browser sends an image request to the jsDelivr CDN. Technically unavoidable, your IP address, browser information (user agent), the requested image URL (containing the country code, e.g. 1f1e9-1f1ea for DE) and possibly the referrer (URL of the visited FragLab page) are transmitted.

To whom? jsDelivr, operated by Prospect One Sp. z o.o., ul. Krolewska 65A/1, 30-081 Krakow, Poland. The Twemoji SVGs themselves are maintained by Twitter/X (CC-BY 4.0 licensed) and delivered via jsDelivr. Privacy: jsdelivr.com/terms/privacy-policy-jsdelivr-net

What do we store ourselves? Nothing. The images are fetched by your browser directly from jsDelivr without FragLab receiving or caching any data.

Data transfer to third countries: jsDelivr is based within the EU (Poland). Data transmission to third countries does not occur through our use; however, jsDelivr itself uses a globally distributed CDN network (Cloudflare, Fastly etc.), which means the image request is routed to a geographically nearby edge server depending on your location.

Legal basis: Art. 6 (1) (f) GDPR. Legitimate interest: cross-platform-consistent display of country flags without self-hosting thousands of image files. Self-hosting the ~250 flag SVGs is technically possible and is being considered.

6. Amazon Associates Program (affiliate links)

We are a participant in the Amazon Associates Program, which is designed to provide a means for websites to earn advertising fees by placing ads and links to amazon.com (on the English version of this site) and amazon.de (on the German version).

What happens when you click an affiliate link? When you click on an affiliate link, you are redirected to the relevant Amazon storefront (amazon.com on the English pages, amazon.de on the German pages). The link contains a partner ID (so-called "tag") with which Amazon recognises that the visit was referred by us. Amazon then usually places a cookie on your device to be able to attribute a later purchase to our referral. This cookie placement is done by Amazon and is subject to Amazon's privacy policy.

What data do we receive? We ourselves do not learn whether you bought something or which products. Amazon only shares anonymous, aggregated commission statistics with us (e.g. number of clicks, number of products ordered, commission amounts — without identifying individuals).

Legal basis: Art. 6 (1) (f) GDPR. Legitimate interest: financing this website via affiliate commissions.

Privacy at Amazon: More information about privacy at Amazon at:
amazon.com/gp/help/customer/display.html (privacy notice)

7. External content

On individual pages of this website we display data taken from publicly accessible third-party sources (e.g. ProSettings.net). This is factual information (sensitivity values, hardware used) about Counter-Strike 2 professional players. Third-party websites are only accessed if you actively click a link — data is not transmitted to third parties on a normal visit to this website.

7a. Embedding of Twitch streams

On the homepage we offer the option to display live streams from the Twitch platform (Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA). No data is transmitted to Twitch on a normal visit to the homepage. Instead of an automatic embed, we show a preview card with a notice and a "Start stream" button. The Twitch player is only loaded after you actively click this button (click-to-load).

What happens when you start the stream? Only then is an iframe of the Twitch platform loaded. Twitch then receives your IP address, browser information, language settings and possibly cookies that Twitch sets for recognition. Twitch may transfer this data to the USA.

Legal basis: Art. 6 (1) (a) GDPR (consent) — by your conscious click on "Start stream" you consent to the data transmission. You can end the stream at any time by leaving or reloading the page.

Data transfer to third countries: Twitch is a US-based company. Twitch has subscribed to the EU-U.S. Data Privacy Framework, so transmission is based on an adequacy decision of the EU Commission (Art. 45 GDPR).

More information: Twitch privacy policy at www.twitch.tv/p/legal/privacy-notice/.

8. Rights of the data subject

You have the right at any time:

The competent supervisory authority for our location is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34
55116 Mainz, Germany
datenschutz.rlp.de

9. SSL encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the address bar of the browser changing from "http://" to "https://" and by the padlock symbol in your browser bar.

10. Currency and changes to this privacy policy

This privacy policy is currently valid and dated April 2026. Due to the further development of our website and offerings or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The respective current privacy policy can be accessed at any time on this page.