Skip to main content

SCNX Crew Privacy Policy

Translation

We have translated this document into English for your convenience. This translation is for informational purposes only, and the definitive version of this page is the German version.

As of: 15 October 2026

With this privacy policy, we inform you how ScootKit UG (haftungsbeschränkt) ("ScootKit" or "we") processes your personal data in the context of the SCNX Crew ("Crew"). It applies to:

  • the website scnx-crew.com,
  • the Crew bot on the ScootKit Discord servers,
  • the Crew emails,
  • the Crew features in SCNX (checkout, invitation page, data export),
  • public Crew profile pages, if you activate them.

For SCNX and the SCNX Marketplace in all other respects, the SCNX privacy policy applies (scootk.it/scnx-privacy).

1. Controller​

ScootKit UG (haftungsbeschränkt)
Graubündener Str. 61, 81475 Munich, Germany
Represented by the managing director Simon Csaba
Email: [email protected]
Legal notice: https://scootkit.com/imprint

2. Processing activities in detail​

2.1 Sign-in with Discord​

You sign in with Discord, using the identify permission. We receive:

  • the Discord ID (which is also the SCNX user ID),
  • the username,
  • the display name,
  • the profile picture identifier.

The username, display name and profile picture identifier are stored only in the sign-in session.

  • Purpose: sign-in and assignment to the SCNX account
  • Legal basis: Art. 6(1)(b) GDPR
  • Retention: sessions end 30 days after sign-in; sessions that are not signed in end after one hour.

2.2 Membership​

For your membership, we process:

  • the email address you provide and confirm,
  • your confirmation of the minimum age,
  • the version of the Terms of Participation you accepted, with the time,
  • your language,
  • the status of your membership,
  • the bookings of Coins and Points with their source,
  • your Tier,
  • Quests and their completion,
  • redeemed Codes and participation in Promotions and Events,
  • the time of your last use of the Program (sign-in, credit or redemption), because the membership ends after 36 months without use,
  • measures taken because of abuse, terminations and exclusions, with reasons.

From your SCNX account, we retrieve at sign-in and regularly afterwards:

  • whether you have an active SCNX account and since when,
  • the status of two-factor authentication,
  • whether advertising is active,
  • the Discord servers you manage (name, icon, plan, duration at SCNX),
  • information on your contributions on the SCNX Marketplace (pseudonymous identifiers of listings, approval and featuring status, updates, reviews).

We do not receive your email addresses from SCNX or Discord for the Crew.

  • Purpose: running the Program, checking participation requirements, awarding Coins for Activities, Quests and Marketplace contributions
  • Legal basis: Art. 6(1)(b) GDPR

Providing an email address is required for participation, because we use it to send you confirmation codes and Program messages. Without it, participation is not possible.

2.3 Confirmation codes​

Confirmation codes are stored only as a hash, together with times and the IP address or IP address range. This serves to limit attempts.

  • Legal basis: Art. 6(1)(b) and (f) GDPR (protection against abuse)
  • Retention: 24 hours

2.4 Purchase data from SCNX​

From your joining, SCNX transmits to the Crew the following about your purchases:

  • payment identifier, payment provider and time,
  • amount paid and list price,
  • product categories,
  • your Membership level,
  • the classification as a business purchase,
  • refunds, chargebacks and payment disputes.

When you first join, SCNX may transmit this information once for a past period, currently twelve months. We do not receive payment method data such as card numbers for the Crew.

  • Purpose: crediting and reversing Coins and Points
  • Legal basis: Art. 6(1)(b) GDPR. Further use of the purchase data held at SCNX is compatible with the original purpose (Art. 6(4) GDPR).

2.5 Activities on Discord​

The Crew bot reads messages in designated channels of the ScootKit Discord servers, including messages from people who are not members. The content is checked only momentarily for length and type and is not stored. If you are a member, we store for a counted Activity the day, the server, the channel and the message ID.

To assign roles, the bot regularly reads the member lists of the servers. We store whether you are on the servers as a yes/no value. The roles for membership and Tier are visible to other people on the server.

  • Legal basis:
    • Members: Art. 6(1)(b) GDPR
    • People who are not members: Art. 6(1)(f) GDPR (technical implementation of the Program; no storage)

2.6 Crew Shop​

When you redeem Coins, we process:

  • the Reward and the price,
  • the server you selected,
  • the delivery status,
  • for immediately provided Rewards, your confirmation regarding the right of withdrawal.

For provision, the necessary information is transmitted to SCNX or ScootKit's Membership service. We handle certain Rewards through a support ticket on your behalf.

If you redeem a Reward as a gift, we process the information about the recipient server or person that is needed for provision (e.g. server ID or SCNX user ID). The recipient does not become a Crew member as a result.

  • Legal basis: Art. 6(1)(b) GDPR; for the confirmation regarding the right of withdrawal also Art. 6(1)(c) GDPR. For the data of the recipient: Art. 6(1)(f) GDPR (provision of the benefit you requested).

Physical Rewards. If you order a physical Reward (e.g. merchandise), we additionally process:

  • your name and delivery address,
  • a telephone number, if the shipping carrier requires it for delivery,
  • order, size and version,
  • shipping status and tracking number,
  • the payment of shipping costs.

You pay the shipping costs through the SCNX checkout process. The SCNX privacy policy applies to that. We pass your name, delivery address and, where applicable, telephone number to the shipping carrier (see 3.).

  • Purpose: handling and shipping the order, handling withdrawal and warranty
  • Legal basis: Art. 6(1)(b) GDPR; for accounting records on shipping costs Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB
  • Retention: delivery address until the end of the warranty period, generally two years after delivery; records on shipping costs in accordance with statutory retention periods

2.7 Emails​

Program messages (e.g. codes, confirmations, Tier changes, changes to the Terms of Participation):

  • Legal basis: Art. 6(1)(b) GDPR

Newsletter and activity reminders you receive only with your consent, confirmed by email (double opt-in).

  • As proof, the version of the consent text and the time, IP address and browser identifier are stored when consent is given and confirmed.
  • For the newsletter, the email address is transmitted to the newsletter system (Sendy).
  • Reminders are based on activity in the Program: last visit, last activity, balance, last redemption.
  • Legal basis: Art. 6(1)(a) GDPR. For the proof: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR and Art. 6(1)(f) GDPR.
  • Withdrawal: You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or in the Member Area.

For every email sent, the type and time are logged.

2.8 Announcements​

We may announce the reaching of a Tier, special achievements and wins from prize draws in public channels of the ScootKit community, in particular on the Discord servers. The announcement may contain:

  • a mention of your Discord account,
  • your display name,
  • your Tier or the achievement or win,
  • an image with your display name.

The image is generated by a ScootKit service that receives only the display name and Tier for this purpose. We store which announcements were published and when.

  • Purpose: shaping the Crew as a community program
  • Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in the community character of the Program. The Tier is visible on the server anyway through the Tier role, and amounts are not published.
info

Objection: You can turn off announcements at any time, without giving reasons, in the Member Area. Your latest announcement is then removed.

2.9 Public profiles​

ScootKit may offer public profile pages. Your profile is visible only if you activate it in the Member Area. You decide yourself which information your profile shows, e.g. display name, profile picture, Tier, badges, member since and content you have written. Your balance, your purchases and your email address are not displayed. Public profiles can be accessed by anyone on the internet.

  • Legal basis: Art. 6(1)(a) GDPR
  • Withdrawal: You can end the display at any time in the Member Area. The profile is then no longer accessible.
  • Retention: The profile information is deleted when you delete the profile, at the latest together with the rest of the data of your membership.

2.10 Prize draws and random rewards​

If you take part in a prize draw or random reward, we process your participation, the check of the eligibility requirements (e.g. your Tier), the result and, in the case of a win, the notification and provision of the Reward. The result is determined by a random procedure. For physical prizes, 2.6 applies. Wins may be announced under 2.8.

  • Legal basis: Art. 6(1)(b) GDPR
  • Retention: like the rest of the data of your membership

2.11 Personal Quests and offers​

Quests and offers based on your progress in the Program (e.g. Tier, balance, completed Quests) are part of the membership (Art. 6(1)(b) GDPR).

Only if you give separate consent do we also take into account your use of SCNX, in particular:

  • modules and features used,
  • your purchase history,
  • abandoned orders.

The Crew then retrieves this information from SCNX and uses it to form suggestions for Quests and offers. Personal offers are marked as such. As proof of consent, we store the version of the consent text and the time.

  • Legal basis: Art. 6(1)(a) GDPR
  • Withdrawal: at any time in the Member Area. After that, we no longer use this information for personal offers.
  • The selection is automated but has no legal or similarly significant effect within the meaning of Art. 22 GDPR.

2.12 Protection against abuse​

  • Network identifiers. An encrypted identifier (HMAC) is formed from the IP address (for IPv6 from the /64 range). This happens at sign-in, confirmation, login and at most daily during use. If several memberships use the same network, the receipt of Bonus Coins may be limited.
  • Further checks:
    • exclusion of certain email providers,
    • comparison of email addresses in normalized form,
    • checking the age of Discord and SCNX accounts,
    • for invitations, a check whether accounts are linked through the joint management of servers.
  • Pause on chargebacks. In the event of chargebacks and payment disputes, the Crew account is automatically paused until the team has reviewed it.

The checks run automatically. They affect only individual Program benefits and have no legal or similarly significant effect within the meaning of Art. 22 GDPR. If such a check affects you, we will point this out to you. You can then request a review by a human.

  • Legal basis: Art. 6(1)(f) GDPR (protecting the Program against abuse and fraud)
  • Retention of network identifiers: 90 days after the last capture

2.13 Invitations​

If you invite others, we store:

  • your agreement to the invitation rules,
  • your invitation codes,
  • counters and credits for invitations.

On the invitation page, we show invited persons your Discord name.

  • Legal basis: Art. 6(1)(b) GDPR

If you were invited:

  • Cookie. If you consent on the invitation page, we set a cookie with the invitation code for 30 days (legal basis: § 25(1) TDDDG, Art. 6(1)(a) GDPR).
  • What SCNX stores. If you create a new SCNX account through an invitation, SCNX stores:
    • your user ID and the invitation code,
    • the time of registration,
    • your first server,
    • whether this server has a paid plan after a certain time,
    • whether a first payment above a minimum amount is made within a certain period.
  • What the Crew receives. The Crew receives from this only a pseudonym and the steps reached. The IP address at registration is transmitted once and stored by the Crew only as an encrypted identifier.
  • What the inviting person sees. They receive a credit for steps reached but do not learn who was invited. With very few invitations, inferences cannot be ruled out.
  • Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in correctly attributing invitations, awarding credits and preventing abuse.
  • Retention:
    • at SCNX 90 days from registration; after a payment, reduced information up to 400 days after the payment
    • at the Crew 120 days; encrypted payment identifiers 400 days

2.14 Website and technical operation​

  • The Crew website does not embed third-party content and uses no analytics tools.
  • After sign-in, a session cookie required for signing in (__Host-crew_session, 30 days) is set (§ 25(2) no. 2 TDDDG).
  • Language setting, the most recently displayed Tier and technical intermediate states are stored in the browser storage.
  • The website is delivered via Cloudflare, which processes IP addresses in the process.
  • Legal basis for operation, security and rate limiting: Art. 6(1)(f) GDPR

2.15 Analytics​

ScootKit evaluates the Program in aggregated form, e.g.:

  • origin of Coins,
  • redemptions,
  • retention of members,
  • purchasing behavior before and after joining.

Small groups are combined.

  • Legal basis: Art. 6(1)(f) GDPR (further development of the Program)

2.16 Access by the team and appointed helpers​

Authorized ScootKit employees can view the following about your membership and make corrections, stating a reason:

  • bookings, purchases and redemptions,
  • network groups,
  • invitation status.

Helpers appointed by ScootKit (e.g. community moderators) can grant you credits, for example as thanks for help. In doing so they see only your user ID, your name and a limited extract of your quest history.

Access by the team requires two-factor authentication. Changes and credits are logged.

  • Legal basis: Art. 6(1)(b) and (f) GDPR

3. Recipients​

RecipientPurposeRole
Discord Inc., USASign-in, bot, roles, announcementsindependent controller for the platform
Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 LuxembourgSending emails, including the newsletterprocessor
Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USADNS, protection and delivery of the websiteprocessor
BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, SloveniaDelivery of the websiteprocessor
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, GermanyServers and databaseprocessor
netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, GermanyServers and databaseprocessor
Contabo GmbH, Aschauer Straße 32a, 81549 Munich, GermanyServers and databaseprocessor
Deutsche Post AG / DHL Paket GmbH, Charles-de-Gaulle-Str. 20, 53113 Bonn, GermanyDelivery of physical Rewardsindependent controller
SCNX and other ScootKit servicesAccount verification, purchase data, Marketplace, provision of Rewards, payment of shipping costs, supportinternal

We operate the newsletter system Sendy ourselves. Newsletters are sent via Amazon Web Services.

4. Transfers to third countries​

Discord and Cloudflare process data in the USA. Both are certified under the EU-US Data Privacy Framework. The transfer is therefore based on the adequacy decision of the EU Commission (Art. 45 GDPR).

Amazon Web Services and BunnyWay process data for us in the EU. Access from third countries, in particular by group companies in the USA or via globally distributed delivery servers, cannot be ruled out. For this we rely on the adequacy decision for the EU-US Data Privacy Framework, where the provider is certified, and otherwise on standard contractual clauses (Art. 46(2)(c) GDPR).

5. Retention​

DataRetention
Sign-in sessions30 days (1 hour if not signed in)
Confirmation codes24 hours
Network identifiers90 days after the last capture
Announcementsup to 400 days after deletion or skipping, so that no Tier is announced twice
Invitation datasee 2.13
Membership, bookings, purchase data, redemptions, Activities, Codes, prize draws, email logfor the duration of the membership and two years after it ends, whatever the reason it ends (leaving, termination, exclusion, inactivity)
Delivery addresses for physical Rewardsuntil the end of the warranty period, generally two years after delivery
Public profileuntil the profile is deactivated or deleted
Proof of consentthree years after the consent ends
After deletionencrypted identifiers, to prevent a renewed retroactive credit and, after an exclusion, a renewed joining
Backupsup to 90 days; after that, deleted data is also removed from the backups

If you delete your SCNX account or request deletion, we delete your Crew data without undue delay. Exempt from this are the encrypted identifiers mentioned and statutory retention obligations. Public announcements are also removed in the process.

6. Your rights​

You have the right to:

  • access (Art. 15 GDPR), including through the data export in your SCNX account,
  • rectification (Art. 16 GDPR),
  • erasure (Art. 17 GDPR), also limited to your Crew data,
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • withdraw your consents with effect for the future (Art. 7(3) GDPR),
  • lodge a complaint with a supervisory authority. The competent authority is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
info

Right to object under Art. 21 GDPR: Where processing is based on Art. 6(1)(f) GDPR (in particular announcements, protection against abuse, invitations, gifts, analytics), you can object to it at any time on grounds relating to your particular situation. You can turn off announcements without giving reasons in the Member Area.

Please send your requests to [email protected] or to SCNX support.

7. Minimum age​

The Crew is aimed at persons aged 16 and over. Memberships of younger persons are ended and the data deleted as soon as ScootKit becomes aware of them.

8. Changes​

We adapt this privacy policy when the Program or the legal situation changes.