Privacy policy

Last updated: 26 September 2026

This is a convenience translation. The German version of this privacy policy is legally binding.

This privacy policy has two parts. Part A applies to this website, part B to the Fortuna Player app (iOS, Android and web app).

A. Website fortuna-solutions.de

1. Controller

The controller responsible for data processing on this website is:

Fortuna Solutions GmbH
Forsmannstraße 22A
22303 Hamburg
Germany

E-mail: support@fortuna-solutions.de

Further company details are in the legal notice.

2. Overview

This website provides information about the Fortuna software. It sets no cookies, uses no analytics or tracking services and loads no third-party content such as fonts, maps or videos.

We process personal data only where necessary to deliver and secure the website, or when you contact us via the form or by e-mail.

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

3. Hosting and server logs

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Pages are delivered via Vercel’s network; server-side functions run in the Frankfurt am Main region (fra1).

With every request, Vercel processes technically necessary connection data: IP address, date and time, requested address, amount of data transferred, the previously visited page (referrer) and information about the browser and operating system. This data is used to deliver the website, to fend off attacks and to troubleshoot errors. We do not combine it with other data.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing the website securely and reliably). Vercel processes the data as a processor. Data may be transferred to the USA; Vercel is certified under the EU-U.S. Data Privacy Framework.

4. No cookies, no analytics

This website sets no cookies and stores no data in your browser. The language follows from the page address (/de, /en, /fr) and is not stored.

We use no analytics or statistics services, no advertising pixels and no social media plugins. The Lato font is loaded from our own server; there is no connection to Google Fonts or other font providers.

5. Contact and demo form

When you use the form to request a demo, an onboarding meeting or to ask a question, we process the information you provide: name, e-mail address, company, preferred dates and your message, and, where provided, phone number, role, country and number of tables, as well as the language of the page. To coordinate the preferred dates, the form also sends your browser’s time zone (e.g. “Europe/Berlin”).

We use this information solely to answer your request and to arrange an appointment. You receive a confirmation of receipt at the e-mail address you provided; it does not contain your message.

The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and, for general questions, Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

Mandatory fields are marked; without them we cannot process the request. Phone number, role, country and number of tables are voluntary, as is any other information that is not marked. If you write to us by e-mail, the same applies to the information in your e-mail.

6. E-mail delivery

We send the request from the form and the confirmation of receipt via the Resend service (Resend, Inc., USA). Resend processes your name, your e-mail address and the content of the e-mail as a processor. Data is transferred to the USA on the basis of EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

The e-mail service is interchangeable. If we switch to another provider, for example one based in the EU, we will update this section before the switch.

The legal basis is Art. 6(1)(b) and (f) GDPR.

7. Spam protection: Cloudflare Turnstile

On the page with the form we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Turnstile checks whether the form is submitted by a human. To do so, Cloudflare processes your IP address and technical characteristics of your browser and device. Turnstile is loaded on this page only, and only once you interact with the form (e.g. select a field); visitors who only read the page do not load Turnstile.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting the form against abuse). The access to information in your browser required for this is based on § 25(2) no. 2 TDDDG, as it is strictly necessary to send the request you asked for.

Data may be transferred to the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework.

8. Request limits

To prevent mass requests, we count form requests per sender. For this purpose we store counters at Upstash (Upstash, Inc., USA; database in the Frankfurt am Main region) under a hash of your IP address and of your e-mail address, plus a marker that prevents duplicate delivery. The hash is created with a secret key; the addresses themselves are not stored there.

The entries are deleted automatically: the IP address counter 10 minutes after the first counted request, the e-mail address counter 24 hours after the first counted request and the marker 24 hours after delivery.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).

9. Retention

Vercel deletes server logs automatically according to the provider’s retention periods. We keep form requests and e-mails as long as needed to handle them and delete them once no further questions are expected. If a request leads to a contract, the statutory retention periods under commercial and tax law apply.

10. Your rights

Under the GDPR you have the following rights:

  • Access to your stored data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on legitimate interests (Art. 21 GDPR)
  • Withdrawal of given consents with effect for the future (Art. 7(3) GDPR)

To exercise your rights, simply e-mail support@fortuna-solutions.de.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information)
Ludwig-Erhard-Straße 22, 7th floor
20459 Hamburg, Germany

11. Data security

The website is delivered exclusively encrypted via HTTPS (TLS); the form also transmits your information encrypted.

12. Changes to this policy

We update this privacy policy when the website, the services used or the legal situation change. The version published here applies.

B. Fortuna Player app

This part applies to the Fortuna Player app on iOS and Android and to the web app at player.fortuna-solutions.de. It corresponds to the privacy policy in the app.

1. Controller

The controller responsible for data processing in the Fortuna app is:

Fortuna Solutions GmbH
Forsmannstraße 22A
22303 Hamburg
Germany

E-mail: support@fortuna-solutions.de

For any privacy-related questions you can reach us at the e-mail address above at any time.

2. Overview

The Fortuna app lets you check in at participating casinos, register for poker cash games, receive notifications (e.g. when your table is ready) and manage your player profile, including player-protection features.

We process your data exclusively on the basis of the GDPR. Below we explain which data we process, for which purposes, on which legal basis, and which rights you have.

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

3. Infrastructure & processors

We use the following service providers as processors:

  • Supabase, Inc. (database, authentication, file storage): All app data is processed and stored in the EU (data center Frankfurt am Main, AWS eu-central-1). A data processing agreement including EU Standard Contractual Clauses is in place.
  • Google Ireland Ltd. / Google LLC (Firebase Cloud Messaging): To deliver push notifications, a device token is transmitted to Google. Data may be transferred to the USA; Google is certified under the EU-U.S. Data Privacy Framework, and EU Standard Contractual Clauses apply in addition.
  • Vercel Inc. (hosting of the web version): When you access the web app, technically necessary connection data (IP address, time, browser information) is processed. Vercel is certified under the EU-U.S. Data Privacy Framework.

The legal basis for using these providers is Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (legitimate interest in secure, reliable operation).

4. Registration & profile

When you register, we process your e-mail address and password (stored exclusively encrypted / as a hash).

During onboarding we additionally collect: first name, last name, date of birth, and optionally username, phone number and profile picture.

We require your date of birth to verify the legal minimum age of 18 (youth and player protection).

Legal bases: Art. 6(1)(b) GDPR (providing the app) and Art. 6(1)(c) GDPR (statutory age verification).

Providing your e-mail address, name and date of birth is required to use the app; without this information no account can be created. All other information is voluntary.

5. Casino check-in

When checking in, you scan a QR code at the casino. We process: the scanned code, time and validity of the check-in, the respective casino, and technical device information (device identifier, app version, platform).

Legal bases: Art. 6(1)(b) GDPR (check-in feature) and Art. 6(1)(f) GDPR (preventing fraudulent check-ins). Camera access is granted via your device’s system permissions and can be revoked there at any time.

6. Poker registrations & gameplay

For gameplay operations we process your game registrations (pre-registrations, waitlist positions), table and seat assignments and – where the casino uses this feature – buy-in amounts.

The casino you visit has access to the data required to run its games (e.g. name on the waitlist, table assignment).

Legal basis: Art. 6(1)(b) GDPR. Casino statistics are based on anonymized data without personal reference (Art. 6(1)(f) GDPR).

7. Push notifications

For notifications (e.g. “Your table is ready”) we use Firebase Cloud Messaging. A device token is stored and linked to your account.

Access to information on your device (e.g. storing the device token) takes place insofar as it is necessary to provide the service you use (§ 25(2) no. 2 TDDDG, the German act on data protection in digital services); beyond that, only with your consent.

Operationally necessary notifications (table calls, reservation status) are sent on the basis of Art. 6(1)(b) GDPR.

Promotional notifications (e.g. news and events from your favorite casinos, Fortuna updates) are sent only with your consent (Art. 6(1)(a) GDPR). You can withdraw these consents at any time in the app settings; you can additionally revoke the push permission in your system settings.

8. Player protection & self-exclusions

You can set up self-exclusions in the app (time-limited, schedule-based or permanent). We process the type, scope, period and – if provided – your reason.

Self-exclusions serve your protection. Account deletion is not possible while a non-revocable self-exclusion is active – this prevents circumventing an exclusion by deleting and re-registering.

Legal bases: Art. 6(1)(b) and (c) GDPR (player protection).

9. Support

If you contact our support (support tickets in the app), we process your request and the information you provide to handle your matter (Art. 6(1)(b) GDPR).

10. Retention & account deletion

We store your personal data for as long as your account exists or as long as necessary for the purposes described.

You can delete your account at any time in the app settings. In that case:

  • Deleted: your profile (name, date of birth, phone number, username), profile picture, notifications and push tokens, favorites and likes, support tickets, and expired self-exclusions.
  • Anonymized: your game history (registrations, table sessions, buy-ins) and check-in timestamps – personal references as well as device data are removed; only anonymous operational data remains for the casinos.
  • Open reservations are cancelled automatically upon deletion. If you are currently seated at a table, deletion is only possible after the current game has ended.

Statutory retention obligations remain unaffected.

11. Your rights

Under the GDPR you have the following rights:

  • Access to your stored data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on legitimate interests (Art. 21 GDPR)
  • Withdrawal of given consents with effect for the future (Art. 7(3) GDPR)

To exercise your rights, simply e-mail support@fortuna-solutions.de. You also have the right to lodge a complaint with a data protection supervisory authority – the authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information.

12. Data security

Communication between the app and our servers is exclusively TLS-encrypted. Passwords are never stored in plain text. Access to your data is protected by server-side access rules (row level security).

13. Changes to this policy

We update this privacy policy when the app or the legal situation changes. The current version is always available in the app and on this page.