Last revised: 20.07.2026 — this version replaces all previous versions.

This notice explains how you can exercise your rights under the General Data Protection Regulation (GDPR) towards Cotoax. Details on which personal data we process, for which purposes, on which legal bases, and for how long are set out in our Privacy Policy.

1. Your Rights Under GDPR

As a data subject, you have the following rights regarding personal data for which Cotoax is the controller:

• Right of Access (Art. 15): obtain confirmation of whether we process your personal data, and receive a copy of that data together with information about the processing.
• Right to Rectification (Art. 16): have inaccurate personal data corrected and incomplete personal data completed. Most account data can be corrected directly in the client area at store.cotoax.com.
• Right to Erasure (Art. 17): have your personal data deleted where there is no longer a legal ground for the processing. Note that data subject to statutory retention obligations (e.g. invoices) is blocked from other use and deleted after the retention period expires.
• Right to Restriction of Processing (Art. 18): restrict the processing of your personal data under the circumstances set out in the GDPR, for example while the accuracy of the data is being verified.
• Right to Data Portability (Art. 20): receive personal data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Right to Object (Art. 21): object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. You may object to processing for direct marketing at any time and without giving reasons.
• Right to Withdraw Consent (Art. 7(3)): withdraw any consent you have given at any time with effect for the future, without affecting the lawfulness of processing carried out before the withdrawal.

2. How to Submit a Request

2.1 Submit your request by email to privacy@cotoax.com or via support ticket in the client area. Requests submitted from the email address registered to your account can usually be processed fastest.

2.2 Please include:

• your full name and, if you have one, your account username or client ID;
• which right you wish to exercise (e.g. access, erasure, portability);
• any details that help us locate the data concerned (e.g. the service or time period).

3. Identity Verification

3.1 To protect your data, we must be sure that a request actually comes from you. Requests submitted from your registered account email or from within the client area are considered verified. For requests from other channels, we may ask for additional information reasonably necessary to confirm your identity (Art. 12(6) GDPR).

3.2 If we cannot verify your identity, we will inform you and may refuse the request; in that case you retain the right to lodge a complaint with a supervisory authority (Article 7).

4. Response Time & Format

4.1 We respond without undue delay and at the latest within one month of receiving your request. For complex requests or a high number of requests, this period may be extended by two further months; we will inform you of any extension and its reasons within the first month.

4.2 We respond in the same form in which the request was received where possible. Copies of data under the right of access or portability are provided in a commonly used electronic format.

5. Fees

5.1 Exercising your rights is free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable administrative fee or refuse to act on the request (Art. 12(5) GDPR); we will justify this in our response.

6. Data Hosted on Customer Servers

6.1 Cotoax provides infrastructure on which customers operate their own services (e.g. game servers, websites, applications). For personal data processed on such customer servers, the respective customer is the controller and Cotoax acts only as a processor. If your request concerns data held by one of our customers (for example, data you entered on a website hosted with us), please direct it to that customer first.

6.2 If you cannot identify or reach the responsible customer, or if the hosted content violates the law or our Terms of Service, you can contact abuse@cotoax.com. We will forward requests to the responsible customer where legally required and take our own measures where our Terms of Service or the law oblige us to.

6.3 Business customers processing personal data of third parties on our infrastructure can request a data processing agreement pursuant to Art. 28 GDPR at privacy@cotoax.com.

7. Complaints

7.1 If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR). We would nevertheless appreciate the opportunity to address your concerns first via privacy@cotoax.com.

8. Contact

8.1 Privacy requests and questions: privacy@cotoax.com

8.2 General support: support@cotoax.com or the client area at store.cotoax.com

8.3 Abuse reports: abuse@cotoax.com