1. Controller

The controller responsible for the processing of personal data on this website is:

Fatih Eksi
Sole proprietor trading as MiSu Games Verlag
Nathan-Kahn-Str. 13b
51061 Cologne, Germany
Telephone: +49 179 3456053
Email: fatih.eksi@misugames.com

2. Scope of this website

BlackBoxPuzzle.com provides information about the BLACK BOX PUZZLE brand and its products. The version described here does not include its own checkout. Registration is not enabled. Guided support and replacement-part enquiries are available through the form with protected file submission. Purchases may be made through separately operated online stores linked from this website.

We process personal data where necessary for the technical provision of the website, responding to enquiries, handling support and replacement-part enquiries including file submission, voluntary product review submission and publication, and respecting your privacy settings.

3. Hosting and technical access data

We use Cloudflare to provide this website, in particular Cloudflare Workers and the delivery of static content through Cloudflare's network. The provider is Cloudflare, Inc., United States, which may involve affiliates and subprocessors.

When you access the website, technically necessary connection and access data are processed. These may include your IP address, the time and content of a request, the requested URL, browser and device information, HTTP headers and security-related metadata. Processing serves to deliver the website, maintain its stability and protect it against misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of our website.

Persistent storage of our own Worker application diagnostics is disabled in the website application. The separate backup service logs technical success messages, timestamps, checksums and generic errors for operational monitoring; review text and private recovery keys are not logged. Cloudflare may nevertheless process and store data independently as part of its technical and security services. Retention depends on the relevant purposes and contractual terms; we cannot specify a single general deletion period for all such data.

4. International transfers involving Cloudflare

Use of Cloudflare may involve processing personal data outside the European Union or European Economic Area, particularly in the United States. Processing exclusively within Europe is not guaranteed.

Section 6.1 of the Cloudflare Self-Serve Subscription Agreement incorporates the Data Processing Addendum for relevant processing. Section 6 of that Addendum governs transfers from the EEA, including Standard Contractual Clauses for restricted transfers. This does not claim a separately signed individual agreement. Information on the available contractual arrangements and safeguards is provided at:

• https://www.cloudflare.com/cloudflare-customer-dpa/
• https://www.cloudflare.com/cloudflare-customer-scc/
• https://www.cloudflare.com/privacypolicy/

The applicable transfer mechanism depends on the specific processing activity and contractual terms.

5. Contact, support and replacement-part enquiries

Your support or replacement-part enquiry

We use your information to handle your enquiry, identify the product, request necessary details and, where agreed, provide a replacement-part service. We process your issue and description, product category and edition, article number and any available batch code, acquisition and purchase-channel information, and necessary contact details. Depending on the issue, this may include receipts or alternative acquisition information, photographs and, where necessary, delivery details. We request delivery details only where needed to handle the enquiry or an agreed delivery.

You can indicate that a receipt or batch code is unavailable. Missing proof of purchase does not automatically exclude statutory rights. Without the information needed for your particular issue, we may be unable to complete our assessment. Submitting an enquiry is free and does not create a payment obligation or a promise of delivery. Any paid replacement-part service requires a separate agreement.

Please provide only necessary information and redact unnecessary details on receipts. Do not send bank login credentials, payment-card details or unnecessary personal information about others. Files are linked to the relevant case and checked for malware and unsuitable file content. Images and PDFs may be converted into sanitised working copies; your local original is unchanged. Files are not submitted to a public virus-scanning service.

Legal bases

Where processing is necessary to perform a contract with you or take steps at your request before entering into a contract, it is based on Article 6(1)(b) GDPR. Other enquiries are handled under Article 6(1)(f) GDPR; our legitimate interest is responding to and appropriately handling incoming enquiries. Protection against misuse, secure file processing, accountable case handling and necessary backups also rely on Article 6(1)(f) GDPR. Statutory retention relies on Article 6(1)(c) GDPR. Where information is necessary to establish, exercise or defend legal claims, our legitimate interest in doing so is the basis under Article 6(1)(f) GDPR. We retain only the information needed for the relevant purpose.

Emails, additional information and automatic reminders

Case-related acknowledgements, requests for information and status messages are sent through IONOS. The sender and reply address is support@blackboxpuzzle.com. Replies are handled in our existing business mailbox info@blackboxpuzzle.com, with a forwarded copy to fatih.eksi@misugames.com. Mailbox, sent-mail and local copies may result. Support emails contain no personal open or click tracking. Brevo is not used to send support emails.

To provide additional information securely, you receive a case reference and a single-use access code valid for up to 72 hours. Open BlackBoxPuzzle.com yourself and enter both in the support area. The code does not grant access to other cases. Emails contain no confidential continuation link. If a code expires, you can reply by email and obtain a new code where needed.

If we need further information and receive no reply, a reminder is planned after seven days. The case may be closed administratively no earlier than fourteen days after the first request and no earlier than seven days after the reminder is sent. These periods rely on documented sending, which does not prove delivery or reading. Detected delivery problems or an unreliable inbox reconciliation prevent automatic closure. An incoming, matched reply interrupts this process. Cases subject to retention holds or outstanding financial matters are not closed automatically.

Administrative closure is an organisational step only. It does not determine statutory claims, trigger charges or delivery, or mean that data is deleted immediately. You can still contact us. Statutory consumer rights remain unaffected.

To match replies and avoid inappropriate reminders, we reconcile case reference, sender address, subject, message and reply identifiers, receipt time and necessary technical error information. This automatic reconciliation does not retrieve message bodies or attachments and does not change mailbox messages. The correspondence itself is handled through the usual support process. We record case status, handling decisions and sending, response and error times; email opens are neither recorded nor used to calculate deadlines.

Service providers and possible international processing

Cloudflare, Inc., United States, provides the technical support application, case management, private file storage, internal file inspection and encrypted backups. IONOS SE provides our business email service. Where these providers process data on our behalf, the existing data processing agreements apply. Access is limited to people and providers authorised for the relevant tasks.

R2 storage used for support files and backups is configured with EU jurisdiction. This does not guarantee that all computing, support access or platform logs remain exclusively in the EU. Cloudflare processing may take place in the United States in particular. The contractual transfer provisions described in Section 4 of the general Privacy Policy also apply to support. Information about safeguards is available in the Cloudflare Data Processing Addendum and Standard Contractual Clauses; you may request a copy of applicable safeguards through our privacy contact. The IONOS data processing agreement provides for EU/EEA processing and addresses necessary third-country transfers under Articles 44 onwards GDPR. Exclusively German storage is not guaranteed.

General and business enquiries may be sent to fatih.eksi@misugames.com. Email links open your email application; any B2B contact field creates only a local email draft.

6. Retention and deletion of support data

We keep information for as long as needed to handle the enquiry, comply with legal duties or safeguard legitimate claims. For closed form cases with no lawful reason for further retention, the standard cleanup periods are 90 days after closure for attachments and twelve calendar months for other case data, including the associated handling history. Expired, unsubmitted form sessions are cleaned up. Separate short-lived technical sending/error identifiers have a 30-day expiry period; this does not shorten retention of the case history.

The email mailbox follows a separate documented monthly review process. Closed support correspondence is generally reviewed twelve months after closure to determine whether further retention is necessary. This covers attachments, sent messages, forwarded copies and local files. Information no longer needed is deleted. Deleting a case in the form system does not automatically remove these email copies.

Records subject to statutory retention and information needed for outstanding claims or disputes are excluded from standard cleanup. Depending on their content, statutory periods may include six years for business correspondence subject to retention and eight years for accounting records. This does not mean that all support data is kept for six or eight years. Necessity, the start of a retention period and any further retention depend on the particular record and purpose. When that reason ends, the information is included in the deletion process.

Case data and related files are backed up daily in encrypted form. A 30-day expiry rule is configured for these backups; actual removal follows the provider's execution cycle and is not guaranteed to the second. Deleted information may remain in backups until expiry but is not returned to the active support dataset. Limited deletion records are stored separately in encrypted form and applied before restoration for this purpose. These records have a configured 31-day expiry rule. No single deletion period has been verified for all providers' own logs and backups; the purpose-based and contractual criteria in the general Privacy Policy apply.

7. Browser settings and local storage

Settings for sound, motion and dismissal of the Club invitation are held only in memory during the current page visit in this website version. They are not saved as persistent browser preferences. Previously stored sound, motion or Club preferences are not read or automatically removed. Sound is initially muted; the website initially takes account of your system's reduced-motion preference.

When you make a selection in the privacy settings dialog, the website locally stores a version identifier, your choice regarding analytics features and a timestamp in your browser under the key bbp-consent-v3. Your selection is recognised for up to 180 days. The stored entry is not necessarily removed automatically after that period. You can change your choice using the privacy settings link in the footer and remove website data through your browser settings.

Section 25 of the German Telecommunications-Digital Services Data Protection Act (TDDDG) governs storing information on, or accessing information from, your device. Storage that is strictly necessary to provide a service expressly requested by you may be permitted without separate consent; otherwise consent is generally required. The storage described here is intended to remember and respect your privacy selection.

The site language follows the DE/EN URL path. Entry through the root address takes the browser language into account. Language selection is not stored persistently. Older bbp-language entries are neither read nor written; existing entries can be removed through your browser’s website-data settings.

Strictly necessary cookie

For the support function you request, we use the bbp_support cookie for up to 24 hours. It securely associates your form session and helps prevent duplicate submissions. This necessary storage relies on Section 25(2)(2) TDDDG; related personal-data processing relies on Article 6(1)(f) GDPR, with the legitimate interest of secure and reliable form use. Short-lived hashed security identifiers limit misuse. The support form sets no advertising or analytics cookies. Google Analytics 4 remains disabled for the planned launch.

8. Google Analytics 4 and consent

Google Analytics 4 is disabled for the planned launch. A selection in the data-settings dialog does not activate the blocked service. The following information describes the prepared analytics function, which is currently inactive. Future use requires separate operational activation and your voluntary consent. Our provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC and other Google companies may participate in processing.

Data includes page views, pseudonymous browser and session identifiers, engagement time and interactions such as categories, editions, collection navigation, product finder use, difficulty levels, scroll progress, video and selected button interactions, language changes and clicks to our external shop. Technical browser/device characteristics, language and approximate geographic information are also processed. Google processes the IP address during transmission, in particular to derive approximate location; according to Google, GA4 does not log or store it. This does not make all analytics data anonymous. We do not send form contents, free search text, email addresses, support details or continuation tokens as analytics parameters. This measurement does not record orders or payments in the external shop.

The legal basis is your consent under Article 6(1)(a) GDPR and, for storing/accessing non-essential information, section 25(1) TDDDG. In Basic Consent Mode, Google tags load only after consent. Before consent or after rejection, our analytics implementation makes no connection to Google and sends no analytics data. Advertising storage, advertising user data, ad personalisation and Google Signals are disabled for this website tag.

After consent, Google Analytics uses in particular _ga and _ga_VBGZR6VCQZ cookies to associate browsers and sessions. Our tag configuration limits their lifetime to 180 days without renewing it on each visit. Browsers may apply shorter periods. The existing property is configured to retain user-level and event-level data for 14 months; the period for user identifiers may restart with new activity. This setting does not apply in the same way to aggregated standard reports.

You may withdraw consent at any time via “Data settings” in the footer, as easily as granting it. The website stops further analytics calls, removes its accessible GA cookies and reloads without Analytics. Withdrawal takes effect for the future and does not automatically delete data previously processed lawfully. The website remains usable without consent.

Processing outside the EEA, particularly in the United States, is possible. Google provides data processing terms and transfer mechanisms including Standard Contractual Clauses; the applicable basis depends on the recipient and current terms. Exclusively European processing is not guaranteed. See Google data processing terms, international transfers and Google privacy information.

9. Product finder and links to external shops

The product finder processes your selections in your browser without creating an account. Certain filter values may appear in the URL and therefore become part of technical request data or your browser history when a link is opened or shared. Please do not enter personal information into URL fields.

Purchase links lead to a separately operated MiSu Games store on Shopify. The privacy information of the linked store applies to processing on that website. BlackBoxPuzzle.com itself does not process orders or payments.

10. Media and availability monitoring

Images, fonts and videos are delivered through the website infrastructure. The technical data described in Section 3 are processed when these resources are requested.

We use UptimeRobot to monitor technical availability. The service automatically requests configured website addresses at regular intervals and notifies us of outages. This does not embed a UptimeRobot tracking service in visitors' browsers.

11. Recipients of personal data

Where necessary for the purposes described, personal data are processed by our technical service providers, in particular Cloudflare for hosting, delivery and security, and IONOS for business email services. Cloudflare also provides technical support processing, including private file inspection and backups. Google for Analytics is used only after separate activation and consent; GA4 is disabled for the planned launch. Further disclosures are made only where there is a lawful basis or legal obligation.

12. Your rights

Subject to statutory requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20).

Where processing is based on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. You may object to processing for direct marketing at any time. You may withdraw consent with effect for the future at any time; this does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, please contact fatih.eksi@misugames.com.

You may also lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information: https://www.ldi.nrw.de/.

13. Voluntary provision of data and automated decisions

No registration is required to use the information pages. If you contact us, you only need to provide the information necessary to handle your enquiry; without it, we may be unable to respond. No solely automated decisions within the meaning of Article 22 GDPR are made in this website version.

14. Product reviews and transparency

The controller is Fatih Eksi, MiSu Games Verlag. Contact support@blackboxpuzzle.com about reviews or privacy. Full business details are provided in the Legal Notice.

Reviews relate only to the selected BLACK BOX PUZZLE article and edition. Submission is voluntary and requires neither registration nor a receipt. Reviewers declare that they have used the product. We do not match reviews to orders or check receipts. Reviews are not labelled verified purchases. Technical limits discourage repeated submissions but do not prove purchase or identity.

All submissions undergo moderation before publication using the same objective criteria. Positive and negative experiences are treated equally. Low ratings, criticism and differing opinions are not reasons for rejection. Spam, unlawful content, third-party personal information, secret puzzle-motif spoilers and content unrelated to the selected product are not published. We do not change ratings or review text. A reasoned rejection may be reconsidered through the contact address; provide the review ID, not the private withdrawal code.

Counts and averages include only published reviews of that specific product. The latest 50 contributions are displayed; all published contributions are included in the average. No average is shown where there are no published reviews.

Data processed

We store review ID, article ID, rating, optional text, language, creation/update times, status, rejection reason and version. Additional fields include a pseudonymous browser identifier, an idempotency identifier and a digest of a private withdrawal code. Moderation and withdrawal events record review ID, action, time, reason and technical actor role. We do not request names, email addresses, photos or receipts. Free text may nevertheless contain personal information; please avoid including it.

Only rating, text, date and product association are published. Browser/network identifiers, withdrawal codes, internal reasons and actor records are not public. There is no automatic purchase verification or automatic publication.

When you request submission, a cookie named bbp_review_client is set with a random server-signed identifier to limit duplicate submissions. It is a session cookie without a persistent expiry (browser session restoration may preserve it). It is HttpOnly, SameSite=Strict and Secure over direct HTTPS. The review form uses the website's shared analytics consent settings. Only after valid consent and separate technical activation can a first successful submission produce the review_submit_success analytics event. Ratings, review text, review identifiers, withdrawal codes and other form entries are not transmitted as analytics parameters. Reviews can be submitted without analytics consent. No marketing pixels are used. Consent is stored in Local Storage as described above; the review form itself does not use Session Storage.

For rate limits, the server derives a daily changing identifier from the network address and a secret key. No raw IP address is stored in the reviews database; separate provider logs are not covered by this statement. Submission is limited to five attempts per network per day and 100 attempts globally per day. Shared networks may share a limit. Rate-limit records carry a two-day expiry marker; actual removal follows the controlled deletion process.

Cloudflare Workers provides hosting. The separate production reviews D1 database was created with EU jurisdiction; Cloudflare reports EEUR. It is separate from the test databases. This is not a promise that all Worker processing or infrastructure logs remain in the EU. The general Cloudflare hosting and transfer disclosures in the consolidated privacy policy also apply to reviews. No uniform deletion period for all platform logs has been verified or is promised. Manual email contact uses the existing IONOS mail service. No Shopify review integration is active.

You may optionally tell us where you obtained your puzzle (Amazon, MiSu Games online shop, retail store, eBay/secondhand, flea market, gift or other). “Other” allows an optional description of up to 120 characters. Please do not provide names, order numbers or contact details. We use this information only internally to understand how our products reach users. It is not published or sent to Google Analytics and does not affect stars, moderation or publication. This is not purchase verification. The legal basis for this limited internal analysis is Article 6(1)(f) GDPR; our interest is providing appropriate assistance across acquisition channels. Providing this information is entirely optional. You may object and request its removal. Upon withdrawal, acquisition details are immediately removed from the active review record; otherwise, the review and deletion periods described below for the associated review apply.

Withdrawal, retention and rights

You may withdraw publication using your review ID and private withdrawal code. The text is removed from the active record and no longer displayed. Keep the code private; only its digest is stored by the operator. Statutory privacy rights do not depend on holding the code; reasonable verification of association may be necessary without it.

Voluntary review submission and publication are based on your consent under Article 6(1)(a) GDPR. This is independent of Analytics consent and may be withdrawn for the future. Limited security and accountability processing is based on Article 6(1)(f) GDPR; our interests are preventing manipulated reviews and misuse and maintaining accountable moderation and withdrawal handling. The session cookie used only when you request submission provides necessary protection for that review service (section 25(2)(2) TDDDG).

We review new submissions weekly using consistent criteria. Pending reviews are specifically reviewed after 90 days; this is not automatic deletion. Rejected or withdrawn records are scheduled for deletion after 30 days from the last update unless lawful retention grounds apply. Deletion is controlled and follows an individual review of lawful retention grounds; exceeding a period does not trigger unattended deletion. Moderation records have an intended maximum retention period of 365 days where necessary and justified. The technical deletion review identifies records after this period; actual deletion is controlled by the operator and does not occur automatically at the deadline. Published contributions are reviewed monthly for continuing purpose and are no longer displayed after withdrawal. Personal content in rejected or withdrawn reviews is not used for marketing.

Deletion records contain review ID and time only. They prevent removed contributions from reappearing after an older backup is restored and must remain available for as long as affected backups can be restored. Historical backups are not an active data source. Restoration reapplies deletion records and quarantines remaining previously published reviews for rechecking. Immediate removal from every historical backup is not promised.

Subject to applicable conditions, you may request access, rectification, erasure, restriction and portability; you may object to processing based on legitimate interests. Consent can be withdrawn for the future. You may complain to a data protection supervisory authority. Contact support@blackboxpuzzle.com. Reviewing is not a condition of purchase or support.

Review backups

Review data is backed up daily in encrypted form to a private Cloudflare R2 bucket with EU jurisdiction. Daily archives have a configured expiry rule of 30 days; actual removal follows the provider’s execution and is not guaranteed to the second. The private recovery key is kept separately from the backup service. Backups are not used for public display. R2 and D1 belong to the same provider; this does not guarantee that all related processing and logs remain exclusively in Europe. Separate alert rules are configured.

15. Effective date and updates

Last updated: 26 October 2026. We will update this Privacy Policy if actual processing activities or legal requirements change.