Data Processing Agreement

The German text is the binding one. This translation is provided for convenience only.

If you process personal data on a game server, a VPS or a website with us, such as player data, your shop’s customer data or your website’s access logs, you are the controller of that data under the GDPR. We process it only on your behalf. This agreement sets that out as Art. 28 GDPR requires.

The parties are the customer ("controller") and GoodFlare IT, proprietor Arne Heidrich, Huthain 1, 09437 Börnichen, Germany ("processor"). The agreement supplements the Terms and Conditions ("main contract") and takes precedence over them on data protection.

It applies where the controller processes personal data when using our services and not purely for personal or household purposes (Art. 2(2)(c) GDPR).

The subject matter is the processing of personal data by the processor in providing the services agreed in the main contract: game servers, virtual servers (VPS and containers), web hosting and the related features of the customer area, such as file management, databases, backups, logs and statistics.

The agreement starts and ends with the main contract. Its obligations continue as long as the processor still processes the controller’s data, in particular until deletion under § 10.

The processor provides computing power, storage and network connectivity and operates the systems on which the controller sets up and runs its applications. Processing includes in particular storing, providing, transmitting (serving to visitors and players), backing up and deleting data. Its sole purpose is providing these services.

For websites, the processor’s front web server logs every request: IP address, time, method and requested address, status code, bytes transferred, processing time, referrer, user agent and the other request headers except cookies and credentials. These raw logs are kept for seven days and then deleted; they serve troubleshooting, defence against attacks and the “Zugriffe & Fehler” (traffic and errors) statistics. For these statistics, hourly figures are counted from them (requests, page views, visits, status codes, bytes, response times, pages requested without query parameters, referring websites as a name, country, names of known programs). The country is derived from the IP address while counting, using a database on the processor’s own server. Visits are counted by a hash of IP address and user agent whose random value changes daily; hashes and the random value are held in memory only and deleted after two days at the latest, so nobody is recognised across days. The hourly figures contain neither IP addresses nor hashes and are kept as long as the website exists.

The processor accesses the controller’s content only where needed to provide the service, for a support request of the controller, or to meet a legal obligation, for example to assess a notice of illegal content under Art. 16 of Regulation (EU) 2022/2065 (Digital Services Act, DSA). It does not use the data for its own purposes.

Which data is processed depends on the controller’s use. Typically:

• master and contact data, such as names, e-mail addresses and postal addresses
• account and usage data in the controller’s applications, such as player names, player IDs, user accounts, permissions, chat and game logs
• content posted by the controller or its users: texts, images, files, database content
• connection and log data: IP addresses, times, requested addresses, user agents
• contract and payment data where the controller runs a shop, for example

Data subjects are the people whose data the controller processes on the systems, typically:

• visitors of its websites
• players and community members on its game servers
• users of its applications and services
• its customers, prospects and business partners
• its staff and the sub-users it gives access

Special categories of personal data (Art. 9 GDPR) and data on criminal convictions (Art. 10 GDPR) are not part of the standard service. If the controller processes such data, it checks whether the measures in Annex 1 are sufficient and, on a VPS, adds its own measures such as encryption where needed.

The processor processes the data only on documented instructions from the controller, including with regard to transfers to a third country, unless required to do so by Union or German law; in that case it informs the controller of that requirement before processing, unless that law prohibits such information on important grounds of public interest (Art. 28(3)(a) GDPR).

Instructions are the main contract, this agreement and the settings and actions the controller makes in the customer area or through the API, such as creating a server, deleting files, creating or restoring a backup. Further instructions are given in text form, for example by e-mail to hello@goodflare.io.

If the processor considers that an instruction infringes the GDPR or other data protection provisions, it informs the controller immediately (Art. 28(3) sentence 3 GDPR) and may suspend it until the controller confirms or changes it.

The controller is responsible for the lawfulness of the processing and for safeguarding data subjects’ rights.

Confidentiality: everyone at the processor who may have access to the data is committed to confidentiality or under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR).

Security: it takes the technical and organisational measures under Art. 32 GDPR described in Annex 1. It may develop them further as long as the level of protection does not fall; it documents significant changes.

Location: the data is processed in Germany. Processing outside the European Union or the European Economic Area takes place only on the controller’s documented instructions and only under the conditions of Art. 44 et seq. GDPR.

Data subject rights: it assists the controller with appropriate measures in responding to requests under Art. 12 to 23 GDPR (Art. 28(3)(e) GDPR). Most data can be viewed, corrected, exported and deleted by the controller in the customer area. If a data subject contacts the processor directly, it forwards the request to the controller without delay and does not answer it itself.

Further assistance: taking into account the nature of processing and the information available to it, it assists the controller with the obligations under Art. 32 to 36 GDPR (Art. 28(3)(f) GDPR).

Records: it keeps a record of the processing activities it carries out on behalf (Art. 30(2) GDPR).

Contact: no data protection officer is designated because the conditions of Art. 37 GDPR and § 38 BDSG are not met. The contact for data protection is the proprietor, Arne Heidrich, hello@goodflare.io.

The controller gives general authorisation to engage other processors (sub-processors) (Art. 28(2) GDPR). Those engaged at conclusion are listed in Annex 2 and are deemed approved.

The processor informs the controller of any intended addition or replacement by e-mail at least four weeks in advance and updates Annex 2. The controller may object within that period for an important data protection reason. If the parties cannot agree, the controller may terminate the affected services without notice as of the change; paid time after it is refunded pro rata.

The processor imposes on each sub-processor by contract the same data protection obligations as set out in this agreement, in particular sufficient guarantees for appropriate technical and organisational measures (Art. 28(4) GDPR), and remains liable to the controller for their compliance.

Ancillary services in which no controller data is processed, such as hardware maintenance without data access or payment processing for our own invoices, are not sub-processing.

The processor notifies the controller of a personal data breach without undue delay after becoming aware of it (Art. 33(2) GDPR), by e-mail to the address in the account. The notification contains, as far as known, the information under Art. 33(3) GDPR; what is not yet known is provided in phases.

Notifying the supervisory authority and the data subjects (Art. 33 and 34 GDPR) remains the controller’s task; the processor assists.

It informs the controller without delay of inspections and measures by a supervisory authority and of requests from authorities concerning the controller’s data, unless such information is prohibited by law.

The controller can export its data at any time during the term, for example via SFTP, the file manager, by downloading a backup or by exporting a database.

When the main contract ends the service is paused. The data then stays available for retrieval for 30 days; after that the processor deletes the server with all data, including the backups it stores (Art. 28(3)(g) GDPR). Until then the controller can export a game server in full in the customer area (“Export everything”); for the other services the processor provides an export on request. Data is kept longer only where Union or German law requires it.

Storage media taken out of service are securely erased or physically destroyed before they leave our hands.

The processor confirms the deletion in text form on request.

The processor makes available to the controller all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, by the controller or an auditor mandated by it (Art. 28(3)(h) GDPR).

Audits start with written information. An on-site inspection is announced with reasonable notice, as a rule at least two weeks, takes place during normal business hours and must not affect operations or other customers’ data. A mandated auditor must not be a competitor of the processor and must be bound to confidentiality. The data centre’s access rules apply there. Each party bears its own costs.

There are currently no certificates or audit reports by independent bodies about the processor.

Liability towards data subjects is governed by Art. 82 GDPR. Between the parties, the liability rules of the main contract apply unless Art. 82 GDPR precludes it.

The agreement is concluded in electronic form (Art. 28(9) GDPR). [To be decided: acceptance with the order or separate confirmation in the customer area, each with the time and version stored.]

Changes require text form. In case of conflict this agreement prevails over the main contract. Should a provision be invalid, the others remain in force. German law applies.

This annex describes the measures for the systems on which the controller’s data is processed. It names only what is in place; anything missing is stated as such.

[For the owner to confirm before launch: every measure in this annex is in place in production.]

The servers are the processor’s own hardware, operated by the proprietor himself. They are located in a data centre in Nuremberg, Germany [exact address of the site]; the data centre provides space, power, cooling and physical security and has no access to data.

The controller’s data is not stored on workstations or in offices.

Access control:

• Customer area: sign-in by link to the stored e-mail address, by passkey or through Google or Discord; no password is stored. A second factor (authenticator app) is available to every account. Signed-in devices are shown with IP address and browser and can be ended one by one.
• Administrative access to virtualisation, server nodes and databases is held by the proprietor only and protected by keys or a second factor.
• Programming interfaces, for example to the virtualisation, use their own keys with the least privileges, limited to the resources of customer services.
• Credentials the portal has to keep (keys to the server nodes, access tokens for DNS providers, initial passwords of new VPS until first retrieved) are stored encrypted with AES-256-GCM.
• File access via SFTP with separate credentials per server; key-based sign-in is possible.

Access and separation control:

• Every game server and every website runs in its own container, every VPS as its own virtual machine or container, each with fixed limits for CPU, memory and storage.
• Customer server networks are separated from our internal networks and divided by a firewall.
• Websites run on their own nodes, separate from game servers. Every database has its own user.
• In the customer area each account sees only its own services. Sub-users get only the permissions the controller gives them.
• The processor accesses content only in the cases of § 2.

Transfer and input control. Retention of activity and sign-in logs: [period to be set].

• Customer area, programming interfaces and consoles are reachable only encrypted (TLS). Files are transferred encrypted via SFTP.
• The processor does not warrant encryption of stored data at the storage level. Anyone who needs it can set it up on a VPS.
• Actions on servers and domains (such as start, stop, backups, DNS record changes) are recorded with time and acting person in the activity log, which the controller can view in the customer area. Sign-ins are stored with IP address and browser.
• Raw website access logs are deleted after seven days (§ 2).

Availability control and recovery:

• All server nodes are checked automatically every minute; incidents are reported and shown on the status page.
• Public addresses are connected through the Noez network, which filters denial-of-service (DDoS) attacks.
• Fixed resource limits per container and virtual machine keep one service from affecting others.
• Backups: game servers and websites can be backed up in the panel, manually and on a schedule; the controller starts a restore itself. These backups are currently stored on the same server node as the service. They protect against operating mistakes and failed updates, not against the loss of that node or the site. For VPS the processor currently makes no backups. Copies at a second location are planned; until then the controller should keep its own copies outside our systems.
• Security updates for virtualisation and server nodes are applied promptly.

Data protection by default, control of sub-processors and regular review:

• Only what operations need is collected. Visitor statistics contain no full IP addresses; shared server logs are cleaned of IP addresses and credentials before publication (Art. 25 GDPR).
• Sub-processors are chosen carefully and bound under Art. 28(4) GDPR (Annex 2).
• Security incidents are documented, assessed and notified under § 9.
• The measures are reviewed and adjusted at least once a year and after every significant incident (Art. 32(1)(d) GDPR).

As at conclusion of this agreement. [Enter name and address of Noez and conclude the contract under Art. 28(4) GDPR.]

• Noez: connectivity of the public IP addresses and filtering of denial-of-service (DDoS) attacks. The services’ traffic passes through this network; no content is stored there.

These providers do not process data on the controller’s behalf and are therefore not in Annex 2:

• Stripe (payments) and our e-mail providers (Zoho Mail for our mailboxes, a service for the customer area’s automatic e-mails): they process only data of our own contract with you, for which we are the controller (privacy policy).
• The data centre in Nuremberg that houses our own hardware: it provides only space, power, cooling and physical security and has no access to data.
• Cloudflare: if you connect your own Cloudflare account in the customer area, we write DNS records through your access; Cloudflare acts under your own contract with Cloudflare. Where we use our own Cloudflare zone for server addresses, it contains only server names and IP addresses.
• Domain registrars and registries: when a domain is registered they act as controllers in their own right (Terms §§ 9 to 11).
• Planned: backup copies with a storage provider in the EU. It will only be engaged after notice under § 8.