Data Processing Agreement (DPA) in accordance with Art. 28 GDPR

(1)

The Data Processor provides server services for the Controller in accordance with the main agreement (e.g., game server hosting).

(2)

To the extent the Customer stores, processes, or transmits personal data on the provided server, this is done exclusively within the scope of this agreement.

(3)

This agreement is valid for the duration of the underlying main agreement. Upon its termination, all stored data and any backups created will be deleted in accordance with § 9.

(1)

Processing is carried out for the purpose of providing, maintaining, and securing virtual servers (game servers) for the Customer.

(2)

The Data Processor provides the technical infrastructure (server and network capacities, panel access, backup options) and, if necessary, performs maintenance and support measures.

(3)

The Data Processor does not conduct any review, use, or evaluation of the content of the data stored on the servers.

(1)

(2)

(1)

ServerAtelier processes personal data exclusively based on documented instructions from the Customer, unless required by law.

(2)

All persons at the Data Processor involved in the processing of personal data are bound by confidentiality.

(3)

(4)

The Data Processor supports the Customer in fulfilling its obligations pursuant to Art. 32–36 GDPR (e.g., in case of security incidents or data subject requests).

(5)

ServerAtelier will inform the Customer without delay if, in its opinion, an instruction violates data protection law.

(1)

(2)

Further sub-processors may only be engaged after prior information and consent of the Customer.

(3)

Contracts in accordance with Art. 28(4) GDPR are in place with all sub-processors.

(4)

ServerAtelier does not transfer data to third countries outside the EU/EEA unless explicitly agreed contractually.

(5)

In the event of a transfer to a third country that is neither recognized under Art. 45 GDPR as providing an "adequate level of protection" nor secured by other appropriate safeguards (e.g., EU Standard Contractual Clauses), ServerAtelier confirms that adequate additional technical and organizational measures are in place.

(1)

The Customer remains the Controller for the processing within the meaning of the GDPR.

(2)

The Customer is responsible for the lawfulness of the processing, the protection of personal data, and safeguarding the rights of data subjects.

(3)

The Customer may only use the Data Processor in compliance with applicable data protection law.

(1)

ServerAtelier will inform the Customer without delay about any personal data breaches affecting the data processed under this agreement. The notification will include at least the nature of the incident, the categories of data affected, potential consequences, and the measures taken or planned to address the breach.

(1)

Upon request, the Data Processor will provide the Customer with the information necessary to demonstrate compliance with Art. 28 GDPR (e.g., certificates or data center audit reports).

(2)

Audits or inspections may be carried out after reasonable prior notice during business hours and without endangering system security.

(1)

Upon termination of the main agreement, all data stored on the servers and any backups created will be deleted immediately (0 days retention).

(2)

Data will only be returned or transferred upon explicit instruction from the Customer and within the term of the agreement.

(3)

Backups stored in Hetzner Object Storage are deleted automatically as soon as the agreement ends or the server panel removes the server.

(1)

The liability provisions of the main agreement apply. Liability under data protection law is governed by Art. 82 GDPR.

(1)

Amendments or supplements to this agreement require written form.

(2)

Should any provision of this agreement be invalid, the validity of the remaining provisions shall remain unaffected.

(3)

German law shall apply. The place of jurisdiction shall be – insofar as legally permissible – the registered office of ServerAtelier.