Data processing agreement (DPA)

1. Subject matter and instructions

The subject matter is the processing of personal data by FNLY IT UG (haftungsbeschränkt) ("processor") on behalf of the customer ("controller") under Art. 28 GDPR, solely to provide the hosting services and only on documented instructions of the controller.

2. Nature, purpose, duration, data categories

Nature and purpose: running and managing the booked servers. Data subjects: end users and players of the controller. Data categories: the data the controller stores on the server, for example account names, IP addresses, chats and save games. Duration: for the term of the main contract.

3. Technical and organisational measures

The processor maintains appropriate technical and organisational measures under Art. 32 GDPR: physical, system and data access control (data centre security, role-based permissions, encrypted access), TLS encryption of connections, separation of customers, logging, regular backups and procedures to restore availability.

4. Sub-processors

The controller approves the following sub-processors; changes are announced in advance and the controller may object:

• Hetzner Online GmbH, Gunzenhausen: infrastructure in Germany and Finland
• Stripe Payments Europe, Ltd., Dublin: payment processing
• Anthropic, PBC, San Francisco: AI assistant, only for requests the controller makes itself

5. Data subject rights and support

The processor supports the controller appropriately in fulfilling data subject rights and notification duties under Art. 33 and 34 GDPR and reports personal data breaches without undue delay.

6. Deletion and return

After the contract ends, the processed data is deleted or returned at the controller's choice unless a legal retention obligation applies.

7. Evidence

The processor provides the controller with the information needed to demonstrate compliance and allows audits to a reasonable extent.