Sign in to accept this agreement. You accept it as part of linking a game server.

1. The parties, and when this applies

This DPA is between you, the person or organisation that connects a game server (the "controller"), and Carpo IT, the operator of SnowstormBot (the "processor", "we", "us"). It applies only to the data your connected game server sends us through the vMenu Enhanced integration. For your account and website data we are the controller ourselves, which our Privacy Policy covers; this DPA does not change that.

A game server here means a FiveM server you run that is connected through the integration. A Discord server is your community on Discord. Our servers are the computers we run the service on.

2. What we process, and why

Purpose and nature. We process your game server's data only to provide the integration features you switch on: the online player list, the live map, moderation actions, whitelisting, reports, stats, and the other controls described in our documentation. We do not use it for anything else, and we never sell it.

Types of personal data. In-game player names, the game session slot number, network ping, and, where a player has linked their Discord account to their game, their Discord user ID. While a live map is open we also process live in-game details (position, heading, in a vehicle or not, in-game health and armour). Depending on the features you use, we also process whitelist entries, access passes, join requirements, in-game reports, and player statistics. We never receive players' real-world IP addresses.

Data subjects. The people who play on your game server. The section on retention in our Privacy Policy sets out exactly how long each kind of data is kept.

3. What we do as your processor

• We process this data only on your instructions, which you give us by choosing which features to switch on, and only for the purposes in section 2, unless the law requires otherwise (in which case we tell you where we are allowed to).
• Everyone on our side who is authorised to access this data (our staff and anyone acting for us) is bound to keep it confidential. This is about the people on our side. It does not cover anyone you choose to show the data to yourself, such as someone you give a live map share link to; that is a disclosure you make as the controller (see section 4).
• We keep the data secure with appropriate technical and organisational measures (section 5).
• We help you meet your own duties where you reasonably need us to: responding to your players' data-subject requests, keeping the data secure, reporting a breach, and any data protection impact assessment, so far as this relates to the data we hold.
• We tell you without undue delay if we become aware of a personal data breach affecting this data.
• When you unlink the game server, or on your request, we delete the data we hold for it, except where the law requires us to keep something. Our Privacy Policy also describes the automatic deletion that already happens (for example the roster clears when a server goes offline, and live positions are never stored).

4. What stays your responsibility as the controller

• You confirm you are allowed to manage the game server and to share its players' data with us.
• You are responsible for having a lawful basis to process your players' data, and for telling your players where the law requires it, including that the live map can show their in-game location, and that a share link can make that visible to others.
• Your instructions to us must themselves comply with data protection law.
• You handle your players' data-subject requests. Because we never contact your players, we cannot identify or reach them for you; section 6 explains the backstop if you do not act on a request.

5. Security, sub-processors, and transfers

Security. The data your game server sends reaches us over an encrypted connection your server starts (we never open a connection to your game server), and we restrict access to stored data. Player data needed for the live map lives only in memory while a map is open and is never written to our database.

Sub-processors. We use the same small set of trusted providers listed in our Privacy Policy (such as Discord and our hosting and infrastructure providers) to run the service. By accepting this DPA you authorise us to use them, and we remain responsible for what they do with this data. We will give you a way to object before we add or replace a sub-processor that handles this data.

International transfers. Where a provider processes data outside the European Economic Area, we rely on appropriate safeguards recognised under data protection law, as our Privacy Policy describes.

6. If a player cannot reach you

Data-subject requests from your players are yours to handle. If a player cannot reach you, or you do not act on their request, they can contact us at [email protected] with your Discord server's ID and, if they know it, the name of the game server. We will remove any of that data we still hold and take it up with you. If you really will not cooperate, we will act to get it resolved: not only ending the game server integration, but also blocking your entire Discord server and your Discord account from using SnowstormBot.

7. Liability, term, and contact

Liability. Liability under this DPA is governed by section 15 of our Terms of Service, and by Dutch law.

Term. This DPA applies for as long as you have a game server connected, and ends when you have unlinked your last game server, except for anything that by its nature should continue (such as confidentiality). We may update it, and when we do we will ask you to accept the new version before you can link another server.

Contact. For any question about this DPA or your players' data, email [email protected]. Carpo IT, Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 42069312.