Data Processing Agreement

Version: ltd-1 · Effective: from the date on which the operation of the BlazeHost services is transferred to BLAZEHOST LIMITED (clause 15.1 of the Terms)

The Czech version of this agreement is binding; the English version is a translation. If the language versions conflict, the Czech version prevails.

concluded under Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 28 of the UK GDPR (together the "GDPR"; references to articles of the GDPR refer to both instruments to the extent they apply to the processing) between

the Customer of the BlazeHost services as controller (the "Controller")

and

BLAZEHOST LIMITED, Company number 17523509, England and Wales, registered office 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom, as processor (the "Processor").

Processor's data protection contact: [email protected]. An EU representative under Article 27 GDPR has not been appointed yet; all data protection matters can be addressed to [email protected].

1. Subject matter and conclusion of the agreement

1.1. This agreement governs the processing of personal data that the Controller stores or otherwise processes within the services provided by the Processor under the General Terms and Conditions of BlazeHost Services (the "Terms"), in particular on game servers, in Discord bots, on VPS, Cloud VPS, dedicated servers and in web hosting (the "Services").

1.2. This agreement forms part of the contract for the provision of Services and is concluded at the same time. If the Controller does not process personal data within the Services, or processes it solely for personal or household purposes (Article 2(2)(c) GDPR), this agreement applies mutatis mutandis.

1.3. The processing of data about the Customer itself (customer account, payments, support) is not the subject of this agreement; to that extent the Processor is an independent controller under the Privacy Notice.

1.4. Data processing agreements concluded with the previous operator of the BlazeHost services, Jiří Viták, company ID (IČO) 21766177, passed to the Processor together with the contracts for the provision of Services on the date the operation was transferred (clause 15.1 of the Terms); from the transfer date they are governed by this agreement. The Processor informs the Controller of this by the transfer notice. A Controller who does not agree with the transfer may terminate the contract for the provision of Services under the procedure in clause 15.1 of the Terms.

2. Nature, purpose and duration of processing

2.1. Nature of processing: storage, hosting and making available of data on the Processor's infrastructure, operation of virtualisation and network connectivity, automatic backups of game-service data (disaster-recovery backups: 7 daily and 4 weekly, see Annex 1), backups of game-service databases (at most 30 days) and creation of backups on the Controller's instruction (up to the number for the plan), filtering of network traffic as part of DDoS protection, sending operational alerts to the Processor's staff and deletion of data after the Service ends.

2.2. Purpose of processing: provision of the Services under the contract for the provision of Services. The Processor does not process personal data for its own purposes.

2.3. Categories of personal data: determined solely by the Controller through the content it stores in the Service; typically identification and contact data, login credentials, game nicknames and identifiers, IP addresses, communications and content created by the Controller's users. The Controller may process special categories of personal data (Article 9 GDPR) and data relating to criminal convictions (Article 10 GDPR) in the Services only at its own responsibility and only if it ensures appropriate additional measures within the Service (in particular encryption); the Services are not specifically designed or certified for such processing.

2.4. Categories of data subjects: in particular players, users and visitors of the Controller's websites and applications, and the Controller's customers, employees and collaborators.

2.5. Duration of processing: for as long as the Service is provided and thereafter for the time necessary to delete the data under clause 9.

3. Controller's instructions

3.1. The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by EU, Member State or United Kingdom law to which the Processor is subject; in such a case the Processor informs the Controller of that legal requirement before processing, unless the law prohibits this (Article 28(3)(a) GDPR).

3.2. Documented instructions are this agreement, the contract for the provision of Services, the settings and actions the Controller performs in the Panel or in the Service administration, and instructions sent by e-mail from the customer account address or by ticket.

3.3. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

4. Confidentiality

4.1. The Processor ensures that persons authorised to process personal data (the Processor's staff) have committed themselves to confidentiality or are under a statutory obligation of confidentiality (Article 28(3)(b) GDPR). Staff access the Controller's data only to the extent necessary to provide the Service, resolve a fault or incident, or in the cases provided for in the Acceptable Use Policy.

5. Security

5.1. The Processor takes the technical and organisational measures under Article 32 GDPR set out in Annex 1. The Controller is responsible for the security of what it manages itself within the Service (the operating system of a VPS and dedicated server, applications, passwords, access rights, encryption and backups of its own data).

5.2. The Processor may change the measures provided that the overall level of security is not reduced.

6. Sub-processors

6.1. The Controller gives the Processor a general authorisation to engage sub-processors. The current list is set out in Annex 2.

6.2. The Processor informs the Controller by e-mail or in the Panel at least 30 days in advance of any intended change (addition or replacement of a sub-processor). The Controller may object to the change on serious data protection grounds; if no agreement is reached, the Controller may terminate the affected Service as of the date the change takes effect and the Processor refunds the unused part of the prepaid price of the affected Service as credit or, at a Consumer's request, in money.

6.3. The Processor imposes on each sub-processor by contract the same data protection obligations as set out in this agreement and remains liable to the Controller for the performance of the sub-processor's obligations (Article 28(4) GDPR).

7. Assistance with data subject rights and other obligations

7.1. The Processor assists the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests to exercise data subject rights (Article 28(3)(e) GDPR). The Controller has direct access to the data in the Service (Panel, SFTP, Service administration) and normally handles requests itself. If the Processor receives a request from a data subject directly, it forwards it to the Controller without undue delay and does not handle it itself.

7.2. The Processor assists the Controller in ensuring compliance with the obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessment, prior consultation), taking into account the nature of processing and the information available to it (Article 28(3)(f) GDPR). The Processor may charge for assistance beyond the usual scope (in particular extensive searches in Service data or assistance not caused by a breach of the Processor's obligations) at a price that it communicates to the Controller in advance and the Controller approves.

8. Personal data breaches

8.1. If the Processor becomes aware of a security breach affecting the Controller's data, it notifies the Controller without undue delay, where possible within 48 hours of becoming aware of it, by e-mail to the customer account address (Article 33(2) GDPR).

8.2. The notification contains, to the extent the information is available: a description of the nature of the breach, the Services affected, the likely consequences, the measures taken and proposed, and a contact person. Information not available immediately is provided by the Processor in phases.

8.3. Notifying the breach to the supervisory authority competent for the Controller and to data subjects is the Controller's obligation; the Processor provides the necessary assistance.

9. End of processing, deletion and return of data

9.1. After the provision of a Service ends, the Processor deletes the Controller's data (Article 28(3)(g) GDPR) in accordance with the Terms:

• VPS, Cloud VPS, web hosting and dedicated servers: after the paid period ends or if credit is insufficient, the Service is suspended and, once the grace period of at least 7 days has expired, the data is irreversibly deleted;
• game servers and Discord bots: the suspended Service is deleted once the grace period of at least 14 days has expired. Backups created by the Controller in the Panel are deleted together with the Service. The Processor's disaster-recovery backups (clause 2.1) are kept for at most 30 days after the Service is deleted and then deleted automatically; the Service's database backups are deleted no later than 14 days after the database or Service is deleted. During this period the Processor uses them only for disaster recovery or at the Controller's request and makes them available to no one.

The exact grace period is shown in the order and in the order confirmation.

The Processor informs the Controller by e-mail of the suspension and, in advance as stated in the order, before deletion.

9.1a. At the Controller's request the Processor deletes the disaster-recovery backups of a deleted Service earlier.

9.2. Return of data is ensured by the Controller itself by downloading the data before the Service ends via the Panel, SFTP or the Service administration. On a request received before deletion, the Processor provides reasonable assistance; longer retention of data is possible only by prior agreement, normally against payment of the Service price for the extension period.

9.3. For dedicated servers, before handing the hardware over to another customer the Processor ensures secure erasure of the storage media (by overwriting the data or by cryptographic erasure; if erasure cannot be performed reliably, the medium is physically destroyed).

9.4. The Processor does not delete data where EU, Member State or United Kingdom law requires it to be retained; it informs the Controller of this.

10. Information and audits

10.1. On request the Processor provides the Controller with the information necessary to demonstrate compliance with the obligations under Article 28 GDPR and allows for audits, including inspections, conducted by the Controller or an auditor mandated by it who is bound by confidentiality (Article 28(3)(h) GDPR).

10.2. An audit must be announced at least 30 days in advance, may be carried out at most once every 12 months (unless prompted by a security breach or an instruction from a supervisory authority), during normal business hours and in a way that does not disrupt operations or endanger other customers' data. The costs of the audit are borne by the Controller. An audit on the data centre premises is subject to the rules of its operator and may be carried out only to the extent the data centre operator permits; otherwise the Processor provides the operator's available documentation.

11. Liability and final provisions

11.1. The parties' liability for damage caused by a breach of this agreement is governed by Article 82 GDPR and the Terms.

11.2. The Controller is responsible for having a valid legal basis for the processing of personal data it carries out in the Services and for having properly informed data subjects.

11.3. Matters not governed by this agreement are governed by the Terms. In the event of a conflict between this agreement and the Terms on data protection matters, this agreement prevails.

11.4. This agreement is governed by the law of England and Wales; this does not affect the mandatory provisions of the GDPR or the protection afforded to a Consumer by the mandatory rules of the state of their habitual residence (chapter 14 of the Terms). The Processor may amend this agreement under the procedure in chapter 12 of the Terms.

Effective: from the date on which the operation of the BlazeHost services is transferred to BLAZEHOST LIMITED (version ltd-1).

Annex 1 – Technical and organisational measures

• Physical security: the Processor's servers are located (colocation) in the firstcolo FRA4 data centre in Frankfurt am Main, Germany; physical protection of the premises, power and cooling are provided by the data centre operator under its own rules. Only persons authorised by the Processor have access to the hardware.
• Customer separation: each Service runs in a separate environment (game-server container, virtual machine, separate web hosting account); access credentials are unique to each Service.
• Access control: role- and permission-based staff access, principle of least privilege, mandatory two-factor authentication for staff, audit log of staff actions in the Panel (kept for 365 days).
• Protection of credentials: user passwords are stored as hashes; Service passwords and infrastructure access keys are encrypted in the database.
• Encryption in transit: the Panel and Service administration are available only over HTTPS/TLS; file access via SFTP.
• Network security: traffic filtering and DDoS protection at the network layer (L3/L4), infrastructure firewall, administrative access to the infrastructure restricted to authorised persons.
• Updates: regular security updates of host systems and Service management applications.
• Logging and detection: application logs kept for 14 days, monitoring of infrastructure availability.
• Backups: for game services, disaster-recovery backups of Service data (latest backup, 7 daily and 4 weekly; at most 30 days after the Service is deleted), game-service database backups encrypted on the Processor's side (7 scheduled, at most 30 days; 3 manual; at most 14 days after the database or Service is deleted) and manual backups in the Panel up to the number for the plan. Backups are stored on backup storage operated by the Processor itself in the firstcolo FRA4 data centre, Frankfurt am Main (EU). For VPS, Cloud VPS and dedicated servers the Controller creates backups (snapshots) itself. The values stated are default settings; the Processor will not increase them without amending this agreement.
• Incident handling: procedure for detecting, assessing and notifying security breaches under clause 8 of this agreement.
• Deletion: automatic deletion of Services after the periods under clause 9.

Annex 2 – List of sub-processors

The Processor stores Service data and its backups on its own infrastructure in the firstcolo FRA4 data centre, Frankfurt am Main (EU); the backup storage is operated by the Processor itself, without a sub-processor. The Processor is established in the United Kingdom, for which the European Commission has adopted an adequacy decision (Article 45 GDPR); access by the Processor's staff to data stored in the EU relies on that decision. Only data processed by Resend, Inc., Cloudflare, Inc. and Discord Inc. (USA) reaches other third countries, to the extent stated in the table; the transfer relies on the European Commission adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR) for certified recipients, and otherwise on standard contractual clauses (Article 46(2)(c) GDPR) concluded within these suppliers' contractual terms; for transfers from the United Kingdom the corresponding UK GDPR instruments apply (the UK Extension to the EU-U.S. Data Privacy Framework or the International Data Transfer Addendum). The Processor operates the Service management software (Pterodactyl/Wings, Proxmox, Convoy, Enhance) on its own infrastructure; its vendors have no access to the Controller's data.