Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the agreement between you, the customer ("Customer"), and VibeGAMES B.V., Lage Ham 190, 5102 AE Dongen, The Netherlands, Chamber of Commerce 86823345 ("VibeGAMES"), for the services described in the Terms of Service. It applies whenever the Customer stores or processes personal data of other people on infrastructure rented from VibeGAMES and the General Data Protection Regulation (EU) 2016/679 ("GDPR") applies to that processing. In that relationship the Customer is the controller and VibeGAMES is the processor, as meant in article 28 GDPR. By ordering or continuing to use a service, the Customer accepts this DPA. No signature is needed; a signed copy is available on request.

This DPA does not cover the personal data VibeGAMES processes about the Customer as its own controller, such as the account, invoices, support tickets and website visits. The Privacy Policy covers that.

Definitions
What VibeGAMES processes, and why
What VibeGAMES can and cannot access
Instructions
Confidentiality
Security
Sub-processors
Transfers outside the EEA
Assistance to the Customer
Personal data breaches
Audits
Deletion and return
Liability
Duration and changes
Governing law
Contact

1. Definitions

"Personal data", "processing", "controller", "processor", "sub-processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given to them in the GDPR. "Service" means a game server, VPS, VDS, bare metal server, DDoS protection or any other service the Customer rents from VibeGAMES. "Customer Data" means all data the Customer, or the users of the Customer's Service, store on or send through a Service.

2. What VibeGAMES processes, and why

Subject matter. The hosting of the Service: providing compute, memory, storage and network, keeping it powered and reachable, protecting it against denial of service attacks, and where the Customer uses them, backups and the control panel.
Nature of the processing. Storage and transmission of Customer Data on VibeGAMES' infrastructure. VibeGAMES does not read, analyse or use Customer Data for its own purposes.
Purpose. Delivering the Service the Customer ordered, nothing else.
Duration. As long as the Service runs, plus the deletion window in section 12.
Categories of data subjects and personal data. The Customer decides what their Service stores, so the Customer determines these. On a game server this is typically player identifiers (usernames, Steam, Discord or license identifiers, IP addresses), chat, in-game progress and moderation records. On a VPS, VDS or bare metal server it is whatever the Customer installs and stores. The Customer is responsible for having a lawful basis for that processing.

3. What VibeGAMES can and cannot access

The three kinds of Service differ in what VibeGAMES technically reaches. This DPA follows that line.

Game servers (control panel). A game server runs in a container that VibeGAMES operates. VibeGAMES' systems have technical access to the files of the server to start it, install the game, keep it updated and make the backups the Customer configures. VibeGAMES staff open a customer's server files or console only (a) when the Customer asks for it in a support request, (b) to investigate abuse, a security incident or a legal obligation, or (c) to keep the platform running, and in each case only to the extent needed. Staff access is tied to a personal account and logged.
VPS and VDS. A virtual server is handed over to the Customer as a whole machine. VibeGAMES manages the hypervisor and the network underneath it and holds no login to the operating system inside. VibeGAMES does not access the data in the virtual machine. The Customer can ask VibeGAMES to reinstall the machine, change its resources or open the emergency console; VibeGAMES acts on such requests and on nothing else. Snapshots and backups the Customer orders are stored as whole-disk images and are not opened by VibeGAMES.
Bare metal servers. A dedicated server is physical hardware that only the Customer installs and operates. VibeGAMES has out-of-band hardware management (power, reinstall on request, remote console on request) and no access to the installed operating system or the data on the disks. The Customer is responsible for disk encryption if the data requires it. When a bare metal server is returned, VibeGAMES wipes its disks before the hardware is reused.
Network and DDoS protection. VibeSHIELD inspects traffic to and from the Service to filter attacks. It processes packet headers and, for game-specific filters, protocol fields; it does not store payload. Traffic statistics are kept per IP address for the Customer's own attack reports and for capacity planning.

4. Instructions

VibeGAMES processes Customer Data only on documented instructions from the Customer. The Terms of Service, this DPA, the order and the actions the Customer takes in the dashboard and the control panel (starting, stopping, reinstalling, configuring backups, opening a console, raising a support request) are those instructions. If VibeGAMES is required by Union or Member State law to process Customer Data otherwise, it informs the Customer of that requirement before processing, unless the law prohibits that. VibeGAMES tells the Customer when, in its opinion, an instruction infringes the GDPR.

5. Confidentiality

Everyone at VibeGAMES who can reach Customer Data is bound to confidentiality by contract and has access only to the systems needed for their work. VibeGAMES does not disclose Customer Data to third parties except to sub-processors under section 7, or where the law requires it; in that case VibeGAMES informs the Customer unless prohibited.

6. Security

Taking into account the state of the art and the nature of the processing, VibeGAMES implements the technical and organisational measures of article 32 GDPR. In particular:

Services run in professional datacenters with physical access control, redundant power and network, in the locations the Customer chooses at ordering.
Every Service sits behind VibeSHIELD, VibeGAMES' own anycast DDoS protection, at no extra cost.
Game servers are isolated from each other in containers with their own resource limits and file systems; virtual servers are isolated by the hypervisor; bare metal servers are physically separate.
Administrative access to VibeGAMES' systems uses personal accounts, strong authentication and is logged. Customer-facing access to the dashboard and the control panel is protected by password, optional two-factor authentication, new-device verification and session management the Customer controls.
Connections to the dashboard, the control panel and the API are encrypted in transit.
Backups the Customer configures are stored separately from the Service and deleted on the schedule in the Terms of Service.
Systems are kept up to date; security advisories for the software VibeGAMES operates are assessed and applied.

The Customer remains responsible for the security of what runs inside their Service: the operating system and software they install, passwords and keys, the game server's own configuration and plugins, and encryption of data that needs it.

7. Sub-processors

The Customer gives general authorisation for VibeGAMES to engage sub-processors. VibeGAMES uses the following categories:

Datacenter and colocation operators that house VibeGAMES' hardware in the locations offered at ordering (physical hosting only, no logical access to Customer Data).
Network carriers and internet exchanges that carry traffic to and from the Service.
Storage providers for backups and snapshots, where the Customer uses those features.
Cloudflare, Inc. for DNS and for the protected hostnames of some control panel features, such as the per-location phpMyAdmin instances and the FiveM image server.

VibeGAMES imposes data protection obligations on sub-processors that are no less protective than this DPA and remains responsible to the Customer for their performance. The current list of named sub-processors is available on request from legal@vibegames.net. VibeGAMES announces an intended addition or replacement at least 30 days in advance by email to the address on file. The Customer may object on reasonable data protection grounds within that period; if VibeGAMES cannot offer an alternative, the Customer may terminate the affected Service without penalty.

8. Transfers outside the EEA

Customer Data is stored in the datacenter location the Customer selects at ordering. VibeGAMES offers locations inside and outside the European Economic Area; by choosing a location outside the EEA the Customer instructs VibeGAMES to host the Service there. VibeGAMES itself operates from the Netherlands. Where VibeGAMES engages a sub-processor outside the EEA that reaches personal data, it relies on an adequacy decision of the European Commission or on the Standard Contractual Clauses, together with supplementary measures where needed.

9. Assistance to the Customer

Taking into account the nature of the processing, VibeGAMES assists the Customer with appropriate technical and organisational measures in fulfilling requests from data subjects under chapter III GDPR, and with the obligations under articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), insofar as the Customer cannot fulfil them alone. On a VPS, VDS or bare metal server the Customer holds all the data and the tools to handle such requests; on a game server the control panel gives the Customer file and database access for the same purpose. If a data subject contacts VibeGAMES directly about a Customer's Service, VibeGAMES refers them to the Customer and does not respond on the Customer's behalf. VibeGAMES may charge reasonable costs for assistance beyond what the Service and the control panel already provide.

10. Personal data breaches

VibeGAMES notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach that affects Customer Data, by email to the address on file. The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned as far as known, the likely consequences, the measures taken or proposed, and a contact point; information that is not yet available follows as soon as it is. The Customer decides on and carries out notifications to the supervisory authority and to data subjects. Breaches that take place inside the Customer's own Service, such as a compromised game server plugin or a stolen password of the Customer, are the Customer's to detect and handle; VibeGAMES helps where it can.

11. Audits

VibeGAMES makes available the information necessary to demonstrate compliance with this DPA and contributes to audits, including inspections, by the Customer or an auditor mandated by the Customer. Audits start with written questions and documentation; an on-site inspection requires at least 30 days' notice, takes place at most once a year during business hours, may not disturb other customers' services and is at the Customer's expense. Information obtained in an audit is confidential.

12. Deletion and return

During the Service the Customer can retrieve Customer Data at any time through the control panel, SFTP or the Service itself, and can delete it the same way. When a Service ends, for whatever reason, all Customer Data including backups, snapshots and configuration is permanently deleted 7 days after the end date, as set out in the Terms of Service; within that window the Customer can ask for reactivation to retrieve data. After deletion the data cannot be recovered. Disks of returned bare metal servers are wiped before reuse. VibeGAMES keeps nothing of the Customer Data afterwards, except where Union or Member State law requires storage.

13. Liability

The liability provisions of the Terms of Service apply to this DPA. Each party is liable towards data subjects as set out in article 82 GDPR.

14. Duration and changes

This DPA applies as long as VibeGAMES processes Customer Data for the Customer. VibeGAMES may update this DPA to reflect changes in the law, in guidance of supervisory authorities or in the Services; changes that reduce the Customer's protection are announced at least 30 days in advance by email. Earlier versions are available on request.

15. Governing law

This DPA is governed by the law of the Netherlands, and disputes are brought before the court that is competent under the Terms of Service. Where this DPA and the Terms of Service conflict on the processing of personal data, this DPA prevails. The English text is the binding one.

16. Contact

Questions about this DPA, requests for a signed copy or the sub-processor list, and breach reports go to legal@vibegames.net. Support questions go to support@vibegames.net. VibeGAMES has no obligation to appoint a data protection officer and has not appointed one.