Data processing agreement (DPA)

1. Modhelm provides the customer with a Discord bot with a dashboard, portal and mobile app for moderating the customer's Discord server and Roblox games.
2. For this, Modhelm processes personal data on behalf of the customer: receiving, storing, converting and showing reports and evidence to the team, logging decisions, applying bans and unbans through Roblox Open Cloud, collecting reports from inside the game, sending messages through Discord, managing appeals, storing notes, caching public profile data from Roblox, and exporting and deleting data on instruction.
3. If the customer has booked the moderation service, Modhelm moderators also decide on open reports according to the customer's rules.
4. Modhelm processes network-wide verification as an independent controller. It is not covered by this agreement.

The agreement applies for as long as Modhelm processes data for the customer, meaning for the term of the main contract and until complete deletion under section 11.

Data subjects: players of the customer's Roblox games, members of the customer's Discord server, reporters, people who appeal, people who can be seen or heard in evidence, and the members of the customer's team.

Types of data:

• Roblox data of players: user ID, user name, display name, previous user names, profile pictures, account age and other public profile data
• Discord data: user ID, user name, display name, profile picture, roles in the server
• Content of reports and appeals, answers to questions, evidence (videos, images, links)
• Decisions and penalties with reason, duration, time and acting person, results of applying them at Roblox
• Team notes, log of actions in the dashboard and the bot
• Records of consent to reports and appeals

Special categories under Art. 9 GDPR and data under Art. 10 GDPR are not intended. Evidence or reports may contain them in individual cases. The customer makes sure that its team stores only necessary content. Data subjects may include children.

1. Modhelm processes the data only on documented instructions from the customer, including for transfers to third countries, unless EU or German law requires Modhelm to process it. In that case Modhelm informs the customer beforehand, unless the law prohibits this.
2. Instructions are this agreement, the terms, and the settings and actions of the customer and its team in the dashboard, bot, app and API. The customer gives further instructions in text form.
3. If Modhelm considers an instruction unlawful, it informs the customer without delay and may suspend carrying it out until it is clarified.
4. Discord and Roblox are not sub-processors of Modhelm. The customer uses their platforms itself. Data goes to them because the customer instructs it, for example through a ban, a reports channel or a direct message to a reporter.
5. Modhelm does not use the data for its own purposes, does not combine it with data of other customers and does not use it to train AI.

Modhelm commits all persons with access to the data, including the moderators of the moderation service, to confidentiality in writing, unless they are already subject to a statutory duty of confidentiality. Only persons who need access for their task get it.

Modhelm takes the technical and organisational measures under Art. 32 GDPR described in Annex 1. Modhelm may further develop them as long as the level of protection does not decrease.

1. The customer gives Modhelm general authorisation to engage sub-processors. The current ones are listed in Annex 2.
2. Modhelm informs the customer at least 30 days in advance in text form or in the dashboard before a new sub-processor is added or one is replaced. The customer may object for an important data protection reason. If the parties cannot agree, either may terminate the main contract.
3. Modhelm binds every sub-processor by contract to the same data protection obligations as in this agreement and remains responsible to the customer for the sub-processor's obligations.

1. Modhelm supports the customer with suitable features in handling requests from data subjects: export of server data, deletion of a player's data on the player page, automatic handling of erasure requests through the Roblox webhook and the API.
2. If a data subject contacts Modhelm directly, Modhelm forwards the request to the customer without delay and does not answer on the merits itself unless the customer instructs it to.
3. Modhelm also supports the customer in its obligations under Art. 32 to 36 GDPR, in particular with information for a data protection impact assessment and a template for privacy notices to players.

Modhelm notifies the customer of a personal data breach without undue delay, where possible within 24 hours after becoming aware of it. The notification contains the information under Art. 33(3) GDPR as far as known and is supplemented as soon as more is known. Modhelm takes immediate measures to limit the damage and supports the customer with notifications to the supervisory authority and to data subjects.

Modhelm deletes moderation data after the default periods (reports without a penalty 180 days after the decision, otherwise one year after the penalty ends, appeals like the related penalty), unless the customer sets shorter periods, and at any time earlier on instruction. Originals of evidence videos are deleted after conversion.

1. After the main contract and the transition period under the terms have ended, the customer can retrieve its data through the export for at least 30 more days.
2. After that, Modhelm deletes all of the customer's data within a further 30 days, including the evidence files. In backups the data is overwritten in the regular cycle within 30 days.
3. Statutory retention obligations remain unaffected. On request, Modhelm confirms the deletion in text form.

1. Modhelm provides the customer with all information needed to demonstrate compliance with this agreement.
2. The customer, or an auditor appointed by it and bound to confidentiality, may carry out audits. The customer announces them at least 14 days in advance. They take place during normal business hours, at most once a year unless there is a specific reason, and must not impair operations or the confidentiality of other customers. Modhelm may first demonstrate compliance through current documents or certificates.

1. Modhelm processes the data on its own server in a data centre in Frankfurt am Main, Germany. A move to a country outside the European Economic Area takes place only after informing the customer in advance and only if the requirements of Art. 44 et seq. GDPR are met.
2. If the customer is established in a country outside the European Economic Area without an adequacy decision, the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), Module Four (processor to controller), additionally apply to transfers to the customer. They are incorporated into this agreement by reference. For Clause 17 German law applies, and for Clause 18 the courts of Berlin have jurisdiction.

1. If the customer is subject to other data protection laws, for example the UK GDPR, the Swiss Federal Act on Data Protection, the LGPD in Brazil or PIPEDA in Canada, this agreement applies accordingly. Terms are understood within the meaning of the respective law.
2. Customers in the United States (CCPA/CPRA): Modhelm acts as a service provider within the meaning of the California Consumer Privacy Act. Modhelm does not sell or share the data, retains, uses and discloses it only for the business purposes stated in section 1, does not combine it with data from other sources except as the law permits, complies with the CCPA and notifies the customer if it can no longer meet its obligations. The customer may take reasonable steps to stop unauthorised use.

1. Liability is governed by Art. 82 GDPR and the rules of the terms.
2. In case of conflict between this agreement and the terms, this agreement prevails on data protection matters. In case of conflict with the standard contractual clauses, the clauses prevail.
3. German law applies.

Encryption and pseudonymisation

• All connections to the website, dashboard, portal, app and API use TLS, with HSTS.
• API keys, bot tokens, OAuth access tokens and client secrets are stored encrypted with AES-256-GCM. The key is kept separate from the database.
• Sessions and API tokens are stored only as a SHA-256 hash, IP addresses only as an HMAC hash.

Physical and system access control

• The server is located in a data centre in Frankfurt am Main with access control by the operator.
• Access to the server only with SSH keys, no password login.
• The database and file storage are not publicly reachable. Administration tools are reachable only after login.
• Login to the dashboard and app only through Discord OAuth with PKCE. Passkeys as a second factor, mandatory for Modhelm staff. The app locks after 15 minutes without use.

Data access control and separation

• Access to the dashboard is checked live against the permissions at Discord on every request.
• Every query is restricted to the customer's server (tenant separation by server ID). Files are stored separately per server.
• Row Level Security is active in the database, and public roles have no access.
• Modhelm staff see a customer's data only if the customer has booked the moderation service, or during a support access with a reason and a time limit that is visible in the customer's log. Roles follow the principle of least privilege.

Input control and integrity

• Every action in the dashboard, the app and the bot is logged with the acting person and the time. Secrets are masked before they are stored in the log.
• Uploads are checked by their content (not just the file name) and limited in size according to the plan.
• Evidence files are delivered only to authorised users or through signed, expiring links, with restrictive security headers.
• Webhooks are verified by signature and timestamp.

Availability and resilience

• Regular backups of the database and evidence files, deleted after at most 30 days.
• Monitoring of all components every minute with a public status page.
• Jobs for Discord and Roblox run through a queue with retries, and bans stay effective at Roblox even if Modhelm is down.
• Limits against abuse for logins, reports, appeals, forms and the API.

Deletion and data minimisation

• Fixed retention periods for moderation data, sessions and logs.
• Deletion of all data of a server at the push of a button, including the files. Deletion of a player's data at the push of a button or through the Roblox webhook.
• Only the necessary permissions at Discord and Roblox. Originals of evidence videos are deleted after conversion.

Organisation

• Written commitment of all persons with data access to confidentiality, training of moderators.
• Defined process for security incidents, informing the customer within 24 hours where possible.
• Regular review of the measures and updates of the software in use.
• Contact address for security vulnerabilities (responsible disclosure).