Data Processing Agreement

1. Parties and scope

This agreement is between the owner of a network in Exylia Link (the "Customer", controller) and Cristobal Aranda, domiciled in Chile (the "Processor"). It applies to the personal data the Processor processes on the Customer's behalf through the Service, mainly data about the players of the Customer's Minecraft servers and the members of its Discord servers ("Customer Personal Data"). It is accepted together with the Terms of Service and lasts as long as the Customer has a network, plus the time needed to delete its data.

Data about the sign-in accounts of the Customer, its staff and players who use the web link page is processed by the Processor as controller under the Privacy Policy, not under this agreement.

The same applies to usage analytics: data about how Users use the dashboard, collected with Google Analytics and Microsoft Clarity only when the User consents, is usage data that the Processor processes as controller. All text inside the dashboard panels is masked in Clarity recordings. Page addresses and titles may include the names of networks, servers or players; they are used only to measure and improve the Service, and are never sold or used for advertising.

2. Details of the processing

• Subject matter and purpose: linking the Minecraft accounts of the Customer's players to their Discord accounts, keeping Discord roles and nicknames in step with the game, delivering rewards, and the other functions of the Service the Customer uses.
• Nature: collection through the ExyliaLink plugin, the Exylia Link Discord bot and imports; storage, consultation, comparison, display, disclosure to the integrations the Customer configures, and deletion.
• Data subjects: players of the Customer's Minecraft servers and members of its Discord servers, including its staff.
• Categories of data: as listed in section 3 of the Privacy Policy: Minecraft UUID and username, presence (online status, server, first and last seen), LuckPerms groups, links between Minecraft UUIDs and Discord user IDs with their history, Discord usernames, linking codes, reward grants, import results and audit entries; and, processed in memory only where Discord sync or rewards are on, members' roles, nickname and Server Boost status.
• Special categories: none are expected. The Customer must not use group names, nicknames, reward commands or imports to process them.
• Duration: linking codes until one day after they expire; processed events 30 days; the rest while the network exists or until the Customer has it erased.

3. Processor obligations

The Processor will:

• Process Customer Personal Data only on the Customer's documented instructions, which are these terms and the configuration the Customer makes in the Service, unless the law requires otherwise; in that case it will inform the Customer first, unless the law forbids it. It will tell the Customer if it believes an instruction infringes data protection law.
• Ensure that anyone authorised to process the data is bound by confidentiality.
• Apply the security measures of section 5.
• Not use Customer Personal Data for its own purposes, sell it, or combine it with data of other Customers, except for aggregate figures that identify no person or Customer and are used only to operate and improve the Service. A player who links on several networks has a separate link in each one; one network never sees another's links.
• Assist the Customer, taking into account the nature of the processing, in answering data subjects' requests, in security, in breach notification and in any data protection impact assessment or prior consultation.
• Make available the information needed to demonstrate compliance with this agreement and allow reasonable audits, as described in section 8.

4. Customer obligations

The Customer is responsible for the lawfulness of the processing: it will have a legal basis, inform its players and members (for example with the notice in section 11), link or import only accounts it is entitled to, not use the Service for special categories of data, and respond to its data subjects' requests. It guarantees that its instructions comply with the law. Creating an API key, a webhook or an Exylia Connect connection is an instruction to disclose the identities within its scopes to the destination the Customer chooses, for which the Customer is responsible.

5. Security measures

• Encryption in transit (TLS) between the plugin, the network provider and the Processor's servers, and for access to the dashboard.
• Network secrets, server tokens, API keys, session and invitation tokens stored only as SHA-256 hashes; Discord access tokens and webhook secrets encrypted with AES-256-GCM using derived keys.
• Sign-in through Discord OAuth with PKCE; linking codes that are short-lived, single use and rate limited per Discord account, per player and per server.
• Logical separation of each Customer's data by network in every table and query, uniqueness of links enforced by the database, and role-based permissions within each network.
• Member data read from Discord for sync and rewards processed in memory and not stored.
• Signed webhooks with protection against requests to internal addresses; rate limits on the API and the plugin gateway.
• Automatic deletion of expired codes and processed events, and backups rotated within 30 days.

6. Sub-processors

The Customer gives general authorisation for the Processor to use sub-processors. The current ones are:

• Cloudflare, Inc. (United States; global network): DNS, TLS termination and network protection for all traffic, including the plugin's connections.
• Discord Inc. (United States): the platform on which the Bot runs; the Bot's replies and its role and nickname changes are made through Discord's API.

The Service is hosted on servers operated by the Processor itself in Chile. Destinations the Customer chooses (its own servers and webhooks, third-party tools that receive an API key, and other Exylia services it connects) act on the Customer's instructions and are not sub-processors of the Processor.

The Processor will impose on each sub-processor data protection obligations equivalent to these where the sub-processor's terms allow it, and remains responsible for their compliance. It will announce any new sub-processor in the dashboard or by email at least 30 days in advance; the Customer may object on reasonable grounds and, if no solution is found, have its network deleted.

7. Data subject requests and erasure

The Customer can remove any link from the dashboard, and can let players remove their own links. To erase a player's data entirely (player record, link history and grants), the Customer writes to [email protected]; the Processor completes it within 30 days. If a data subject contacts the Processor directly, the Processor will pass the request on to the Customer without undue delay and will not answer it on its own unless the Customer instructs it to.

8. Breaches and audits

The Processor will notify the Customer without undue delay, and in any case within 48 hours of becoming aware of it, of any personal data breach affecting Customer Personal Data, with the information available at the time: its nature, the categories and approximate number of people and records affected, likely consequences and the measures taken or proposed. It will supplement the information as it becomes available.

On written request, no more than once a year unless there has been a breach or an authority requires it, the Processor will answer reasonable questionnaires about its compliance and provide the relevant documentation. On-site audits, if necessary, will be agreed in advance, at the Customer's expense and subject to confidentiality.

9. End of processing

When the Customer asks for its network to be deleted, the Processor deletes all Customer Personal Data from its active systems within 30 days and from backups within a further 30 days, unless the law requires it to be kept. Before that, the Customer can consult its links in the dashboard and through the API, and can ask for an export of its links at the same address.

10. International transfers and law

The Processor is in Chile, a country without an adequacy decision of the European Commission. For Customer Personal Data subject to the GDPR, the parties incorporate by reference the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914: Module Two (controller to processor), or Module Three (processor to processor) when the Customer is itself a processor. For those clauses: clause 7 (docking) applies; in clause 9 option 2 (general authorisation) applies with the notice period of section 6; the optional wording of clause 11 does not apply; in clauses 17 and 18 the law and courts of Ireland apply; Annex I is completed with sections 1 and 2 of this agreement, Annex II with section 5 and Annex III with section 6. For data subject to UK law, the International Data Transfer Addendum issued by the ICO is incorporated in the same way. In case of conflict, the clauses prevail over this agreement.

In all other respects this agreement is governed by the law and courts set out in the Terms of Service, and the liability limits of those terms apply to it to the extent the law allows.

11. Notice template for your players

Customers can publish this text, adapted to the features they use, in their rules, website or Discord:

"This network uses Exylia Link to link Minecraft accounts to Discord accounts. When you play, we record your Minecraft UUID and username, when and on which server you were last seen, and your rank groups. If you link your account, we keep which Discord account it belongs to and when it was linked. [Also: we give Discord roles and nicknames based on your link and rank, and deliver rewards for Server Boosts or roles; for that the Exylia Link bot reads your roles and boost status in our Discord server.] We are responsible for this data; Exylia Link processes it on our behalf. You can unlink with /unlink. To access or delete your data, contact [network contact]. More information: https://link.exylia.net/privacy"