Data processing agreement (DPA)

If you store other people's personal data on your server, your bot, your web hosting, your Deploy project, your database or your VPS – player data, users of your website, members of your Discord server – you are responsible for it, and CitexNode processes that data on your behalf. This data processing agreement (Auftragsverarbeitungsvertrag, AVV) governs that under Art. 28 GDPR.

It applies automatically to every account as soon as you order a service, and forms part of the General Terms and Conditions (AGB). You do not need to sign anything. If you need a signed copy for your records, send us a ticket; we will send it to you as a PDF.

1. Parties

• Controller: you as the holder of the customer account ("customer").
• Processor: Phillipp Jäger, CitexNode, Karl-Liebknecht-Ring 2, 06679 Hohenmölsen, Germany, info@citexnode.de ("CitexNode").

2. Subject matter and duration

The subject matter is providing and operating the services you order from CitexNode: game servers, Discord bots, TeamSpeak music bots, web hosting, CitexNode Deploy (websites, apps, databases, file storage), MySQL databases, VPS and cloud servers. CitexNode stores, backs up and provides the data you place there or that your applications create there.

The agreement runs as long as you use services and ends with your last service or with the deletion of your account. Obligations that apply beyond the end (deletion, evidence, confidentiality) remain in force.

3. Types of data and data subjects

You decide which data is on your services; CitexNode as a rule does not look inside. Typically this is:

• Types of data: names, usernames, player and account IDs, email addresses, IP addresses and log data, chat and forum posts, contents of databases and files your application stores.
• Data subjects: users of your servers, websites and bots, players, members, visitors, and your customers and employees.

Special categories under Art. 9 GDPR (e.g. health data) are not intended. If you want to process such data, talk to us first.

4. Instructions

CitexNode processes the data only on your documented instructions. Instructions are the settings and actions you trigger in the dashboard, through the API or by ticket, as well as this agreement and the AGB. If CitexNode considers an instruction unlawful, CitexNode tells you without delay and may suspend carrying it out until the matter is clarified.

Processing outside your instructions only takes place where the law requires it (Art. 28 para. 3 lit. a GDPR). CitexNode then informs you beforehand, unless the law prohibits this.

5. Confidentiality

Anyone at CitexNode with access to your data is bound to confidentiality. Support only accesses your data for operations, for your support request or to fight abuse; every such access appears in your activity log (see privacy policy, "Access by support").

6. Technical and organisational measures

CitexNode takes the measures under Art. 32 GDPR set out in Annex 1. They may be developed further as long as the level of protection does not fall.

7. Sub-processors

You allow CitexNode to use the sub-processors listed on the sub-processors page. CitexNode contractually binds each of them to the same level of protection as this agreement.

If a new sub-processor is added or one is replaced, CitexNode announces this at least 14 days in advance on that page and with a notice in the dashboard. Within this period you can object for an important reason under data protection law; if no solution can be found, you can cancel the affected services free of charge, and unused credit for these services is credited back to you pro rata.

Services you integrate yourself with third parties (for example a Cloudflare proxy in front of your Deploy project or an external mail service in your application) are not sub-processors of CitexNode; you have the contractual relationship with them yourself.

8. Support with data subject rights and obligations

Using the dashboard, the API and tickets, CitexNode supports you in answering requests from data subjects (access, rectification, erasure, restriction, portability) and in meeting your obligations under Art. 32 to 36 GDPR. If a data subject contacts CitexNode directly, CitexNode forwards the request to you and does not answer it itself.

9. Notification of breaches

If CitexNode detects a breach of the protection of your data, CitexNode notifies you without delay, at the latest 48 hours after becoming aware of it, with the information you need for your own notification under Art. 33 GDPR, as far as it is available. Disruptions with no data aspect are shown, as before, on status.citexnode.com.

10. Deletion and return

You can download your data yourself at any time (file manager, SFTP, database export, backups). When a service ends, CitexNode deletes the data of that service after the grace period set out in the AGB; on deletion of your account, immediately. This does not apply to data CitexNode is legally required to keep (booking records) and to backups of the platform database, which expire on their own after their retention period (at most 30 days).

11. Evidence and audits

CitexNode provides you with the information you need as evidence and answers questions about it by ticket. On-site audits are possible by arrangement, with reasonable advance notice, during normal business hours and without putting other customers' data at risk; you bear the costs of this, unless the audit reveals a breach by CitexNode.

12. Place of processing

Processing takes place in Germany or in the EU. A transfer to a third country only takes place with the safeguards of Art. 44 et seq. GDPR and only if it is listed on the sub-processors page.

13. Liability and final provisions

Liability is governed by Art. 82 GDPR; otherwise the rules of the AGB apply. If this agreement and the AGB contradict each other, this agreement prevails for the protection of personal data. If a provision is invalid, the rest remains valid. German law applies.

---

Annex 1: Technical and organisational measures (Art. 32 GDPR)

Confidentiality

• Data centres: the servers are located in professional data centres with access control (Firstcolo Frankfurt am Main via Tausio, IONOS). CitexNode has no physical access of its own.
• Access to the servers: by SSH key only; password login is disabled. Only the owner and people he has appointed have access.
• Access to the dashboard: passwords stored as Argon2id hashes, sessions in httpOnly cookies, sign-in notifications for new devices, rate limits and an IP block list against attacks on sign-in.
• Permissions: roles and permissions per member of a server; personal API tokens only with a fixed scope (read/write), which never reach account, money, orders or deletions.
• Separation: every service runs in its own container or its own virtual machine. Containers run without root rights, without additional privileges and with limits for CPU, memory and processes. VPS are protected by a firewall against taking over other people's IP addresses.
• Support access: only for operations, your request or against abuse; every access is logged and shown in your activity log.

Integrity

• Transmission: dashboard, API and status page only over HTTPS. Backups are sent encrypted (SSH) to the second provider; the servers of the Deploy cluster communicate with each other over WireGuard.
• Logging: changes to accounts, services and permissions are recorded in an audit log.
• Secrets: login details CitexNode keeps for you (e.g. the first root password of a VPS) are stored encrypted in the database.

Availability and resilience

• Platform backups: the platform database is backed up daily and checked for integrity; a copy is kept with a second provider at another location for 30 days, on a target the backup process can only write to, but cannot read or delete anything from.
• Backups of your services: you create backups yourself in the dashboard; they are stored on the same node as the service. You are responsible for an additional backup at another location yourself.
• Operations: databases and file storage of CitexNode Deploy are mirrored across several servers. Network protection against flood attacks on the game server nodes. Monitoring of all services with a public status page.
• Recovery: restoring the platform database has been tested and is repeated after major changes.

Review procedures

• Security updates for the servers are applied promptly; critical vulnerabilities with priority and an announcement on the status page.
• The measures are reviewed when the infrastructure changes, and this annex is then updated.
• Data protection organisation: the contact person is the owner, reachable at info@citexnode.de. A data protection officer does not have to be appointed under § 38 BDSG.