Data processing agreement (DPA)

If you store other people's personal data on your server, bot, webspace, Deploy project, database or vServer – player data, users of your website, members of your Discord server – you are responsible for it, and CitexNode processes that data on your behalf. This agreement covers that under Art. 28 GDPR. The German version of this agreement is binding.

It applies automatically to every account as soon as you order a service, and is part of the terms. You don't need to sign anything. If you need a signed copy for your records, open a ticket and we'll send it as a PDF.

1. Parties#

• Controller: you as the holder of the customer account ("customer").
• Processor: Phillipp Jäger, CitexNode, Karl-Liebknecht-Ring 2, 06679 Hohenmölsen, Germany, info@citexnode.de ("CitexNode").

2. Subject and duration#

The subject is providing and running the services you order from CitexNode: game servers, Discord bots, TeamSpeak music bots, webspace, CitexNode Deploy (websites, apps, databases, file storage), MySQL databases, vServers and cloud servers. CitexNode stores, backs up and serves the data you put there or that your applications create there.

The agreement runs as long as you use services and ends with your last service or the deletion of your account. Duties that outlast it (deletion, evidence, confidentiality) remain.

3. Types of data and data subjects#

You decide which data lives on your services; CitexNode normally doesn't look inside. Typically:

• Types of data: names, usernames, player and account IDs, email addresses, IP addresses and logs, chat and forum posts, contents of databases and files your application stores.
• Data subjects: users of your servers, websites and bots, players, members, visitors, your customers and staff.

Special categories under Art. 9 GDPR (e.g. health data) are not intended. If you want to process such data, talk to us first.

4. Instructions#

CitexNode processes the data only on your documented instructions. Instructions are the settings and actions you trigger in the dashboard, through the API or by ticket, plus this agreement and the terms. If CitexNode considers an instruction unlawful, it tells you without delay and may pause it until clarified.

Processing outside your instructions only happens where the law requires it (Art. 28(3)(a) GDPR). CitexNode then informs you beforehand unless the law forbids it.

5. Confidentiality#

Everyone at CitexNode with access to your data is bound to confidentiality. Support only accesses your services for operations, your support request or to fight abuse; every such access shows up in your activity log (see the privacy policy, "Access by support").

6. Technical and organisational measures#

CitexNode takes the measures under Art. 32 GDPR listed in Annex 1. They may evolve as long as the level of protection does not drop.

7. Sub-processors#

You allow CitexNode to use the sub-processors listed on the sub-processors page. CitexNode binds each of them contractually to the same level of protection as this agreement.

If a sub-processor is added or replaced, CitexNode announces it at least 14 days in advance on that page and with a notice in the dashboard. Within that period you may object for an important data protection reason; if no solution is found, you can cancel the affected services at no cost and get unused credit for them back pro rata.

Services you connect yourself (for example a Cloudflare proxy in front of your Deploy project or an external mail service in your application) are not CitexNode's sub-processors; that contract is yours.

8. Support with data subject rights and duties#

With the tools of the dashboard, the API and by ticket, CitexNode helps you answer requests from data subjects (access, rectification, erasure, restriction, portability) and meet your duties under Art. 32 to 36 GDPR. If a data subject contacts CitexNode directly, CitexNode forwards the request to you and does not answer it itself.

9. Breach notification#

If CitexNode becomes aware of a breach affecting your data, it notifies you without undue delay, at the latest 48 hours after becoming aware, with the details you need for your own notification under Art. 33 GDPR, as far as they are available. Outages without a data aspect are published on status.citexnode.com (opens in a new tab) as before.

10. Deletion and return#

You can download your data yourself at any time (file manager, SFTP, database export, backups). When a service ends, CitexNode deletes its data once the grace period in the terms has passed; with account deletion immediately. Exceptions are data CitexNode must keep by law (booking records) and backups of the platform database, which expire on their own after their period (at most 30 days).

11. Evidence and audits#

CitexNode provides the information you need as evidence and answers questions about it by ticket. On-site audits are possible by arrangement, with reasonable notice, during normal business hours and without putting other customers' data at risk; you bear the cost unless the audit reveals a breach by CitexNode.

12. Place of processing#

Processing takes place in Germany or the EU. A transfer to a third country only happens with the safeguards of Art. 44 et seq. GDPR and only if it is listed on the sub-processors page.

13. Liability and final provisions#

Liability follows Art. 82 GDPR; otherwise the terms apply. Where this agreement and the terms conflict, this agreement prevails for the protection of personal data. If a provision is invalid, the rest remains valid. German law applies.

Annex 1: Technical and organisational measures (Art. 32 GDPR)#

Confidentiality#

• Data centres: the servers are in professional data centres with access control (Firstcolo Frankfurt am Main via Tausio, IONOS). CitexNode has no physical access of its own.
• Server access: SSH keys only, password logins are disabled. Only the owner and people he appoints have access.
• Dashboard access: passwords stored as Argon2id hashes, sessions in httpOnly cookies, sign-in notifications for new devices, rate limits and an IP block list against attacks on sign-in.
• Permissions: roles and permissions per server member; personal API tokens only with a fixed scope (read/write) that never reaches account, money, orders or deletions.
• Separation: every service runs in its own container or virtual machine. Containers run without root rights, without extra privileges and with limits for CPU, memory and processes. vServers are protected by a firewall against taking over other IP addresses.
• Support access: only for operations, your request or against abuse; every access is logged and shown in your activity log.

Integrity#

• Transfer: dashboard, API and status page only over HTTPS. Backups travel encrypted (SSH) to the second provider; the servers of the Deploy cluster talk to each other over WireGuard.
• Logging: changes to accounts, services and permissions go to an audit log.
• Secrets: credentials CitexNode keeps for you (e.g. a vServer's first root password) are stored encrypted in the database.

Availability and resilience#

• Platform backups: the platform database is backed up daily and checked for integrity; a copy is kept with a second provider at another location for 30 days, on a target the backup job can only write to, never read or delete.
• Backups of your services: you create backups yourself in the dashboard; they are stored on the same node as the service. An extra copy at another location is your responsibility.
• Operations: databases and file storage of CitexNode Deploy are mirrored across several servers. Network protection against flood attacks on the game server nodes. Monitoring of all services with a public status page.
• Recovery: restoring the platform database has been tested and is repeated after major changes.

Review#

• Security updates are applied promptly; critical vulnerabilities with priority and an announcement on the status page.
• The measures are reviewed when the infrastructure changes and this annex is updated.
• Data protection organisation: the contact is the owner, at info@citexnode.de. No data protection officer has to be appointed under § 38 BDSG.