Data Processing Agreement

1. Parties and scope

This agreement is between the owner of a workspace in Exylia Staff (the "Customer", controller) and Cristobal Aranda, domiciled in Chile (the "Processor"). It applies to the personal data the Processor processes on the Customer's behalf through the Service: data about the players of the Customer's network, its staff team and the members of its bound Discord servers ("Customer Personal Data"). It is accepted together with the Terms of Service and lasts as long as the Customer has a workspace, plus the time needed to delete its data.

The Discord accounts with which people sign in to the panel are processed by the Processor as controller under the Privacy Policy, not under this agreement. What those people do inside a workspace (their role, records, appeals and form responses) is Customer Personal Data.

Usage analytics (Google Analytics and Microsoft Clarity, only for people who accept them in the cookie banner) is usage data about how Users use the panel and our sites, which the Processor processes as controller under the Privacy Policy, not under this agreement. Panel content and a network's public pages are masked in Clarity recordings. Page addresses and titles may include workspace, server or player names; they are used only to measure and improve the Service, and are never sold or used for advertising. Google and Microsoft are not sub-processors of Customer Personal Data.

2. Details of the processing

• Subject matter and purpose: moderating the Customer's Minecraft network and managing its staff team from a web panel and a Discord bot, and the other functions of the Service the Customer uses.
• Nature: collection through the ExyliaStaff plugin and the Bot, storage, consultation, display, relay of commands and messages between the panel, Discord and the game, automated assistance (AI labels, summaries, proposals and, if the Customer enables it, automatic chat moderation), disclosure to the destinations the Customer configures, and deletion.
• Data subjects: players of the Customer's network, its staff members, members of its Discord servers who interact with the Bot, and people who appeal or answer its forms.
• Categories of data: as listed in sections 3 and 4 of the Privacy Policy, according to the modules enabled: Minecraft UUID and username, playtime and live location while online, punishments, reports, help requests, notes, freezes, inventory backup records, anticheat and x-ray alerts, audit log, chat history including private messages and commands, keyed hashes and encrypted copies of IP addresses, staff records (ranks, permissions, duty time, strikes, absences, reviews), evidence files and links, appeals, form responses, Discord user and role IDs, staff chat messages relayed from Discord, and AI outputs about them.
• Special categories: none are expected. The Customer must not use the Service to process them.
• Duration: chat history as set by the Customer (14 days by default, 90 at most); IP data as set by the Customer (90 days after last use by default); evidence as set by the Customer after its punishment or strike ends (90 days by default); live location while the player is online; the rest while the workspace exists or until the Customer asks for its deletion.

3. Processor obligations

The Processor will:

• Process Customer Personal Data only on the Customer's documented instructions, which are these terms and the configuration the Customer makes in the Service, unless the law requires otherwise; in that case it will inform the Customer first, unless the law forbids it. It will tell the Customer if it believes an instruction infringes data protection law.
• Ensure that anyone authorised to process the data is bound by confidentiality. Access by platform administrators to a workspace is limited to support, abuse handling and maintenance, and is logged.
• Apply the security measures of section 5.
• Not use Customer Personal Data for its own purposes, sell it, or combine it with data of other Customers, except for aggregate figures that identify no person or Customer and are used only to operate and improve the Service. What the AI learns from a workspace's decisions is used only in that workspace.
• Assist the Customer, taking into account the nature of the processing, in answering data subjects' requests, in security, in breach notification and in any data protection impact assessment or prior consultation.
• Make available the information needed to demonstrate compliance with this agreement and allow reasonable audits, as described in section 8.

4. Customer obligations

The Customer is responsible for the lawfulness of the processing: it will have a legal basis, inform its players and staff (for example with the notice in section 11), enable only the modules it needs, set proportionate retention periods, not process sensitive data, review the automatic actions it enables and respond to data subjects' requests. It guarantees that its instructions comply with the law.

Choosing destinations is an instruction to disclose: posting to the Discord channels and direct messages it configures, publishing the public ban list, and creating API keys, webhooks or connections with other apps disclose the corresponding data to those destinations, for which the Customer is responsible. If the Customer connects its own bot application or its own AI provider, it is responsible for that relationship.

5. Security measures

• Encryption in transit (TLS) between the plugin, the network provider and the Processor's servers, and for access to the panel.
• IP addresses never received in plain text: only an HMAC-SHA256 hash and an AES-256-GCM ciphertext with keys derived from the network's own secret; opening them requires a specific permission.
• Tokens for servers, sessions, invitations, API keys and network secrets stored only as SHA-256 hashes; custom bot tokens, AI keys, integration tokens and webhook secrets encrypted with AES-256-GCM under keys bound to their workspace; sign-in through Discord OAuth with PKCE.
• Logical separation of each Customer's data by workspace in every table and query, and role-based permissions within each workspace combined with the staff member's in-game permissions, including specific permissions for IP addresses, private messages, deleting evidence and the full audit log.
• Evidence stored in private object storage operated by the Processor and served only through short-lived signed links.
• IP addresses removed from every text before it is sent to an AI model.
• Rate limiting, idempotent processing of the plugin's events, and automatic deletion according to the retention periods of section 2.

6. Sub-processors

The Customer gives general authorisation for the Processor to use sub-processors. The current ones are:

• Cloudflare, Inc. (United States; global network): DNS, TLS termination and network protection for all traffic, including the plugin's connection.
• The AI model provider configured for the platform (United States), only for workspaces that use AI features with the platform's connection: it receives the text needed for each task, without IP addresses.

The Service, its database and its evidence storage are hosted on servers operated by the Processor itself in Chile. Services the Customer chooses to use act on the Customer's instructions and are not sub-processors of the Processor: Discord, where the Bot posts to the Customer's servers; an AI provider or classifier the Customer connects itself; other Exylia apps, API clients and webhook endpoints it connects; and the video platforms whose links it attaches as evidence. Player heads and Discord avatars are loaded by the browser of the Customer's staff directly from mc-heads.net and Discord.

The Processor will impose on each sub-processor data protection obligations equivalent to these and remains responsible for their compliance. It will announce any new sub-processor on the panel or by email at least 30 days in advance; the Customer may object on reasonable grounds and, if no solution is found, have its workspace deleted.

7. Data subject requests and erasure

The Customer can answer most requests itself: it can view on the panel what is held about a person, delete evidence, clear a player's punishment history from the game (the panel mirrors the deletion), shorten retention periods, disable modules, unbind Discord servers and revoke API keys and connections. For anything it cannot erase itself, such as all the records of one player, the Customer can write to [email protected] and the Processor will delete the data within 30 days.

If a data subject contacts the Processor directly, the Processor will pass the request on to the Customer without undue delay and will not answer it on its own unless the Customer instructs it to.

8. Breaches and audits

The Processor will notify the Customer without undue delay, and in any case within 48 hours of becoming aware of it, of any personal data breach affecting Customer Personal Data, with the information available at the time: its nature, the categories and approximate number of people and records affected, likely consequences and the measures taken or proposed. It will supplement the information as it becomes available.

On written request, no more than once a year unless there has been a breach or an authority requires it, the Processor will answer reasonable questionnaires about its compliance and provide the relevant documentation. On-site audits, if necessary, will be agreed in advance, at the Customer's expense and subject to confidentiality.

9. End of processing

When the Customer asks for its workspace to be deleted, the Processor deletes all Customer Personal Data, including evidence files, within 30 days from its active systems and within a further 30 days from backups, unless the law requires it to be kept. Before asking, the Customer can consult in the panel the data it needs. Removing the Bot from a Discord server or unlinking the network stops new processing at once but does not delete what is already stored.

10. International transfers and law

The Processor is in Chile, a country without an adequacy decision of the European Commission. For Customer Personal Data subject to the GDPR, the parties incorporate by reference the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914: Module Two (controller to processor), or Module Three (processor to processor) when the Customer is itself a processor. For those clauses: clause 7 (docking) applies; in clause 9 option 2 (general authorisation) applies with the notice period of section 6; the optional wording of clause 11 does not apply; in clauses 17 and 18 the law and courts of Ireland apply; Annex I is completed with sections 1 and 2 of this agreement, Annex II with section 5 and Annex III with section 6. For data subject to UK law, the International Data Transfer Addendum issued by the ICO is incorporated in the same way. In case of conflict, the clauses prevail over this agreement.

In all other respects this agreement is governed by the law and courts set out in the Terms of Service, and the liability limits of those terms apply to it to the extent the law allows.

11. Notice template for your players and staff

Customers can publish this text, adapted to their modules, in their rules, website or Discord:

"This network uses Exylia Staff to moderate the server and manage the staff team. We record your Minecraft UUID and username, when and where you play, punishments, reports and help requests that involve you, notes from our staff, and your chat, private messages and commands (kept [14] days; the arguments of login and password commands are never recorded). [With the alts module: a hash and an encrypted copy of your IP address, to detect alternative accounts, kept [90] days.] [For staff: your rank, duty time, strikes, absences and performance reviews.] [If you use our Discord: messages you write in the staff chat channel and your rank roles.] Some features use AI to help our staff; [automatic chat moderation can issue warnings and mutes, which you can appeal]. We are responsible for this data; Exylia Staff processes it on our behalf. To access or delete your data, or to appeal a decision, contact [network contact]. More information: https://staff.exylia.net/privacy"