Data Processing Agreement

This Data Processing Agreement (“DPA”) applies where you use GameAP Cloud to process personal data for which you are the controller — for example, when your game servers or your panel hold data about your own players or staff, and that data reaches our backup or monitoring services. It forms part of the Terms of Service and satisfies Article 28(3) of the GDPR.

If you need this DPA signed as a separate document, write to support [at] gameap.cloud.

1. Roles

You are the controller. Individual Entrepreneur Nikita Kuznetsov (Sole proprietor registered in the Republic of Armenia, TIN 23378307) is the processor. Where the GDPR does not apply, the equivalent roles under applicable data protection law apply instead.

For our own relationship with you — your account, billing and support — we act as controller. That processing is described in the Privacy Policy and is outside this DPA.

2. Subject matter of the processing

Backup contents reach us encrypted with a key we do not hold. In practice this means we process them as opaque ciphertext and cannot read, sort or analyse them.

3. Our obligations

We will:

1. process personal data only on your documented instructions, including as to international transfers, unless required otherwise by law — in which case we will inform you before processing, unless that law forbids it;
2. ensure that everyone authorised to process the data is bound by confidentiality;
3. implement the technical and organisational measures set out in clause 6;
4. respect the conditions in clause 4 for engaging sub-processors;
5. assist you, by appropriate measures and taking into account the nature of the processing, in responding to requests from data subjects exercising their rights;
6. assist you with your obligations under Articles 32 to 36 of the GDPR — security, breach notification and data protection impact assessments — taking into account the information available to us;
7. at your choice, delete or return the personal data at the end of the service, as set out in clause 9;
8. make available the information necessary to demonstrate compliance with Article 28 and allow for audits as set out in clause 8.

4. Sub-processors

4.1. You give general authorisation for us to engage sub-processors. The current list is published at Sub-processors.

4.2. We will give at least 30 days’ notice before adding or replacing a sub-processor, by email or in the dashboard. If you reasonably object on data protection grounds within that period, we will work with you to find a solution; if none is available, you may terminate the affected service and receive a refund for the unused period.

4.3. We impose on each sub-processor the same data protection obligations as in this DPA, and we remain fully liable to you for their performance.

5. International transfers

5.1. We are established in the Republic of Armenia, which is not covered by an EU adequacy decision.

5.2. Transfers of personal data from the EEA are made under the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), which are incorporated into this DPA by reference and completed as follows: you are the data exporter, we are the data importer; the details in clause 2 above populate Annex I; the measures in clause 6 populate Annex II; the list in clause 4.1 populates Annex III. Where the optional docking clause applies, it is included.

5.3. Transfers from the United Kingdom are made under the same clauses as modified by the UK International Data Transfer Addendum issued by the Information Commissioner.

5.4. On request we will provide the information you reasonably need for a transfer impact assessment.

6. Security measures

Taking into account the state of the art, the costs of implementation and the risks to data subjects, we maintain:

• encryption of data in transit (TLS) for all connections to the Service;
• support for client-side encryption of backup contents, with keys held only by you;
• pseudonymisation and hashing where practical, including irreversible password hashes;
• access control: least privilege, individual accounts, multi-factor authentication for production systems;
• logical separation of customer data;
• logging and monitoring of access to systems that hold personal data;
• regular backups and a tested restore procedure;
• a documented incident response procedure;
• periodic review of these measures.

7. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and in any event within 72 hours. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Where information is not available at once, we will provide it in phases.

8. Audits

8.1. We will provide, on written request and no more than once a year, the information reasonably necessary to demonstrate compliance with this DPA.

8.2. If that is insufficient, you may audit us, or appoint an independent auditor bound by confidentiality, on 30 days’ notice, during business hours, without disrupting the Service, and at your cost — except where the audit reveals a material breach on our side.

9. Deletion and return

On termination, you may export your data through the Service for 30 days. After that period we delete the personal data from production systems, and from backups within a further 90 days as those backups rotate, unless retention is required by law. On request we will confirm deletion in writing.

10. Liability and precedence

10.1. Liability under this DPA is subject to the limitations in the Terms of Service, except where mandatory law provides otherwise.

10.2. In case of conflict, the Standard Contractual Clauses prevail over this DPA, and this DPA prevails over the Terms of Service in matters of data protection.

Version 1.0, 30 August 2026.