Data Processing Agreement

This data processing agreement applies when you use Trivolut services for a business, an organisation or anything else outside purely personal use, and you store or process personal data on them. It is part of our Terms of Service and needs no separate signature: it applies from the moment you use our services in that way. It meets the requirements of article 28 of the General Data Protection Regulation (GDPR).

1. Who is responsible for what

• For the personal data you put on your services, such as the data of your users, customers or players, you are the controller and we are your processor.
• For the data of your own account with us, such as your name, billing details and support conversations, we are the controller. Our Privacy Policy describes that, not this agreement.

2. What we process for you

• Subject and duration. We store and process the data you put on your services, for as long as those services exist and until it is deleted as described in section 10.
• Nature and purpose. Hosting: storing, running, copying for backups and transmitting data, only to provide the services you ordered.
• Types of data and people. You decide what you put on your services, so you decide which personal data and whose. We do not look at it to find out (see section 4).

3. Your instructions

We process the data only on your instructions. Your instructions are these terms, our Terms of Service, and what you do in your panel or ask us in a ticket. We do not process the data for our own purposes. If the law requires us to process it in another way, for example because of a court order, we tell you first, unless the law forbids that. If we think an instruction breaks data protection law, we tell you.

4. Confidentiality and access by our staff

• Everyone at Trivolut who can access your data is bound to confidentiality.
• Our staff do not look at what is on your services, except when you ask us to, when you give support access in your panel, or when we need to investigate abuse or a security incident.
• Support access to a VPS is off by default. You turn it on yourself, separately for seeing the root password and for SSH access, and every use by our staff is logged with a reason.

5. Security

• We take the measures listed in the annex below. We may improve them over time, but we will not lower the level of protection.
• Our services are unmanaged unless we agreed otherwise. You are responsible for securing what you run on them: the operating system and software on a VPS, your applications, your passwords and who you give access to.

6. Sub-processors

• You give us general permission to use sub-processors, such as the data centre providers our infrastructure runs in and the provider of our web hosting platform. We impose the same data protection obligations on them as this agreement imposes on us.
• You can ask us for the current list by ticket or at support@trivolut.com.
• We tell you at least 30 days before we add or replace a sub-processor that can access your data. If you object on reasonable grounds and we cannot solve it, you can end the services involved before the change, and we refund the part of the period you paid for and did not use.
• We remain responsible to you for the work of our sub-processors.

7. Where your data is

The services you run with us, and their backups, are hosted in the European Union. We do not transfer your data outside the European Economic Area, except through features that need it and that you choose to use, such as the AI crash explanation for game servers (an AI service) and looking up Minecraft player names (Mojang), under the safeguards the GDPR requires. If anything else changes, we tell you in advance as in section 6.

8. Helping you

• If someone asks you to exercise their rights under the GDPR, you can usually handle it yourself, because you control the data on your services. Where you need us, we help as far as we reasonably can.
• We also help you, with the information we have, with security, data protection impact assessments and consultations with a supervisory authority.
• If a person contacts us directly about data on your services, we pass the request on to you and do not answer it ourselves.
• We may charge reasonable costs for help that takes more than a little time, after telling you the amount.

9. Personal data breaches

If we become aware of a breach of security that affects personal data on your services, we tell you without undue delay, and where possible within 48 hours. We tell you what we know about what happened, which data and services are involved, what the likely consequences are and what we are doing about it, and we send more as we learn it. You decide whether to report the breach to the authority and to the people involved.

10. When a service ends

• When a service is terminated, the server and the data on it are deleted, as described in our Terms of Service. Until then you can download or copy your data yourself, through your panel, SFTP or your own tools.
• Backups we made of the service are deleted within 30 days after the service is terminated.
• We do not keep copies after that, unless the law requires us to.

11. Audits and information

We give you the information you need to show that we meet this agreement. If that is not enough, you can have an audit carried out by an independent auditor who is bound to confidentiality, at your own cost, at most once a year and with at least 30 days' notice. The audit may not disturb our services or reveal data of other customers.

12. Liability and order of precedence

The liability rules in our Terms of Service apply to this agreement. If this agreement and our Terms of Service conflict on the processing of personal data, this agreement decides. This agreement ends when we no longer process personal data for you.

Annex: our security measures

• Encryption in transit. All our websites, panels and APIs use HTTPS. Access to a VPS and to game server files goes over SSH and SFTP.
• Access for our staff. Access to our team panel requires two-factor authentication. Permissions are set per role and per action, so staff can only do what their work needs.
• Logging. Actions by our staff on customer accounts and services, such as using support access or signing in as a customer to help, are recorded in an audit log. Signing in as a customer is limited to one hour and is shown in the customer's own activity log.
• Secrets. VPS root passwords are stored encrypted and can only be decrypted by the system that needs them. Passwords of accounts are stored as one-way hashes, and two-factor secrets encrypted.
• Separation. Each VPS is a separate virtual machine, and each game server and application runs in its own container.
• Network. Attack traffic is filtered in front of our nodes, and we measure traffic per node to detect attacks.
• Maintenance. Our platform servers install security updates automatically and block repeated failed sign-in attempts.
• Backups. Backups of services are made and kept as described for each service and in your panel.