Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you, the customer ("Customer", "Controller", "you"), and Galaxy Nexus ("Galaxy Nexus", "Processor", "we", "us"). It sets out how Galaxy Nexus processes personal data on your behalf when providing our hosting services, including game servers, Discord bots, virtual private servers (VPS), and dedicated servers. Where you are an entity subject to the Australian Privacy Act 1988 (Cth) or the EU/UK General Data Protection Regulation (GDPR), this DPA applies to the extent those laws govern your relationship with us.

2. Definitions

• Personal Data: any information relating to an identified or identifiable individual
• Controller: the party that determines the purposes and means of processing personal data (the Customer)
• Processor: the party that processes personal data on behalf of the Controller (Galaxy Nexus)
• Processing: any operation performed on personal data, including collection, storage, use, transfer, and deletion
• Subprocessor: a third party engaged by Galaxy Nexus to process personal data as part of delivering our services
• Data Subject: the individual to whom personal data relates
• Personal Information: personal data as defined by the Privacy Act 1988 (Cth)
• Security Incident: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data

3. Roles and Responsibilities

• Customer acts as Controller: you determine the purposes and means of processing any personal data held within your services
• Galaxy Nexus acts as Processor: we process personal data only to provide, secure, bill, and support the services you purchase from us
• Customer is responsible for the lawfulness of processing, including providing privacy notices, obtaining consents, and satisfying any registration requirements that apply to your own use of the services
• Galaxy Nexus processes personal data only on your documented instructions, as set out in this DPA and your service configuration

4. Nature and Purpose of Processing

• Purpose of processing: provision, maintenance, security, billing, and support of the Galaxy Nexus services you purchase
• Categories of personal data: account information (name, email address, phone number, billing address), payment information, usage data (IP addresses, browser types, access times, referring pages), server data you host, and VPS access application details
• Categories of data subjects: our customers and, where your use of the services involves it, your end users, players, visitors, and employees
• Duration of processing: for the term of your services, then for the retention periods set out in Section 11 below

5. Processor Obligations

• Process personal data only on your documented instructions, including transfers of personal data, unless required to do so by law
• Ensure persons authorized to process personal data are bound by appropriate confidentiality obligations
• Assist you, where possible, in complying with data subject rights requests, including access, correction, deletion, and portability
• Assist you in meeting data protection impact assessment and prior consultation obligations where required
• Make available information necessary to demonstrate compliance with this DPA
• Notify you without undue delay if, in our opinion, an instruction of yours infringes applicable data protection law

6. Security Measures

• All data is encrypted in transit using TLS 1.3
• Sensitive data at rest is encrypted using AES-256
• Regular security audits and penetration testing
• Access to customer data is restricted to authorized personnel
• Incident response procedures for data breaches

7. Subprocessors

• You provide general authorization for Galaxy Nexus to engage the subprocessors listed on our subprocessor list, which currently includes: Stripe and PayPal (payment processing), Google Analytics (anonymized analytics), and help desk software (support)
• Each subprocessor processes personal data only to the extent necessary to perform its function and is bound by data protection obligations equivalent to those in this DPA
• We will notify you by email or on our website of any intended changes to the subprocessor list, giving you the opportunity to object
• If you object to a new subprocessor on reasonable data protection grounds, we will work with you in good faith to address your concerns

8. International Data Transfers

Your data may be transferred to and processed in countries other than Australia. We ensure appropriate safeguards are in place to protect your data in compliance with Australian privacy laws and, where applicable, the GDPR, including standard contractual clauses approved for international transfers.

9. Data Subject Requests

• You are responsible for responding to data subject requests relating to personal data you control
• Where a data subject request identifies personal data processed by Galaxy Nexus, we will assist you in fulfilling the request within a reasonable time
• If a data subject contacts Galaxy Nexus directly, we will forward the request to you without undue delay unless prohibited by law

10. Security Incident Notification

• Galaxy Nexus will notify you without undue delay, and in any event within 72 hours of becoming aware, of any confirmed Security Incident affecting personal data we process on your behalf
• Notifications will describe the nature of the incident, the categories and approximate number of data subjects concerned, the likely consequences, and the measures taken or proposed to mitigate
• We will assist you in meeting any obligations to notify supervisory authorities or affected data subjects

11. Data Retention and Deletion

• Account data is retained while your account is active
• Usage logs are retained for 30 days for security purposes
• Billing records are retained for 7 years to meet Australian taxation record-keeping requirements
• Data is deleted within 30 days of account closure
• Upon termination of services, we will delete all personal data processed on your behalf, except where retention is required by law

12. Audits

Upon written request, and no more than once per calendar year unless required by a supervisory authority or following a Security Incident, Galaxy Nexus will make available information and, where necessary, allow an independent audit to demonstrate compliance with this DPA. Any audit must be conducted with reasonable notice, during business hours, without disrupting our operations, and at your expense.

13. Liability

To the extent permitted by law, the limitation of liability in the Terms of Service applies to any breach of this DPA. Galaxy Nexus shall not be liable for indirect, incidental, special, or consequential damages, and our maximum liability shall not exceed the fees paid in the 12 months preceding the claim.

14. Term and Termination

This DPA remains in effect for as long as Galaxy Nexus processes personal data on your behalf, until terminated per the Terms of Service. Provisions that by their nature should survive termination, including confidentiality, security, retention, and liability, continue to apply.

15. Governing Law

This DPA is governed by the laws of Queensland, Australia. Any disputes shall be resolved in the courts of Brisbane, Queensland.

16. Contact Information

For questions about this DPA, to exercise your rights, or to object to a subprocessor, contact us at [email protected] or [email protected].