Data Processing Agreement

Processing schedule

Subject matter: operating the Customer's connected communities and game servers through War Guardian. Duration: the service term and the agreed return, deletion and backup periods. Nature: collection, organization, storage, retrieval, authorized disclosure, statistical review, moderation delivery, return and deletion. Purpose: providing the ordered administration and review service on the Customer's instructions.

People: community staff, players, people included in authorized public Steam relationships and people appearing in submitted evidence. Data: account and player identifiers, display names, roles, sessions, gameplay events, statistics, moderation reasons and actions, staff notes, evidence and enabled integration results. Special-category information is not requested; the Customer must avoid uploading it without a separately documented lawful basis and agreed safeguards.

Locations and authorized suppliers are described in the Subprocessor and Integration Register. Retention and export follow the Data Retention and Cold Storage Policy. The security obligations appear below. These documents form part of this agreement and must be available when it is electronically accepted.

Instructions and confidentiality

War Guardian processes the data only on documented lawful instructions, including the accepted order and authorized settings. If law requires another use, we inform the Customer before that use unless legally prohibited. We promptly flag an instruction we believe infringes applicable data protection law. People authorized to process the data must be bound by confidentiality.

The Customer instructs WarGuardian to fit local detection models to recorded gameplay statistics solely to support manual anti-cheat review. This permission excludes uploaded evidence, messages, saved AI summaries, Steam profile information and anonymous cold storage. No instruction authorizes LLM or general-purpose model training, external AI provider training or overrides applicable privacy rights. By accepting this agreement, the Customer expressly instructs War Guardian to provide community access to kill feed records for 180 days from each event, subject to the subscription and authorized access, then anonymize them and retain the anonymous kill feed data and derived statistics in cold storage on a lifetime basis, with no fixed expiry. Steam profile information, ban records and evidence are excluded from that archive. Ban records and their associated evidence follow a separate 180-day deletion schedule. Earlier lawful deletion or end-of-service requirements still apply to identifiable records. The safeguards in the retention policy apply throughout.

Security and assistance

We implement technical and organizational measures appropriate to the risk, including controlled access, protected credentials, secure transmission and backup and recovery controls. Any additional security measures expressly agreed in the order also apply.

Taking account of the processing and information available, we assist the Customer with rights requests, security obligations, incident assessment, impact assessments and any required consultation. We promptly forward rights requests relating to Customer data and do not decide their substantive outcome without instructions unless law requires it.

Incidents and suppliers

We notify the Customer without undue delay after becoming aware of a personal data breach affecting its data. We provide available details of the nature and extent, likely effects, contacts and response measures, and update them as the investigation progresses. The Customer retains its own notification duties.

The Customer grants general written authorization only for subprocessors identified in the named register provided to and accepted by the Customer before processing begins. The public provider notice describes recipient categories; it does not replace this named register. Before adding or replacing a subprocessor, we provide at least 30 days' notice and a meaningful opportunity to object on data protection grounds. If no adequate alternative resolves the objection, the affected processing must not proceed and either party may end the affected service with a refund of its unused prepaid portion. We impose equivalent data protection duties by contract and remain responsible for our subprocessors' performance.

Transfers and accountability

The Customer instructs War Guardian to host and process the agreed service data in the United States. This agreement does not itself establish an international transfer mechanism. Before any transfer that requires additional legal safeguards, the parties must put the applicable arrangement in place for the actual parties and data, including any required assessment. Neither party may initiate such a transfer on the assumption that this agreement or a different provider's terms cover it.

We provide information necessary to demonstrate compliance and allow and contribute to audits and inspections by the Customer or its appointed auditor. Reasonable arrangements may protect other customers and system security, but must not prevent a necessary audit or regulator access.

End of service

At the Customer's choice, we return or delete processor-held personal data within 30 days after service ends, and delete copies unless law requires retention. Backup copies are isolated from ordinary use and are removed through the applicable recovery rotation schedule and when no longer needed for recovery, subject to legal retention requirements. We provide the Customer with the applicable maximum backup retention period before it authorizes the processing. Restored data must have previously approved deletions reapplied. Independent-controller records require their own lawful basis and retention; they are not silently included in the processor exception.

If this agreement conflicts with the service terms on personal data processing, this agreement takes priority. Mandatory law and any executed transfer clauses take priority over conflicting provisions. The applicable version is the version electronically accepted with the Customer's account or order. The acceptance record also documents the Customer's instruction to prepare anonymized kill feed cold storage.