Data processing agreement

Last updated: 27 October 2026 · Version 1.1

Parties and scope

This agreement is made between the organization that uses Handler (the controller) and the publisher of Handler, identified in the legal notice (the processor). It adds to the terms of use and is part of them: it applies as soon as an organization connects a server or creates an account for the organization, with no separate signature.

A signed copy can be requested at the contact address: [email protected]

It applies to the players' personal data that Handler processes for the organization. For members' accounts, billing, the security of the service and the shared anticheat network, Handler is a controller: see the privacy policy.

Subject matter, nature and purpose

Handler provides the organization with a control and moderation service for Wardogs game servers. To do so, Handler collects, stores, analyzes and displays the data that the organization's servers expose.

Purposes: control and moderation of servers, statistics, anticheat, player tickets, automations, the organization's public pages and API. Handler processes this data only for these purposes.

Data and data subjects

Data subjects: players who connect to the organization's servers, and people who open a ticket or take part in a vote on its public page.

Game identity: SteamID, nicknames, dates and number of sessions.
Activity: kills, deaths, weapons, distances, factions, cash, ping, match events.
Moderation: sanctions, reasons, team notes, anticheat cases and detections.
Tickets: messages, evidence links, optional email address.
Participation: kick votes, map and lighting polls.
Public Steam profile: nickname, avatar, declared country, account age, VAC and game bans.

Handler does not process sensitive data within the meaning of GDPR article 9 and does not collect players' IP addresses on servers. The organization refrains from entering such data in notes and tickets.

The organization's instructions

Handler processes data only on the organization's documented instructions: these terms, the service settings and the actions of its members. If an instruction seems to infringe the GDPR, Handler informs the organization.

If Union or Member State law requires Handler to process data, Handler informs the organization beforehand, unless the law forbids it.

The organization's obligations

Have a legal basis to process its players' data, for example its legitimate interest in moderating its server and protecting it against cheating.
Inform its players, for example in the server rules, of the use of Handler, the data processed, the retention periods and their rights.
Provide a way to appeal a sanction and apply a human review to any automated decision it turns on.
Answer its players' rights requests, with Handler's help.
Choose carefully what it publishes on its public page and what it shares with the anticheat network.
Manage its members' access: roles, permissions, two-factor authentication, removing members who leave.

Confidentiality

Handler makes sure that the people authorized to process the data commit to confidentiality or are bound by a legal duty. Access to data is limited to what the service, security and support need.

Security

Handler implements technical and organizational measures appropriate to the risk, including those in annex 1. They are reviewed when the service changes.

Handler notifies the organization of a data breach affecting its player data without undue delay, and at the latest 48 hours after becoming aware of it, with the information it has: nature, data and people concerned, likely consequences, measures taken.

Sub-processors

The organization authorizes Handler to use the sub-processors in annex 2. Handler imposes obligations equivalent to those of this agreement on them and remains responsible for their performance.

Handler informs the organization by email or in the service, at least 30 days in advance, of any addition or replacement. The organization may object on legitimate data protection grounds before the end of that period; failing agreement, it may terminate at no cost.

Transfers outside the European Union

Some sub-processors process data in the United States. These transfers rely on the adequacy decision on the Data Privacy Framework or on the European Commission's standard contractual clauses. Handler makes no other transfer outside the Union without appropriate safeguards.

Assistance

Handler helps the organization, through technical and organizational measures and as far as possible, to answer requests to exercise data subjects' rights: access, rectification, erasure, restriction, portability, objection. If a player contacts Handler directly, Handler directs them to the organization.

Handler helps the organization with security, impact assessments and consultations of the supervisory authority, taking into account the nature of the processing and the information available to it.

Shared anticheat network

The shared network is optional. If the organization chooses to share its telemetry, to publish reports or to receive them, it does so under its own responsibility and according to the terms of use.

For reputation, consensus between organizations and player appeals, Handler acts as a controller, as the privacy policy states. The organization that publishes a report warrants that it rests on a case confirmed by a human or on an active ban, and answers appeals within the set deadlines.

Duration, end and return

This agreement lasts as long as the organization uses Handler. At the end of the contract, or when the organization is deleted, Handler deletes the organization's data within 30 days, unless a legal retention duty applies. During that period, the organization may ask for an export of its data in a common format. While the contract runs, raw game event detail is kept without a time limit; a retention period may be set for the Free plan, with notice to the organization before it applies.

Backups are deleted according to their normal rotation cycle.

Evidence and audits

Handler makes available to the organization the information needed to show compliance with this agreement. An organization may request an audit, at its own cost, with reasonable notice, once a year, without disrupting the service or accessing other organizations' data. The conditions are set by mutual agreement.

Handler keeps a record of the categories of processing carried out on behalf of organizations.

Liability and governing law

The parties' liability is governed by the terms of use, without prejudice to the rights data subjects hold under the GDPR. This agreement is governed by French law.

Annex 1: security measures

Encrypted connections; passwords and tokens stored hashed; two-factor secrets and RCON passwords encrypted.
Strong authentication: two-factor authentication, passkeys, recent identity confirmation for sensitive actions, organization-level two-factor policy.
Access control by roles and permissions, per organization and per server; data separated between organizations.
Audit log of sensitive actions, with before and after values.
Rate limits, bot check, abuse detection.
Members' IP addresses kept as a fingerprint; logs without cookies or authentication headers.
Public pages and API protected by limits and by minimal exposure of data.
Backups and business continuity: the database is copied every day to backup servers located in the European Union (France, Italy, Poland, the Netherlands), from which the service can be restored.

Annex 2: sub-processors

OVH SAS (France): hosting of the servers and the database, in Italy (OVHcloud datacenter), in the European Union.
Cloudflare, Inc.: network and protection (United States).
Brevo (Sendinblue SAS, France) or another email provider: transactional emails, for example the confirmation of the address of a player who opens a ticket.
Valve (Steam): retrieval of public profiles and ban statuses (United States). Valve acts on its own behalf.
Discord Inc.: posting messages in the channels the organization chooses (United States). Discord acts on its own behalf.