Hosting

Data processing agreement

under Art. 28 GDPR · Last updated: 21.10.2026

This is a translation for your convenience. The German version is legally binding: Vertrag zur Auftragsverarbeitung.

This agreement applies between the Customer as controller and Jörg Stuff (Navoryx), c/o flexdienst – #22262, Kurt-Schumacher-Straße 74, 67663 Kaiserslautern, Germany, as processor, as soon as a hosting contract exists and the Customer processes personal data on their server. It ends with the hosting contract.

1. Subject, nature and purpose

The processor provides server containers (game servers, bot servers) including storage, backups, panel and SFTP. It processes the data the Customer stores on the server, or that is collected there from players or users, solely for hosting: storing, backing up (at the Customer's request), transferring and deleting after the contract ends. It does not evaluate the data for its own purposes.

2. Types of data and data subjects

Which data is involved depends on the Customer's use. Examples are player names and identifiers (UUID), IP addresses in server logs, chat messages, game saves and bot content (such as Discord or Telegram identifiers and messages). Data subjects are the Customer's players, users and fellow players.

3. Instructions

The processor processes the data only on documented instructions from the Customer. The instructions result from the hosting contract and the settings the Customer makes in the customer area and the panel. The Customer gives further instructions by email to contact@navoryx.site. If the processor considers an instruction unlawful, it informs the Customer. Statutory obligations (such as orders from authorities or measures under the Digital Services Act) remain unaffected. Where permitted, the processor informs the Customer of them.

4. Confidentiality

Only the processor's owner, who is bound to confidentiality, has access to customer data. The owner accesses it only to the extent necessary for operation, troubleshooting, support at the Customer's request or statutory obligations.

5. Technical and organisational measures (Art. 32 GDPR)

  • Data centre of Hetzner Online GmbH in Falkenstein (Germany), ISO/IEC 27001 certified, with access control, fire protection and emergency power.
  • Separation of customers by individual containers with their own storage areas and resource limits.
  • Encrypted transmission: panel, customer area and interfaces only via TLS, file transfer via SFTP.
  • Administrative access only with a second factor (passkey, authenticator app or code by email); the operator's server access only via SSH keys.
  • Backups at the Customer's request, stored locally on the server; deletion of server data 14 days after the contract ends.
  • Regular security updates of the operating system, panel and runtime environment; monitoring of availability and load.

6. Sub-processors

The Customer consents to the use of the following sub-processors:

  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: servers and data centre.
  • IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany: sending emails, only insofar as the Customer sends third-party data to us by email.

The processor informs the Customer of new or changed sub-processors at least four weeks in advance by email. The Customer may object and then terminate the contract effective at the change.

7. Support and notifications

The processor supports the Customer with data subject requests, data protection impact assessments and notifying data breaches. It notifies the Customer of a personal data breach on the server without undue delay, at the latest within 48 hours of becoming aware of it.

8. Deletion and return

After the contract ends, the Customer can download their data for 14 days (terms § 6). Afterwards the processor deletes all data of the server including backups, unless a statutory retention obligation applies.

9. Evidence and audits

On request, the processor provides the Customer with the information necessary to demonstrate compliance. Where this information is insufficient, on-site audits are possible by arrangement with reasonable notice. For the measures in the data centre, its certificates serve as evidence.

10. Final provisions

In case of conflict between this agreement and the terms, this agreement prevails for data protection. German law applies. Customers who need a signed agreement can request one at contact@navoryx.site.