Data Processing Addendum

1. Definitions

• Data Protection Law means all laws on personal data that apply to the processing, including:
• the Israeli Privacy Protection Law, 5741-1981, and its regulations;
• the GDPR;
• the UK GDPR and the Data Protection Act 2018;
• the CCPA.
• Customer Personal Data means personal data that we process on your behalf when providing the Service. This includes data about your Members, staff and, for Tenants, End Customers.
• "Controller", "processor", "data subject", "personal data breach", "processing" and "supervisory authority" have their meanings under the GDPR. Under Israeli law they correspond to "database owner", "holder" and "security incident", as appropriate.
• Other capitalised terms have the meaning given in the Terms.

2. Roles and scope

2.1. For Customer Personal Data:

• you are the controller (for a Tenant acting for its End Customers, you may be a processor, and we are then your sub-processor);
• we are the processor.

We are an independent controller only for the data described in section 4.1 of our Privacy Policy. Examples are console accounts, billing, security logs and aggregated statistics.

2.2. Details of the processing are set out in Annex I.

2.3. You are responsible for:

• the lawfulness of the processing you instruct, including having a lawful basis and giving your Members any required notices;
• the accuracy of Customer Personal Data;
• your choice of features, settings and integrations.

You confirm that you will not instruct us to process special categories of data, criminal-offence data or children's data, except where Data Protection Law allows it and you have assessed the risk.

3. Instructions

3.1. We process Customer Personal Data only on your documented instructions. Your instructions are:

• the Agreement and this DPA;
• your configuration and use of the Service (enabling features, settings, Flows, commands);
• any other written instruction that we agree to.

We may also process it where the law to which we are subject requires. In that case we will inform you before processing, unless that law prohibits it.

3.2. We will tell you if, in our opinion, an instruction breaches Data Protection Law. We may then decline to follow it.

3.3. We will not:

• sell Customer Personal Data;
• use it for advertising;
• combine it with other data except as needed to provide the Service;
• retain, use or disclose it for any purpose other than providing, securing and supporting the Service, or complying with the law.

4. Confidentiality

We ensure that everyone we authorise to process Customer Personal Data:

• is bound by confidentiality obligations;
• accesses the data only as needed for their tasks.

5. Security

5.1. We implement the technical and organisational measures described in Annex II. They are designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the costs, and the nature and risks of the processing.

5.2. We may update these measures, as long as the overall level of protection is not reduced. You acknowledge that the security of your Discord account, your Server's permissions, your Flows' endpoints and credentials, and your Custom Bot and OAuth secrets outside the Service is your responsibility.

6. Sub-processors

6.1. General authorisation. You authorise us to engage sub-processors. Our current sub-processors are listed on the Sub-processors page.

6.2. Their obligations. We impose on each sub-processor data-protection obligations that are substantially as protective as this DPA. We remain responsible for their performance.

6.3. Changes and objections. We will announce new or replacement sub-processors by updating the Sub-processors page at least 14 days before they begin processing Customer Personal Data. Business and White Label Customers who have asked us at info@botgg.app to be notified will also receive an email.

You may object on reasonable data-protection grounds within that period. If we cannot reasonably accommodate the objection, you may terminate the affected part of the Service. Where you are entitled to it, we will refund prepaid fees for the unused period. This is your sole remedy for the objection.

6.4. Services that are not our sub-processors. Some services are independent controllers or recipients that you select, and are not our sub-processors:

• Discord, the platform on which the Service runs;
• PayPal;
• third-party services that you choose to connect, such as endpoints, databases or spreadsheets in your Flows, social platforms you follow, or game APIs your Members use.

7. Assistance

7.1. Data subject requests. Taking into account the nature of the processing, we assist you through the Service's features and, where needed, on request. The features include deleting records, resetting data, and exporting backups and transcripts. If we receive a request directly from a data subject about Customer Personal Data, we will forward it to you or tell the data subject to contact you. We will not respond ourselves unless you authorise us, or the law requires us to.

7.2. Other assistance. We provide reasonable assistance with data protection impact assessments, prior consultations and inquiries from supervisory authorities, to the extent the information is available to us. We may charge a reasonable fee for assistance that goes beyond the Service's standard features, unless the assistance is needed because of our breach.

8. Personal-data breaches

8.1. We will notify you without undue delay, and where feasible within 48 hours, after becoming aware of a personal-data breach affecting Customer Personal Data. We will notify you through the console, a Discord message to the Server Owner, or email to the address we hold.

8.2. The notice will include, as far as it is available at the time (and later in phases):

• the nature of the breach;
• the categories and approximate number of data subjects and records affected;
• the likely consequences;
• the measures taken or proposed;
• a contact point.

8.3. We will take reasonable steps to contain and remedy the breach, and we will cooperate with you on your notification obligations. You are responsible for notifying supervisory authorities and data subjects where you are the controller, unless we agree otherwise.

8.4. Our notification is not an acknowledgement of fault or liability.

9. Deletion and return

9.1. During the term, you can export and delete Customer Personal Data using the Service's features.

9.2. After the Service ends for a Server (the bot is removed) or for your plan, we delete the Customer Personal Data of that Server after 30 days. Until then you can reverse an accidental removal. We delete Tenant data 30 days after the Tenant plan ends. Copies in our database backups are deleted within a further 14 days, when those backups expire.

We may retain data only where the law requires us to. That data stays protected by this DPA and is used for no other purpose.

9.3. If you ask for the data to be returned before deletion, we will provide it in the formats the Service's export features support (for example backup files) within the 30-day period.

10. Audits and information

10.1. On written request (no more than once a year, except after a personal-data breach or where a supervisory authority requires it), we will provide information reasonably necessary to demonstrate compliance with this DPA. This will be in the form of written answers to a reasonable security questionnaire and relevant documentation.

10.2. If that information is not sufficient to demonstrate compliance, or a supervisory authority requires it, you may carry out an audit, or have it carried out by an independent auditor bound by confidentiality, under these conditions:

• at least 30 days' prior written notice;
• during business hours;
• without access to other customers' data;
• without undue disruption;
• at your cost.

We may charge reasonable fees for our time. We do not hold third-party certifications (such as ISO 27001 or SOC 2) and do not claim to.

10.3. As required by Israeli law, we will report to you, at least once a year or on request, on how we are meeting our obligations under this DPA and the Data Security Regulations.

11. International transfers

11.1. We host the Service in Germany (European Union) and operate it from Israel. Israel is recognised by the European Commission and the United Kingdom as providing adequate protection.

11.2. Where Customer Personal Data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, the relevant mechanism applies:

• the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated by reference:
• Module 2 (controller to processor) where you are a controller;
• Module 3 (processor to processor) where you are a processor;
• the UK International Data Transfer Addendum applies for UK data;
• or the transfer is based on another lawful mechanism, such as the recipient's certification under the EU-U.S. Data Privacy Framework.

For the SCCs:

• the optional clause 7 does not apply;
• in clause 9, option 2 (general authorisation) applies, with the notice period in section 6.3;
• in clause 11, the optional language does not apply;
• in clauses 17 and 18, the law and courts of Ireland apply;
• Annexes I and II of this DPA complete the SCC annexes.

If the SCCs conflict with this DPA, the SCCs prevail.

11.3. Transfers from Israel comply with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.

12. CCPA

Where the CCPA applies, we act as your service provider. We will not:

• sell or share Customer Personal Data;
• retain, use or disclose it outside our direct business relationship with you, or for any purpose other than the business purposes in this DPA;
• combine it with personal information we receive from others, except as the CCPA permits.

We certify that we understand these restrictions.

13. Liability and precedence

13.1. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except where Data Protection Law does not allow this.

13.2. If there is a conflict, the order of precedence is:

1. the SCCs;
2. this DPA;
3. the Terms.

13.3. This DPA ends automatically when we no longer process Customer Personal Data for you.

Annex I: Description of the processing

Parties.

• Controller: the Server Owner, business or White Label Customer, identified by their Discord account and Servers.
• Processor: BotGG, contact info@botgg.app.

Data subjects.

• Members of your Servers;
• your staff and moderators;
• people who interact with the bot or your Flows (including webhook senders);
• for Tenants, End Customers and their Members.

Categories of data, depending on the features you enable:

• Discord identifiers (user, Server, channel, role and message IDs), usernames, display names and avatars;
• activity counters (messages, voice minutes, reactions, XP), voice-state events, member join and leave events and invite attribution;
• message content and attachment metadata, where features need it (tickets transcripts, AutoMod processing in memory, logs posted to your channels, starboard previews, backup message archives, Flows);
• form answers (tickets, applications, verification questions, exit surveys);
• moderation cases and reasons;
• birthdays (day and month, optional year);
• reminder texts;
• linked game account identifiers and public game statistics;
• followed social accounts and feeds;
• Server structure (roles, channels, permissions) in backups;
• Flows definitions, encrypted credentials, and execution inputs and outputs;
• Custom Bot application details and the encrypted bot token;
• White Label branding and encrypted OAuth client secrets.

Special categories. None are intended. You must not configure the Service to collect them (see section 2.3).

Nature and purpose. Hosting, storing, analysing, displaying and transmitting data to provide the Discord bot and console features you enable, and to secure and support the Service.

Frequency. Continuous, for as long as the Service is used.

Duration and retention. For the term of the Agreement, plus the periods in section 9 and in the Privacy Policy.

Sub-processors. See the Sub-processors page.

Annex II: Technical and organisational measures

These measures describe how the Service is actually built and operated today.

1. Encryption in transit: HTTPS/TLS for the console, website and API; Discord API and gateway connections over TLS; TLS to third-party APIs where the provider supports it.
2. Encryption of secrets at rest: AES-256-GCM (authenticated encryption, a random IV per value, and keys held only in server-side configuration, separate from the database) for: - Custom Bot tokens; - White Label OAuth client secrets; - Flows credentials. Secret values are never returned to the browser.
3. Authentication and sessions: sign-in only through Discord OAuth2 with the minimal scopes identify and guilds; the OAuth access token is not stored; the OAuth state parameter prevents forged sign-ins; the session is regenerated at sign-in; session cookies are HTTP-only, Secure and SameSite=Lax, and expire after at most 7 days; sessions are stored server-side.
4. Access control: every console request for a Server checks that the signed-in user can manage that Server (according to Discord) and that the bot is in it. Changes are recorded in a per-Server audit log. Administrative access to production is restricted to the operator.
5. Outbound request protection (SSRF): for Flows HTTP, MySQL and other user-supplied destinations, we resolve DNS and block loopback, private (RFC 1918), link-local, carrier-grade NAT, multicast, cloud-metadata and equivalent IPv6 addresses. Connections are made to the checked address, with timeouts and response-size limits.
6. Incoming webhooks: cookies, authorisation headers and IP-forwarding headers are stripped before a Flow sees the request. Webhook URLs contain a random 256-bit token that can be rotated.
7. Application security: input validation with schemas; request size limits; rate limits on public endpoints and on Flows executions; security headers including a Content Security Policy; PayPal webhook signature verification and idempotent processing.
8. Data minimisation: features are off by default. Captcha codes are stored only as hashes. Card data is never received. The public leaderboard shows no user IDs. Execution history is pruned automatically (1–90 days).
9. Resilience: a full database backup every day, kept for 14 days and then deleted automatically. The backups are compressed database dumps stored on the production server, in files readable only by the system administrator account; they are not separately encrypted. Automatic recovery of interrupted jobs. An off-site backup copy is planned but not yet in place.
10. Deletion: the retention periods in the Privacy Policy, and deletion of a Server's data 30 days after the bot is removed.
11. Incident response: the breach process in section 8, and records of security incidents as required by the Israeli Data Security Regulations.
12. Supplier management: sub-processors are selected for their security practices and bound by written terms.