Data processing agreement (Art. 28 GDPR)

Version 2026-08-08. This English rendering is a courtesy translation. The German version is the binding one, and it is the text that was concluded.

If you use Putty Party commercially and process third-party personal data — in practice, participants' names — you are the controller (Art. 4(7) GDPR) and we are the processor (Art. 4(8)). Art. 28(3) requires a contract for that, and this page is it: concluded electronically when your Betrieb was created, as Art. 28(9) expressly permits, and recorded against your account with the version you accepted.

Its § 2 states the controller's own duties and rights, as the Art. 28(3) chapeau requires; §§ 3–10 track the mandatory checklist in Art. 28(3) lit. a–h one clause at a time: instructions, confidentiality, Art. 32 measures, sub-processors, assistance with data subject rights, breach notification, deletion and return, and audits. § 11 covers where processing happens, including the one component that is not pinned to the EU. Annex 1 lists the sub-processors and is generated from this deployment's own configuration; Annex 2 is the technical and organisational measures.

Sub-processors (Annex 1)

Generated from this installation's actual configuration rather than maintained by hand, so it can neither list a service we do not use nor omit one we do:

Recipient	Purpose	Location
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA	Application runtime, database, object storage (backups and uploaded images), delivery, access control for the operator console, bot mitigation, e-mail forwarding	EU
Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA	Transactional e-mail: address confirmation, invitations, password resets	Sending in the EU (Ireland), logs in the US
Sentry (Functional Software, Inc.) — EU-Region, Rechenzentrum Frankfurt	Error reporting, for fault diagnosis	EU

Cloudflare: Database and object storage are pinned to the EU by jurisdiction, not merely by location hint, as are the realtime components. One exception: the session cache lives in a globally replicated key-value store for which the provider offers no jurisdiction binding. It holds session identifiers and counters, not tournament data.
Resend: Account and delivery logs are stored in the US regardless of the chosen sending region, on the basis of the EU standard contractual clauses. Resend in turn uses Amazon SES as its own sub-processor for delivery.
Sentry (Functional Software: Error reports contain neither e-mail addresses nor the secret management links: both are stripped before sending. The public game id is kept, because it is printed on the QR poster anyway and an event without it could not be traced to an incident.

Recipients acting as independent controllers

The following services are not sub-processors under this agreement: they receive personal data as independent controllers (Art. 4(7) GDPR) and are listed here for transparency, with details in the privacy policy:

Recipient	Purpose	Location
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland	Sign-in with a Google account — only where that sign-in method is chosen	EU / US
Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Irland	Payment processing and invoicing	EU / US

Google Ireland Limited: The sign-in happens at Google: credentials are entered there, not here. Only the e-mail address, the name and the address’s verification status are passed to us. Google is responsible for the Google account and for the sign-in itself, under its own privacy terms. Signing up with e-mail and password does not involve Google at all.
Stripe Payments Europe: Payment details are entered exclusively on Stripe-hosted pages and never touch our systems. For payment processing and its statutory checks Stripe acts as an independent controller.

For the full and binding text, see the German version.

← Putty Party·Imprint·Privacy·Terms·Withdrawal·DPA·Cancel contracts here·Report content