Data Processing Addendum
Applies automatically to every customer under Art. 28 GDPR. Draft pending legal review.
1. Roles#
Customer is controller of player data processed in its projects; Aurix is processor. Aurix processes such data only on documented instructions — the configuration you make in the console and API.
2. Subject matter#
Real-time voice transmission, optional recording and transcription, token issuance and related metering for the duration of the contract. Data subjects: your players and team members. Categories: identifiers, display names, position data, audio, connection metadata.
3. Obligations of the processor#
- Confidentiality of staff; access on need-to-know.
- Technical and organisational measures as described in Security.
- Assistance with data-subject requests and impact assessments within reasonable effort.
- Notification of personal-data breaches without undue delay, at most 48 hours after awareness.
- Deletion or return of data at the end of the contract (projects: at deletion; backups: within 30 days).
- Audit information on request once a year; on-site audits at the customer's cost with 30 days' notice.
4. Sub-processors#
Listed on the Sub-processors page. We notify changes 30 days in advance by e-mail; you may object on reasonable grounds and terminate affected projects.
5. Transfers#
Processing takes place in the EU/EEA. Should a sub-processor outside the EEA be engaged, Standard Contractual Clauses apply.
6. Liability and term#
As in the Terms of Service. This DPA ends with the deletion of the customer's last organisation.