Data processing agreement

Who this agreement is between

This agreement is between KORDU LTD ("we"), which runs Mizan, and each community that uses Mizan ("you"). It's part of our terms of use. You accept it when you create a community, connect a game server to it or install the Mizan server module, and the person who does that accepts it for the community.

It covers the UK GDPR and, where it applies to you, the EU GDPR. Where it and the terms differ on how we handle personal data, this agreement wins.

Who decides what

For the data described below, you're the controller and we're your processor. You decide to collect it and why, and we handle it for you.

We're a controller in our own right, outside this agreement, for:

• the public ban registry, including any bans your community chooses to publish to it
• recordings of play we use to build and test Mizan's detection, made only where you've agreed to them
• your staff's mizan.ac accounts, your community's account and keys, and the records of how the keys are used
• what we keep to protect Mizan from abuse, such as rate limits and the addresses game servers connect from

The privacy policy covers those.

What we process for you

Mizan doesn't use aim and movement data to recognise who a player is or to link their accounts.

Your instructions

We process the data only on your documented instructions: this agreement, the settings you choose (such as turning on the module's link, your join policy and your alerts), and what your staff do in the dashboard. If the law makes us process it any other way, we'll tell you first, unless the law forbids that. If we think an instruction breaks data protection law, we'll tell you straight away.

What you're responsible for

• Having a lawful basis for running the module and for what your staff record. For most communities that's a legitimate interest in keeping cheating off their servers.
• Telling your players that your servers run Mizan, for example in your rules or on your website, and linking to Mizan's privacy policy.
• Taking extra care where your players include children.
• Answering your players' requests about their data, with our help.
• Keeping your server keys secret, and giving dashboard access only to staff who need it.

Confidentiality

Only Mizan staff who need to see your data, to run Mizan or to help you, can see it. Each of them is bound to keep it confidential.

Security

We protect your data with measures suited to the risk, as Article 32 of the UK GDPR requires. They include:

• The module's link to the detection service uses TLS 1.3, checks the service's certificate, and proves each server with its own key, tied to that connection.
• The detection service reads each command's data in memory and doesn't write it to disk.
• Community API keys are stored as a hash, with an encrypted copy so owners can show them again, never in plain text.
• Dashboard access follows the roles and permissions your community sets, checked on our servers.
• Evidence files are private, and are read only after a permission check or through a signed link that expires.
• Every mizan.ac account can turn on two-step verification.
• The detection service runs in a locked-down service, on a server that accepts only the module's link and our own administration.

If you find a weakness, our security policy says how to report it.

Providers we use

You give us general permission to use these providers for the processing above. Each is bound by written terms that protect the data as this agreement does, and we're responsible to you for what they do.

We'll email your community's owners at least 14 days before we add or replace a provider, and update this list. If you object on reasonable data protection grounds, tell us within those 14 days. If we can't meet your objection, you can stop using the part of Mizan the change affects, or delete your community.

Transfers outside the UK

Cloudflare and PlanetScale are US companies, and Cloudflare handles requests in many countries. The detection service's server is in Canada. Where a transfer of your data outside the UK and the EEA isn't covered by UK adequacy regulations or an EU adequacy decision, we rely on the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses. Accepting this agreement is your instruction to make these transfers.

Your players' requests

If a player asks us about data we hold for you, we'll pass the request to you, unless the law requires us to answer it ourselves. When you ask, we'll find, export, correct or delete a player's data we hold for you within 14 days, so you can answer within the month the law gives you.

Help with your own duties

We'll give you the information you need about how Mizan processes your data for your own security, your data protection impact assessments and any consultation with a regulator (Articles 32 to 36 of the UK GDPR). This page is the start; ask us for anything it doesn't answer.

Personal data breaches

If a personal data breach affects your data, we'll email your community's owners without undue delay, and no later than 48 hours after we become aware of it. We'll say what happened, which data and roughly how many players it affects, what it's likely to mean and what we've done, and send more as we learn it. You decide whether to tell your regulator and your players, and we'll help. We keep a record of every breach.

When your community is deleted

When you delete your community, its keys stop working at once, and its owners have 30 days to change their minds. After those 30 days we delete its dashboard records and evidence files, in batches every hour until they're all gone. Database backups hold deleted data for up to two days after that. If you want a copy first, ask us before the 30 days are up and we'll send you an export.

Detection results are the exception for now. They stay in the detection service's files until those files are deleted, as the privacy policy's table of how long we keep data says, and deleting your community doesn't remove them sooner yet.

We keep anything else only where the law requires us to.

Showing we keep to this agreement

We'll give you the information you need to show we keep to this agreement, and answer written questions about it within 30 days. You, or an independent auditor bound to confidentiality, can audit our compliance once a year on 30 days' written notice, or sooner after a breach or when a regulator asks. You pay for your own audit, and it covers only what concerns your data.

Changes and law

We'll email your community's owners at least 14 days before a change to this agreement takes effect, unless the law requires it sooner. If you need a signed copy for your records, ask us. This agreement is governed by the law of England and Wales, and its courts deal with any dispute about it.