Data Processing Agreement

“Player Data” means personal data submitted by Players through a Customer's published Game, as described in our Privacy Policy. “Controller,” “Processor,” “Sub-processor,” and “Data Subject” have the meanings given under applicable data protection law.

For Player Data, the Customer is the Controller and adgamify is the Processor. adgamify processes Player Data only on the Customer's documented instructions — which include the game configuration and fields the Customer sets up in the editor — and only for the purpose of providing the platform.

This DPA applies for as long as adgamify processes Player Data on the Customer's behalf, i.e. for the term of the Customer's subscription or Event Pass, and for any post-termination retention period described in our Privacy Policy.

• Process Player Data only on the Customer's instructions, except where required by law;
• Ensure personnel who process Player Data are subject to confidentiality obligations;
• Implement the technical and organizational security measures described in Section 6;
• Engage Sub-processors only under the terms of Section 5;
• Assist the Customer, to the extent reasonably possible, in responding to Data Subject requests and in meeting its own obligations regarding security, breach notification, and data protection assessments;
• Notify the Customer without undue delay after becoming aware of a security incident affecting Player Data;
• At the Customer's choice, delete or return Player Data at the end of the relationship, except where retention is required by law.

The Customer authorizes adgamify to engage the following Sub-processors to help deliver the platform:

We will provide reasonable advance notice, such as an update to this page, before adding or replacing a Sub-processor with access to Player Data, so Customers can object on reasonable grounds.

• Encryption of data in transit;
• Access controls limiting who can reach production data, with authentication managed via Clerk;
• Logical separation of each Customer's data within our Postgres database by workspace;
• Routine review of access and dependencies as the platform evolves.

Where Player Data is transferred outside the jurisdiction it was collected in, adgamify will rely on appropriate safeguards, such as standard contractual clauses, to the extent required by applicable law.

On reasonable written request, and no more than once per year absent a security incident or regulatory requirement, adgamify will provide the Customer with information reasonably necessary to demonstrate compliance with this DPA.

Liability under this DPA is governed by the limitation-of-liability terms in our Terms of Service. This DPA is governed by the laws of [GOVERNING LAW JURISDICTION — not yet finalized].

Questions about this DPA, or requests for a signed PDF copy, can be sent to privacy@adgamify.com or via /contact.