Data Processing Addendum

This Data Processing Addendum (“DPA”) supplements the Terms of Service (“Agreement”) entered into by and between AoE Web Services LLC (“Company,” “Processor,” “we,” “us,” or “our”) and the client (“Customer,” “Controller,” or “you”).

Order of Precedence

This DPA supplements and forms an integral part of the Agreement. In the event of any conflict or inconsistency between the terms of this DPA and the terms of the Agreement, Terms of Service, Acceptable Use Policy (AUP), or Service Level Agreement (SLA), the terms of the terms of service shall govern and control  with regard to the processing and protection of Customer Personal Data.

1. Roles and Scope of Processing

• 1.1 Legal Roles: The parties acknowledge and agree that with respect to the processing of personal data hosted on Customer’s virtual private servers (VPS), game server instances, or offsite backup vaults, Customer acts as the Data Controller (or Business) and AoE Web Services LLC acts as a Data Processor (or Service Provider).
• 1.2 Scope: Processor shall process personal data on behalf of Customer and in accordance with Customer’s documented instructions, as specified in the Agreement, this DPA, or through Customer's configuration of the Services via the WHMCS billing portal or server control panels.

2. Technical and Organizational Security

• 2.1 Security Safeguards: Processor shall implement and maintain appropriate technical, physical, and organizational measures designed to protect Customer data against unauthorized or unlawful access, destruction, loss, alteration, or disclosure.
• 2.2 Confidentiality: Processor ensures that all personnel authorized to handle host node infrastructure, physical hardware, or system administration are subject to strict obligations of confidentiality.

3. Subprocessors

• 3.1 Authorization: Customer grants Processor general authorization to engage third-party infrastructure providers, data center operators, cloud storage vendors, and software licensing providers (“Subprocessors”) to support the delivery of the Services.
• 3.2 Subprocessors: The Client authorizes the use of reasonable third-party service providers including hosting providers, cloud storage providers, email providers, website management tools, and analytics platforms. The Service Provider shall ensure that subprocessors are contractually required to protect personal data in a manner consistent with this Agreement and applicable data protection laws.
• 3.3 Subprocessor Obligations: Processor shall contractually impose data protection obligations on any Subprocessor that are no less protective than those set forth in this DPA.

4. Security Incident & Breach Notification\

• 4.1 Breach NoticeThe Service Provider shall notify the Client without undue delay after becoming aware of a personal data breach affecting Client data and provide available information regarding the nature of the breach, categories of affected data, likely consequences, and remediation measures taken.
• 4.1 Breach NoticeThe Service Provider shall notify the Client without undue delay after becoming aware of a personal data breach affecting Client data and provide available information regarding the nature of the breach, categories of affected data, likely consequences, and remediation measures taken.

5. Data Return and Deletion upon Termination

• 5.1 Data Return Window: Upon termination or expiration of the Agreement, standard accounts shall be granted a seven (14) calendar day grace period to export or retrieve stored data via client portals or server access.
• 5.2 Post-Termination Purge: Following the expiration of the 14-day data return window (or immediately upon termination in cases of severe Acceptable Use Policy violations such as active DDoS attacks, malware distribution, or illegal content), Processor shall securely destroy and purge all Customer data stored on Processor’s servers, except where retention is required by applicable law or active law enforcement investigation.

6. Data Protection and GDPR Compliance

• 6.1 Categories of Personal Data Processing may include: Names, Email addresses, Telephone numbers, Customer records, Employee records, Website user information, Analytics and usage information.
  
  Processing shall be limited to what is necessary for the performance of the Services.
• 6.2 Confidentiality of Personnel The Service Provider shall ensure that personnel with access to personal data are subject to confidentiality obligations, appropriately trained regarding data protection, and access personal data only when necessary.
• 6.3 Security Measures The Service Provider shall implement appropriate technical and organizational measures including strong password controls, access restrictions, encryption during transmission where appropriate, anti-malware protections, software patch management, secure backups, and multi-factor authentication for administrative accounts where feasible.
• 6.4 CooperationThe Service Provider shall reasonably assist the Client with access, correction, deletion, portability, restriction, and regulatory requests related to data processed under this Agreement.
• 6.5 International Transfers Where personal data is transferred outside the European Economic Area, United Kingdom, or other applicable jurisdictions, the Parties shall implement legally required transfer mechanisms, including Standard Contractual Clauses where applicable.

7. CCPA Compliance Obligations

• 7.1 CCPA Service-Provider Restrictions
  Where the California Consumer Privacy Act (CCPA) applies, AoE Web Services LLC acts  as a "Service Provider." We certify that we understand and will comply with all applicable restrictions under the CCPA. We shall not retain, use, or disclose personal information for any purpose other than for the business purposes specified in the Agreement, including retaining, using, or disclosing personal information for a commercial purpose other than the business purposes specified in the Agreement. We prohibit "selling" or "sharing" personal information as defined under the CCPA.
• 7.2 Data Subject Rights Assistance
  Processor shall, to the extent legally permitted, provide reasonable and timely assistance to Customer by appropriate technical and organizational measures to enable Customer to respond to requests from data subjects (or consumers) exercising their rights under applicable privacy laws (including GDPR access, rectification, erasure, restriction, and portability, or CCPA consumer rights requests).

8. Contact Us

For questions regarding this DPA or to submit privacy-related requests, please contact us