Data Processing Agreement (Template)
Under Art. 28 GDPR, between the customer (controller) and Simon Daniel März, ProjectMakers, provider of horizOn (processor). Version: October 2026. To conclude it, send us this template with your details to the email address in our legal notice. The German version is binding.
1. Subject and duration
The processor processes personal data on behalf of the controller in order to provide the horizOn services under the Terms and Conditions (game backend: user management, cloud saves, leaderboards, remote config, logs, crash reports, feedback, email sending and further features). This agreement runs for the term of the service contract.
2. Types of data and data subjects
The data subjects are the players of the controller's games. Depending on the features used, the following is processed:
- Account data: player ID, display name, email address, Google or Apple sign-in identifiers, password hash
- Game data: cloud saves, scores, profile details, contents of validated runs
- Technical data: IP address, device and platform information, logs, crash reports
- Communication: feedback texts and emails the controller sends through its own SMTP server
3. Instructions
The processor processes the data only on documented instructions from the controller. Instructions are the settings in the dashboard and the API calls made by the controller's game. If the processor considers an instruction unlawful, it informs the controller.
4. Confidentiality
Persons with access to the data are bound to confidentiality.
5. Technical and organisational measures
- A separate database per customer, kept apart from other customers' data
- Encrypted transport (TLS) between the game, the content delivery network and the servers
- Encrypted storage of cloud saves
- Administrative access only through a private network with key-based login, a firewall on every server
- Daily encrypted backup per customer: daily backups kept 14 days, weekly 8 weeks, monthly 12 months
- Database replication to three servers in three regions
6. Sub-processors
The controller agrees to the following sub-processors. The processor announces new sub-processors in advance, and the controller may object for good cause.
| Provider | Service | Place of processing |
|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Servers, backups | Germany, Finland, Singapore |
| netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany | Servers | Germany, USA (Virginia) |
| Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA | Content delivery network, load balancing, attack protection | worldwide |
7. Transfers to third countries
Data is processed in the USA and in Singapore. Transfers are based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) and, for Cloudflare, on the EU-US Data Privacy Framework.
8. Assisting the controller
The processor assists the controller with data subject requests (access, rectification, erasure), with notifying personal data breaches and with data protection impact assessments. The controller can handle many requests in the dashboard, for example deleting a player.
9. Breach notification
The processor notifies the controller of a personal data breach without undue delay after becoming aware of it.
10. Deletion after the end of the contract
When the contract ends, the obligation to store the data ends under section 11.4 of the Terms and Conditions, and the processor deletes the controller's data. For free accounts, deletion after inactivity under section 12 of the Terms and Conditions applies as well. Copies in backups are deleted when the retention periods from section 5 expire, after 12 months at the latest.
11. Evidence and audits
The processor provides the controller with the information needed to demonstrate compliance with Art. 28 GDPR and allows audits after prior agreement.
12. Controller details
| Company or name | |
|---|---|
| Address | |
| horizOn account (email) | |
| Place, date, signature |
Back to horizon.pm