Data Processing Addendum (DPA)

Effective date: 18 August 2026 Last updated: 18 August 2026

This Data Processing Addendum ("DPA") forms part of and is incorporated into the Terms of Service between PZStack ("Processor", "we") and the customer who agreed to those Terms ("Controller", "you").

When it applies. Most PZStack customers use the Service in a personal, hobbyist, or small-community capacity and, for the data they give us about themselves, PZStack acts as a controller in its own right under the Privacy Policy - no DPA is needed.

This DPA applies only where you use PZStack to host a service through which you, acting as a controller under the GDPR, UK GDPR, or KVKK, process the personal data of third-party individuals (e.g. your players) and you therefore need PZStack to act as your processor for that onward data. The classic case: you run a public community, collect your players' personal data via your own sign-up, and that data ends up on the server we host for you.

If that describes you, this DPA takes effect automatically when you tick the "I agree to the Terms of Service" box at signup - no additional signature is needed, though we will sign a countersigned copy on request.

1. Roles and scope

• Controller = you. You decide the purposes and means of processing your players' / community members' personal data.
• Processor = PZStack. We process that data only on your documented instructions, which are: (a) running the server you configured, (b) retaining backups per your plan, (c) providing you with logs and dashboards about it, (d) operating support you request, and (e) performing the security and anti-abuse measures in our AUP and Privacy Policy.
• Subject matter: hosting a Project Zomboid game-server instance.
• Duration: as long as your PZStack account and the relevant subscription exist, plus the backup / audit-log retention windows stated in the Privacy Policy.
• Nature and purpose of processing: storage, transmission, backup, restore, mod install, logging, anti-abuse.
• Types of personal data processed on your behalf: typically limited to in-game identifiers (Steam IDs, character names, chat messages), connecting player IP addresses captured by the game server, and any fields you configure. You agree not to route special-category data through the Service.
• Categories of data subjects: your players / community members.

2. Processor obligations

We will:

1. Process personal data only on your documented instructions, unless required by applicable EU / UK / Türkiye law to process it otherwise - in which case we will tell you, unless that law forbids us to;
2. Ensure that personnel with access to personal data are under an appropriate duty of confidentiality;
3. Implement and maintain the technical and organisational measures ("TOMs") described in Annex A to protect against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data;
4. Only engage the subprocessors listed in Annex B (and, thereafter, give you notice of new subprocessors with at least 14 days to object - see §5);
5. Assist you, taking into account the nature of the processing, with (a) responding to data-subject rights requests, (b) security, (c) breach notification, and (d) DPIAs and prior consultation, all under GDPR Articles 32–36 / UK GDPR equivalents / KVKK Art. 12;
6. At your choice, delete or return all personal data at the end of the provision of the Service, and delete existing copies unless a retention is required by law (see the Privacy Policy retention schedule);
7. Make available to you all information necessary to demonstrate compliance with Article 28 GDPR obligations and allow for and contribute to audits - see §6.

3. Personal-data breach notification

If we become aware of a personal-data breach affecting data we process on your behalf, we will notify you without undue delay, and in any event within 72 hours of becoming aware, with the information required for you to comply with your own Article 33 / KVKK Art. 12(5) notification obligation. We will cooperate in good faith with any follow-up investigation.

4. International transfers

To the extent personal data you send through the Service is transferred out of the EEA, UK, or Türkiye, we rely on:

• The EU Standard Contractual Clauses (Commission Decision 2021/914/EU), Module 3 (processor-to-processor) for onward transfers to subprocessors outside the EEA. The Clauses are deemed incorporated into this DPA by this reference; Annex I.A, I.B and II below populate them.
• The UK International Data Transfer Addendum (IDTA) for UK-origin data.
• For data flowing to providers in the United States, the EU–US Data Privacy Framework where the vendor is certified, otherwise the SCCs plus our Transfer Impact Assessment (available on request).
• Under KVKK, Art. 9 - until Türkiye's cross-border regime settles, we rely on the explicit consent of data subjects obtained by you as Controller, or on the narrow contract-performance exception where available.

5. Subprocessors

We engage the subprocessors listed in Annex B. We remain liable to you for their acts and omissions as if they were our own.

For new subprocessors we want to engage, we will post an update on https://pzstack.com/legal/dpa (and, for customers using this DPA, we will email you) at least 14 days before adding them. If you have a reasonable, documented, data-protection objection, you may terminate the affected part of the Service for convenience within that 14-day window and get a pro-rata refund for the unused period. That is your exclusive remedy.

6. Audit rights

We will answer reasonable written questions from you about our security measures, at no charge and within a reasonable time. Where you reasonably believe an on-site or third-party audit is necessary (and the independent reports we make available are not enough), we will cooperate, provided that:

• No more than one audit per 12-month period, except after a confirmed breach;
• At least 30 days' advance written notice;
• Scope and methodology agreed in advance;
• Conducted by an independent, reputable auditor bound by confidentiality;
• You bear the cost, unless the audit reveals material non-compliance by us.

7. Liability and miscellaneous

The limitation of liability in §15 of the Terms of Service applies to this DPA and to the SCCs that are incorporated by reference. Where mandatory law says the SCC liability regime applies instead (Clause 12 of the EU SCCs), that mandatory regime controls to the extent required.

If there is a conflict between this DPA and the Terms, the DPA controls for the processing of personal data described in §1. If there is a conflict between this DPA and the SCCs, the SCCs control.

8. Contact

• Data-protection contact: [email protected] (subject: "DPA")
• Breach notification channel: [email protected] (subject: "breach")

Annex A - Technical and organisational measures (Art. 32 GDPR)

1. Access control. Argon2id password hashing; refresh tokens stored only as SHA-256 hashes with per-device rotation and theft detection; HttpOnly, path-scoped authentication cookies; tight per-route rate limits on credential endpoints; two-step OTP confirmation for account- and server-destructive actions; HMAC-signed agent ↔ API traffic; production DB and object-storage access restricted to staff with a documented operational need and MFA.
2. Encryption. TLS 1.2+ for all traffic in transit; encryption-at-rest for object storage (mod cache, backups) using the storage provider's server-side encryption.
3. Logical separation. Each customer's servers run in a separate container with resource limits. Customer data in the primary DB is partitioned by userId and guarded by row-level predicates in the application layer.
4. Resilience. Automated backups per plan; OTP-gated hard-delete of servers; webhook idempotency so a payment event cannot be double- applied; rate-limits to absorb abuse without impacting legitimate traffic.
5. Logging and monitoring. Audit-log events for every sensitive action (register, login, session revoke, email verify, password reset, server delete, credential rotate); RCON command audit log; Sentry error monitoring (when enabled); alerting on anomaly.
6. Change management. Infrastructure as code, migrations through Prisma with an append-only migration history, review before deploy, scoped deploy credentials.
7. Staff. Confidentiality obligations in employment / contractor contracts; security training before production access.
8. Incident response. Documented runbook, on-call, breach notification within 72 hours as above.
9. Vulnerability management. Dependency update cadence (Renovate); security reviews before shipping significant features.
10. Data subject request tooling. Support email with a tracked process and a standard 30-day response SLA.

Annex B - Subprocessors

Hostinger and Hetzner are both EU-incorporated processors with their own GDPR Article 28 DPAs, which are incorporated here by reference. Copies of those DPAs can be requested at any time via [email protected].

Annex C - List of parties (for the SCCs, when relied on)

• Data exporter: the Customer, acting as Controller.
• Data importer: PZStack, the Operator identified in the Terms of Service, acting as Processor.
• Competent supervisory authority (SCC Clause 13): the authority of the Member State in which the Controller is established.

If you need a countersigned PDF copy of this DPA for your own records, email [email protected] with subject "DPA countersignature" and your account email; we will return a signed PDF on our letterhead.