Data Processing Agreement

1. Definitions

"Personal Data", "Processing", "Controller", "Processor", "Data Subject" and "Personal Data Breach" have the meanings given to them in the EU General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR, where applicable. "Services" means the Judicium bot's scam, raid and malicious account protection features as enabled by the Controller. "Sub-processor" means any third party engaged by Judicium to process Personal Data under this DPA.

2. Scope and roles

This DPA applies to Personal Data relating to members of a Controller's Discord server that is processed through the Services. The Controller determines whether the Services are enabled and which punishments are applied within its server. Judicium processes Personal Data only to provide the Services, as described in the Privacy Policy, and on the Controller's documented instructions, which are given by enabling and configuring the Services.

Where Judicium uses data across servers for the shared blacklist and detection network, it does so to operate the Services for all participating Controllers. Judicium will identify in the Privacy Policy any such processing that it carries out as an independent controller, and this DPA does not apply to that processing.

3. Categories of data and data subjects

• Data subjects: Discord users who are members of, or interact with, a server protected by the Services, including users who appeal a flag through the support ticket system.
• Data categories: Discord user IDs and usernames, server IDs, message IDs and, where a detection requires it, message content; perceptual image hashes; backed-up role data for accounts flagged as hacked; staff case notes; ticket and appeal transcripts; and Ban IDs. The full list is set out in Section 2 of the Privacy Policy.
• Special category data: The Services are not designed to process special category data under GDPR Article 9. The Controller must not configure the Services in a way that intentionally collects such data.

4. Processor obligations

Judicium will:

• process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law, in which case Judicium will inform the Controller of that legal requirement before processing, unless the law prohibits it;
• ensure that persons authorised to process Personal Data are bound by confidentiality obligations;
• implement appropriate technical and organisational measures, including access restriction to authorised bot developers and high-level administrators, and encryption of data in transit;
• assist the Controller, taking into account the nature of the processing, in responding to requests from Data Subjects exercising their rights under the GDPR;
• notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting the Controller's data; and
• at the end of the relationship, delete or return Personal Data as set out in Section 7, subject to retention needed for the purposes described in the Privacy Policy.

5. Sub-processors

The Controller gives general authorisation for Judicium to engage the Sub-processors listed below. Judicium will impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains responsible for their performance.

• Discord Inc., as the platform on which the Services operate (its own privacy policy applies to its processing).
• Cloudflare, Inc., to host and run the Services' web pages and Workers infrastructure.

Judicium will notify Controllers of any intended addition or replacement of a Sub-processor through the support server, giving Controllers the opportunity to object on reasonable data protection grounds.

6. International transfers

Personal Data may be processed outside the Controller's country, including in the United States, through the Sub-processors listed above. Where such transfers occur, Judicium relies on the safeguards those Sub-processors make available, such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses, as applicable.

7. Retention and deletion

Personal Data is retained as described in Section 5 of the Privacy Policy. On a valid written request from the Controller, or when the Controller removes the Services from its server, Judicium will delete or anonymise Personal Data that is no longer required for the Services or for the case history described in the Privacy Policy, except where retention is required by law.

8. Audits and information

Judicium will make available information reasonably necessary to demonstrate compliance with this DPA. Requests may be sent through the support server. Any audit must be reasonable in scope, scheduled with advance notice, and must not expose data about other Controllers or Data Subjects.

9. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms of Service regarding the processing of Personal Data, this DPA prevails for that processing.

10. Term and changes

This DPA takes effect when a Controller enables the Services and remains in effect for as long as Judicium processes Personal Data for that Controller. Judicium may update this DPA as the Services change, and will update the "Last updated" date when it does. Material changes will be notified through the support server.

11. Contact

Questions about this DPA, or requests to exercise data protection rights, can be sent through our support server.