HR Protocol: Data Processing Agreement

This Data Processing Agreement ("DPA") applies under Art. 28(3) GDPR whenever Ridoco processes personal data on your behalf rather than for its own purposes. It forms part of the Terms of Service and takes effect when you start using the relevant service. No signature is needed, though a countersigned copy is available on request.

1. When This Applies

You are the controller and Ridoco is the processor in these situations:

• Discord bots on your server. You invite one of Ridoco's bots to a guild you own or administer. You decide what the bot does there and who can use it.
• Hosted software instances. Ridoco hosts an EclipseCP or Clean instance for you. (Self-hosted licences create no processor relationship: Ridoco never touches that data.)
• Laetium workspaces. Governed by the dedicated Laetium DPA, which takes precedence for that product.
• Hosted status pages (EclipsePulse). Ridoco hosts a status page for you. You decide which services it lists and what you publish about them, and the people who subscribe to it are your subscribers, not Ridoco's.
• Hosted booking pages (EclipseBook). Ridoco hosts a booking page for you. You decide what may be booked and on what terms, and the people who book with you are your attendees, not Ridoco's. Ridoco stores what they submit in order to run the booking for you: their name, their email address, and any answers to the intake questions you set.

This DPA does not cover data Ridoco holds as controller, such as your own account, billing records and support tickets. That is covered by the Privacy Policy.

2. Details of the Processing

Subject matter and duration: provision of the relevant service, for as long as you use it plus the retention periods in section 7.

Nature and purpose: for bots, receiving and responding to messages, moderation, progression and economy features, and generating AI replies. For hosted instances, operating the application you configure. For hosted status pages, storing the addresses of people who subscribe to your incident notifications and sending them. For hosted booking pages, taking bookings on your behalf and sending the confirmations and reminders that go with them.

Categories of data subjects: members of your Discord guild, the end users of your hosted instance, the people who subscribe to your status page, and the people who book time with you.

Types of personal data: platform user IDs, guild or account membership, message content and channel context passed to the bot, conversation memory, reaction and sentiment records, moderation warnings, progression and economy balances, whatever your users enter into a hosted instance, the email address of a status-page subscriber, and the name, email address and intake answers of a person who books with you.

Special categories: the services are not designed for Art. 9 data and you must not deliberately use them for it. Free text from your users may incidentally contain it, and you remain the controller for that.

3. Ridoco's Obligations

• Ridoco processes only on your documented instructions. Your configuration of the service is your instruction. If law compels Ridoco to go further, Ridoco tells you first unless forbidden.
• Ridoco tells you if an instruction appears to breach the GDPR, and may pause it until confirmed.
• Everyone with access is under a lasting duty of confidentiality.
• Ridoco applies the security measures in section 6, per Art. 32.
• Ridoco assists you with Arts. 32 to 36: security, breach notification, impact assessments.
• Ridoco notifies you without undue delay after becoming aware of a personal data breach affecting your data, in time for you to meet your own 72 hour duty under Art. 33.

4. Sub-processors

You give general authorisation for the sub-processors below. Ridoco gives you at least 14 days notice before adding or replacing one, and you may object on reasonable data protection grounds.

• netcup GmbH, and the Anexia group companies it relies on. Hosting, databases and backups. Germany and Austria (EU).
• Discord. The platform the bots operate on. United States.
• External AI provider (optional). AI reply generation on the optional external tier only, which is off by default. When it is enabled, replies are processed by an external AI provider, currently Google Gemini. By default AI runs on Ridoco's own servers and sends nothing outward. United States.
• Sentry. Error and crash reporting. EU and United States.
• Google. Calendar sync for EclipseBook, only where you connect your Google Calendar to a booking page. The name, email address, time and notes of the person who books with you are written into a Google Calendar event, with a Google Meet link added for a video call. United States.

Where you configure a webhook on a status page or a booking page, Ridoco sends the notification to the address you supply, in practice Discord or Slack. You choose that destination. It is not a Ridoco sub-processor and it falls under your own responsibility. What is sent is the text of the incident or of the booking, including the name and notes the booker supplied.

Ridoco imposes obligations on each sub-processor no less protective than these, and stays fully liable to you for their performance.

5. International Transfers

Data is stored in the European Union. Transfers to the sub-processors above rely on the EU to US Data Privacy Framework where they are certified, or on the European Commission's Standard Contractual Clauses with supplementary technical measures. Copies available on request.

6. Security Measures

• TLS for all data in transit
• Per-site operating system user isolation on the production host
• Access to production data limited to the operator, under confidentiality
• Encrypted backups held within the EU
• Automated nightly retention sweep on the bot datastore
• Dependency and vulnerability monitoring, patches applied as released

7. Data Subject Requests, Deletion and Return

The bots expose /privacy, /data-delete and /data-optout directly to your members, which covers access, erasure and objection without either party doing anything. If a data subject contacts Ridoco instead, they are referred to you and the request is forwarded.

Records older than the configured retention window (365 days by default) are swept nightly. When you remove the bot from your guild, or end a hosted instance, Ridoco deletes or returns the data at your choice and deletes remaining copies, except where law requires retention. Backup copies are overwritten on the normal rotation.

8. Audit

Ridoco provides the information needed to demonstrate compliance with Art. 28 within 30 days of a written request. Where that is not enough for your obligations, you may audit once in any 12 month period on 30 days notice, during business hours, subject to confidentiality and without unreasonable disruption. You bear the costs unless the audit finds a material breach by Ridoco.

9. AI Processing

Bot replies are generated by a large language model, not by a person. Message content and recent channel context are sent to that model. By default the model runs on Ridoco's own infrastructure and nothing is sent outward. An optional external tier is off by default; when it is enabled, or when you supply your own provider key, replies are processed by the external AI provider named in section 4. You are responsible for telling your members that an AI system is in use, which the /privacy command also does. AI output can be wrong and must not be relied on for legal, medical, financial or safety decisions.

10. Term, Precedence and Law

This DPA lasts as long as Ridoco processes personal data on your behalf. Where it conflicts with the Terms of Service on a data protection point, this DPA wins. Nothing here limits a data subject's rights under Art. 82. Governed by the law of the Netherlands.

11. Contact

Ridoco, KvK 95439609, Netherlands
Email: contact@doombringerz.com