Subprocessors

In short

DigitalOcean, LLC

• What for: the servers the site and the game run on, the database, DNS.
• What data: everything listed on the privacy page: accounts, the game state, letters through the form, server logs.
• Where: Frankfurt, Germany (region FRA1) — EEA.
• Company jurisdiction: USA (New York).
• Transfer: EU–US Data Privacy Framework; as a fallback, the standard contractual clauses (SCC).
• Processing agreement: digitalocean.com/legal/data-processing-agreement

Zoho Corporation B.V.

• What for: the privacy@k15.space mailbox — requests about data arrive here, and a human answers them from here.
• What data: the sender's address and whatever the letter contains.
• Where: EU data centres (zoho.eu) — EEA.
• Company jurisdiction: Netherlands (Amsterdam).
• Transfer: processing in the EEA; SCC within the Zoho group.
• Kept for: ordinary correspondence — 12 months after the last letter; requests about rights and complaints — 3 years.
• Processing agreement: zoho.com/gdpr.html

MailerSend, Inc. — connected later

• Status: not connected. Today the site sends no mail at all. MailerSend will arrive along with letters about your account — password recovery, for example; until then nothing is sent to it.
• What for: delivering letters about your account. Not advertising.
• What data: the email address, the text of the letter and delivery details.
• Where: Google Cloud data centres in the EU (Belgium) — EEA.
• Company jurisdiction: USA (New York); EU representative — MailerLite Limited (Dublin).
• Transfer: SCC; EU–US Data Privacy Framework.
• Processing agreement: mailersend.com/legal/data-processing-addendum

Paddle.com Market Ltd — connected later

• Status: not connected. Ticks are not sold today; Paddle will arrive along with the shop.
• Role: not our processor but an independent controller. Paddle is the seller of the ticks (Merchant of Record): it takes the payment, issues the documents and works out the taxes itself. Its relationship with you is described by its privacy policy, its relationship with us by the Data Sharing Addendum.
• What data: name, email, payment data, country. Only Paddle sees the card details; it will pass us what it takes to credit the ticks: the purchase number, the email, the country and the amount.
• Where: United Kingdom and EU.
• Company jurisdiction: United Kingdom (London).
• Transfer: the European Commission's adequacy decision for the United Kingdom.

Who is not here

• Error monitoring, analytics and advertising — no third-party services at all. Errors show up in our own server's logs.
• Google Fonts — the fonts sit on our own server.
• Third-party captchas — ALTCHA is computed on our own server.
• Let's Encrypt — issues the certificate for HTTPS and receives no player data.

When the list changes

We will add a new company here no later than 30 days before it starts receiving data; the date of the last edit is at the bottom of the page. If you object, you can delete the account before that day — the privacy page says how.

Questions and objections go to privacy@k15.space.