This Data Processing Addendum ("DPA") supplements the Exilefolio Terms of Service and Privacy Policy where Exilefolio processes personal data on behalf of a customer ("Customer", "you") who acts as a data controller under applicable data protection law.
1. Scope and roles
This DPA applies when you use Exilefolio in a business or organizational capacity and we process personal data subject to the GDPR or UK GDPR on your behalf. In that context, you are the controller and Exilefolio is the processor for the processing activities described in your use of the Service.
2. Subject matter and duration
Processing is limited to providing currency monitoring, snapshot storage, authentication, and related support for the Service. Processing continues for the duration of your use of the Service and as described in our retention practices.
3. Nature and purpose of processing
- Storing and displaying wealth snapshots derived from authorized PoE API data
- Maintaining user accounts and sessions
- Operating, securing, and improving the Service
- Providing support at your request
4. Categories of data subjects and personal data
Data subjects may include your team members or end users authorized to access the Service. Personal data may include account identifiers, session data, technical logs, and game-related data made available through the official Path of Exile API.
5. Processor obligations
Exilefolio will:
- Process personal data only on documented instructions from the Customer
- Ensure personnel with access are bound by confidentiality obligations
- Implement appropriate technical and organizational security measures
- Assist with data subject requests where reasonably possible
- Notify the Customer without undue delay of a personal data breach affecting Customer data
- Delete or return personal data upon termination, subject to legal retention requirements
6. Subprocessors
You authorize our use of subprocessors listed on the Subprocessors page. We will maintain an up-to-date list and provide notice of material changes where required by law.
7. International transfers
Primary database hosting is in the European Union (AWS EU via Neon). Where personal data is transferred outside the EEA or UK, we will implement appropriate safeguards such as Standard Contractual Clauses.
8. Audits
Upon reasonable written request, we will provide information necessary to demonstrate compliance with this DPA, subject to confidentiality and security constraints.
9. Order of precedence
If there is a conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA prevails to the extent of the conflict.
10. Contact
To request a signed copy of this DPA or discuss data processing arrangements, contact contact@exilefolio.com.