Data processing agreement

Draft for review by counsel. This is not legal advice. Text in [square brackets] must be filled in or confirmed before signature. Check the annexes against the code before each release.

Effective [date]. Version 0.1.

This agreement is part of the CasinoOS terms of service between [CasinoOS legal entity] ("the Processor") and the Customer ("the Controller"). It applies when the Processor processes personal data for the Controller in providing the Service. It is written to meet Article 28 of the EU General Data Protection Regulation (GDPR) and of the UK GDPR. Where other data protection laws apply, the parties read it so that it meets their equivalent requirements.

1. Roles

1. The Controller decides why and how player, staff and affiliate personal data is processed in the Service. The Processor processes it only for the Controller.
2. The Processor is a controller only for its own business data: customer account contacts, billing, and its own website. Its privacy notice covers that data.
3. Annex 1 describes the processing.

2. The Processor's obligations

The Processor:

1. processes personal data only on the Controller's documented instructions, including on transfers. The agreement, the Controller's configuration of the Service and the actions of its staff in the Service are those instructions. If the law requires other processing, the Processor tells the Controller first, unless the law forbids it.
2. tells the Controller at once if it believes an instruction breaks data protection law.
3. makes sure everyone who processes the data is bound by confidentiality.
4. applies the technical and organisational measures in annex 2, and keeps them at least as protective during the term.
5. uses subprocessors only as section 3 allows.
6. helps the Controller, taking into account the nature of the processing, to respond to data subjects exercising their rights (section 4).
7. helps the Controller with security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36), taking into account the information available to it.
8. deletes or returns the data when the Service ends (section 6).
9. makes available the information needed to show compliance with this agreement and allows audits (section 7).

3. Subprocessors

1. The Controller gives general authorisation for the subprocessors in annex 3.
2. The Processor gives at least [30] days' notice of a new or replacement subprocessor, by email and on the subprocessor list. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may end the affected part of the Service and receive a pro-rata refund of prepaid fees.
3. The Processor puts data protection terms in place with each subprocessor that are at least as protective as this agreement, and remains liable for its subprocessors.
4. Some integrations are chosen and contracted by the Controller itself, such as its email or SMS provider, Slack or Microsoft Teams workspace, and self-exclusion registers. When the Controller connects one, data passes to it on the Controller's instruction. Those providers are not the Processor's subprocessors. They are listed in annex 3 for completeness.

4. Data subject rights

1. The Service sends messages that look like data-rights requests (access, erasure and similar) to a person on the Controller's data protection team. It never answers them with an AI draft.
2. The Processor gives the Controller the means to find, export, correct and delete a data subject's data, through the Service or, where that is not yet possible, on request within [10] business days.
3. If a data subject contacts the Processor directly, the Processor passes the request to the Controller and does not answer it unless the Controller asks.

5. Personal data breaches

1. The Processor tells the Controller without undue delay, and in any case within [24] hours, after becoming aware of a personal data breach affecting Controller data.
2. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, and the measures taken or proposed. Information may be given in stages.
3. The Processor does not notify a supervisory authority or data subjects about a breach of Controller data unless the Controller asks or the law requires it.

6. Retention, return and deletion

1. The Controller sets retention per market in the Service's jurisdiction profiles. The defaults are 5 years for the audit trail and AML records and 2 years for chat.
2. The Service deletes support and live chat conversations automatically once the chat period for their market has passed since the last message, except a case still open with a person. When the Controller records a data subject's erasure request in the Service, the Service deletes that person's conversations at once and keeps the records the Controller must keep under anti-money laundering law. Each deletion run is recorded in the audit trail.
3. Current limit: the audit trail is not deleted automatically, because it is hash chained. Entries past their period are kept until the Controller and the Processor agree how to archive them; the Processor deletes them on the Controller's written request within [30] days, without breaking the chain for the entries that remain.
4. When the agreement ends, the Controller can export its data for [30] days. The Processor then deletes it, including from backups within [90] days, unless the law requires it to be kept. Records the Controller must keep under anti-money laundering law are returned to the Controller, not kept by the Processor.

7. Audits

1. The Processor answers the Controller's reasonable security questionnaires once a year, and after a personal data breach.
2. If the answers and the Processor's reports are not enough to show compliance, the Controller, or an independent auditor bound by confidentiality, may audit the Processor once a year with [30] days' notice, during business hours and at the Controller's cost.
3. A regulator of the Controller may audit the Processor as the Controller's licence requires. The Processor cooperates.
4. The Processor does not currently hold ISO/IEC 27001, SOC 2 or PCI DSS certification. [Update when that changes.]

8. International transfers

1. The Processor processes Controller data in [hosting region]. Some subprocessors in annex 3 may process data outside the EEA and the UK.
2. For each such transfer, the Processor relies on an adequacy decision (including the EU-US Data Privacy Framework where the recipient is certified) or the European Commission's standard contractual clauses (Module 3, processor to processor) with the UK addendum, plus a transfer risk assessment. [Confirm the mechanism for each provider and region.]
3. Before any model call, the Service removes direct identifiers (see annex 2), which reduces what is transferred to model providers.

9. Liability and order of precedence

Liability under this agreement is subject to the limits in the terms of service [unless counsel agrees a separate cap for data protection]. On data protection matters, this agreement prevails over the terms of service.

Annex 1: Description of the processing

Annex 2: Technical and organisational measures

Measures marked in place exist in the Service today. Measures marked planned are not yet in place and must not be relied on until this annex is updated.

Annex 3: Subprocessors

Integrations the Controller chooses and contracts for itself (not the Processor's subprocessors, see section 3.4):