Data Processing Agreement

NebulaNodes hosts Minecraft servers for the customer. Players connect to these servers, and the server software and plugins chosen by the customer store data about them. NebulaNodes processes this data only to provide the hosting service on behalf of the customer.

This agreement applies as long as the customer has at least one server with us, and ends automatically when the last server is deleted. Clauses that by their nature must continue (e.g. confidentiality, deletion) survive termination.

• Nature and purpose: storage of server files and backups, running the server software, transferring data between players and the server, and technical support when the customer asks for it.
• Types of data: Minecraft usernames and UUIDs, IP addresses of players, chat messages, in-game data (inventories, positions, statistics), logs, and any other data the customer or their plugins store on the server.
• Data subjects: players and visitors of the customer’s server, and users the customer gives access to the server.

NebulaNodes processes the data only on documented instructions of the customer. The settings and actions in the dashboard, the API and support tickets count as such instructions. If NebulaNodes believes an instruction infringes data protection law, it informs the customer without undue delay.

NebulaNodes does not use the data for its own purposes, does not analyse it and does not pass it on, unless required by law. In that case NebulaNodes informs the customer beforehand unless the law forbids it.

All persons who can access the data are bound to confidentiality. Staff only access server files when this is necessary to run the service, to fix an error, or when the customer asks for it in a support ticket.

The technical and organisational measures in the annex apply. They may be developed further, as long as the level of protection does not drop.

The customer agrees to the sub-processors listed below. NebulaNodes informs the customer about any intended change in advance (by notification in the dashboard); the customer may object within 14 days for good reason. If no agreement is reached, the customer may terminate the affected service. NebulaNodes imposes the same data protection obligations on its sub-processors.

• aurologic GmbH, Germany (servers in the Netherlands, EU): Data centre, server hardware and DDoS protection for the game servers
• Hetzner Online GmbH, Germany (EU): Storage of server backups (Storage Box)

NebulaNodes supports the customer, as far as possible with the means of the service, in answering requests from data subjects (e.g. access or deletion), in data protection impact assessments and in consultations with supervisory authorities. Most requests can be handled by the customer directly via the file manager, SFTP, the console and backups.

NebulaNodes informs the customer without undue delay, and where possible within 48 hours, after becoming aware of a breach affecting the customer’s data, with the information available at that time.

The customer can download all server files at any time (file manager, SFTP, backups). When a server is deleted, its files and backups are deleted immediately; copies in system backups of the platform database disappear after at most 30 days. Server files themselves are not part of these system backups.

NebulaNodes provides the customer with the information necessary to demonstrate compliance with Art. 28 GDPR on request. Audits on site are possible after reasonable notice, during business hours and without disrupting operations; the customer bears its own costs.

The data is processed in the European Union only (game servers in the Netherlands, backups in Germany).

In case of contradictions, this agreement takes precedence over the Terms of Service with regard to data protection. German law applies. Liability is governed by the Terms of Service.

• Servers are located in a professionally operated data centre with access control (aurologic GmbH).
• Dashboard login via Discord OAuth; sessions are stored only as hashes; two-factor authentication on the Discord account is shown and recommended.
• Fine-grained permissions for co-users of a server; API keys with limited scopes, IP-independent revocation and access only after approval.
• SFTP access with separate passwords (scrypt hashes), locked into the folder of one server, protection against brute force (lockout and firewall bans).
• Each game server runs in its own isolated container without extra privileges, in a separate network; the host firewall only opens the ports that are needed.
• Staff access to customer files only when needed; all admin actions are recorded in an audit log.

• All connections to the dashboard and API are encrypted (TLS 1.2/1.3, HSTS); SFTP is encrypted via SSH.
• Strict Content Security Policy and CSRF protection in the dashboard; input validation on all API endpoints.
• Activity log per server: who changed what, when (logins, file changes, console commands, power actions).

• DDoS protection for the network (aurologic GmbH).
• Customer backups (manual and scheduled) stored on a separate storage system in Germany (Hetzner Storage Box).
• Daily backup of the platform database, kept for 30 days.
• Automatic installation of security updates for the operating system; monitoring of all services with a public status page.
• Resource limits per server (memory, CPU, storage), so one server cannot affect others.

• Regular security reviews of the platform and its dependencies (vulnerability audits of software packages).
• Deletion: server files and backups are deleted when the server is deleted; logs and notifications are deleted after fixed periods.
• Data protection by default: no tracking, only technically necessary cookies, data processing in the EU only.