Data Processing Agreement
Version of 22 October 2026
This is a translation for convenience. In case of any discrepancy the Russian version prevails.
This Data Processing Agreement (“DPA”) is part of the Terms of Service between the User (“Controller”, “Client”) and Individual Entrepreneur Grigoriy Vladimirovich Yatsunov (tax id 362083037805 (OGRNIP 326366800037471), “Processor”).
1. Roles
The Client is the controller of its players’ data and decides whether to use the SDK, which events to send and whether player consent is required. The Processor processes player data only on the Client’s documented instructions (the Service settings, the Terms and this DPA).
2. Subject matter
| Data subjects | Players of the Client’s games |
|---|---|
| Data | Anonymous player id, device and environment data, country (from IP without storing the IP), game events; optionally a user id chosen by the Client |
| Operations | Collection, storage, aggregation, reporting, anonymisation, deletion |
| Purposes | Game analytics for the Client; anonymised aggregated statistics (section 5) |
| Duration | The retention period of the Client’s plan |
3. Processor obligations
- confidentiality and security (Art. 32 GDPR): HTTPS, per-studio access isolation, hashed passwords and tokens, no IP storage;
- no processing for other purposes; staff bound by confidentiality;
- notify the Client of personal data breaches without undue delay, where possible within 72 hours;
- assist the Client with data subject requests (deletion by player id) and provide information needed to demonstrate compliance;
- store data in the Russian Federation.
4. Client obligations
Have a legal basis, inform players, do not send direct identifiers or special categories of data, and initialise the SDK after consent where consent is required.
5. Anonymised aggregated statistics
The Client instructs and permits the Processor to anonymise game data and produce aggregated statistics for industry benchmarks (shown to all users) and market analysis, only for groups of at least 5 games from at least 3 studios with at least 100 players each, keeping aggregates only (quantiles) without identifiers of games, studios or players. Such statistics are not personal data.
6. Sub-processors
General authorisation: hosting provider (servers in Russia) and an e-mail provider (e-mails to Service users only). Changes are published on this page.
7. Deletion and international transfers
Player data is deleted within 60 days after the retention period, game deletion or termination. Data of EU players is processed in Russia; where GDPR applies, the Client assesses the transfer, and the parties may sign Standard Contractual Clauses on request. Lawyer: review this section for EU players. Contact: info@redrockstudio.ru.