Data Processing Agreement

1. Definitions

• "Controller": the game server operator who deploys the BlackGuard software and determines the purposes and means of processing player data.
• "Processor": Real Dudes LLC / BlackGuard, acting on the Controller's instructions to provide anti-cheat detection services.
• "Data Subjects": players who connect to the Controller's game server.
• "Personal Data": any information relating to an identified or identifiable natural person, including IP addresses, hardware identifiers (HWIDs), and gameplay telemetry.
• "Services": the BlackGuard anti-cheat detection platform, including the in-game resource, dashboard, and supporting infrastructure.

2. Roles and Responsibilities

The Controller determines why and how player personal data is collected and processed on their server. BlackGuard acts solely as a Processor and processes personal data only on the documented instructions of the Controller (i.e., providing the Services as described in the subscription agreement).

The Controller is responsible for ensuring they have a lawful basis for processing player data and for informing players that BlackGuard's software is active on their server.

Separately from its role as Processor, BlackGuard may create de-identified and aggregated data from Personal Data processed under this DPA, as authorised in Section 4A.

3. Categories of Personal Data Processed

In providing the Services, BlackGuard may process the following categories of personal data on the Controller's behalf:

• IP addresses and connection metadata.
• Hardware identifiers (HWID, system fingerprint data).
• In-game behavioural telemetry (movement, positional data, action timing) used for detection analysis.
• Session logs (connection times, session duration, server ID).
• Detection event records and associated risk scores.
• Game-render screenshots captured when a player is flagged by behavioural analysis, for the purpose of detecting unauthorised visual tools or performance-assist software. Screenshots capture only the game window/render output. Never the player's desktop, other applications, browser windows, or personal files. These images are processed by automated systems and retained for a maximum of 30 days before permanent deletion.
• Non-image results derived from screenshots (such as detection labels, model verdicts and image fingerprints) may be retained in de-identified form under Section 4A.

BlackGuard does not process payment data, government identifiers, health data, or any special categories of personal data as defined under GDPR Article 9.

4. Purpose and Legal Basis for Processing

BlackGuard processes personal data solely to provide the anti-cheat detection, session monitoring, and ban management features that comprise the Services. Processing is carried out only on the Controller's instructions. BlackGuard will not process personal data for any other purpose without the Controller's prior written consent, except where required by law.

4A. Product Improvement

The Controller authorises BlackGuard to create de-identified and aggregated data from Personal Data processed under this DPA, and to use that data to operate, secure and improve the Services and to develop new products, including research and the training of detection models. BlackGuard will take reasonable technical and organisational measures to prevent re-identification, will not attempt to re-identify that data, and will not sell Personal Data. De-identified and aggregated data is not Personal Data for the purposes of this DPA.

5. Sub-Processors

BlackGuard uses the following third-party sub-processors to deliver the Services. By entering into this DPA, the Controller provides general authorisation for the use of these sub-processors:

• Supabase Inc.: database and authentication infrastructure. Data is stored in encrypted, access-controlled environments. Supabase operates under its own Privacy Policy and DPA.
• Anthropic, PBC: AI analysis of game-render screenshots and gameplay telemetry for detection.

BlackGuard will notify the Controller of any intended addition or replacement of sub-processors, giving the Controller the opportunity to object on reasonable data-protection grounds.

6. Security Measures

BlackGuard implements and maintains appropriate technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Measures include:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Access controls and least-privilege principles for all staff.
• Regular security reviews and vulnerability assessments.
• Hashing and pseudonymisation of hardware identifiers before storage.

7. Data Subject Rights

Where a player (Data Subject) exercises a right under applicable data protection law, such as the right of access, erasure, rectification, or restriction. The Controller is responsible for responding to that request. BlackGuard will assist the Controller by providing the technical means to retrieve, correct, or delete data held in connection with a specific player identifier, upon reasonable written request.

Requests should be submitted to [email protected].

8. Data Retention and Deletion

Personal data processed by BlackGuard on the Controller's behalf is retained for the duration of the active subscription or as required by the Controller's instructions. Upon termination of the subscription, BlackGuard will, at the Controller's election, delete or return all personal data within 30 days, unless retention is required by applicable law.

De-identified and aggregated data created under Section 4A is not subject to deletion or return under this Section.

9. International Data Transfers

Personal data may be transferred to and processed in countries outside the UK/EEA as part of our infrastructure (including Supabase). All such transfers are carried out in accordance with applicable data transfer requirements, including Standard Contractual Clauses where applicable.

10. Data Breach Notification

In the event BlackGuard becomes aware of a personal data breach affecting data processed under this DPA, BlackGuard will notify the Controller without undue delay and in any event within 72 hours of becoming aware, providing sufficient information to allow the Controller to meet their own notification obligations under GDPR.

11. Audit Rights

BlackGuard will make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and will permit and contribute to audits conducted by the Controller or a mandated third-party auditor, subject to reasonable advance notice and reasonable confidentiality protections.

12. Governing Law

This DPA is governed by the laws of England and Wales, consistent with the Terms of Service. Nothing in this DPA limits mandatory data protection rights under the EU GDPR where applicable to Controllers in the European Economic Area.

13. Contact

For questions about this DPA, data processing practices, or to submit a data subject request, contact Real Dudes LLC / BlackGuard at [email protected].

This DPA is a template and is provided for informational purposes. Server operators with specific compliance requirements are advised to seek independent legal advice.