Data processing agreement

This data processing agreement ("DPA") forms part of the terms of service for renmy runtime and applies to the processing of personal data by Renmy UG (haftungsbeschränkt) i.G., Apoldaer Str. 21, 12249 Berlin, Germany, not yet entered in the commercial register of the Amtsgericht Charlottenburg and represented by its managing directors René Knierim and Mandy Bebenroth ("Processor"), on behalf of a customer ("Controller") using renmy runtime, as set out in section 2. By using renmy runtime, the Controller agrees to this DPA. Customers requiring a counter-signed copy may request one at privacy@renmy.net.

Renmy UG (haftungsbeschränkt) i.G. processes the account, license, billing and support-contact data of its customers as an independent controller, as described in the privacy policy; this DPA does not cover that processing.

Until the customer agrees to the transfer of their contract to Renmy UG (haftungsbeschränkt) i.G., contracts concluded before 2026-10-15 stay with René Knierim, trading as Renmy (formerly Nimbus Solutions), who remains the processor for them.

1. Definitions

Terms used in this DPA have the meanings given in Article 4 of the EU General Data Protection Regulation 2016/679 ("GDPR"). "Personal Data" means the personal data the Processor processes on behalf of the Controller as set out in section 2.

2. Subject matter and duration

Subject matter: The personal data the Controller entrusts to the Processor in using renmy runtime's team features and support: the email addresses of team members that the Controller's team admin enters in the portal, the invitations sent to them and their seats, and personal data the Controller gives the Processor in support requests.
Duration: For the term of the underlying service agreement (section 12); section 11 governs deletion.

3. Nature and purpose of processing

The Processor processes Personal Data solely to provide the service to the Controller. Specifically:

• Store the email addresses of team members a team admin enters, and send them invitations
• Keep the team's seats and each member's status, and show them to the team admin
• Respond to the Controller's support requests

4. Categories of data subjects

• Members of the Controller's team whom a team admin invites or assigns a seat
• The Controller's employees and other persons named in support requests

5. Categories of personal data

• Email addresses of team members
• Membership records: role, status (invited, active, revoked), and when the invitation was sent and accepted
• Personal data the Controller includes in support requests

6. Processor obligations

The Processor shall:

• Process Personal Data only on documented Controller instructions, including the use of the service
• Ensure persons authorized to process Personal Data are bound by confidentiality
• Implement appropriate technical and organizational measures (TOMs) per section 8
• Assist Controller in responding to data subject rights requests
• Notify Controller without undue delay of any Personal Data breach (within 72 hours)
• Make available all information necessary to demonstrate compliance with this DPA
• Allow audits by Controller or an independent auditor (subject to reasonable notice and confidentiality)

7. Subprocessors

Controller hereby grants the Processor general written authorization to engage subprocessors. The Processor maintains a current list of subprocessors at /subprocessors and will notify Controller at least 30 days in advance of changes. Controller may object to a new subprocessor by giving written notice within that period; if the parties cannot resolve the objection, Controller may terminate this DPA and the related service for that subprocessor's portion of processing.

Each subprocessor is bound by data protection obligations no less protective than those set out in this DPA.

8. Technical and organizational measures (TOMs)

• Encryption in transit: All HTTP traffic uses TLS 1.2 or higher
• Encryption at rest: Databases and file storage encrypted at rest (AES-256)
• Access control: Personal Data access limited to authorized personnel; service-role keys used only by trusted server-side functions, never exposed to browsers
• Row-level security: Database access controls ensure users can only read their own data
• Audit logging: Consent records, billing changes, and account modifications are logged with IP and user agent
• Backups: Daily encrypted backups; tested restore procedures
• Incident response: Documented breach notification procedure (72-hour notification window)
• Personnel training: All staff with data access trained in GDPR basics and confidentiality obligations

9. International transfers

The Processor primarily processes Personal Data within the European Economic Area. Where transfers to third countries are necessary (e.g. via subprocessors in the United States), they are governed by the EU Standard Contractual Clauses (SCCs) Module Two (Controller-to-Processor) or equivalent transfer mechanisms. See the subprocessors page for current arrangements.

10. Data subject rights

The Processor enables Controllers and end users to exercise their rights under Articles 15–22 GDPR directly through the service:

• Access (Art. 15): Self-serve JSON export from the user portal
• Rectification (Art. 16): Account fields editable in the portal
• Erasure (Art. 17): Self-serve account deletion (anonymization with retained tax records as legally required)
• Restriction and objection (Art. 18, 21): Contact privacy@renmy.net
• Portability (Art. 20): JSON export is in a machine-readable format

11. Retention and deletion

Personal Data is retained only as long as necessary for the purposes set out above. How long Renmy UG keeps the data it processes as controller (account, license and billing records, invoices) is set out in the privacy policy.

Upon termination of this DPA, the Processor will delete or return all Personal Data (Controller's choice), subject to retention periods required by applicable law.

12. Liability and term

This DPA enters into force when Controller starts using the service and terminates with the underlying service agreement. Liability under this DPA is governed by the limitation of liability provisions in the terms of service.

13. Governing law and jurisdiction

This DPA is governed by the laws of Germany. The place of jurisdiction is as set out in § 10 of the terms of service.

14. Contact

For all matters relating to this DPA or data protection in general, contact privacy@renmy.net. Full company details are in the Impressum.