← Back to home

Draft — not yet reviewed by a lawyer

This text is a work in progress. All highlighted details must be filled in and all notes resolved before the page goes public.

Data Processing Agreement

Last updated: 12 October 2026

Only the German version is legally binding. This English translation is provided for convenience. Read the German version

pursuant to Art. 28 of the General Data Protection Regulation (GDPR)

1. Parties and conclusion

This agreement applies between the server operator as controller and Kilian Hauber, Am Rosengarten 18B, 79183 Waldkirch, Germany (“Herukan”) as processor. The server operator is whoever owns, according to Discord, the Discord server on which Herukan is used.

This agreement forms part of our terms of service and is concluded for each server as soon as the bot is used there. Anyone else who invites the bot or manages it in the dashboard does so on behalf of the server operator. The terms of service apply otherwise; in matters of data protection this agreement prevails.

2. Subject matter, nature and purpose

Herukan processes personal data on behalf of the server operator to provide the features they enable on their server and configure in the dashboard, such as moderation, AutoMod, leveling, tickets, giveaways, minigames, statistics, transcription, /ask, the audit log and the custom bot of the Ultimate tier. Processing comprises collection through the Discord API, storage, retrieval, display in the dashboard and the app, transfer to the sub-processors listed in Annex 2, and deletion.

Which data each feature processes and how long it is kept is set out in detail in section 4 of the privacy policy; that description forms part of this agreement.

3. Types of data and data subjects

Data subjects are the server’s members, its team (moderators, administrators) and anyone interacting with the bot on the server.

Types of data, depending on the features enabled: Discord IDs, display names and avatars; moderation data such as warnings and their reasons; leveling, game and giveaway data; messages in ticket channels and ticket transcripts; for transcription the consent decision, voice audio until conversion and the recognised text; questions to /ask; audit log entries; images uploaded in the embed builder; the custom bot’s token. Special categories under Art. 9 GDPR are not the subject of processing, but may appear in free text such as ticket messages without Herukan having any influence on this.

4. Duration

This agreement runs for as long as Herukan is used on the server and ends when the bot is removed; the obligations under section 11 continue to apply.

5. Instructions

Herukan processes the data only on documented instructions from the server operator, unless required to do so by Union or Member State law; in that case Herukan informs the server operator beforehand unless that law prohibits it. The instructions are set out in this agreement, the terms of service and the settings the server operator or their team make in the dashboard, the app and through bot commands. Further instructions are given in text form to [email protected]. Herukan informs the server operator without delay if it considers an instruction to infringe data protection law and may suspend it until clarified.

6. Confidentiality

Herukan ensures that everyone with access to the data is bound by confidentiality or under an appropriate statutory obligation of confidentiality.

7. Security of processing

Herukan implements the technical and organisational measures under Art. 32 GDPR described in Annex 1 and may adapt them to technical progress as long as the level of protection is not reduced.

8. Sub-processors

The server operator grants Herukan general authorisation to engage sub-processors. The sub-processors in place at conclusion are listed in Annex 2 and deemed approved. Herukan announces any intended addition or replacement at least 30 days in advance on this page and in the dashboard. The server operator may object within that period on reasonable data protection grounds; if Herukan cannot address the objection, the server operator may terminate this agreement by removing the bot from their server.

Herukan imposes the same data protection obligations on each sub-processor. Transfers outside the EU and EEA take place only where Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision such as the EU-U.S. Data Privacy Framework or the EU Commission’s Standard Contractual Clauses. Discord itself is not a sub-processor of Herukan: the server operator uses Discord under their own responsibility, and Herukan accesses the data through Discord’s API.

9. Assistance

Herukan assists the server operator with appropriate measures in fulfilling data subjects’ rights (Art. 12–23 GDPR), including functions in the dashboard for deleting member data, and forwards requests received directly to the server operator where they can be identified. Herukan also assists with the obligations under Art. 32–36 GDPR, taking into account the nature of processing and the information available.

10. Personal data breaches

Herukan notifies the server operator of any personal data breach affecting their server without undue delay after becoming aware of it, with the information under Art. 33 (3) GDPR as far as available, and takes the necessary measures to contain it.

11. Deletion and return

After the bot is removed, Herukan deletes the server’s data within 30 days, which allows an accidental removal to be undone; database backups are overwritten after a further 30 days. On request in text form within those 30 days, Herukan provides the existing data in a common machine-readable format.

12. Evidence and audits

Herukan provides on request all information necessary to demonstrate compliance with Art. 28 GDPR, primarily through documentation such as this description of measures and the certificates or audit reports of sub-processors. Where this is insufficient in an individual case, the server operator may carry out an audit including an inspection, or have it carried out by an auditor bound to confidentiality who is not a competitor of Herukan. Audits must be announced in text form at least 30 days in advance, take place during normal business hours without disrupting operations, and are limited to once per calendar year unless a specific reason such as a breach justifies another. The server operator bears the costs. Data centres of sub-processors are accessible only under their own rules; their evidence takes the place of an inspection there.

13. Liability

Liability towards data subjects is governed by Art. 82 GDPR; between the server operator and Herukan, section 9 of the terms of service applies.

14. Changes

Changes to this agreement follow section 10 of the terms of service; changes to Annex 2 follow section 8.

Annex 1: Technical and organisational measures

  • Physical access: servers and database run in data centres of Hetzner Online GmbH in Germany (ISO/IEC 27001 certified); Herukan operates no server rooms of its own.
  • System access: administrative access to servers, database and management interface is limited to Herukan’s operator personally. The database is not reachable from the internet. Sign-in to the dashboard and the app works only through Discord (OAuth2).
  • Data access: in the dashboard and the app a person only sees and changes servers they may manage according to their Discord permissions and the server’s access settings, checked on the server side.
  • Separation: all servers’ data is logically separated; every record belongs to one server and is processed only in its context.
  • Transfer control: all connections to the website, dashboard, app API and sub-processors are encrypted with TLS. Bot tokens and Discord access tokens are stored encrypted (AES). Transcripts are kept in non-public storage.
  • Input control: changes to a server’s settings through the dashboard and the app are recorded in the audit log with the acting person, time and changed values.
  • Availability: daily database backups to storage with EU data residency, kept for 30 days; restoring has been tested successfully. Continuous health monitoring of all services with automatic restarts.
  • Data minimisation and deletion: message content outside ticket channels is not stored; questions to /ask are sent to the provider without a Discord ID. Automatic deletion periods apply to all types of data as set out in the privacy policy.
  • Review: measures are reviewed on material changes to the service and at least once a year.

Annex 2: Sub-processors

  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — hosting of bot, dashboard, app API and database; located in Germany.
  • Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA — storage of images and transcripts, database backups (with EU data residency) and delivery of website and dashboard through the Cloudflare network; EU-U.S. Data Privacy Framework, Standard Contractual Clauses in addition.
  • Groq, Inc., USA — speech-to-text (transcription) and answering questions (/ask), only when these features are used; Standard Contractual Clauses.
  • 650 Industries, Inc. (Expo), USA, forwarding to Apple or Google — delivery of Herukan app push notifications containing the server name and ticket or application number; EU-U.S. Data Privacy Framework, Standard Contractual Clauses as a fallback.