Data Processing Agreement

This Data Processing Agreement ("DPA") is between you, the business or organization using RemoteAccessApp ("you", the "Customer"), and Rust Games Australia Pty Ltd (ABN 64 683 623 065, "we", "us"). It's part of our Terms of Service.

When this applies

When you use RemoteAccessApp for a business or other organization, you put other people's personal data into it: your team members' email addresses, roles and permissions, the names of the PCs you manage and who's signed in to them, notes about the help a PC got, and so on. For that data, you're the controller (you decide why and how it's used) and we're your processor (we handle it for you, only to run RemoteAccessApp).

This DPA sets out the terms the law requires for that: Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR, and Switzerland's Federal Act on Data Protection (FADP), together "data protection law".

You don't need to sign anything. This DPA applies automatically whenever data protection law applies to personal data we process for you as your processor. If you'd like a countersigned copy for your records, email [email protected].

It doesn't cover data we decide about ourselves, such as your own account, billing, security logs and our website: for that we're the controller, and our Privacy Policy applies.

1. What we process for you

We can't see your sessions. Screens, keyboard and mouse input, chat, clipboard, files and commands in the apps are end-to-end encrypted between your Console and your PCs, and synced passwords and keys are end-to-end encrypted too: we can't read them, so we don't process their content. Browser sessions pass through our website server in memory only, to be relayed, and are never stored.

2. Our obligations as your processor

We will:

1. Follow your instructions. We process the data only on your documented instructions: these terms, the Terms of Service, and what you do in RemoteAccessApp (for example adding a team member or deleting a note). If the law requires us to do something else, we'll tell you first unless the law forbids it. If we think an instruction breaks data protection law, we'll tell you.
2. Keep it confidential. Only people who need access to run the Service have it, and they're bound to confidentiality.
3. Keep it secure, with the measures in Annex 2 (Article 32).
4. Use subprocessors only as set out in section 4.
5. Help you with people's requests (access, correction, deletion and the other rights): most can be done directly in RemoteAccessApp, and for the rest we'll help, as far as we reasonably can, when you ask. If someone asks us directly about data we process for you, we'll pass it on to you and not answer it ourselves, unless the law requires otherwise.
6. Help you meet your other obligations: security, data breach notifications, data protection impact assessments and consulting a supervisory authority, taking into account what we can know about your processing.
7. Delete or return the data at the end, as set out in section 9.
8. Give you the information you need to show you comply with Article 28, and allow audits as set out in section 8.

3. Your obligations

You:

• are responsible for having a lawful basis for the data you put into RemoteAccessApp, and for telling the people concerned (your team members, the people at your PCs) about it, as our Terms of Service say;
• make sure your instructions comply with data protection law;
• don't put special categories of personal data or data about criminal convictions into RemoteAccessApp unless the law allows it and you've told us.

4. Subprocessors

You give us a general authorisation to use subprocessors. The current ones are on our Subprocessors page, with what each does and where.

• Before we add or replace a subprocessor, we update that page and email the owners of accounts with a team (and anyone who asks us to be told) at least 30 days in advance.
• You can object on reasonable data protection grounds within those 30 days, by email. We'll try to find a solution with you. If we can't, you can stop using the Service and cancel your subscription before the change.
• We bind each subprocessor to data protection terms that give at least the same protection as this DPA, and we're responsible to you for their work as the law requires.

5. Personal data breaches

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data we process for you, we'll tell you without undue delay, and in any case within 48 hours of becoming aware of it, by email to the account owner. We'll tell you what we know (what happened, which data and people are likely affected, the likely consequences and what we're doing about it) and send more as we learn it. Telling you isn't an admission of fault.

6. International transfers

We're in Australia, and the data is stored there, on our servers and backups. Australia doesn't have an adequacy decision from the European Commission, the UK or Switzerland. Some subprocessors handle data in the United States and other countries (see the Subprocessors page).

So, where data protection law requires it for data you send to us, the Standard Contractual Clauses are incorporated into this DPA by reference and apply between you (exporter) and us (importer):

• EU: the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, Module Two (controller to processor) and, where you are yourself a processor for someone else, Module Three (processor to processor). The optional docking clause (Clause 7) applies. Under Clause 9, option 2 (general written authorisation) applies, with the 30 days' notice in section 4. The option in Clause 11 doesn't apply. Under Clause 13, the supervisory authority is the one competent for you, or, if you have no establishment in the EU, the one in the Member State where your EU representative is. Under Clauses 17 and 18, the clauses are governed by Irish law, and disputes go to the courts of Ireland.
• UK: the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0), with the details in this DPA filling in its tables, and neither party may end it under its section 19.
• Switzerland: the EU clauses above, adapted for the FADP: the Federal Data Protection and Information Commissioner is the supervisory authority for transfers under the FADP, references to the GDPR include the FADP, and people in Switzerland can bring claims in Switzerland.

Annexes 1 to 3 of this DPA are the information the clauses' annexes need. If the clauses and this DPA ever conflict, the clauses win. Our own transfers to subprocessors are covered by the Standard Contractual Clauses (or the EU-US Data Privacy Framework, where a subprocessor is certified under it).

7. Government requests

If a government authority asks us for data we process for you, we'll tell you and ask the authority to come to you, unless the law forbids it. We'll only give what we're legally required to, after checking the request is lawful.

8. Information and audits

On request we'll give you the information you reasonably need to check we meet this DPA, including our security white paper. If that isn't enough, or a supervisory authority requires it, you (or an independent auditor bound to confidentiality) may audit our compliance once a year, with at least 30 days' written notice, during business hours, at your own cost, without access to other customers' data and in a way that doesn't put the Service's security at risk.

9. When it ends

You can delete data at any time in RemoteAccessApp (for example by removing a team member or a PC, or deleting your account). When you stop using the Service and delete your account, we delete the personal data we process for you within 14 days, except where the law requires us to keep it. Deleted data can remain in our backups for up to 14 more days until they rotate out, and in our security log for up to 90 days, protected the same way. Before you go, you can take a copy of your data with "Download my data" or by asking us.

10. Liability and the rest

• Liability under this DPA is as set out in our Terms of Service, except where data protection law or the Standard Contractual Clauses don't allow it to be limited (for example our responsibility towards the people the data is about).
• Order of precedence: if documents conflict, the Standard Contractual Clauses win, then this DPA, then the Terms of Service.
• Governing law: this DPA is governed by the law that governs the Terms of Service (Australian law), except the Standard Contractual Clauses, which are governed as section 6 says, and except where data protection law requires otherwise.
• Changes: we may update this DPA to reflect changes in the law or the Service; we won't reduce the protection it gives without telling you first, as the Terms of Service describe.

Annex 1: the parties and the processing

• Data exporter (controller): the Customer, as identified by the account that uses RemoteAccessApp for its organization. Contact: the account's email address. Activities: using RemoteAccessApp for its organization.
• Data importer (processor): Rust Games Australia Pty Ltd (ABN 64 683 623 065), Australia. Contact: [email protected]
• Description of the transfer: as in section 1. Frequency: continuous, while the Service is used. Retention: as in section 9 and our Privacy Policy.

Annex 2: security measures

• Encryption in transit: every connection to our servers uses TLS, and the apps only trust our own server certificate.
• End-to-end encryption: sessions between the Console and a PC are end-to-end encrypted; our relay can't read them. Synced passwords and SSH keys are encrypted in the browser or app with a key from the account password, so we can't read them.
• Encryption at rest: synced settings, PC history notes, scheduled tasks and their results, and push subscriptions are encrypted on our server.
• Passwords and secrets: account passwords are never stored, only a slow one-way hash; two-factor backup codes, license keys and session tokens are stored only as hashes or encrypted.
• Access control in the product: two-factor authentication; emailed codes for sign-ins from new devices; trusted networks; team roles and per-PC permissions, signed by our server and enforced by the PC itself.
• Consent at the PC: the person at a PC is asked before each session (unless unattended access was turned on at that PC), and a banner shows during every session.
• Operational security: administrative access to our servers and data is limited to the company's owner, with strong authentication; servers are kept up to date; app updates are digitally signed and checked before they install.
• Logging and monitoring: a security log of sign-ins and account changes, kept 90 days; automatic limits on unusually frequent requests and sign-in attempts.
• Data minimisation: we collect only what each feature needs (see the Privacy Policy), and keep it only as long as listed there.
• Resilience and recovery: nightly backups, kept 14 days.
• Incidents: a written breach response procedure, including notifying you within 48 hours (section 5).

Annex 3: subprocessors

The list on our Subprocessors page, as updated under section 4.