Data Processing Agreement

1. When this applies

This Agreement is between the operator of Nexobots, ModoraLabs, a private individual in the Netherlands, as a non-commercial hobby project ("Nexobots"), and you, the developer of a bot listed on Nexobots ("Developer"). It applies whenever you receive personal data from us, specifically when you:

• switch on a vote webhook, which sends a voter's Discord ID on each vote;
• use the API to check whether a user voted, or to list recent voters, which returns their Discord ID, username, avatar and vote time.

2. Roles

Nexobots is the controller of this data on Nexobots. Once you receive it, you decide what your bot does with it, so you are an independent controller for that use and you are responsible for following the GDPR yourself. Should you in any case process this data on our behalf, you act as our processor, only on the instructions in this Agreement.

3. Purpose limits

You may use this data only to:

• recognise that a user voted, and give them a reward or thanks in your bot;
• send a vote reminder or similar message inside your bot, to users who have chosen to receive it.

You may not sell this data, share it with others, build profiles of users, combine it to identify people beyond your bot's normal use, or contact voters for marketing outside Discord.

4. Security measures

You must protect this data with suitable measures, at a minimum:

• keeping your API token and webhook secret out of source code, and resetting them if they may have leaked;
• checking the X-Nexo-Signature header on each webhook;
• receiving webhooks only over HTTPS;
• limiting access to people who need it, and keeping your systems updated.

5. Confidentiality

Anyone working on your bot with access to this data must be bound to keep it confidential.

6. Service providers

You may use service providers, such as your hosting provider, to run your bot. You remain responsible for them, and they must meet the same obligations. If you use a provider outside the EEA, a valid GDPR transfer mechanism must be in place.

7. Breach notification

If you discover or suspect a breach affecting this data, you must tell us within 48 hours at [email protected]. Tell us what happened, which data and how many people are affected, and what you've done about it. Help us with what we need to meet our own legal duties.

8. Helping with user rights

If a user asks you to access or delete their data, or we pass on such a request, you must act on it or help us to, without undue delay.

9. Deletion on termination

Delete this data when you no longer need it for the purposes above. When your listing or account ends, or you switch off webhooks and stop using the API, delete all voter data you received within 30 days, unless the law requires you to keep it.

10. Audits and breaches of this Agreement

On reasonable request, you must give us the information needed to show that you comply. If you break this Agreement, we may switch off your webhook, revoke your API access and suspend your listing.

11. Governing law

Dutch law applies, and disputes go to the competent court in the Netherlands. If this Agreement conflicts with the Terms of Service on personal data, this Agreement takes priority.