Annex B to the Gameheim Customer Agreement (https://www.gameheim.com/agreement), of which it is an integral part. Together with Annex 1 it serves as the data-processing agreement (art. 28 GDPR / art. 9 nFADP) for the personal data Virsion processes on the Customer's behalf. Version 1.3 of 15 October 2026. The Italian version prevails in case of discrepancy.
1. Categories of data subjects
- The Customer's Users (employees, contractors, authorised consultants)
- Actors, voice actors and other natural persons whose voice recordings the Customer uploads to the voice-acting pipeline
- People who run the Customer's internal builds or the Unreal Engine editor on projects for which the Customer has enabled crash reception (typically the Customer's Users, testers and contractors)
- Any natural persons whose data is contained in content uploaded by the Customer
2. Categories of Personal Data processed
| Category | Examples |
|---|---|
| Account data | Name, username, email, role, Organization |
| Authentication data | Password (encrypted), MFA data, biometric-login tokens (hashed) |
| Usage data | Access logs, timestamps, country of access, actions performed (audit log), AI token consumption; IP address, kept in application logs only in pseudonymised form and in clear in the access logs of the delivery network (Azure Front Door), for the period stated in Annex 1, § 5 |
| Presence and activity data | Presence status, application heartbeats, inactivity indicators detected by the Agent (timestamp of the last operating-system input) |
| Content | Tasks, wiki, documents, messages, comments, moodboards, attachments and any personal data contained therein |
| Voice recordings | Voice-acting takes uploaded by the Customer |
| Perforce metadata | File names/paths, states, locks, changelists (file content is not transmitted) |
| AI prompts and Output | Text of queries and of the generated responses |
| Mobile app data | Installation identifier, push token, platform |
| Unreal Engine crash data | Error message, callstack, build versions and configuration, changelist; Unreal machine identifier, kept only as a hash (including that of the workstation running the Agent, used to give editor crashes the changelist of the workspace and, only if the Customer enables the option «Record who had the crash» for the project, the User of the Agent installed on that workstation); minidump (process memory at the time of the crash) and the final part of the application log, which may contain the system user name, the computer name, local paths and any data present in memory. Only if the Customer enables test mode: the full report, including the login identifier and the Epic account identifier, for at most 7 days |
The Customer alone knows the nature of the data contained in the content it uploads and is responsible for assessing whether it includes special categories (art. 9 GDPR / art. 5(c) FADP) and for holding the rights and releases for voice recordings (art. 7.4 of the Agreement).
Crash reception is intended for the Customer's internal builds. The Customer undertakes not to distribute externally (players, external testers) builds configured with its project's reception address; if a build leaves the internal perimeter, the Customer regenerates the reception key. The Customer may also have reports of «Shipping» builds discarded on arrival. Minidumps may contain any data present in memory: the Customer takes this into account when granting the permission to download them. The option «Record who had the crash» is disabled by default and concerns editor crashes only. If the Customer enables it, the User associated with a crash is visible to those who can read the project's bugs; disabling it erases the associations already recorded in the project. The Customer informs its staff before enabling it.
Processing for which Virsion is an independent Controller (outside the scope of this Annex): Organization registration data, billing and payments, administrative communications (art. 12.1 of the Agreement).
3. Purposes of processing
Virsion, as Processor, processes Personal Data solely for:
- Providing the Service under the Agreement
- Indexing and search
- Generating AI Output through RAG
- Real-time collaboration and presence features
- Receiving, grouping and analysing crashes of the Customer's software, linking them to bugs and detecting regressions
- Security, monitoring and abuse prevention
- Compliance with legal obligations
4. Instructions, confidentiality and assistance
Virsion processes Personal Data only on the Customer's documented instructions (the Agreement constitutes the general instruction), ensures that authorised persons are bound by confidentiality, adopts the measures in Annex C, assists the Customer with data-subject requests and with the obligations under arts. 32–36 GDPR within the terms of the Agreement (arts. 13 and 21), and on termination deletes the data in accordance with art. 5.5.
5. Duration and deletion
Processing lasts for the term of the Agreement. On termination of the Agreement art. 5.5 applies (30 days to request export, then deletion).
Crash minidumps and logs are deleted 90 days after receipt; full reports kept in test mode after 7 days. The other crash data follow the life of the project.
6. Sub-processors and international transfers
The Customer gives general authorisation for the Sub-processors listed in Annex 1, which also governs the update mechanism and the right to object. Data is processed in European data centres (Annex 1, § 3). For transfers to third countries the safeguards set out in the individual sub-processors' DPAs apply (Annex 1, § 4).
Forwarding editor crashes to Epic Games. If the Customer enables the option «Also send editor crashes to Epic», Virsion transmits to Epic, on the Customer's behalf and instructions, the Unreal Engine editor crash reports as received, in the same form in which the editor would send them to Epic without the Service. Epic is not a Sub-processor of Virsion: it receives the data as a recipient chosen by the Customer and processes it as an independent controller under its own terms (the Unreal Engine licence and the Epic Games privacy policy). For Unreal Engine users residing outside the United States, Epic's privacy policy names Epic Games Commerce GmbH, established in Switzerland, as controller; the transfer from the European Economic Area to Switzerland relies on the European Commission's adequacy decision. The option is disabled by default.
External applications connected by Users. The Customer determines, through roles and permissions, which Users may connect external applications to Gameheim (for example AI assistants). When an authorised User connects an application, Virsion makes available to that application, on the Customer's behalf and instructions, the data it requests within the permissions granted. The application's provider is not a Sub-processor of Virsion: it receives the data as a recipient chosen by the Customer or its Users and processes it under its own terms. It is for the Customer to determine which applications, providers and accounts its Users may use and to assess any resulting transfers to third countries. The connection can be revoked at any time by the User and by the Customer.