Annex 1: Sub-processors

1. Purpose and scope

This Annex 1 is an integral and substantial part of the Agreement and implements the references in arts. 1.3, 11, 12.1 and 12.3. It identifies the sub-processors and infrastructure subcontractors Virsion relies on to provide the Service, together with the applicable third-party terms, conditions and documentation.

Those third-party terms cannot be negotiated by Virsion and apply directly to the services provided by the respective third parties. In case of conflict between this Annex and the referenced third-party terms, the latter prevail solely for the services those parties provide, without prejudice to Virsion's mandatory obligations towards the Customer and to applicable mandatory law.

The version of this Annex in force is the one published and/or notified by Virsion under the update mechanism in § 6. The Customer shall periodically consult the updated version.

2. Roles in the processing (reference to art. 12.1)

• Customer: Controller (for the Organization's data).
• Virsion: Processor (for the Organization's data); independent Controller for registration and billing.
• Parties listed in § 3: Sub-processors or independent providers, as stated there.
• Epic Games, when the Customer enables the forwarding of Unreal Engine editor crashes: not a Sub-processor, but a recipient chosen by the Customer that processes the data as an independent controller (Annex B, § 6).

3. List of sub-processors / subcontractors

3.1 Microsoft Corporation

3.2 Stripe

3.3 Google LLC (Firebase Cloud Messaging)

3.4 Apple Inc. (Apple Push Notification service)

3.5 Hostinger International Ltd

Note on geolocation (GeoIP): country-level geolocation of accesses is performed internally using the MaxMind GeoLite2 database hosted on the Service's systems: no data is sent to MaxMind, which is therefore not a recipient of the data.

4. Applicable third-party terms, conditions and documentation

4.1 Microsoft / Azure

4.2 Stripe

4.3 Google / Firebase

4.4 Apple

4.5 Hostinger

5. Logs, retention and Zero Data Retention (reference to art. 12.3)

Unless specifically configured and where available, the «Zero Data Retention» mode for Azure OpenAI is not enabled by default.

Microsoft's policies on technical logs, retention and abuse monitoring described in the documentation in § 4 apply.

Current Gameheim configuration:

Zero Data Retention for Azure OpenAI is available on request to Microsoft for eligible customers. It requires Microsoft's approval and disables abuse monitoring. Virsion will consider enabling it at the Customer's request, subject to the applicable Microsoft conditions.

6. Updates to the list and right to object

This clause specifies and completes the reference in art. 11.1 of the Agreement (updated online version).

Virsion may add or replace sub-processors by notifying the Customer at least 20 (twenty) days before the change takes effect, by written notice to the email address of the Organization's administrator and/or an in-platform notice.

The Customer may object to the change on reasonable, documented data-protection grounds within 15 days of the notice.

If no agreed solution is found within 15 days of the objection, the Customer may withdraw without penalty, limited to the affected services, as its sole remedy.

The online version is the version in force; the date of the last update is shown at the top of this Annex.

7. Points of contact