Skip to content
Epochthe game

· Epoch The Game ·

Data Processing Addendum

For the business, educator, or organisation that needs one in writing.

Last updated: 2026-04-22

Who needs this

If you are an individual signing up to the waitlist, you do not need a Data Processing Addendum. Our privacy policy already covers the relationship under GDPR.

A DPA is relevant when an organisation — for example, a school, a museum, or a workplace book club — intends to introduce Epoch to its members and needs a GDPR Article 28 data-processing agreement on file. The DPA formalises who is the controller, who is the processor, what instructions the processor is acting on, and what sub-processors are engaged.

How to request one

Email scribe@epochthegame.com with:

  • Your organisation's name and country.
  • The name of an authorised signatory.
  • A short description of how you intend to use Epoch with your members.

We will send back our standard DPA, based on the ICC Model Clauses, within five business days. For EU customers we include the Standard Contractual Clauses for US transfers.

Our sub-processors

Today, running this site requires:

  • Vercel Inc. — hosting and server logs. United States. GDPR DPA in place on their side; SCCs for EU data.
  • Supabase, Inc. (planned, not yet live) — database and, in time, authentication. Not yet processing any data from this site; when it begins, this list and our privacy policy will be updated and you will be notified.

When we add new sub-processors — for example, a transactional-email provider when the waitlist begins sending actual emails — DPA customers receive thirty days' notice and may object in writing.

What our DPA covers

  • Scope and duration of processing.
  • Categories of data and data subjects.
  • Our obligations as processor (Article 28(3)): written instructions, confidentiality, technical and organisational measures, sub-processor controls, assistance with data-subject requests, breach notification, return or deletion on termination.
  • Sub-processor list (see above) and your right to object.
  • Standard Contractual Clauses (2021/914) for EU-to-US transfers.
  • Our security and organisational measures.
  • Audit rights (standard industry scope).

Contact

For DPA requests or questions about our data-processing practices, email scribe@epochthegame.com.

You may also want to read our Privacy Policy and our Terms.