Data Processing Agreement (AVV)
pursuant to Art. 28 (3) GDPR
Last updated: September 2026
This is a translation for your convenience. The German version at www.msk-scripts.de/de/terms/avv is authoritative.
This agreement becomes part of the contract as soon as you, as the operator of a Discord server, activate the Ticket Bot transcript service, Hosted Bot Management or MSK Forms ("controller", "you"). The processor is Moritz Kohm, MSK Scripts, c/o Impressumservice Dein-Impressum, Stettiner Str. 41, 35410 Hungen ("MSK Scripts", "we"). You can access this agreement at any time at https://www.msk-scripts.de/terms/avv and save it for your records.
1. Subject matter and duration
(1) The subject matter is the storage, provision and processing of data generated by your Ticket Bot or your MSK Forms forms on our systems. You decide which tickets are uploaded, which forms are published and which data they collect; we provide the infrastructure.
(2) The agreement applies for the duration of the use of the respective service and ends with its termination and the deletion or return of the data under section 9.
2. Nature and purpose of the processing, categories of data, data subjects
| Transcript service | Hosted Bot Management | MSK Forms | |
|---|---|---|---|
| Purpose | Storage and retrieval of ticket transcripts and attachments | Operation of your bot instance including configuration and database | Operation of your application forms, storage and status management of submissions |
| Categories of data | Discord usernames, display names, avatars, message content, timestamps, attachments | Bot configuration, credentials (token, secrets), ticket data, Discord IDs of your team | Answers of applicants (fields defined by you), uploads, Discord identity of signed-in applicants, status history, reviewer notes |
| Data subjects | Users of your Discord server, your support team | Your team, users of your server | Applicants, your review team |
Special categories of personal data (Art. 9 GDPR) may only be processed if you have a legal basis for doing so; we recommend not including such data in tickets or forms.
3. Instructions
(1) We process the data exclusively in accordance with your documented instructions. You issue instructions through the configuration of the service (upload, retention period per tier, form fields, deletion in the dashboard) and in text form to info@msk-scripts.de.
(2) We inform you without delay if we believe that an instruction infringes data protection law.
(3) No processing for our own purposes takes place; anonymised, aggregated usage statistics without any personal reference are excepted.
4. Obligations of MSK Scripts
We undertake
- to process data only within the EU/EEA (server location Germany, netcup GmbH);
- to bind all persons involved in the processing to confidentiality (currently the owner only);
- to comply with the technical and organisational measures under section 6 and to review them regularly;
- to support you in responding to data subject requests (Art. 12–22 GDPR) to a reasonable extent, e.g. by deleting or exporting individual transcripts and submissions;
- to support you in complying with the obligations under Art. 32–36 GDPR (security, notification of data breaches, data protection impact assessment);
- to inform you without delay, and at the latest within 48 hours of becoming aware of personal data breaches affecting your data;
- to make available to you all information necessary to demonstrate compliance with this agreement.
5. Obligations of the controller
You are the controller for the data in your transcripts, bot databases and forms, and you ensure in particular that
- a legal basis for the processing exists and that your users or applicants are informed pursuant to Art. 13/14 GDPR, including the notice that MSK Scripts is engaged as a processor;
- you pass on transcript and form links only to authorised persons;
- you keep credentials (API keys, bot tokens) secret and renew them immediately if compromised;
- data subject requests received by you are handled by you; we will support you in doing so.
6. Technical and organisational measures (Art. 32 GDPR)
- Access control: server access only via SSH with key authentication; dashboard access only after Discord OAuth; sessions as HttpOnly/Secure cookies.
- Authorisation control: transcripts under random, non-guessable UUID paths; form submissions under random IDs; API keys specific to each server; secrets (OAuth, Turnstile) stored encrypted.
- Transmission control: exclusively TLS-encrypted connections (HTTPS), Certbot/Let's Encrypt.
- Separation: separate directories and database records per Discord server; hosted bots as separate processes.
- Availability: rate limiting against misuse; operation on systems within the EU.
- Deletion: automatic deletion after the retention period expires; archiving of deleted hosted bot installations for 14 days, then final deletion.
- Logging: server logs 14 days.
7. Sub-processors
You consent to the engagement of the following sub-processors:
| Sub-processor | Service | Location |
|---|---|---|
| netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe | Hosting, storage | Germany |
| IONOS SE, Elgendorfer Str. 57, 56410 Montabaur | DNS, email delivery | Germany |
We will inform you at least 30 days in advance by email or via a notice in the dashboard about the engagement of further sub-processors. You may object within that period for good cause; in that case you may terminate the service.
Discord Inc. and Stripe are not sub-processors but independent controllers for the platforms they operate.
8. Audit rights
You may verify compliance with this agreement, primarily by requesting information and evidence in text form. On-site audits are possible after reasonable advance notice (at least 14 days) during normal business hours, at most once a year, unless there is specific cause.
9. Deletion and return after the end of the contract
After the end of the service we delete all data processed on your behalf: transcripts after their respective retention period expires, hosted bot installations 14 days after deactivation, form data upon deletion of the form or of your account. On request we will hand over configuration files and exports (CSV/JSON) beforehand. Statutory retention obligations remain unaffected.
10. Liability and final provisions
(1) Art. 82 GDPR and the liability provisions of the Terms and Conditions apply to liability.
(2) In the event of contradictions, this agreement takes precedence over the Terms and Conditions insofar as data protection is concerned. German law applies.
(3) We notify you of changes to this agreement in the same way as changes to the Terms and Conditions.
By activating the respective service you confirm that you have read this agreement and that you enter into it. On request to info@msk-scripts.de we will provide you with a signed version as a PDF.
