This is a convenience translation. Only the German version is legally binding: Deutsche Fassung
This document is our standard offer pursuant to Art. 28 GDPR for server operators who use KynxBot on their Discord server. It is not an individually reviewed legal mandate. In the case of special risks (e.g. schools, public authorities, health data), please obtain your own legal advice.
The controller of the personal data of server members for the purposes of server moderation, tickets, welcome messages and internal community rules is, as a rule, the respective Discord server operator (admin/owner).
The processor for the technical provision of KynxBot is Julius Zeeck (KynxStudios), kynxbot.de (contact details in the Imprint).
Discord Inc. also remains the platform provider. Google (Gemini) is only involved if the server operator deliberately uses Voice AI or comparable AI skills.
The processor provides the Discord bot and the dashboard and, in doing so, processes the data required for the features activated by the controller (configuration, tickets, leveling, moderation, optional AI).
Typically: Discord user IDs, usernames, role and channel IDs, texts configured by the server, ticket content, XP/levels, moderation actions, and optionally voice or chat context where AI features are activated. Details can be found in the data inventory.
Members and visitors of the controller's Discord server, team members (moderators, admins), persons who open tickets or submit requests via an interface set up by the controller (e.g. contact form, game report), and persons speaking in voice channels with Voice AI enabled.
Processing takes place only for the performance of the contract and in accordance with the settings made by the controller in the dashboard. The data is not used for advertising or third-party analytics. If the controller sets up webhooks or the settings API, we transmit the selected event data (e.g. Discord IDs, usernames, message texts) on their instruction to the address they specify; the controller alone is responsible for this recipient (contract, third country, informing members).
The following sub-processors process personal data on our behalf:
Not sub-processors (receive no personal data):
Third countries: Personal data is only sent to the sub-processors listed above, and to third countries only with appropriate safeguards (EU-U.S. Data Privacy Framework or Standard Contractual Clauses). Further transfers to third countries only take place on the documented instruction of the controller – for example if they set up webhooks, the settings API or their own AI key of another provider (voice AI or “AI models & providers” in the server settings); they are responsible for this themselves.
Changes: We announce new or changed sub-processors at least 30 days in advance on this page and on the support server. The controller may object within this period for an important data protection reason; if we find no solution, they can terminate the contract by removing the bot and requesting deletion.
The technical and organisational measures (Art. 32 GDPR) are set out in Annex 1.
Information about your own website account: Privacy Center. The processor accepts deletion requests relating to the account. Data that the controller itself holds in the server context (tickets, leveling, configuration) is deleted by the controller in the dashboard; the server owner can also arrange for the deletion of all data of their server in the profile.
The agreement applies for as long as the bot is installed on the controller's server or a website account exists. After the bot has been removed, the server data is retained for a further 60 days (e.g. to allow a switch to a whitelabel bot or a re-invitation) and is then deleted automatically; a technical backup copy is removed after a further 14 days. Statutory retention obligations remain unaffected.
If the controller uses their own bot (white label), this agreement applies equally. The bot token is stored encrypted and only used to operate this bot; the controller is responsible for the Discord developer account of their own bot.
The server operator expressly accepts this DPA in the dashboard (checkbox "As the controller, I conclude the DPA for this server and all other servers I manage with KynxBot"). The acceptance applies once per account and version to all servers this person manages. As proof, we store the Discord ID of the accepting person, the version and the time, plus a separate record for each server concerned. As long as there is no express acceptance, the DPA is deemed agreed by inviting and continuing to operate the bot. A signed version can be requested via support@kynxbot.de. Version: 2026-11.
Last updated: November 2026 · Template, not certified by a lawyer