Skip to main content
Sign inCreate an account

Data processing agreement

Last updated: 28 September 2026

Version 2026-09-28. This agreement, required by article 28 of the GDPR, applies between you, the server owner (the controller), and [To complete: legal name of the publisher] (the processor) for the player data that the FiveM Analytics resource sends from your server. You accept it when you add a server. It forms part of the terms of service.

1. Subject, duration and purpose

The processor stores and analyses player data to display statistics about your server in your dashboard. The processing lasts as long as the server is connected to your account.

2. Data and data subjects

Data subjects: players who connect to your server. Data: game and platform identifiers (Citizen ID, Steam, Discord, Rockstar licence), FiveM and character names, sessions and AFK time, job and gang, in-game balances and transactions, inventory, vital stats, deaths, vehicles and in-game positions. The Service is not designed to process special categories of data (article 9 GDPR); do not send any through custom metadata.

3. Your obligations as controller

  • Have a lawful basis for the processing, typically your legitimate interest in running and moderating your server.
  • Inform your players before they play, for example in your server rules or Discord. A notice you can adapt is provided in section 9.
  • Answer your players' requests; the dashboard lets you delete a player and all linked data.
  • Give instructions only through the settings of the Service or in writing.

4. Our obligations as processor

  • Process player data only on your documented instructions, including these terms and your settings, and tell you if an instruction seems unlawful to us.
  • Ensure that people authorised to access the data are bound by confidentiality.
  • Apply appropriate security measures (article 32): encryption in transit, hashed API keys, isolation of each server's data by row-level security, access limited by role, limited retention.
  • Help you answer data subject requests and meet your obligations under articles 32 to 36.
  • Notify you of any personal data breach affecting your players without undue delay, and at the latest 48 hours after becoming aware of it.
  • Make available the information needed to demonstrate compliance and allow audits by you or an auditor you appoint, with reasonable notice, at your expense.

5. Retention

  • In-game positions: 30 days.
  • Online player counts: 90 days.
  • Transactions, deaths and sessions: 180 days in detail, then monthly totals.
  • Other player data: until you delete the player or the server, or close your account.

6. Sub-processors

You authorise the processor to use the following sub-processor, bound by the same data protection obligations: [To complete: hosting provider name (e.g. Hetzner Online GmbH or OVH SAS)], [To complete: hosting provider address] (hosting). We will inform you by email at least 30 days before adding or replacing a sub-processor that handles player data; you may object and close your account if you do not agree.

7. Transfers

Player data is not transferred outside the European Economic Area unless you are informed beforehand and an appropriate safeguard under chapter V of the GDPR is in place.

8. End of the processing

When you delete a server or close your account, the related player data is deleted within 30 days. You can ask for an export beforehand by writing to [To complete: privacy contact email address].

9. Notice for your players (template)

Adapt this text and publish it where your players will see it before playing:

This server uses FiveM Analytics to produce statistics for its staff. While you play, we record your game and platform identifiers (Steam, Discord, Rockstar licence), your character name, play sessions, job, in-game money, inventory, deaths, vehicles and in-game positions. We use this data to run and moderate the server, on the basis of our legitimate interest. Positions are kept 30 days; session, transaction and death details 180 days; your profile until you ask for deletion. You can ask us to access or delete your data by contacting [server contact]. You can also complain to your data protection authority.