# Sub-processors & Data Processing Agreement (DPA) | F76.WORLD

In compliance with GDPR Article 28 and international data protection standards, F76.WORLD discloses all third-party sub-processors engaged to support our infrastructure and services.

## Current Sub-processors

| Entity | Purpose | Processing Location | Transfer Safeguards |
|---|---|---|---|
| **Cloudflare, Inc.** | Content Delivery Network (CDN), DDoS Mitigation, DNS Routing, Turnstile Bot Protection | Global / United States | Standard Contractual Clauses (SCCs), EU-US Data Privacy Framework |
| **Hetzner Online GmbH** | Bare-metal server hosting, network uplink | Falkenstein / Nuremberg, Germany (EU) | Direct GDPR Article 28 Data Processing Agreement |

## Data Minimization & Security Invariants
- F76.WORLD does not collect or store personal identifying data (such as emails or passwords).
- All BA2 archive processing, texture decompression, and NIF mesh auditing occurs entirely client-side in the user's browser.
- No third-party tracking or behavioral marketing scripts are loaded.

For questions or DPA inquiries, contact: `ops@f76.world`.