Data processing addendum

For organisations that run the game for their people

Last updated October 9, 2026

Most people play Alibi Town for themselves, and this page does not apply to them: the Privacy page does. This addendum is for an organisation (a school, a club, a company) that runs the game for its own pupils, members or staff and needs a written agreement about their data. It takes effect when you write to support@alibitown.com to say you accept it and we confirm.

1. What this is

"You" are the organisation. "We" are Media Yard LLC. This addendum is part of the Terms between us and covers the personal data of your people that we handle so they can play ("your data"). For your data, you decide why and how it is used and we act only on your behalf (you are the controller, we are the processor). Where we count visits or prevent abuse for our own purposes, as the Privacy page describes, we are responsible for that ourselves.

2. What is processed

• Whose data: the people you seat at a table.
• What: first names and place names they type, the alibis they write, their votes; a key and the town saved with it, if you buy one; a town page, if they publish one; an email address, if one is typed to receive a key.
• Why: to run the game for them. Nothing else.
• How long: as the UK and EU page sets out, and no longer than this addendum lasts.
• Sensitive data: the game does not ask for any and you must not put any in.

3. What we promise

• Instructions. We handle your data only to provide the game as these pages describe, and on your written instructions. If we think an instruction breaks the law, we will tell you.
• Confidentiality. Anyone working for us who can reach your data is bound to keep it confidential.
• Security. We keep appropriate technical and organisational measures: encryption in transit; storage kept under keys and codes rather than identities; email addresses kept only as a one-way fingerprint; daily limits against abuse; access to our systems limited to the people who run them; and no advertising or third-party scripts beyond the visit counter named on the Privacy page.
• Sub-processors. You agree to our using the companies on the Sub-processors page. We hold each to data protection terms at least as protective as these, and remain responsible for what they do with your data. We will tell you at least 14 days before adding or replacing one; if you object on reasonable grounds and we cannot resolve it, you may end your use, and our usual refund terms apply.
• Helping you. We will help you, as far as we reasonably can, to answer requests from your people about their data, and with your own duties on security, impact assessments and consulting a regulator.
• Breaches. If we learn of a breach of your data we will tell you without undue delay, with what we know about what happened and what we are doing about it.
• Deleting. When you ask, or when your use ends, we will delete your data, unless the law requires us to keep it.
• Showing our work. We will give you the information reasonably needed to show we keep these promises, and allow an audit, by you or someone you appoint, at most once a year, on reasonable notice, at your cost, and without exposing anyone else's data.

4. What you promise

• You have a lawful reason to let your people play, and have told them what they need to be told.
• Where your people are children, you have whatever permission your law requires, and an adult seats the table.
• You will not put sensitive data, or anyone's private details, into the game.

5. Data leaving the UK and the EU

We are in the United States. If you are in the UK or the EEA and the law requires a safeguard for sending your data to us, the standard contractual clauses approved by the European Commission (controller to processor), and for the UK the Information Commissioner's addendum to them, apply between us and are part of this addendum, with you as the exporter, us as the importer, and the details in sections 2 and 3 above as their annexes. If those clauses and this page ever conflict, the clauses decide.

6. The rest

This addendum lasts as long as we handle your data. Liability under it is subject to the limits in the Terms, except where the law does not allow that. If this addendum and the Terms conflict about personal data, this addendum decides.

To accept it, or to ask for a countersigned copy, write to support@alibitown.com with your organisation's name, address and a contact.