Data processing terms for clubs

1. The processing

• Purpose: providing Sport Tracking – storing and showing athletes' results, tests, training and goals for the club.
• Data subjects: the club's athletes (often children), their guardians, staff and coaches, result reporters.
• Personal data: name, birth date/year, club, sport, results, tests, training, goals, comments, photo (optional), sign-in e-mail. Health data (pain yes/no, body weight) only with explicit consent collected in the service.
• Duration: as long as the club uses the service, then deletion under section 7.

2. Instructions

The processor processes the data only on the club's documented instructions: these terms, the service's functions and the settings the club makes. If the processor believes an instruction infringes the GDPR, it tells the club immediately.

3. Confidentiality and security (Art. 32)

• Only authorised personnel (today the platform administrator) have access, under confidentiality. Support access “as a user” is logged.
• HTTPS for all traffic, per-row access rules in the database (row-level security), private file storage for photos, hashed passwords.
• Data is stored in the EU (Supabase, Ireland; server functions at Vercel Dublin).

4. Sub-processors

The club approves these sub-processors:

• Supabase Inc. – database, sign-in, file storage (EU, Ireland).
• Vercel Inc. – hosting (server functions in Dublin; US company, EU–US Data Privacy Framework/standard contractual clauses).
• Resend Inc. – e-mail, once enabled (standard contractual clauses).
• Google – only if a user chooses Google sign-in.

The processor notifies the club at least 30 days before engaging a new sub-processor, by e-mail to the club's owner or in the service. The club may object and is then entitled to stop using the service. Sub-processors are bound by equivalent obligations.

5. Assisting the club

• Data subject rights: the service has export, correction and deletion. The processor otherwise helps the club answer requests and forwards requests it receives directly.
• The processor assists with impact assessments and prior consultation where needed.

6. Personal data breaches

The processor notifies the club without undue delay, and at the latest within 48 hours of becoming aware of a breach affecting the club's data, with the information the club needs to notify the supervisory authority within 72 hours.

7. When the terms end

The club can export its data at any time. When the club stops using the service (deletes the club or its athletes) the data is deleted from the database immediately and photos within a day. There are no backups today; if added, the data disappears from them within 7 days.

8. Audits

The processor gives the club the information needed to demonstrate compliance with Art. 28, including this page, the record of processing activities and the security measures, and contributes to reasonable audits after notice.

9. The club's responsibilities

• The club is responsible for having the right to add its athletes (e.g. membership) and for informing athletes and guardians. The confirmation made when an athlete is added is stored.
• The club gives access only to the staff who need it.