Data processing agreement
This agreement is made between you (the club, coach or organization using TactiCourt, "the Controller") and TactiCourt, tax ID (NIF/CIF) [TO COMPLETE: tax ID], with address at [TO COMPLETE: address] ("the Processor"), and is accepted when you open the account. It applies for as long as you use the Service.
1. Subject matter, nature and purpose
The Processor will process personal data on behalf of the Controller solely to provide the Service described in the Terms: hosting, storing, syncing, backing up, displaying and processing the information the Controller enters, and providing support. The processing consists of collecting, recording, organizing, storing, consulting, communicating and deleting that data.
2. Duration
The duration of the Service. When it ends, section 9 applies.
3. Types of data and data subjects
- Data subjects: players (including minors), coaching staff members, opponents and their players (scouting data) and contact persons.
- Data: identification and contact details (first and last name, nickname, jersey number, national ID/passport, date of birth, phone, email, address), athletic data (position, stats, attendance, reports, videos), physical data (height, weight, size) and image; and, if the Controller records them, health data (injuries, allergies, medication, supplements, effort and discomfort questionnaires), which are a special category (Art. 9 GDPR).
4. Obligations of the Processor
- Process the data only on the Controller's documented instructions (normal use of the Service counts as such) and not use it for its own purposes. If it believes an instruction infringes the regulations, it will tell the Controller.
- Ensure that authorized persons have committed to confidentiality.
- Apply the security measures required by Art. 32 GDPR (see section 7).
- Assist the Controller, with reasonable technical and organizational measures, in responding to individuals' rights (access, rectification, erasure, objection, restriction and portability). If it receives a request directly, it will forward it without delay.
- Help the Controller with its obligations on security, breach notification, impact assessments and prior consultations, as far as its role requires.
- Notify the Controller, without undue delay and as soon as it becomes aware, of any security breach affecting its data, with the information available so that the Controller can meet its deadlines.
- Make available the information needed to demonstrate compliance and allow reasonable audits, with prior notice and without compromising the security of other customers.
- Keep a record of the processing activities it carries out on behalf of the Controller (Art. 30.2).
5. Obligations of the Controller
The Controller warrants that it has a legal basis to process the data, that it has informed the individuals concerned, that it holds explicit consent for health data and the authorization of parents or legal guardians for individuals under 14, and that it decides which people can access its data and with what permissions.
6. Sub-processors
The Controller grants a general authorization to engage sub-processors, which are listed in the Privacy Policy (currently: Supabase, Netlify, GitHub, Cloudflare, Resend, Sentry, Google and, once billing is activated, Lemon Squeezy). The Processor will impose the same data protection obligations on them and will give notice of any change far enough in advance for the Controller to object; if it objects and there is no alternative, it may cancel its subscription.
7. Security measures
- Data hosted in the European Union and encrypted communications.
- Access control by team, role and module, enforced on the server; a single session per account; passwords stored only as encrypted hashes.
- Automatic backups and a trash bin, with restore by module.
- Access logging and data-loss alerts; separation of data between customers; control of the code and its dependencies.
8. International transfers
Team data is hosted in the European Union. If a sub-processor handles it from outside the EU, this will be under an adequacy decision or the standard contractual clauses, with the safeguards that apply.
9. End of the Service: return and deletion
Upon termination, the Controller may retrieve its data for a reasonable period, after which the Processor will delete it (including backups, according to their retention cycle: 7 or 30 days, depending on the plan), unless the law requires it to be kept.
10. Liability and governing law
Each party is liable in accordance with the GDPR. This contract is governed by Spanish law.