Data Processing Agreement
Last updated: Sunday, May 10
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the academy or organization ("Controller") and SportSYNC ("Processor") regarding the Processor's processing of Personal Data on behalf of the Controller as part of the Service. This DPA reflects the parties' agreement with respect to the terms governing such processing of Personal Data, in accordance with GDPR Article 28.
1. Definitions
"Personal Data", "Process", "Controller", "Processor", "Data Subject", "Sub-processor", and "Supervisory Authority" have the meanings given in Article 4 of the GDPR. "Customer Data" means any data the Controller submits to the Service, including Personal Data.
2. Subject matter and duration
Subject matter: the Processor's processing of Customer Data to provide the Service. Duration: for the term of the Controller's subscription plus any retention period defined in the Privacy Policy. Nature and purpose: hosting, processing, and presenting Customer Data so the Controller can operate its sports academy. Types of data: identification data, contact data, child profile data, medical data, performance evaluations, attendance, financial transactions. Categories of data subjects: Controller's users (admins, coaches, parents) and the children registered with the Controller's academy.
3. Processor obligations
The Processor agrees to: (a) process Personal Data only on the documented instructions of the Controller, including with regard to international transfers, (b) ensure persons authorized to process Personal Data have committed themselves to confidentiality, (c) implement appropriate technical and organizational security measures (Article 32 GDPR), (d) assist the Controller in responding to data subject rights requests, (e) assist the Controller with notifications, impact assessments, and prior consultations as required, (f) at the Controller's choice delete or return all Personal Data after the end of services, (g) make available all information necessary to demonstrate compliance with Article 28.
4. Sub-processors
The Controller authorizes the Processor to engage the following sub-processors: Vercel (hosting), Neon (database), Cloudflare (storage and CDN), Sentry (error monitoring), Upstash (rate limiting). The Processor will inform the Controller of any intended changes to sub-processors at least 30 days in advance and the Controller may object on reasonable grounds. Each sub-processor is bound by contractual obligations no less stringent than this DPA.
5. International transfers
Where Personal Data is transferred outside the EEA / UK to a country without an adequacy decision, the parties rely on the Standard Contractual Clauses (SCCs) and any supplementary safeguards required by applicable law. The SCCs are deemed incorporated by reference.
6. Personal data breaches
The Processor will notify the Controller without undue delay (and in any event within 48 hours) after becoming aware of a Personal Data breach affecting Customer Data, including the nature of the breach, categories and approximate number of data subjects, likely consequences, and measures taken or proposed.
7. Audit rights
Once per calendar year and on at least 30 days' notice, the Controller (or an independent third-party auditor under NDA) may audit the Processor's compliance with this DPA, subject to the Processor's reasonable confidentiality and security requirements. Routine audits are satisfied by the Processor providing relevant SOC 2 / ISO 27001 reports if available.
8. Deletion or return of data
Within 30 days of termination of the Service, the Processor will, at the Controller's election, delete or return all Personal Data, except where retention is required by law.
9. Liability
Each party's liability under this DPA is governed by the limitations set out in the Terms of Service. [REVIEW: confirm carve-outs for data-protection breaches with counsel.]
10. Execution
By accepting the Terms of Service or otherwise using the Service, the Controller is deemed to have entered into this DPA. A signed copy is available on request: email hello@sportsync.app with the academy name and the requesting signatory.