DATA PROCESSING AGREEMENT (DPA)

This Data Processing Agreement ("DPA") forms part of and is incorporated into the Club Supporter Platform Terms and Conditions.

This DPA applies where My Club Supporter Ltd processes Personal Data on behalf of a Club.

1. PARTIES

Processor

My Club Supporter Ltd
Company Number: 15736366

Registered Office:

15 Front Street
Sherburn Hill
Durham
DH6 1PA

Email: support@clubsupporter.co.uk

Controller

The Club using the Club Supporter Platform.

2. DEFINITIONS

The terms Controller, Processor, Personal Data, Processing, Data Subject and Personal Data Breach shall have the meanings given in the UK General Data Protection Regulation ("UK GDPR").

3. SUBJECT MATTER

Processing undertaken through the Club Supporter Platform including:

• membership management;

• supporter management;

• volunteer management;

• recurring subscriptions;

• communications;

• fundraising;

• event management;

• online shop functionality;

• reporting and analytics.

4. DURATION

This DPA remains in force for the duration of the Club's use of the Platform and any applicable retention period required by law.

5. NATURE AND PURPOSE OF PROCESSING

Processing may include:

• collection;

• storage;

• organisation;

• retrieval;

• transmission;

• reporting;

• analysis;

• deletion.

The purpose of processing is to provide and improve the Platform and associated services.

6. CATEGORIES OF DATA SUBJECTS

Including but not limited to:

• club officials;

• administrators;

• members;

• players;

• coaches;

• volunteers;

• supporters;

• donors;

• event attendees;

• parents or guardians.

7. CATEGORIES OF PERSONAL DATA

Including but not limited to:

• names;

• addresses;

• email addresses;

• telephone numbers;

• membership details;

• subscription information;

• attendance records;

• communication preferences;

• donation history;

• transaction references

8. PROCESSOR OBLIGATIONS

My Club Supporter Ltd shall:

• process Personal Data only on documented instructions from the Club except where otherwise required by law;

• maintain appropriate technical and organisational security measures;

• ensure personnel are subject to confidentiality obligations;

• assist the Club where reasonably required to fulfil data subject rights requests;

• notify the Club of Personal Data Breaches where legally required.

9. SECURITY MEASURES

My Club Supporter Ltd maintains security measures appropriate to the risks presented by the processing activities including where appropriate:

• encrypted communications using TLS;

• secure authentication mechanisms;

• role-based access controls;

• audit logging;

• monitoring and alerting systems;

• vulnerability management;

• software patching;

• backup procedures;

• disaster recovery processes;

• supplier due diligence.

10. SUBPROCESSORS

The Club authorises My Club Supporter Ltd to appoint subprocessors.

Current subprocessors include:

My Club Supporter Ltd may add, replace or remove subprocessors from time to time.

11. INTERNATIONAL TRANSFERS

Where Personal Data is transferred outside the United Kingdom, My Club Supporter Ltd shall implement appropriate safeguards in accordance with applicable law.

12. AUDITS

The Club may request reasonable information demonstrating compliance with this DPA.

My Club Supporter Ltd may satisfy such requests through provision of policies, certifications, audit reports or equivalent documentation.

13. RETURN OR DELETION OF DATA

Upon termination of services, Personal Data may be retained where reasonably necessary for:

• legal obligations;

• accounting obligations;

• fraud prevention;

• dispute resolution;

• security purposes;

• legitimate business interests.

Data no longer required shall be deleted in accordance with My Club Supporter Ltd's retention policies.

14. LIABILITY

Liability under this DPA shall be governed by the liability provisions contained within the Club Supporter Platform Terms and Conditions.

15. GOVERNING LAW

This DPA shall be governed by the laws of England and Wales.