Data processing agreement

Parties

Controller (hereinafter the “club”):
[Club name]
[address]
represented by [name, role]
Email: [club contact email]

and

Processor (hereinafter the “operator”):
2builders studio (owner: Mila Otto-Bickl)
Rue d’Oultremont 45, 1040 Etterbeek, Belgium
Company number: BE 1039.008.273
Email: squadform@2builders-studio.eu

The club uses the “SquadForm” platform for the individual development of its youth players. In doing so, the operator processes personal data on behalf of and on the instructions of the club. This agreement sets out in detail the parties' data protection obligations under Art. 28 GDPR and is an annex to the underlying licence agreement.

§ 1 Subject matter and duration

(1) The subject matter is the processing of personal data by the operator in the context of providing and running the SquadForm platform (training planning, squad and schedule management, development documentation).

(2) The duration corresponds to the term of the licence agreement. This agreement ends when the licence agreement ends; the provisions on deletion/return (§ 8) remain unaffected.

§ 2 Nature, purpose and scope · data subjects and data categories

Purpose: the individual sporting development of young people — weighted development focuses and weekly training plans are derived from coach observations; in addition, team organisation (events, squad, goals).

Nature of the processing: collecting, storing, organising, evaluating (including AI-assisted text analysis, see § 6), making available, deleting — automated within the application.

Categories of data subjects: underage players of the club, coaches and club officials.

Categories of personal data:

• master data (name, year of birth, position, stronger foot, height optional, equipment) as well as account/login data (name, email, password exclusively as a hash);
• performance and development data (benchmarks and their progression, completed exercises, self-assessments, coach notes, derived focuses, ratings, reflections, wishes);
• organisational data (team events, squad assignment, season goals);
• proof of parental consent (time and method).

Special protection of minors: no weight or body fat data and no goals relating to them are processed. Nutrition guidance is purely performance-oriented. Without demonstrable parental consent, no function can be used by the player.

§ 3 The club's right to issue instructions

(1) The operator processes the data exclusively on documented instructions from the club; this agreement and the use of the platform count as such instructions. Further or deviating instructions must be issued in text form (e.g. email).

(2) If the operator is of the opinion that an instruction infringes applicable data protection law, it informs the club without delay and may suspend the instruction concerned until it is confirmed.

§ 4 Obligations of the operator

• processing only within the documented framework of this agreement and the instructions;
• obligating all persons authorised to process the data to maintain confidentiality;
• implementing and maintaining the technical and organisational measures pursuant to Art. 32 GDPR (Annex 1);
• supporting the club in responding to data subject rights (§ 5) and with data protection impact assessments and notifications (Art. 32–36 GDPR), as far as this is possible for the operator;
• notifying the club of personal data breaches without delay (§ 7);
• using sub-processors only in accordance with § 6;
• demonstrating compliance with these obligations and enabling audits (§ 9);
• deleting or returning the data after termination (§ 8).

§ 5 Data subject rights

The operator supports the club with appropriate measures in complying with requests for access, rectification, erasure, restriction, data portability and objection. The application provides functions for data access/export and for deleting a profile. If data subjects contact the operator directly, it forwards the matter to the club without delay.

§ 6 Sub-processors

(1) The club approves the use of the sub-processors named in Annex 2. The operator contractually obliges them to an equivalent level of data protection (Art. 28(4) GDPR).

(2) The operator gives advance notice in text form of any change or addition of a sub-processor. The club may object within 14 days on important data protection grounds.

(3) If processing takes place in a third country, the operator ensures appropriate safeguards pursuant to Chapter V GDPR (in particular EU standard contractual clauses).

§ 7 Notification of personal data breaches

The operator notifies the club of personal data breaches without delay, at the latest within 48 hours of becoming aware of them, with the information available pursuant to Art. 33(3) GDPR, and provides support with any notifications to the supervisory authority or communications to the data subjects concerned.

§ 8 Deletion and return

After the processing has ended, the operator will, at the club's choice, delete all processed data or return it in a common format, unless a statutory retention obligation prevents this. When a player leaves or on request, the profile and linked data are deleted directly in the application.

§ 9 Audit rights

The club may satisfy itself that this agreement is being complied with. For this purpose the operator provides the necessary information (including this description of the technical and organisational measures); on-site or remote audits are possible with reasonable advance notice and without disrupting operations.

§ 10 Miscellaneous

The law at the club's registered office applies, or the choice of law made in the licence agreement. Should individual provisions be invalid, the remainder of the agreement remains valid. Amendments must be made in text form. In the event of contradictions between the licence agreement and this DPA, the provisions of this DPA prevail in data protection matters.

Annex 2 — Approved sub-processors

Only the text content required for the respective derivation (notes, wishes, reflections, profile data) is transmitted to the AI.