Data processing agreement

• Subject matter: providing the Club10 service.
• Duration: the term of the agreement, plus the deletion period below.
• Data subjects: the customer's members, players, guests, coaches, staff and contacts.
• Data: names, contact details, bookings, attendance, payments and balances, memberships, lessons, staff shifts and hours, messages, and anything else the customer enters.
• Special categories: none expected. The customer should not enter health or other sensitive data unless needed and lawful.

• Process personal data only on the customer's documented instructions, which are the agreement and the customer's use of the service.
• Ensure people with access are bound by confidentiality.
• Keep appropriate technical and organisational security measures (section 5).
• Help the customer respond to data subjects' requests and with impact assessments, as reasonably needed.
• Tell the customer without undue delay, and within 72 hours where possible, after becoming aware of a personal data breach.
• Delete or return personal data when the agreement ends (section 7).
• Make available information needed to show compliance with this DPA.

The customer authorises the subprocessors on our Subprocessors page. We'll give at least 30 days' notice of a new subprocessor; the customer may object on reasonable data protection grounds, and if we can't resolve the objection the customer may end the affected service. We remain responsible for our subprocessors and bind them to obligations like these.

Data may be processed in the United States and other countries where our subprocessors operate. Where the law requires, transfers rely on the EU Standard Contractual Clauses (and the UK addendum) or another lawful mechanism, which are incorporated by reference.

• Encryption in transit (TLS) and at rest.
• Row-level access rules separating each customer's data, and role-based permissions for staff.
• Card data handled by Stripe (PCI DSS Level 1); Club10 never stores card numbers.
• Secrets kept server-side; least-privilege access for our own staff.
• Backups, logging and monitoring by our hosting providers.

On written request, no more than once a year, we'll answer reasonable security questionnaires and provide our subprocessors' available audit reports.

The customer can export its data while the account is open. Within [90] days after the account closes we delete customer personal data, unless the law requires us to keep it.