Academy Data Processing Addendum

1. Details of processing

• Subject matter and duration: processing needed to provide the Service to the Academy, for as long as the Academy uses it, plus the deletion and retention periods in the Privacy Policy.
• Nature and purpose: hosting, storing, transmitting, displaying to authorised users, backing up and deleting the Academy’s records: member rosters and enrollment answers, attendance and scheduling, fees and payment records and reminders, training records maintained by the Academy’s coaches, announcements, events and academy content, coach notes, and enquiry records.
• Categories of data subjects: the Academy’s students, including students under 18 whose information is provided by a Guardian or by the Academy rather than by the student; their parents and guardians; the Academy’s staff; and people who enquire with the Academy. Students under 18 do not themselves hold ClubStreak accounts.
• Categories of personal data: identity and contact data; date of birth and gender; enrollment answers; attendance records; fee and payment records; training records; and content and communications.
• No health data. The Service provides no field for health information and refuses enrollment and event questions that ask for it. The Academy must not use the Service to collect medical or allergy details, including through free-text fields, and keeps any such records outside the Service.

2. Academy (controller) obligations

The Academy warrants and undertakes that it:

• (a) has a lawful basis for all personal data it collects through the Service, gives all required notices, and obtains all required consents, including verifiable parental or guardian consent for students under 18;
• (b) collects only what it needs, keeps it accurate, and configures enrollment questions and access permissions accordingly;
• (c) responds to data subject requests directed to it, and tells ClubStreak where it needs help;
• (d) uses the export, correction and deletion tools in the Service to give effect to those rights; and
• (e) will not instruct ClubStreak to process personal data in a way that breaks applicable law.

3. ClubStreak (processor) obligations

ClubStreak will:

• (a) process the Academy’s data only on the Academy’s documented instructions, as given through its configuration and use of the Service and through this DPA, unless the law requires otherwise, in which case we tell the Academy unless the law forbids it;
• (b) ensure people authorised to process the data are bound by confidentiality;
• (c) implement appropriate technical and organisational measures, including encryption in transit and at rest, an additional layer of encryption for designated sensitive fields, role-based access control with audit logging, hashed one-time codes, and environment isolation;
• (d) assist the Academy, taking account of the nature of processing, in responding to data subject requests and in meeting its own duties on security, breach notification and data protection impact assessments;
• (e) notify the Academy without undue delay after becoming aware of a personal data breach affecting the Academy’s data, with the information it reasonably needs for its own notifications;
• (f) at the end of the services, delete or return the Academy’s data in line with the export and deletion process in the Terms and Privacy Policy, deleting existing copies unless the law requires us to keep them;
• (g) make available the information reasonably necessary to show compliance with this DPA and, no more than once a year and on reasonable notice, allow for and contribute to an audit by the Academy or an auditor it appoints, at the Academy’s cost; and
• (h) not sell the data, retain, use or disclose it other than to provide the Service, including never using it to target advertising of our own, or combine it with data from other sources except as the CCPA permits a service provider to. ClubStreak certifies that it understands and will comply with these restrictions.

4. Sub-processors

The Academy gives general authorisation for the sub-processors below. We give 30 days’ notice of any addition or replacement, through the Service or the Academy’s registered contact details, during which the Academy may object on reasonable data protection grounds. If an objection cannot be resolved, the Academy may terminate the affected part of the Service. We impose data protection obligations on sub-processors no less protective than this DPA, and we remain responsible for their performance.

5. International transfers

ClubStreak will not transfer the Academy’s data relating to EEA or UK data subjects outside the EEA or UK without appropriate safeguards, being an adequacy decision or Standard Contractual Clauses, which are incorporated by reference where required with ClubStreak as data importer. Transfers of data relating to Indian data principals comply with Section 16 of the DPDP Act.

6. Liability and precedence

Liability under this DPA is subject to the limits in the Terms of Service, except where data protection law does not allow such a limit. If this DPA conflicts with the Terms, this DPA wins on data protection matters. If mandatory local law requires different terms, for example the EU Standard Contractual Clauses, those terms win to the extent of the conflict.

7. Term

This DPA is in effect while ClubStreak processes personal data on the Academy’s behalf, and ends automatically when that processing ends.

Questions

Academies with questions about this addendum, or who need a countersigned copy for their own records, can write to legal@clubstreak.com.