ClubChamps Data Processing Terms

1. Scope

1.1 These Data Processing Terms ("DPT") form part of the ClubChamps Terms of Service (the "Terms") and apply whenever an Organiser uses the Service to process Participant Data. They are between the Organiser ("you", the controller) and Adam Playle, trading as ClubChamps ("ClubChamps", "we", "us", the processor).

1.2 They apply only to Participant Data, meaning personal data about Players or other individuals that you enter into, or collect through, the Service for your Events. They do not apply to personal data that ClubChamps processes as a controller, such as Account details and data about Players who register themselves, which is covered by our Privacy Policy.

1.3 Capitalised terms not defined here have the meanings given in the Terms. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and any other data protection law that applies to the processing. "Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in Data Protection Law. If the DPT conflicts with the Terms on data protection, the DPT prevails.

2. Details of the processing

• Subject matter: providing the Service to run your Events.
• Duration: for as long as you use the Service, and until the Participant Data is deleted under clause 9.
• Nature and purpose: storing, organising, displaying and publishing entries, draws, schedules, scores and results so that you can run your Events, and providing related support.
• Types of personal data: names; and, only where you add them, email addresses, phone numbers, club or team, and scores, results and match information.
• Categories of data subjects: Players and other individuals you add to an Event, which may include children under 18.
• Special category data: none. You must not add health, ethnicity or other special category data, or criminal offence data, to the Service.

3. Your responsibilities

3.1 You are responsible for complying with Data Protection Law as controller. In particular, you must: have a lawful basis for adding each person to an Event; give them appropriate privacy information, including that their first name and last-name initial will appear on public Event pages; obtain the permission of a parent or guardian for anyone under 18; and add only the information the Event needs.

3.2 Your instructions to us are set out in the Terms, this DPT and your use of the Service's features. You may give further reasonable instructions in writing. They must comply with Data Protection Law.

4. Our obligations

4.1 Instructions. We will process Participant Data only on your documented instructions, including in relation to international transfers, unless the law requires us to do otherwise. In that case we will tell you before processing, unless the law prohibits this. We will tell you promptly if we think an instruction breaches Data Protection Law.

4.2 Confidentiality. We will ensure that anyone authorised to process Participant Data is bound by confidentiality.

4.3 Security. We will take appropriate technical and organisational measures to protect Participant Data, as described in the Annex, taking into account the nature of the processing and the risks to individuals.

4.4 No other use. We will not use Participant Data for our own purposes, will not use it for marketing, and will not email or message the people you add unless you instruct us to through the Service.

5. Sub-processors

5.1 You give us general authorisation to use the sub-processors listed in Part B of the Annex. We will tell you at least 14 days before adding or replacing a sub-processor, by email or in the Service. If you object on reasonable data protection grounds, we will discuss your concerns with you. If we cannot resolve them, you may stop using the Service and close your Account.

5.2 We will put a written contract in place with each sub-processor containing data protection obligations that offer an equivalent level of protection to this DPT. We remain responsible to you for our sub-processors' performance of those obligations.

6. International transfers

We will not transfer Participant Data outside the UK unless the transfer complies with Data Protection Law, for example because the destination is covered by UK adequacy regulations or because appropriate safeguards (such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses) are in place. Participant Data is stored and processed in the UK and EU. The transfers to the USA described in Part B of the Annex rely on the UK Extension to the EU-US Data Privacy Framework or on the UK International Data Transfer Agreement or UK Addendum, as set out in each provider's data processing terms.

7. Assistance

7.1 Requests from individuals. The Service lets you edit and delete entries. If a person contacts us directly about Participant Data, we will pass the request to you promptly and will not respond ourselves except on your instructions. We will give you reasonable help to respond within the time required by law.

7.2 Other assistance. Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your obligations on security, personal data breaches, data protection impact assessments and consultation with the Information Commissioner's Office.

8. Personal data breaches

We will tell you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Participant Data. We will give you the information reasonably available to us to help you assess the breach and meet any obligation to report it, and we will take reasonable steps to contain it.

9. Deletion and return

When you delete an Event, or your Account is closed, or you send us a verified deletion request, we will delete the related Participant Data from our live systems within 30 days, unless the law requires us to keep it. We do not keep restorable back-ups. Any residual copies held in our hosting provider's internal snapshots, which we cannot access, are overwritten within a further 7 days. You can delete individual entries in the Service, and you can ask us to exclude a Player or entry from public Event pages at any time.

10. Information and audits

We will make available to you the information reasonably necessary to show that we comply with this DPT, and will allow for and contribute to audits, including inspections, by you or an auditor you appoint. Audits must be on reasonable written notice, no more than once a year unless required by a regulator or following a personal data breach, and subject to appropriate confidentiality. We may meet audit requests first by providing written answers and relevant documents.

11. Liability and general

11.1 Each party's liability under this DPT is subject to the limits and exclusions in the Terms, to the extent permitted by Data Protection Law.

11.2 This DPT continues for as long as we process Participant Data. We may update it under the process for changes in the Terms. It is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex – Part A: Security measures

Each measure below is in place at the date of these DPT.

• Encryption in transit: all traffic over HTTPS (TLS), with HSTS enforced for one year, including subdomains, and on the browser preload list.
• Encryption at rest: database, storage and back-ups encrypted at rest by Supabase (AES-256).
• Authentication: passwordless sign-in using a one-time code sent by email, or Google sign-in. No passwords are stored. Multi-factor authentication is not offered.
• Access control: row-level security on every table in the production database, so each user can read and change only the records the access rules allow. Public Event pages read through restricted read-only views that expose only fields shown publicly.
• Privileged access: the database service key is held only on the server and never sent to browsers. Administrative actions check the user's role on the server.
• Abuse protection: rate limits on login and other sensitive endpoints.
• Application security: Content Security Policy; framing blocked; MIME sniffing blocked; strict referrer policy; external input validated and user-written content sanitised before display.
• Data minimisation in analytics: PostHog and Google Analytics load only after cookie consent. PostHog session recordings mask all text and inputs. Sentry replays mask all text and block all media.
• Environment separation: the sales demonstration environment uses a separate database and hosting project, payment test keys only, and sends no analytics.
• Monitoring: application errors are reported to Sentry, and Supabase's security advisor is reviewed.
• Public data controls: public pages show only a Player's first name and last-name initial, and a Player or entry can be excluded from public pages on request.
• Payment data: card details are entered directly with Stripe and never reach ClubChamps' servers.

Annex – Part B: Sub-processors

• Supabase Inc. – database, authentication and file storage – all account, Player, Event, entry and result data, and uploaded logos and images – London, UK (AWS eu-west-2).
• Vercel Inc. – application hosting and server functions – all data in transit through the app, and request logs including IP address – global edge network, with server functions in London, UK.
• Vercel Inc. (Web Analytics) – cookieless page-view statistics – page URL, referrer, country and device type (no cookies or persistent identifier) – USA.
• Resend Inc. – transactional email, including login codes and notifications – name, email address and email content – EU.
• PostHog Inc. – product analytics and session recording, only after cookie consent – user ID, email, usage events, masked session recordings and IP address – EU (Frankfurt).
• Google LLC (Google Analytics 4) – marketing-site analytics, only after cookie consent – pseudonymous identifiers, usage events and IP address – USA.
• Functional Software Inc. (Sentry) – error monitoring, performance tracing and session replay (10% of sessions and all sessions with an error; text masked and media blocked) – IP address, browser, user and request details on errors – EU (Frankfurt).
• Stripe Payments Europe Ltd / Stripe Inc. – subscription billing and Event entry payments (Stripe Connect) – name, email, payment details and transaction records – Ireland/EU and USA. Listed for transparency: Stripe acts as an independent controller for card and payment data.
• Anthropic PBC (Claude) – AI tool used to build internal analytics dashboards from ClubChamps' database and product analytics data, with model training turned off – account, Player, Event, entry and result data and usage events, limited to what the dashboards need – USA.

Google sign-in is offered as a login option. Google acts as an identity provider for the user and is not a sub-processor.