Data Processing Agreement

"Personal Data," "Processing," "Data Subject," "Controller," "Processor," and "Supervisory Authority" have the meanings given in the EU General Data Protection Regulation (GDPR).

"Services" means the club management platform and related services provided by Waresport under the applicable subscription agreement.

"Sub-processor" means any third party engaged by Waresport to process Personal Data on behalf of the Controller.

Waresport processes Personal Data on behalf of the Controller solely to provide the Services. The subject matter, duration, nature, purpose, types of Personal Data and categories of Data Subjects are described in Annex 1 to this DPA.

Waresport will:

• process Personal Data only on documented instructions from the Controller, unless required by applicable law;
• ensure that persons authorized to process Personal Data have committed to confidentiality;
• implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk;
• assist the Controller in responding to requests from Data Subjects exercising their rights under GDPR;
• assist the Controller in ensuring compliance with data security, breach notification, data protection impact assessment and prior consultation obligations;
• at the Controller's choice, delete or return all Personal Data after the end of the provision of Services; and
• make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for audits.

The Controller grants Waresport general authorization to engage Sub-processors. Waresport will maintain a current list of Sub-processors at waresport.com/sub-processors and will notify the Controller at least 30 days before adding or replacing a Sub-processor. If the Controller objects, the parties will work in good faith to resolve the concern. Waresport will impose equivalent data protection obligations on each Sub-processor.

Waresport is based in the United States. Where Personal Data is transferred from the EEA, UK, or Switzerland to the United States, the parties rely on the EU Standard Contractual Clauses (Module Two: Controller to Processor) as the transfer mechanism. The Standard Contractual Clauses are incorporated into this DPA by reference and are available upon request.

Waresport will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach. The notification will include the nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and measures taken or proposed.

Waresport will provide reasonable assistance to the Controller in conducting data protection impact assessments and prior consultations with Supervisory Authorities, to the extent required under Articles 35 and 36 of GDPR.

Waresport will make available information necessary to demonstrate compliance with this DPA. The Controller may conduct or commission an audit, with reasonable advance notice and during business hours, no more than once per year unless required by a Supervisory Authority.

This DPA will remain in effect for as long as Waresport processes Personal Data on behalf of the Controller. Obligations relating to confidentiality and data deletion survive termination.

• Subject matter: Provision of club management software services including registration, scheduling, communication, payments, roster management, tryouts, and related tools.
• Duration: The term of the Controller's subscription agreement with Waresport, plus the data retention period described in Waresport's Data Retention Policy.
• Nature and purpose: Processing of Personal Data to provide the club management services, including storing, retrieving, transmitting, organizing and deleting data as needed to deliver the platform features.
• Types of Personal Data: Names, email addresses, phone numbers, dates of birth, guardian and emergency contact information, team assignments, attendance records, registration responses, communications, payment metadata (amounts, status, last four card digits), uploaded content.
• Categories of Data Subjects: Club administrators, coaches, staff, parents, guardians and athletes (including minors).