This Data Processing Agreement ("DPA") is between the Club and SPLT Club [Ltd] ("Provider"). Clauses 1 to 14 (Part A) cover Club Records, which the Provider processes on the Club's behalf. Clause 15 (Part B) covers Athlete Profiles, which the Provider controls and shares with the Club at each Athlete's request. It forms part of the Club Subscription Agreement ("Agreement"). Capitalised terms not defined here have the meanings given in the Agreement.
Part A: Club Records
1. Definitions
"Data Protection Laws" means all laws applicable to the processing of Personal Data under the Agreement, including UK GDPR and the Data Protection Act 2018; EU GDPR (Regulation (EU) 2016/679) and national implementing laws; US state comprehensive privacy and consumer health data laws, including the California Consumer Privacy Act as amended ("CCPA") and the Washington My Health My Data Act; PIPEDA, Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), and equivalent provincial laws; and COPPA. "Personal Data" means personal data, personal information or equivalent terms under Data Protection Laws, contained in Club Data. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data. "Sub-processor" means any third party engaged by the Provider to process Personal Data. "Controller", "processor", "data subject" and "processing" have the meanings given in UK GDPR, and include equivalent terms such as "business" and "service provider" under US law.
2. Roles and scope
2.1 The Club is the controller and the Provider is the processor of Personal Data. The details of the processing are set out in Annex 1.
2.2 The Provider acts as an independent controller only for: (a) account, security and fraud-prevention data about Authorised Users and Athletes, to operate and secure the Platform; (b) billing and contract data about the Club; (c) aggregated, de-identified data under clause 10.3 of the Agreement; and (d) Athlete Profiles, as set out in clause 15. For these purposes, the Provider's own privacy notice applies.
3. Club obligations
3.1 The Club warrants that it has, and will maintain, a lawful basis and any required consents for the processing described in this DPA, including explicit consent for health data and verifiable parental consent where required.
3.2 The Club will provide data subjects with all required information about the processing, and is responsible for the lawfulness of its instructions.
4. Processing on instructions
4.1 The Provider will process Personal Data only on the Club's documented instructions, including with regard to international transfers, unless required to do otherwise by law. In that case, the Provider will inform the Club before processing unless the law prohibits it.
4.2 The Agreement, this DPA, the Club's configuration of the Platform and its written requests are the Club's complete documented instructions. Additional instructions outside the scope of the Agreement require prior written agreement, and may incur reasonable additional charges.
4.3 The Provider will promptly inform the Club if, in its opinion, an instruction infringes Data Protection Laws.
5. Personnel
The Provider will ensure that personnel authorised to process Personal Data: (a) are bound by appropriate confidentiality obligations; (b) receive regular data protection and security training; (c) have access only as necessary for their role; and (d) where they have production access to health data, have passed appropriate background checks, subject to local law.
6. Security
6.1 The Provider will implement and maintain appropriate technical and organisational measures to protect Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risks to individuals, including the special category nature of health data and the vulnerability of children. The current measures are described in Annex 2.
6.2 The Provider may update its measures, provided it does not materially reduce the overall level of protection.
7. Sub-processors
7.1 The Club gives general written authorisation for the Provider to engage the Sub-processors listed at spltclub.com/legal/sub-processors (Annex 3).
7.2 The Provider will give at least [30] days' notice before engaging a new Sub-processor, by updating the list and notifying subscribed Clubs by email.
7.3 The Club may object on reasonable data protection grounds within that notice period. The parties will discuss the objection in good faith. If it cannot be resolved, the Club may terminate the affected part of the services and receive a pro-rata refund of prepaid Fees.
7.4 The Provider will impose data protection obligations on each Sub-processor by written contract, providing at least the same level of protection as this DPA. The Provider remains fully liable to the Club for each Sub-processor's performance.
8. International transfers
8.1 Personal Data is hosted in the United States, with the Provider's hosting provider. The Provider will not transfer Personal Data to any other country except in accordance with this clause.
8.2 From the EEA. Transfers to the UK rely on the European Commission's adequacy decision for the UK [confirm it is current]. Onward transfers to Sub-processors in countries without adequacy rely on the EU-US Data Privacy Framework, where the recipient is certified, or on the EU Standard Contractual Clauses (Module 3, processor to processor) between the Provider and the Sub-processor.
8.3 From the UK. Transfers rely on UK adequacy regulations, including the UK-US Data Bridge where the recipient is certified, or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, or the International Data Transfer Agreement.
8.4 From Switzerland. The EU Standard Contractual Clauses apply, with the amendments required by Swiss law, or the Swiss-US Data Privacy Framework where applicable.
8.5 Where the Club is outside the UK and EEA and the Provider is in the UK, the parties will put in place any transfer mechanism required by the Club's local law, as set out in an Order Form.
8.6 The Provider will provide the information reasonably needed for the Club to complete a transfer risk assessment, or the privacy impact assessment required under Quebec Law 25.
9. Assistance to the Club
9.1 Data subject requests. The Provider will provide Platform tools that let the Club access, correct, export, restrict and delete Personal Data, and will otherwise provide reasonable assistance. If the Provider receives a request directly, it will forward it to the Club within [5] business days and will not respond except to confirm receipt and redirect the requester, unless instructed otherwise.
9.2 Impact assessments. The Provider will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities relating to the Platform, including by maintaining a template DPIA that Clubs can adapt.
9.3 Authorities. The Provider will cooperate with supervisory authorities as required by law, and will notify the Club of any request relating to Club Data unless legally prohibited. The Provider will challenge any government access request it considers unlawful and disclose only the minimum required.
10. Personal Data Breaches
10.1 The Provider will notify the Club without undue delay, and in any event within [48] hours, after becoming aware of a Personal Data Breach affecting Club Data.
10.2 The notification will include, as far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information may be provided in phases.
10.3 The Provider will promptly take reasonable steps to contain, investigate and remedy the breach, and will cooperate with the Club's notifications to authorities and individuals. The Provider will not notify third parties about the breach without the Club's consent, unless required by law.
10.4 Notification is not an admission of fault or liability.
11. Return and deletion
11.1 During the Subscription Term, the Club can export Personal Data in a common machine-readable format (such as CSV or JSON) using the Platform.
11.2 On termination, the Club may export its data at any time within 60 days. At the end of that period, the Provider will delete all Personal Data from its live systems and certify deletion on request. Backups are overwritten in their normal cycle of up to [35] days, and are protected in the meantime.
11.3 The Provider may keep Personal Data only where required by law, and will continue to protect it under this DPA.
11.4 When an Athlete leaves. When an Athlete leaves or is removed from the Club, stops sharing with it, or deletes their SPLT Club account, the Provider will delete the Club Records about that Athlete 60 days later, unless the Club tells the Provider before then that it must keep them by law. The Club may export them in the meantime under clause 11.1.
12. Records and audits
12.1 The Provider will keep records of processing as required by Article 30(2) of UK and EU GDPR.
12.2 The Provider will make available all information reasonably necessary to show compliance with this DPA, including any current certifications or independent audit summaries, and completed security questionnaires.
12.3 If that information is not enough to satisfy a regulatory requirement, the Club (or an independent auditor bound by confidentiality) may audit the Provider once in any 12-month period, on at least [30] days' notice, during business hours, at the Club's cost, and without access to other customers' data. Additional audits are allowed after a Personal Data Breach or on a regulator's request.
13. Liability
Each party's liability under this DPA is subject to the limitations in clause 14 of the Agreement, including the Data Protection Cap. This does not limit either party's liability to data subjects under Data Protection Laws.
14. Term and precedence
14.1 This DPA lasts for as long as the Provider processes Personal Data on behalf of the Club.
14.2 If this DPA conflicts with the Agreement on data protection matters, this DPA prevails. Any Standard Contractual Clauses, Addendum or International Data Transfer Agreement incorporated by reference prevail over both.
14.3 This DPA is governed by the law that governs the Agreement, except where the transfer mechanisms in clause 8 require a different law.
Part B: Athlete Profile sharing
15. Sharing Athlete Profiles with the Club
15.1 Roles. The Provider is the controller of each Athlete Profile. When an Athlete, or the Guardian of an Athlete under 16, consents to share with the Club, the Provider makes the consented data ("Shared Profile Data") available to the Club. The Club receives it as an independent controller, solely for coaching the Athlete, supporting their welfare and meeting its duty of care to them (the "Permitted Purpose").
15.2 Scope. Shared Profile Data covers only what the Athlete has consented to: data from their share start date, or their full history if they chose to share it. It never includes Club Records created by any other club. Injuries and availability recorded by any club's Authorised Users form part of the Athlete Profile, and are included in the same way.
15.3 Club obligations. The Club will: (a) use Shared Profile Data only for the Permitted Purpose; (b) give access only to Authorised Users who need it for that purpose; (c) not sell, rent or disclose it to any third party, except where required by law or to protect the Athlete's vital interests in an emergency; (d) not copy or export it outside the Platform, except where necessary for the Permitted Purpose, and then protect any copy to the standard of this DPA; (e) comply with Data Protection Laws in its use of it, including responding to data subject requests about that use; and (f) notify the Provider within [48] hours of becoming aware of any breach affecting it.
15.4 Withdrawal and leaving. If the Athlete stops sharing with the Club, the Club's access ends immediately and it stops recording notes about the Athlete; the Club Records it already holds are then handled under clause 11.4. If the Athlete leaves or is removed from the Club, or the Agreement ends, the Club keeps read-only access for 60 days to Shared Profile Data from before that date, and cannot see anything added afterwards. After 60 days, access is removed. The Club will then delete any copies it holds outside the Platform, unless it is legally required to keep them.
15.5 Provider obligations. The Provider will: (a) collect and record the Athlete's consent to share; (b) enforce the access rules in clause 15.4 through the Platform; (c) notify the Club promptly when an Athlete stops sharing; and (d) keep the Shared Profile Data accurate as the Athlete updates it.
15.6 North America. Under US state privacy laws, each disclosure is made at the consumer's direction and is not a sale or share for advertising. The Club is responsible for meeting any obligations it has as a recipient, including under the Washington My Health My Data Act. Under Canadian law, the Athlete's consent covers the disclosure, and the Club is accountable for its own use of the data.
15.7 Liability. The limitations in clause 14 of the Agreement apply to this clause 15.
Schedule A: United States
This Schedule applies where the Club, an Athlete or Personal Data is subject to US state privacy laws.
A.1 Service provider and processor. The Provider is a "service provider" or "contractor" under the CCPA, and a "processor" under other US state privacy laws and the Washington My Health My Data Act. It processes Personal Data only for the business purpose of providing the Platform, as described in Annex 1.
A.2 Prohibited uses. The Provider will not: (a) sell or share Personal Data, including for cross-context behavioural advertising; (b) retain, use or disclose Personal Data for any purpose other than the business purposes in the Agreement, or outside the direct business relationship with the Club; or (c) combine Personal Data with personal information it receives from other sources, except as permitted by law.
A.3 Compliance. The Provider will comply with applicable obligations under US state privacy laws and give Personal Data the same level of privacy protection those laws require. It will notify the Club if it determines it can no longer meet these obligations.
A.4 Club rights. The Club may take reasonable and appropriate steps to ensure the Provider uses Personal Data consistently with the Club's legal obligations, and to stop and remediate any unauthorised use, including through the assessments described in clause 12.
A.5 Consumer health data. The Provider will process consumer health data only under this DPA and the Club's instructions. Where required, it will help the Club honour requests to access, delete or withdraw consent for consumer health data, including deletion from its Sub-processors and backups.
A.6 Children. For Athletes under 13, the Provider will process Personal Data only as necessary to provide the Platform, in line with COPPA's requirements for operators and service providers, and will support the Club's parental consent and parental access processes.
A.7 Certification. The Provider certifies that it understands and will comply with the restrictions in this Schedule.
Schedule B: Canada and Quebec
This Schedule applies where the Club, an Athlete or Personal Data is subject to Canadian privacy law.
B.1 Comparable protection. The Provider will give Personal Data a level of protection comparable to that required of the Club under PIPEDA and applicable provincial laws, consistent with the Club's accountability for information transferred for processing.
B.2 Quebec. In line with section 18.3 of Quebec's private sector privacy law, the Provider will: (a) take measures to protect the confidentiality of Personal Data; (b) use it only to carry out its mandate under the Agreement; (c) not keep it after the end of the Agreement, except as required by law; (d) notify the Club without delay of any violation, or attempted violation, of these obligations, including any confidentiality incident; and (e) allow the Club to carry out any verification relating to confidentiality requirements.
B.3 Confidentiality incidents. For Quebec purposes, Personal Data Breaches under clause 10 include "confidentiality incidents". The Provider will give the Club the information it needs to keep its incident register and assess the risk of serious injury.
B.4 Transfers outside Quebec. The Provider will provide the information needed for the Club's privacy impact assessment before Personal Data of Quebec residents is communicated outside Quebec.
Annex 1: Processing details
| Item | Details |
|---|---|
| Subject matter | Provision of the SPLT Club training, attendance and athlete-management platform |
| Purpose | Planning and recording training, managing workload, injury and wellbeing, communicating with athletes and guardians, and club administration |
| Duration | The Subscription Term plus the return and deletion period in clause 11 |
| Nature of processing | Collection, recording, storage, organisation, retrieval, analysis, display to authorised users, transmission, export, restriction and erasure |
| Data subjects | Athletes (including children), parents and guardians, the Club's Authorised Users (coaches, medical and support staff, administrators, volunteers) |
| Personal data | Club Records: coaching and medical notes written by Club staff, attendance, selection and team data, club messages, membership and guardian contact details entered by the Club, and Authorised User account data and audit logs. Athlete Profiles, including the injuries and availability that Club staff record, are covered by Part B, not this Annex. |
| Special category and sensitive data | Health information in Club staff notes, such as treatment and return-to-play notes. Data about children. |
| Retention during the term | Default: deleted 60 days after the Athlete leaves the Club, stops sharing with it or closes their account (clause 11.4). The Club may set a longer period only for specific records it is legally required to keep. |
| Hosting location | The United States |
Annex 2: Technical and organisational measures
| Area | Measures |
|---|---|
| Governance | [Named data protection lead; written information security policy reviewed annually; risk register; DPIA for the Platform] |
| Encryption | TLS 1.2+ in transit; [encryption at rest, including backups, by the hosting provider — confirm with Railway] |
| Access control | Role-based access with least privilege; health data limited to the Club's coaches and the Athlete; multi-factor authentication available to every account, with Club admins able to see which staff have it turned on; MFA for all Provider production access |
| Segregation | Logical separation of each Club's data, enforced in code and covered by automated tests |
| Logging and monitoring | Audit logs of changes, kept [12] months; [security monitoring and alerting] |
| Secure development | Code review; separate environments; no production data in testing; [dependency and secret scanning] |
| Testing | [Annual independent penetration test; regular vulnerability scanning; remediation within defined timeframes by severity] |
| Resilience | Daily encrypted backups kept [35] days; [tested restores; documented business continuity and disaster recovery plan] |
| People | [Confidentiality agreements; security and privacy training on joining and yearly; background checks for production access; access removed on leaving] |
| Incident response | [Documented, yearly-tested incident response plan] with breach notification steps under clause 10 |
| Vendors | Security and privacy due diligence on all Sub-processors before onboarding, [and annually] |
| Certifications | None held at present |
Annex 3: Sub-processors
The current list is maintained at spltclub.com/legal/sub-processors.
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Railway | Hosting, database and file storage | All Club Data | United States | [EU-US Data Privacy Framework and UK-US Data Bridge, or Standard Contractual Clauses — confirm] |
| SendGrid (Twilio) | Transactional email: invitations, sign-in links, password resets, notifications | Name, email address, message content | United States | [Data Privacy Framework or Standard Contractual Clauses — confirm] |
| Stripe | Taking club fee payments | Payer name, email address, amounts; card details are held by Stripe | United States | [Data Privacy Framework or Standard Contractual Clauses — confirm] |
| Anthropic | Reading an ergometer photo, a receipt or a race draw, and reviewing training video; and the coach assistant, which answers a coach's questions and drafts crews, sessions and messages for the coach to confirm | For reading and video review: the image or video frames only, with no names. For the assistant: the names and squads of the athletes the coach asks about, their recent training, last test, readiness and its trend, whether they are fit (never an injury's reason) and check-in notes, limited to athletes who share with the Club; and the Club Records involved, such as crews, sessions and regattas | United States | [Data Privacy Framework or Standard Contractual Clauses — confirm] |
Apps an Athlete connects themselves, such as Concept2, Strava, Garmin or Whoop, are not Sub-processors: the Athlete authorises them directly, and each has its own privacy policy. Google Places, used to find where a club rows, receives only the place name a coach types, sent from the Provider's servers, and no Personal Data.