Data Processing Agreement (DPA)

Last Updated: September 2026

This Data Processing Agreement ("DPA") forms part of the Subscription Agreement between Badduck Limited trading as MyAthlete ("Processor") and the Sports Club, Academy, or Athletic Organization ("Controller"). It reflects the parties' agreement with regard to the processing of personal data, in accordance with the requirements of Data Protection Laws, including the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person (Athletes, Members, Parents, Coaches, Volunteers, Staff) processed by the MyAthlete Engine.
"Self-Healing Logic" refers to the automated background processes used to maintain data integrity through probabilistic matching, identity reconciliation, and record merging.

2. Subject Matter and Duration

The subject matter of the processing is the provision of a Club Operating System and athletic management platform. Processing shall continue for the duration of the Club’s subscription.

3. Nature and Purpose of Processing

Processor shall process Personal Data for the following purposes:

Maintaining an authoritative "Golden Record" of member profiles and athletic performance via automated Self-Healing Database processes.
Processing financial liabilities, batch sweeps, and payment metadata via Mollie B.V. integration.
Managing safeguarding, vetting, and medical vaults for athlete safety.
Providing statistical analytics, attendance registers, and athletic development tracking.
Hosting club operational documentation, incident records, and consent agreements under the Fair Use Storage Policy.

4. Controller Obligations

The Controller (The Club) represents and warrants that it has obtained all necessary lawful bases and consents (especially regarding minors' medical information and media permissions) to process personal data via the Service. The Controller is responsible for the accuracy of manual data imports and the secure transmission of generated competition entry files.

5. Processor Obligations & Sub-processors

Instruction: Processor shall process data only on documented instructions from the Controller.
Confidentiality: Processor ensures that personnel authorized to process data are committed to confidentiality.
Security: Processor implements technical and organizational measures including AES-256 encryption at rest, TLS 1.3 in transit, and Scoped Permission Gating.
EEA Data Residency & Sub-processors: All primary databases and object storage infrastructure are hosted within the European Economic Area (EEA). Current authorized sub-processors include:
- Akamai / Linode Cloud: Infrastructure hosting, computing nodes, and S3-compatible encrypted object storage (Frankfurt / Dublin, EEA).
- Mollie B.V.: Regulated European payment institution for SEPA Direct Debit and card checkout processing (Netherlands, EEA).
- Google Cloud (GCP): Off-site disaster recovery backups and container infrastructure (EEA regions).

6. Special Categories of Data

The Service processes Special Category Data (Medical/Health information and Criminal Vetting status). Processor shall apply enhanced security controls to these modules, ensuring access is restricted to users holding specific "Compliance Officer" or "Medical Lead" administrative scopes.

7. Data Subject Rights

Processor shall provide the Controller with administrative tools to fulfill Data Subject requests (access, rectification, erasure). Due to the Self-Healing nature of the database, the Processor will assist the Controller in identifying merged or retrospectively reconciled records upon request.

8. Data Breaches

Processor shall notify the Controller without undue delay (and in any event within 48 hours) after becoming aware of a personal data breach, providing sufficient information to allow the Controller to meet its legal obligations.

9. Data Deletion and Return

Upon termination of the Subscription Agreement, the Processor shall, at the choice of the Controller, delete or return all Personal Data, unless statutory laws or governing body regulations (such as official sporting record retention requirements) require ongoing storage.

Annex 1: Details of Processing

Data Subjects: Club Athletes, Junior Members, Adult Members, Parents, Legal Guardians, Coaches, Volunteers, and Committee Members.
Data Types: Names, DOB, Gender, National Governing Body Registration IDs, Bank Account metadata (Mollie), Medical Conditions, Emergency Contacts, Garda Vetting / Background Check status, and Performance Statistics.