Data Processing Agreement

The Processor provides a software platform that enables sports organizations to manage operational and administrative activities including player records, scheduling, and team management.

Processing will occur for the duration of the Organization's use of the Platform.

Processing activities may include:

• Collection

• Storage

• Organization

• Retrieval

• Transmission

• Deletion

These activities occur solely to enable the functionality of the Platform.

Data subjects may include:

• Players

• Coaches

• Staff members

• Parents or guardians

Personal data processed may include:

• Names

• Email addresses

• Phone numbers

• Date of birth

• Height and weight

• Team membership

• Attendance records

• Emergency contact details

The Processor shall:

• Process personal data only on documented instructions from the Controller

• Ensure persons authorized to process personal data are bound by confidentiality

• Implement appropriate security measures in accordance with GDPR Article 32

• Assist the Controller in responding to data subject rights requests

• Notify the Controller without undue delay after becoming aware of a personal data breach

The Controller authorizes the use of sub-processors necessary for the operation of the Platform.

Current sub-processors include:

The Processor will ensure that sub-processors provide appropriate data protection safeguards.

Where personal data is transferred outside the European Economic Area, the Processor will ensure appropriate safeguards such as Standard Contractual Clauses.

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting personal data processed under this Agreement.

The Processor shall assist the Controller, where reasonably possible, with:

• Data subject rights requests

• Data protection impact assessments

• Security obligations under GDPR

Upon termination of services, the Processor shall delete or return all personal data to the Controller unless retention is required by applicable law.

The Controller may request reasonable information necessary to demonstrate compliance with this Agreement.

This Agreement shall be governed by the laws of Bulgaria and applicable European Union data protection law.