Data Processing Agreement
Version 1.0 · [date]
This agreement forms part of the Klubzo Terms of Service between [Klubzo Ltd, company number …, registered office …] ("Klubzo", "we") and the club or organisation that uses Klubzo ("the Club", "you"). It applies whenever we process personal data on your behalf.
1. Roles
1.1 For the personal data of your members, players, parents and carers, volunteers, coaches, visitors and others that you put into Klubzo ("Club Data"), you are the controller and we are your processor, as those terms are defined in the UK GDPR and the Data Protection Act 2018.
1.2 For the details of the people who set up and run your Klubzo account (for billing, security and support), and for anonymised data created under clause 8, we are the controller. Our Privacy Notice explains how we handle that data.
2. What we process
| Subject matter and duration | Providing Klubzo to you for as long as your account is open, and for the deletion period in clause 10 |
| Nature and purpose | Hosting, storing, organising, displaying, sending messages, taking payments, producing reports and providing the features you choose, and the support, security, backup and monitoring needed to run them |
| Types of personal data | Names, contact details, dates of birth, membership and payment records, team, fixture and availability information, photos and documents you upload, messages, attendance, coach feedback and development records, and any answers to your own membership questions |
| Special category and sensitive data | Health and medical information, emergency contacts, safeguarding concerns, DBS and Safe Hands status, and (where you collect it) equality monitoring information |
| Data subjects | Your members and players (including children), parents and carers, volunteers, coaches, officials, committee members, visitors, supporters, donors and people who contact you |
3. Our obligations
We will:
- process Club Data only on your documented instructions, which are these Terms, this agreement and the settings and actions you take in Klubzo, unless the law requires otherwise (and if so, we will tell you first unless the law forbids it);
- make sure everyone who can access Club Data is bound by confidentiality;
- keep Club Data secure with the measures in Schedule 2, and review them regularly;
- use sub-processors only as set out in clause 5;
- help you respond to people exercising their rights (access, correction, erasure, restriction, objection and portability), including through the export and erasure tools built into Klubzo;
- help you meet your duties on security, breach notification, data protection impact assessments and consultation with the Information Commissioner, taking into account the information available to us;
- delete or return Club Data at the end of the service as set out in clause 10;
- give you the information you reasonably need to show compliance with this agreement, and allow audits as set out in clause 9;
- tell you straight away if we think an instruction from you breaks data protection law.
4. Your obligations
You will:
- have a lawful basis for the personal data you put into Klubzo, and give people the information they need about how your club uses it (Klubzo provides a template club privacy notice you can adapt);
- obtain consent where the law requires it, for example parental consent for children, photo consent, and consent for any medical information you choose to collect;
- give access only to people in your club who need it, using Klubzo's roles, and remove access when someone leaves a role;
- keep sign-in details secure and tell us promptly if you think an account has been compromised;
- not upload personal data that your club has no need to hold.
5. Sub-processors
5.1 You give general authorisation for us to use the sub-processors listed in Schedule 1.
5.2 We will give you at least 30 days' notice by email and in Klubzo before adding or replacing a sub-processor. You may object on reasonable data protection grounds; if we cannot address your objection, you may end your subscription without penalty and receive a pro-rata refund of any prepaid fees.
5.3 We will put a written contract in place with each sub-processor that gives Club Data the same level of protection as this agreement, and we remain responsible to you for their performance.
6. International transfers
Where a sub-processor processes Club Data outside the UK, we will make sure the transfer is covered by UK adequacy regulations or by appropriate safeguards (such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework), and we will tell you which safeguard applies on request.
7. Personal data breaches
7.1 We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Club Data.
7.2 We will tell you what happened, the data and people likely to be affected, the likely consequences, and what we have done or propose to do, and will update you as we learn more.
7.3 Unless the law requires otherwise, you decide whether to notify the Information Commissioner and the people affected; we will help you do so.
8. Anonymised and aggregated data
8.1 You authorise us to create anonymised, aggregated statistics from Club Data and from how Klubzo is used ("Anonymised Data"). Examples: how many juniors, women and girls play a sport in a county; how participation changes through a season; membership price ranges; how many clubs meet a governance standard; volunteer numbers; and facilities needs.
8.2 Anonymised Data must not identify, and must not be reasonably capable of being used to identify, any individual. In particular we will:
- combine data from several clubs, and never publish or share a figure based on fewer than 10 people or fewer than 5 clubs;
- never include names, contact details, dates of birth, photos, free text or messages;
- never use safeguarding concerns, DBS or Safe Hands records, health or medical information, coach feedback text, or equality monitoring answers to produce Anonymised Data, except simple counts that meet clause 8.2.1 (for example, the number of clubs with a named safeguarding officer);
- not identify your club in Anonymised Data unless you have chosen to share with an organisation under clause 8.5 or you agree in writing.
8.3 Once data has been anonymised in this way it is no longer personal data. We own the Anonymised Data and may use it to run, improve and develop Klubzo; to give clubs benchmarks (for example, "clubs like yours"); to publish research and reports; and to provide reports and services, including paid ones, to governing bodies, county boards, leagues, funders and other partners.
8.4 We will never sell, rent or license personal data from Klubzo to anyone, or use Club Data to market to your members.
8.5 Separately from this clause, if you link your club to a county board, league or other organisation in Klubzo, the information you choose to share with it is governed by the data-sharing agreement you accept when linking.
9. Audits
9.1 On request, and no more than once a year (unless a breach or regulator requires it), we will provide a written summary of our security measures and answer reasonable written questions.
9.2 If that is not enough to show compliance, you may appoint an independent auditor, bound by confidentiality, to carry out an audit on 30 days' notice, during working hours, at your cost, in a way that does not disrupt the service or expose other clubs' data.
10. End of service
10.1 When your subscription ends you can export your data from Klubzo for 30 days.
10.2 After that we will delete Club Data from the live service within a further 30 days, and from backups within 90 days as they expire, unless the law requires us to keep it. Safeguarding records are subject to clause 10.3.
10.3 Because safeguarding records may need to be kept for many years, before closing your account you should export them or arrange for them to pass to your governing body or successor club. If you ask us in writing, we will keep them securely and separately for the period you specify, at no extra charge, and delete them at the end.
11. Liability and precedence
Each party's liability under this agreement is subject to the limits in the Terms of Service, except where the law does not allow liability to be limited. If this agreement conflicts with the Terms of Service on data protection, this agreement wins.
Schedule 1: Sub-processors
| Sub-processor | What it does | Where data is processed | Transfer safeguard |
|---|---|---|---|
| 20i Ltd | Hosting of the Klubzo app servers and club websites | UK | Not applicable (UK) |
| Brevo (Sendinblue SAS) | Sending emails and text messages | EU (France) | UK adequacy regulations for the EEA |
| Stripe Payments UK Ltd and Stripe, Inc. | Card payments and subscriptions | UK, EU and US | [To confirm] |
| Anthropic PBC | AI features: drafting, summaries, help and website chat (only when you use them) | US | [To confirm] |
| [Backup storage provider] | Encrypted off-site backups | [To confirm] | [To confirm] |
Stripe is also an independent controller for the payment data it processes under its own terms.
Schedule 2: Security measures
- Encryption in transit (HTTPS) for all connections, and encryption at rest for health information, safeguarding records and coach feedback.
- Role-based access in each club, with every access to safeguarding and medical records logged.
- Two-factor sign-in for Klubzo staff and for organisation users.
- Strict browser security policies, protection against request forgery, and rate limits on sign-in and forms.
- Encrypted daily backups held off-site, with restore tested.
- Monitoring and alerts for errors and outages.
- Security updates applied promptly; access to production systems limited to named Klubzo staff.
- Built-in tools to export and erase a person's data, and automatic retention rules each club can set.
See also: Terms of Service · Privacy notice