Data Processing Agreement (DPA)

This document is a template data processing agreement entered into under Article 28 GDPR between a club or sports organisation using TrainTeam as the data controller and the Service Provider as the processor.

The agreement is concluded when the controller starts using TrainTeam features and supplements the Terms of Service and Privacy Policy. The controller accepts the agreement in the club administration panel or by using features that require data processing on its behalf.

1. Parties

Processor: Przemysław Padrak, jednoosobowa działalność gospodarcza, registered at Otwarta 9, 60-185 Skórzewo, Polska, tax ID 6722053457, email contact@trainteam.pl, phone +48 664 736 118.

Controller: the club or sports organisation whose registration data and representative details are provided in the TrainTeam administration panel.

2. Subject and Purpose

The Controller entrusts the Processor with processing personal data of club members to provide TrainTeam services: team management, attendance, call-ups, communication, calendar, membership records and club billing support.

3. Scope and Categories of Data

The processing covers the following data categories:

• identification and contact data, such as name, email, phone number and photo,
• player sports and organisational data, such as date of birth, position, height, weight, nationality, licence number, national ID where provided, address, medical exam date, attendance and call-ups,
• parent-child links, club roles and team memberships,
• club communication and notification content,
• technical session and security data.

The processing does not include club members' payment card data. That data is processed directly by Stripe.

4. Duration

This agreement remains in force while the Controller uses TrainTeam. After it ends, the Processor deletes or returns the entrusted data within 30 days according to the Controller's decision, unless law requires longer retention.

5. Processor Obligations

The Processor agrees to:

• process data only on documented instructions from the Controller,
• ensure confidentiality for persons authorised to process data,
• apply appropriate technical and organisational measures,
• assist the Controller with data subject rights,
• assist with Article 32-36 GDPR obligations, including security and breach matters,
• provide information needed to demonstrate compliance and enable audits.

6. Sub-processing

The Controller gives general consent for the Processor to use sub-processors for infrastructure, integrations and payment support. The current list of sub-processors is published in the Privacy Policy. The Processor gives 14 days' notice of planned changes. The Controller may object, in which case either party may terminate this agreement.

7. Security Measures

The Processor applies in particular:

• role-based access control and database security policies,
• encrypted connections and encryption of sensitive tokens at rest,
• private storage for attachments,
• audit logs for administrative operations,
• abuse-prevention mechanisms and input validation,
• backups and data recovery procedures,
• separation of production and test environments.

8. Personal Data Breaches

The Processor notifies the Controller of a breach affecting entrusted data without undue delay and no later than 48 hours after becoming aware of it, using the club representative email address provided in TrainTeam or in the administration panel.

9. Transfers Outside the EEA

Data is processed primarily on servers in the European Union. Where sub-processing requires a transfer to a third country, the transfer is based on European Commission Standard Contractual Clauses and additional safeguards where required.

10. Liability and Final Provisions

The parties are liable for damage caused by GDPR violations under Article 82 GDPR. Matters not regulated by this agreement are governed by GDPR and Polish law. Disputes are resolved by the court competent for the Processor's registered office.

If the club needs a countersigned copy, contact us at contact@trainteam.pl. We will prepare a copy completed with the club's details.