Data Processing Agreement

1. Definitions

In this Data Processing Agreement ("DPA"), the following terms have the meanings set out below:

• "Controller" means the club or organisation that uses OurClub to manage its members and determines the purposes and means of processing personal data.
• "Processor" means OurClub Online Ltd, a company registered in England & Wales under company number 17385935, trading as OurClub, which processes personal data on behalf of the Controller.
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the UK GDPR.
• "Processing" means any operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.
• "Data Subject" means the identified or identifiable natural person to whom personal data relates.
• "Sub-processor" means any third party engaged by the Processor to process personal data on behalf of the Controller.
• "UK GDPR" means the General Data Protection Regulation as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, read together with the Data Protection Act 2018.

2. Scope and Purpose of Processing

This DPA governs the processing of personal data by OurClub (the Processor) on behalf of the club (the Controller) in connection with the provision of the OurClub platform services. The purpose of processing is to enable the Controller to manage club membership, communications, events, grading records, attendance tracking, payment collection, and related club administration activities.

The Processor shall process personal data only on documented instructions from the Controller, unless required to do so by applicable law. Where processing is required by law, the Processor shall inform the Controller of that legal requirement before processing, unless prohibited from doing so.

3. Types of Personal Data Processed

The Processor may process the following categories of personal data on behalf of the Controller:

• Identity data: Full name, date of birth, gender.
• Contact data: Email address, telephone number, postal address.
• Financial data: Payment card details (processed and stored by Stripe; OurClub does not store raw card numbers), transaction history, subscription status.
• Membership data: Grading records, attendance history, membership status, licence numbers.
• Communications data: Messages sent via the platform's direct messaging feature, push notifications delivered to registered mobile devices, and email / SMS correspondence relating to the service.
• Content data: Community posts, comments, uploaded images (including profile photos), and documents attached to notices or club communications.
• Technical data: IP addresses, browser type, device information, mobile-device identifiers, usage logs, and API access logs.

4. Categories of Data Subjects

Personal data processed under this DPA relates to the following categories of data subjects:

• Club members: Individuals who are registered members of a club using the platform, including children and their parents/guardians.
• Coaches and instructors: Individuals engaged by the club to deliver coaching, training, or instruction.
• Club administrators: Individuals responsible for managing the club's account and operations on the platform.

5. Processor Obligations

The Processor shall:

• Process personal data only in accordance with the Controller's documented instructions and as necessary to provide the platform services.
• Ensure that all personnel authorised to process personal data are bound by obligations of confidentiality.
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption of data in transit and at rest, access controls, regular security testing, and incident response procedures.
• Not engage another processor (sub-processor) without prior specific or general written authorisation of the Controller. In the case of general written authorisation, the Processor shall inform the Controller of any intended changes.
• Assist the Controller in responding to data subject access requests and in ensuring compliance with obligations under Articles 32 to 36 of the UK GDPR.
• At the choice of the Controller, delete or return all personal data after the end of the provision of services, and delete existing copies unless storage is required by law.
• Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the UK GDPR and allow for and contribute to audits.
• Require all users of the platform to comply with the OurClub Acceptable Use Policy as a condition of access.

6. Sub-processors

The Controller provides general authorisation for the Processor to engage the following sub-processors. The Processor shall ensure that each sub-processor is bound by data protection obligations no less onerous than those set out in this DPA.

• Stripe Payments UK, Ltd. & Stripe Connect: Payment processing and connected account management. Processes financial and identity data to facilitate member payment collection, platform-fee application, and payouts to the Controller's connected bank account.
• Resend: Transactional email delivery. Processes email addresses and message content for the purpose of delivering platform notifications and communications.
• Vonage: SMS delivery. Processes telephone numbers and message content for the purpose of delivering SMS notifications and verification codes.
• Amazon Web Services (AWS): Infrastructure hosting and object storage for uploaded images and documents. Stores and processes categories of personal data as necessary to operate the platform, within the United Kingdom and European Union regions.
• Fathom Analytics: Privacy-first, cookieless website analytics. Processes only anonymised, aggregated page-view and performance data; does not receive personal data directly.

An up-to-date list of sub-processors (including any newly engaged parties) is available on request from [email protected]. The Processor shall notify the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object. If the Controller objects on reasonable grounds, the parties shall discuss the concern in good faith.

7. Data Subject Rights

The Processor shall assist the Controller in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III of the UK GDPR, including the right of access, rectification, erasure, restriction of processing, data portability, and the right to object. The Processor shall promptly notify the Controller if it receives a request from a data subject directly.

8. Data Breach Notification

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach. The notification shall include:

• A description of the nature of the breach, including the categories and approximate number of data subjects and records concerned.
• The name and contact details of the Processor's data protection officer or other contact point.
• A description of the likely consequences of the breach.
• A description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

The Controller remains responsible for notifying the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a breach, where required by Article 33 of the UK GDPR. The Processor shall provide all reasonable assistance to the Controller in fulfilling this obligation. For full details of OurClub's breach procedures, see our Breach Notification Procedure .

9. Data Deletion and Return on Termination

Upon termination of the agreement between the Controller and the Processor, the Processor shall, at the Controller's election, either return all personal data to the Controller or delete all personal data within 90 days of termination. This is consistent with the data retention period set out in the OurClub Privacy & Cookie Policy .

The Processor may retain personal data to the extent required by applicable law, in which case the Processor shall continue to ensure the confidentiality and security of such data and shall process it only for the purpose required by law.

10. International Transfers

The Processor shall not transfer personal data outside the United Kingdom unless appropriate safeguards are in place as required by the UK GDPR, such as standard contractual clauses, an adequacy decision, or binding corporate rules. Where sub-processors process data outside the UK, the Processor shall ensure that equivalent protections are in place and shall inform the Controller of any such transfers.

11. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this DPA and in Article 28 of the UK GDPR. The Processor shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. The Controller shall give reasonable notice of any audit and shall conduct it in a manner that minimises disruption to the Processor's business.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the OurClub Terms of Service . Nothing in this DPA limits either party's liability for breaches of data protection law to the extent that such liability cannot be limited under applicable law.

13. Contact

For questions about this Data Processing Agreement, please contact us at [email protected] .

For data protection enquiries, you may also contact our Data Protection Officer at [email protected] .