Data processing agreement

Article 1. Definitions

Terms from the GDPR (personal data, processing, data subject, controller, processor, personal data breach, supervisory authority) have the same meaning in this agreement as in the GDPR. In addition the following terms apply.

GDPR Regulation (EU) 2016/679, the General Data Protection Regulation, and the Dutch GDPR Implementation Act.

Platform The online club software of Loyal2Sports, including all modules, the parent portal, the public club pages and the integrations the club activates.

Environment The own, separated database and settings of one club within the platform.

Club data All personal data that the club or its administrators, members, customers, sponsors, volunteers, pupils or parents enter into the environment or that arise there through use.

Administrator A person who logs in to the environment on behalf of the club with their own account.

Sub-processor A party that Loyal2Sports engages to process club data, as listed in Annex 2.

Main agreement The agreement under which the club uses the platform, including the general terms and conditions of Loyal2Sports.

Data breach A breach of security that accidentally or unlawfully leads to the destruction, loss, alteration, unauthorised disclosure of, or access to club data.

Article 2. Subject, duration and precedence

1. This agreement governs how Loyal2Sports processes club data for the club when providing the platform.
2. It takes effect on the date of signing, or earlier if the club already uses the platform, and runs for as long as the main agreement runs. Article 13 (return and deletion) and article 10 (confidentiality) continue to apply afterwards.
3. This agreement forms an inseparable part of the main agreement. Where this agreement differs from the general terms and conditions, this agreement prevails, but only for the processing of personal data.
4. If the club agrees something with Loyal2Sports that differs from what is written here, that arrangement prevails, provided it is recorded in writing and confirmed by both parties.
5. The nature, the purpose, the categories of data subjects and the types of personal data are set out in Annex 1.

Article 3. Only on instruction

1. Loyal2Sports processes club data only as the club instructs. That instruction lies in the use of the platform itself: what the club enters, configures, activates and publishes. In addition the club can give further written instructions.
2. Loyal2Sports never uses club data for its own purposes. It does not sell them, does not rent them out and does not use them to profile or track anyone.
3. Loyal2Sports may use anonymised and aggregated usage data to improve the platform, as agreed in article 8 of the general terms and conditions. No person or individual club can ever be derived from it.
4. If Loyal2Sports considers an instruction to be contrary to the GDPR or other privacy legislation, it informs the club immediately and does not carry out the instruction until it has been amended.
5. If a law of the European Union or a member state obliges Loyal2Sports to process club data outside the instruction, it informs the club in advance, unless that same law prohibits such notification.

Article 4. Obligations of Loyal2Sports

1. Loyal2Sports processes club data exclusively within the European Union, except in the two cases from article 7 that the club activates itself.
2. Loyal2Sports keeps the club's environment physically separated from those of other clubs, with a separate database per club.
3. Loyal2Sports does not look into club data, except when the club asks for help or when an outage has to be resolved. That is done by a person, is logged and never happens unasked.
4. Loyal2Sports takes the security measures from article 6 and Annex 3 and engages sub-processors only in accordance with article 7.
5. Loyal2Sports assists the club with requests from data subjects (article 8), with data breaches (article 9) and with a data protection impact assessment or a question from a supervisory authority (article 11).
6. Loyal2Sports keeps a record of the processing it carries out for the club, insofar as the GDPR requires this of a processor, and gives the club all information it reasonably needs to demonstrate that this agreement is being complied with.
7. Loyal2Sports deletes or returns club data at the end of the agreement in accordance with article 13.

Article 5. Obligations of the club

1. The club ensures that it may process the club data on a valid legal basis, that it informs the data subjects, for example in its own privacy statement, and that it has consent where required.
2. For children's data the club obtains consent from a parent or guardian where the law requires it. This applies in particular to youth members, to the education environment and to the link between parent and child in the parent portal.
3. The club is and remains responsible for what it publishes through connected channels, such as posts and images on its Facebook page or Instagram account, and for the rights to that material.
4. The club remains responsible for the data it imports from or exports to its federation administration (Sportlink, Lisa). The federation and the federation software are not sub-processors of Loyal2Sports.
5. The club handles login details with care, switches on two-step verification where Loyal2Sports offers it, revokes the accounts of administrators who leave the club and reports any suspicion of unauthorised access immediately.
6. The club decides itself which club data may go and when, and uses the tools in the platform for that or asks Loyal2Sports for deletion (see Annex 1 on retention periods).
7. The club assesses itself whether a data breach must be reported to the Dutch Data Protection Authority and to data subjects, and makes that report itself (article 9).
8. The club indemnifies Loyal2Sports against claims from data subjects or third parties arising from club data that the club has processed in breach of the law, as set out in article 11 of the general terms and conditions.

Article 6. Security

1. Loyal2Sports takes appropriate technical and organisational measures to protect club data against loss and against any form of unlawful processing, taking into account the state of the art, the costs, the nature of the data and the risks to data subjects (article 32 GDPR).
2. The measures Loyal2Sports takes on the date of this agreement are set out in Annex 3.
3. Those measures are not a snapshot. Loyal2Sports adjusts them when technology or risk requires it and may replace a measure with another that protects at least as well. It notifies the club in advance of any reduction in the level of protection.
4. Loyal2Sports does not guarantee uninterrupted availability. Article 4 of the general terms and conditions applies to availability, maintenance and back-ups: daily back-ups, kept for fourteen days, intended for recovery after an outage.
5. The club is responsible for security on its own side: devices, accounts, passwords and the conduct of its administrators.

Article 7. Sub-processors and transfers outside the EEA

1. The club gives Loyal2Sports general authorisation to engage sub-processors. Which ones those are on the date of this agreement, and for what, is set out in Annex 2.
2. If Loyal2Sports wants to add or replace a sub-processor, it notifies the club's contact person by email at least thirty days in advance.
3. If the club has a well-founded objection, the parties talk it through. If they cannot resolve it, the club may terminate the main agreement as of the date the change takes effect, free of charge and with a refund of what was paid in advance for the period after that.
4. Loyal2Sports imposes on every sub-processor, in writing, the same obligations it enters into in this agreement and remains fully responsible towards the club for what a sub-processor does or fails to do.
5. The servers and databases of the platform are located within the European Union. Only in the following two cases do data leave the European Economic Area, and only if the club activates those components itself.
6. If the club connects its Facebook page or Instagram account, the posts it publishes go to Meta, together with the reference to that page or account. Loyal2Sports sends no member data to Meta.
7. If someone switches on notifications in the parent portal, a device address goes to the push service of Google, Apple or Mozilla. The content of the notification is encrypted by Loyal2Sports and unreadable to that service.
8. These transfers are covered by the standard contractual clauses of the European Commission and, for Meta, additionally by the EU-US Data Privacy Framework. If the club wants no transfer outside the EEA at all, it does not use these two components and no transfer takes place.
9. Connections the club makes itself to its own suppliers, such as its accounting package or its federation administration, do not fall under this article. There the club itself is the controller and makes the necessary arrangements itself.

Article 8. Rights of data subjects

1. A data subject who wants access, rectification, erasure, restriction, objection or portability turns to the club. The club is the controller and the club decides.
2. Loyal2Sports assists the club with the tools the platform offers: looking up, amending, exporting and deleting can largely be done by the club itself. If something cannot be done by the club, Loyal2Sports does it at its request within ten working days.
3. If a request from a data subject reaches Loyal2Sports directly, it does not handle it itself. It forwards it to the club within five working days and lets the requester know it has done so.
4. For the data for which Loyal2Sports is itself the controller (the club's contact persons and administrators, invoicing, its own logs) the privacy statement on loyal2sports.nl applies and Loyal2Sports handles requests itself.

Article 9. Data breaches

1. If Loyal2Sports discovers a data breach involving club data, it reports it to the club's contact person without undue delay and in any case within 24 hours of becoming aware of it.
2. The report contains at least: what happened, which categories of data and approximately how many data subjects are affected, what the likely consequences are, and which measures Loyal2Sports has taken or proposes. If not everything is known yet, Loyal2Sports reports what it does know and adds more as soon as it becomes known.
3. The club decides itself whether to report the breach to the Dutch Data Protection Authority (within 72 hours) and to the data subjects. That is its duty, not that of Loyal2Sports. Loyal2Sports provides the information it needs for that.
4. Loyal2Sports never reports a breach to a supervisory authority on behalf of the club on its own initiative and makes no public statements about an incident at the club without consulting it.
5. Loyal2Sports keeps an internal register of data breaches, including the facts, the consequences and the measures taken, and gives the club access to it on request insofar as it concerns its environment.
6. Both parties work together to limit the consequences of a data breach and to prevent recurrence.

Article 10. Confidentiality

1. Everyone at Loyal2Sports who can access club data is bound to confidentiality. That is recorded in writing and continues to apply after someone leaves Loyal2Sports.
2. Access to the club's environment is given only to those who need it for their work, and only for as long as it is needed.
3. Loyal2Sports keeps confidential everything it learns about the club and its members, except insofar as it is public or the law requires disclosure. This duty survives the end of this agreement, as article 13 of the general terms and conditions also provides.

Article 11. Audit and assistance

1. The club may check whether Loyal2Sports complies with this agreement. Loyal2Sports provides the information the club reasonably needs for that, including a current version of Annex 2 and Annex 3.
2. If the club wants an on-site audit or one by an independent expert, it gives at least thirty days' notice, at most once a year, unless there is a concrete reason such as a data breach or a request from a supervisory authority. The expert signs a confidentiality undertaking and the audit may not affect the service to other clubs.
3. The costs of an audit are borne by the club, unless it shows that Loyal2Sports did not comply with this agreement.
4. If the club has to carry out a data protection impact assessment (DPIA), or a supervisory authority wants information, Loyal2Sports helps with what it knows about how the platform works and how it is secured.

Article 12. Liability

1. Liability under this agreement is governed by article 10 of the general terms and conditions: liability only for direct damage caused by an attributable failure, after notice of default, limited to the amount the club paid Loyal2Sports in the twelve months before the damage, with a maximum of ten thousand euros per event and per year.
2. A fine imposed on the club by a supervisory authority is borne by the club, except insofar as it results from a failure by Loyal2Sports.
3. The limitations do not apply in the event of intent or deliberate recklessness on the part of the management of Loyal2Sports, nor insofar as the law does not permit them.
4. Each party is itself liable for the fines and damage arising from its own non-compliance with the GDPR, in accordance with article 82 GDPR.

Article 13. End of the agreement: return and deletion

1. When the main agreement ends, the environment remains accessible for another thirty days so the club can export its data. If it wants an export in a particular format, it requests that within those thirty days.
2. After that Loyal2Sports deletes the club data and the environment, and within ninety days also the back-ups in which they appear. Loyal2Sports confirms that deletion in writing if the club asks for it.
3. If Loyal2Sports has to keep something longer because the law requires it, for example invoices for the seven-year tax retention obligation, it keeps only that, only for as long as it must, and uses it for nothing else.
4. Access tokens of connected services (such as Facebook and Instagram) are erased at the end. The club can also disconnect those services itself earlier in Club settings.

Article 14. Final provisions

1. This agreement is governed by Dutch law. Disputes are submitted to the competent court in the district where Loyal2Sports is established, after the parties have first tried to resolve them together.
2. Loyal2Sports may amend this agreement and its annexes when the law, technology or the service requires it. It notifies the club's contact person of a change by email at least thirty days in advance. If the change is to the club's disadvantage, the club may terminate the main agreement as of the date the change takes effect.
3. The current version of this agreement is published at loyal2sports.nl/verwerkersovereenkomst/. Where the signed version and the online version differ, the signed version applies, unless the club has agreed to a newer version in writing.
4. If a provision of this agreement is invalid, the remaining provisions continue to apply and the parties replace the invalid provision with a valid one that comes as close as possible to its purpose.