Data Processing Agreement
This agreement forms part of the Terms of Service between Game of Inches ("the processor", "we") and each club that uses Game of Inches ("the club", "the controller"). It applies to personal data the club adds to Game of Inches, and meets the requirements of Article 28 of the UK GDPR. If this agreement and the Terms disagree, this agreement wins on data protection.
1. Details of the processing
| Subject matter | Providing Game of Inches to the club. |
|---|---|
| Duration | While the club uses the service, plus up to 30 days after its plan ends (see section 8). |
| Nature and purpose | Storing, organising and displaying match tags, squads, statistics, ratings, clips and match video so the club's coaches can analyse games. |
| People the data is about | The club's players, including players under 18; opposition players named in the club's games; the club's coaches and officials. |
| Types of personal data | Names; shirt numbers; positions; fitness status (fit, injured or unavailable, with no medical detail); match actions and their times and pitch locations; ratings calculated from them; match video showing players; coaches' and officials' names and email addresses. |
| Special category data | None intended. The fitness status field is limited to fit, injured or unavailable. The club must not add medical detail. |
2. The club's responsibilities
- The club decides what personal data it adds and why, and must have a lawful basis for it.
- The club must tell its players, and the parents or guardians of players under 18, how their data is used. It must also get any consent needed, including for filming, in line with its governing body's guidance.
- The club deals with requests from its players about their data. We will help as set out in section 6.
3. Our responsibilities
- We process the club's personal data only on the club's documented instructions. Those instructions are set by the Terms, this agreement and the club's use of the service's settings. If we think an instruction breaks data protection law, we will tell the club.
- Anyone we allow to process the data is bound by confidentiality.
- We don't use the club's data for our own purposes, sell it, or combine it with other clubs' data in a way that identifies anyone.
4. Security
We take appropriate technical and organisational measures to protect the data, including:
- encryption in transit (HTTPS) for all traffic
- database access rules that separate each club's data, so members can only reach their own club's data
- individual logins for every club member, with roles set by the club admin
- two-step sign-in on all of our admin accounts with our providers
- secret keys kept out of the code and in a password manager
- regular backups by our database provider
5. Sub-processors
The club agrees that we may use these sub-processors: Supabase (database and sign-in), Netlify (hosting and server functions), Resend (email delivery), Stripe (payments; admin billing data only), Bunny.net (match video storage and streaming). We have written contracts with each that give at least the protection in this agreement. We will give at least 30 days' notice by email before adding or replacing a sub-processor. The club may object, and if we can't resolve the objection, the club may cancel and get a refund for the unused part of its paid year.
6. Helping the club
- We will help the club respond to requests from people exercising their data rights. Many can be handled directly in the app, for example by deleting a game or exporting the club's data. For anything else, email us and we will do it for the club.
- We will give reasonable help with data protection impact assessments and with the ICO, where the processing makes that relevant.
7. Data breaches
If we become aware of a breach affecting the club's personal data, we will tell the club admins without undue delay and in any case within 48 hours. We will say what happened, what data and how many people are affected, and what we are doing about it. We will then keep the club updated.
8. When the service ends
When a club's plan ends, the club can export its data until access ends. We then keep the data for 30 days in case the club renews, and delete it after that, except where the law requires us to keep it. Backups held by our database provider are overwritten in the normal course of their cycle.
9. International transfers
Where a sub-processor processes data outside the UK, we make sure the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum.
10. Checks
We will give the club the information it reasonably needs to show that this agreement is being met, and answer reasonable written questions about our processing.
Contact
Game of Inches · [registered office address to be added] · support@gameofinches.ie · ICO registration: [to be added]