Data Processing Agreement

Subject matter: capturing, storing, displaying privately to the owner, exporting and deleting participant leads for hosted events. Nature and purpose: providing the organiser’s lead-capture service. Data subjects: event attendees and players.

Data types: full name, email, nickname, join timestamp and marketing opt-in record. No special-category data is requested. Duration: while the organiser instructs us to retain the records within the service, subject to agreed deletion and lawful retention.

We process participant leads only on the organiser’s documented instructions, including agreed service functions and lawful transfer instructions, unless law requires otherwise. If legally permitted, we will notify the organiser of a legal requirement before processing.

We will notify the organiser if an instruction appears to infringe applicable data-protection law. Persons authorised to access participant data must be bound by confidentiality obligations.

We maintain measures appropriate to risk, including authenticated workspace-owner access, isolation of lead records between workspaces and HTTPS transport. Participant emails are excluded from public race displays and room broadcasts.

We will notify the organiser without undue delay after becoming aware of a personal-data breach affecting their records, providing available information about the incident, likely effects, mitigation and contact arrangements, with updates as information becomes available. The organiser remains responsible for required regulator and participant notifications.

The organiser authorises the hosting infrastructure needed to provide Business mode. Lovable Cloud is the current platform provider. The legal entities, downstream provider list and locations must be documented before this DPA is finalised. Stripe is a payment provider, not an intended recipient of participant leads.

We will give advance written notice of proposed new or replacement sub-processors and a reasonable opportunity to object on data-protection grounds. We will impose equivalent protective obligations and remain responsible for sub-processor performance under this DPA.

Restricted international transfers require a lawful UK GDPR mechanism and appropriate safeguards. No UK-only hosting commitment is made by this draft.

Taking account of the nature of processing and information available to us, we will assist with data-subject requests, security obligations, breach response, impact assessments and prior consultation where required by UK GDPR.

We will make information reasonably necessary to demonstrate compliance available and allow and contribute to audits, including inspections, by the organiser or an authorised auditor. Reasonable arrangements may protect other customers’ data, confidentiality and service availability without defeating these rights.

At the organiser’s choice on termination, we will return participant data in an available export format or delete it and delete existing copies unless law requires retention. Organisers can export CSV and delete active lead records in workspace settings.

Restricted backup copies are removed through the applicable provider lifecycle; the schedule must be documented before this agreement is finalised. Data must not be restored for ordinary use after deletion. The organiser is responsible for deleting its own exported copies.

The organiser must provide participants with its own privacy notice, identify a lawful basis for required name/email collection, establish retention periods, respond to requests and ensure instructions are lawful.

Marketing permission is optional, separate and initially unticked. The organiser must comply with UK GDPR and applicable electronic-marketing rules, honour withdrawals and retain adequate consent evidence for its intended communications. The presence of a checkbox alone does not establish compliance.

This DPA is governed by the law of England and Wales subject to mandatory applicable protections. It should be reviewed with the service terms and privacy policy.

The proprietor’s full legal name, service address, data-protection contact, sub-processor schedule and retention arrangements are awaiting confirmation. Complete these items and obtain appropriate legal review before relying on this draft as a binding Article 28 agreement.