Data Processing Agreement

1. Parties and subject matter

This Data Processing Agreement (the “DPA”) is concluded between the club using the spartON service (the “Club” or “controller”) and MACET, s.r.o., Nitrianska 32/189, 949 11 Nitra, IČO 35953781, Zapísaná v Obchodnom registri Okresného súdu Nitra, oddiel: Sro, vložka č. 17071/N (the “Processor”) pursuant to Article 28(3) of Regulation (EU) 2016/679 (the “GDPR”) and Slovak Act No. 18/2018 Coll. on Personal Data Protection.

The DPA forms part of the Terms of Service for Clubs (the “Terms”) and is concluded by the Club together with them upon registration. Terms defined in the Terms have the same meaning in this DPA.

The subject matter of the DPA is to set out the conditions under which the Processor processes personal data on behalf of the Club when providing the spartON service (the “Service”). In matters of personal data protection, this DPA prevails over the Terms.

2. Duration

The DPA is concluded for the term of the agreement for the provision of the Service under the Terms. The Processor’s obligations continue after its termination until the Processor has deleted or returned the Club’s personal data in accordance with Section 9.

3. Nature and purpose of processing

The purpose of processing is to provide the Service to the Club, in particular keeping records of members and groups, issuing and recording payment requests and payments, recording attendance, receiving applications, communicating with members and guardians (e-mail, push notifications, SMS), managing events and creating posts with artificial intelligence, and storing and sharing documents.

Processing includes in particular collection, recording, organisation, storage, retrieval, consultation, transmission (message delivery), making available to authorised Club users, backup, restriction and erasure of personal data. Processing is carried out by automated means in the Service’s information system.

4. Categories of data subjects and personal data

Data subjects: Club members and participants in its activities, including minors; members’ legal guardians; applicants who have submitted an application; coaches, group leaders, staff and volunteers of the Club; other persons whose data the Club enters into the Service.

Categories of personal data: identification data (first name, surname, date of birth), contact details (e-mail, phone, address), membership and group assignment data, attendance data, payment request and payment data, content of applications and messages, photos and documents uploaded by the Club, user account data and technical data on their use.

Special categories of personal data (for example health data) are processed only if the Club enters them into the Service; the Club is responsible for having a legal basis under Article 9 GDPR and for minimising such data.

5. Obligations of the Processor

The Processor shall: (a) process personal data only on documented instructions from the Club, including with regard to transfers to a third country, unless required to do so by Union or Member State law, in which case it shall inform the Club of that legal requirement beforehand unless that law prohibits it. Documented instructions consist of the Terms, this DPA and the settings and actions the Club performs in the Service;

(b) ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

(c) take all measures required under Article 32 GDPR (Section 11);

(d) respect the conditions for engaging another processor (Section 6);

(e) taking into account the nature of the processing, assist the Club by appropriate technical and organisational measures in responding to requests for exercising data subjects’ rights (Section 7);

(f) assist the Club in ensuring compliance with the obligations under Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to the Processor (Sections 7 and 8);

(g) delete or return personal data after the end of the provision of the Service in accordance with Section 9;

(h) make available to the Club all information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections (Section 10).

The Processor shall inform the Club without undue delay if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

6. Sub-processors

The Club grants the Processor general written authorisation to engage sub-processors. At the time this DPA is concluded, they fall into the following categories:

Hosting and infrastructure provider established in, and with data centres in, the European Union – operation of servers and the database, storage and backup of all Service data.

E-mail delivery provider – delivery of e-mail messages (recipient address, message content).

SMS gateway provider – delivery of SMS messages (recipient phone number, message content). Operators of web browser push services deliver push notifications whose content is encrypted in transit.

Anthropic (USA) – generation of post texts using artificial intelligence. Only the event description and photos that the Club uploads for that purpose are passed on; personal data from the member records is not passed on. If photos show identifiable persons, the Club is responsible for uploading them. Under its contractual terms, the provider does not use this data to train its models.

Stripe – card payment processing. For card payments, Stripe acts as an independent controller of payment data under the agreements it concludes with the Club and the payer; the Processor passes on only the data needed to create the payment (amount, payment description, reference to the payment request).

Meta (Facebook, Instagram) – only if the Club connects its page or account and a post is published on its instruction. Only post content approved by the Club (text and photos) is passed on; once published, Meta processes it under its own terms accepted by the Club.

The Processor will inform the Club of any intended addition or replacement of a sub-processor by e-mail to the Club Administrator at least 30 days in advance. The Club may object on reasonable data protection grounds; if the parties cannot agree, the Club may terminate the agreement with effect from the date of the change. The Processor shall impose on each sub-processor the same data protection obligations as apply to itself and remains liable to the Club for the sub-processor’s performance. The current list of specific sub-processors is available on request at info@sparton.eu.

Personal data is transferred to third countries only in compliance with Chapter V GDPR, in particular on the basis of an adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses adopted by the European Commission.

7. Assistance with data subject rights and other obligations

The Service allows the Club to search, view, rectify, export and delete data subjects’ data, thereby assisting it in handling requests under Articles 15 to 22 GDPR. If the Processor receives a data subject request concerning the Club’s data, it will forward it to the Club without undue delay and will not respond to it itself unless authorised by the Club.

On request, the Processor will provide the Club with information necessary for a data protection impact assessment and prior consultation with the supervisory authority, as well as information on the security of processing.

8. Personal data breach

The Processor shall notify the Club of a personal data breach affecting the Club’s data without undue delay and no later than 48 hours after becoming aware of it.

The notification shall include, to the extent the information is available: a description of the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point for further information. Information not immediately available shall be provided in phases without undue delay.

The Processor shall promptly take reasonable measures to mitigate the effects of the breach and assist the Club in notifying the supervisory authority and data subjects. Notifying the supervisory authority and data subjects is the Club’s obligation.

9. Deletion and return of data

The Club may export its data at any time during the agreement and for 30 days after it ends. After that period, the Processor will irreversibly delete the Club’s personal data, including copies, except for data whose retention is required by Union or Member State law.

Copies in backups are deleted in the ordinary backup rotation cycle; until then they are protected by the same measures and are not used for any other purpose. The Processor will confirm the deletion in writing on request.

10. Audits and inspections

On request, the Processor will provide the Club with the information necessary to demonstrate compliance with this DPA, in particular a description of the technical and organisational measures and the list of sub-processors.

The Club or an auditor mandated by it and bound by confidentiality may carry out an audit or inspection with at least 30 days’ prior notice, as a rule no more than once per calendar year, except in the event of a personal data breach or at the request of a supervisory authority. Audits shall be carried out so as to minimise disruption to the Service and not to endanger other clubs’ data; the costs of the audit are borne by the Club.

11. Technical and organisational measures

The Processor has implemented in particular the following measures: encryption of communications (HTTPS/TLS); storing passwords only as Argon2id hashes; logical separation of each club’s data and authorisation checks on every access to club data; role-based access and the principle of least privilege; login rate limiting and other abuse protections; regular backups; storage of data in data centres in the European Union; logging of security-relevant events; ongoing software updates; minimisation of data passed to sub-processors (in particular for artificial intelligence); confidentiality undertakings of authorised persons; and an incident response procedure.

The Processor may change these measures provided that the level of personal data protection is not reduced.

12. Final provisions

The parties’ liability is governed by Article 82 GDPR and the Terms. This DPA is governed by the laws of the Slovak Republic and is amended in the same manner as the Terms.

The Processor’s contact address for data protection matters is info@sparton.eu.