Data Processing Agreement

This agreement governs the processing of club members’ personal data in Book & Row under Article 28 GDPR. The parties are the club using the service (the controller) and Softeo Aleksander Rakucki, tax ID (NIP) 5242947071, correspondence address: ul. Laurowa 35/5, 03-197 Warszawa (the processor, “we”).

§ 1. Conclusion and term

The club concludes this agreement together with the agreement to use the service and confirms its acceptance electronically, for example by a message from the persons authorised to represent it.

The agreement remains in force for as long as the agreement to use the service. In matters of personal data it takes precedence over the Terms of Service.

§ 2. Subject and scope

We process data solely to provide the club with the Book & Row service: we store and organise it, make it available to people in the club according to their roles, send notifications and delete it.

This concerns the people the club invites to the service: athletes, including minors, coaches and managers.

Types of data:

• identification and contact data: name, email address, phone number, photo;
• profile data, including year of birth, gender, height, weight and rowing preferences;
• club activity data: training sessions, outings, sign-ups, results, plans, announcements, fault reports and notes;
• membership fee data: amounts, due dates and payment status;
• technical data: days on which the service was used, push notification subscriptions, IP address and logs.

The service is not intended for special categories of data (Article 9 GDPR), such as health data. The club does not enter such data into the service, including in free-text fields.

We also use technical data for our own purposes: to maintain, secure and develop the service. To that extent we are its controller.

§ 3. Our obligations

We process data only on documented instructions from the club. The instructions are this agreement, the Terms of Service and the actions taken in the service by people the club has authorised. If an instruction would infringe the law, we inform the club.

In addition:

• only people we have authorised and who are bound by confidentiality have access to the data;
• we apply the security measures required by Article 32 GDPR, including an encrypted connection, passwords stored as irreversible hashes, separation of each club’s data, role-based access and backups;
• we help the club respond to requests from data subjects and meet its obligations under Articles 32–36 GDPR, as far as the nature of the service allows;
• we provide the club with the information needed to demonstrate that we comply with this agreement.

§ 4. Sub-processors

The club agrees that we may use sub-processors. Currently this is a hosting provider based in Poland, which maintains the server, database, files and outgoing email. We give its name at the club’s request.

We impose on them data protection obligations no less strict than in this agreement and are liable for their actions as for our own.

We inform the club of any intended addition or replacement of a sub-processor at least 14 days in advance. The club may object by terminating its use of the service.

Data is stored in the European Economic Area. Push notifications reach the device through the push service of the browser the user has chosen. Their content is encrypted and the browser provider cannot read it.

§ 5. Personal data breaches

We notify the club of a personal data breach without undue delay after becoming aware of it and provide the information the club needs to report it to the supervisory authority.

§ 6. Audits

The club may verify that we comply with this agreement. We first answer its questions in writing. An on-site audit is possible with at least 14 days’ notice and no more than once a year, unless a breach has occurred. The club bears the cost of the audit.

§ 7. End of processing

After the agreement ends, we delete the club’s data without undue delay. It disappears from backups as they are overwritten.

If the club asks before the agreement ends, we first hand over its data in a commonly used electronic format.

§ 8. The club’s responsibilities

The club is responsible for having a legal basis to process the data it enters, for informing its members that their data is processed in the service, and for obtaining the consent of legal guardians where required.

We are liable for damage under Article 82 GDPR, that is only where we have not complied with obligations imposed on us by the GDPR or this agreement, or have acted outside or contrary to the club’s instructions.

§ 9. Changes and governing law

We announce changes to this agreement at least 14 days in advance. A club that does not accept them may stop using the service within that time.

Matters not covered here are governed by the GDPR and Polish law.

Matters concerning this agreement should be sent to hello@softeo.dev.