Data Processing Agreement (DPA) – Club add-on

Version as of: 10 August 2026 · Annex to § 15 of the Terms, applies exclusively to clubs that order the club add-on.

Note: For better readability, the masculine form is used for references to persons. It applies equally to all genders.

1. Contracting parties and subject matter

This data processing agreement (DPA) pursuant to Art. 28 GDPR applies between the club, represented by a person authorised to do so (hereinafter “Controller”), and Andrzejewski, Mahnke, Hengelhaupt & Bornholdt Fussball-Performance GbR, Schwarzer Weg 14, 21244 Buchholz (hereinafter “Processor”). It takes effect upon the ordering of the club add-on (§ 15 of the Terms) and applies for the duration of the use of the club add-on.

2. Subject matter and purpose of the processing

The Processor processes personal data on behalf of the Controller insofar as it arises in the club add-on. The club add-on serves the administration of pitches and their allocation, of fixtures and rescheduling, of club news and of the cafeteria rota. Org users such as the board, coordinator, groundskeeper or cafeteria team do not gain any insight into the data of a team in the process: neither into player lists nor into ratings, attendance, absence periods or contact details of players and legal guardians. For processing within an individual team, the Processor remains directly the controller in accordance with the privacy policy.

3. Categories of data subjects and data

The data subjects are the coaches and team staff of the teams as well as the Org users of the club. Their name, email address and club or team affiliation are processed, as well as the data created in the club add-on itself: pitch and allocation data, booking and rescheduling requests, dates, club news and rota entries.

Data of players and legal guardians reaches the Controller in only one way: a coach can generate an attendance report as a PDF from within his team and pass it on himself, for example to reconcile the membership list. The report contains names, shirt numbers, attendance rates and the dates of missed training sessions. The Processor merely provides the output function; whether, when and to whom such a report is passed on is decided solely by the coach. No automatic transmission to the club takes place.

4. Obligation to follow instructions

The Processor processes the data exclusively on documented instructions from the Controller. The way the club add-on works and this DPA constitute a general instruction for the provision of the contractually agreed services. Any further individual instructions must be given in text form.

5. Technical and organisational measures

The Processor takes the technical and organisational measures described in the privacy policy (item 8) pursuant to Art. 32 GDPR (including a hardened server, restricted SSH access, firewall, automatic security updates, encrypted connections, daily automated backups with restore tests) and maintains them for the duration of the contract.

6. Sub-processors

The Controller grants general authorisation for the use of the following sub-processors, as described in the privacy policy (item 7):

— Hostinger International Limited (Cyprus, server location Frankfurt am Main) — hosting of the platform including the database
— Google LLC (USA) — Firebase Cloud Messaging, push notifications in the native app; standard contractual clauses, in addition EU-US Data Privacy Framework
— checkdomain GmbH (Lübeck, server location Germany) — email delivery
— Cloudflare, Inc. (USA) — reverse proxy, protection against overload attacks and encrypted off-site backup (storage region EU); standard contractual clauses

The Processor informs the Controller of the engagement of further sub-processors or the replacement of existing ones with reasonable advance notice; the Controller may object within two weeks on grounds relevant under data protection law.

7. Assistance, notification obligations and control

The Processor assists the Controller in fulfilling the rights of data subjects (Art. 15 to 22 GDPR) and notifies it without undue delay of any personal data breach, at the latest within 48 hours of becoming aware of it. On request, the Controller may satisfy itself of compliance with this DPA (evidence, self-disclosures); an on-site inspection is possible after prior notice.

8. Deletion and return

After the end of the club add-on, the Processor deletes the data processed on behalf of the Controller or returns it on request, unless a statutory retention obligation prevents this, in accordance with the periods stated in the privacy policy (item 9).

9. Liability

The statutory provisions apply to the liability of the parties, in particular Art. 82 GDPR, and in addition § 9 of the Terms.