Data processing agreement (GDPR art. 28)

1. Parties and purpose

The club (“controller”) and Sidahmed Larbi Youcef EI (nom commercial : Deep Moats), publisher of Lapelio (“processor”). The processor processes personal data on the club's behalf, only to provide Lapelio, for as long as the subscription lasts.

2. Description of processing

• Purposes: running members, dues and payments, payment reminders, attendance, club documents and events.
• Data subjects: members, payers (often parents), emergency contacts, prospects, coaches.
• Data: identity and contact, membership and club life, payments, messaging consents, uploaded documents (which may include a medical certificate, i.e. health data).
• Operations: collection, storage, consultation, sending messages at the club's request, matching Stripe payments, export, erasure.

3. Our commitments

• Process data only on the club's documented instructions: its settings and actions in Lapelio are its instructions. We tell you if an instruction seems to breach the GDPR.
• Never sell the data or use it for our own purposes or for advertising.
• Confidentiality: only people who need access have it, and they are bound to secrecy.
• Security (art. 32): encrypted connections, two-factor sign-in, each club isolated in the database, encrypted tokens, logs without personal data, backups, tracked security updates.
• Help the club answer data subjects' requests (access, correction, erasure, portability): most are done directly in the app, export included.
• Help the club with security, a data protection impact assessment or a consultation of the authority, where useful.

4. Sub-processors

The club authorises the subprocessors listed in the privacy policy. We impose the same data protection obligations on them. We email the club at least 30 days before adding or changing one; the club may object on serious grounds and cancel free of charge if we find no solution.

Stripe is not our subprocessor for your payments: it is your own provider, under your own contract. Lapelio accesses it with your permission.

5. Location and transfers

Data is stored in the European Union (Ireland). A transfer outside the EU only happens to the listed subprocessors, covered by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

6. Data breach

We tell the club without undue delay, and at the latest 48 hours after becoming aware of a breach affecting its data, with what we know (nature, data and people affected, measures taken), so the club can notify its authority within 72 hours if needed.

7. End of contract

When the subscription ends, the club can export all its data for 30 days. Then we erase it, backups included as they expire, unless the law requires us to keep it.

8. Evidence and audit

We make available the information needed to show compliance with this agreement. The club may request one audit a year, with 30 days' notice, at its own cost, done by itself or an auditor bound to secrecy, with no access to other clubs' data. Contact: TODO_FOUNDER@example.com.

9. The club's commitments

The club has a legal basis for every piece of data it enters, informs its members, enters only what is needed (no health data in free-text notes), collects the consents required for messages, and passes us any request it can't handle itself.