Skip to main content

Data processing agreement (AVV)

Draft

This page is a draft, written from the code and server configuration on 14 October 2026. It has not been reviewed by a lawyer yet and is not ready to sign. It describes what Clubkit actually does today; open gaps are marked open.

The data processing agreement (Auftragsverarbeitungsvertrag, Art. 28 GDPR) between your club and the provider of Clubkit. The German version prevails; this English version is for information.

Version: 14 October 2026 (draft)

Parties​

Controller (the "Club"):

[Club name] [Address] represented by [name, position]

Processor (the "Provider"):

Mac Beagan – Web Development Isartalstr. 16 80469 München, Germany Email: hello@clubkit.team

The Provider operates the club platform Clubkit (web admin, member app, public club website) at clubkit.team.

1. Subject matter and duration​

1.1 The Provider processes personal data on behalf of the Club by providing Clubkit to it. The basis is the Club's use of Clubkit ([main agreement / terms of use, date]).

1.2 This agreement applies for as long as the Provider processes personal data for the Club. It ends automatically with the main agreement; clause 11 (deletion and return) survives.

2. Nature, purpose and scope​

2.1 Purpose: running club life: member administration, teams and squads, events with replies, attendance, matches with live scores, messages by app, push and email, fee status, consents (e.g. photos), guardian administration and the public club website.

2.2 Nature of processing: collecting, storing, organising, synchronising to the devices of authorised users, displaying, transmitting (email, push), publishing on the club website (only where the Club enables it and consent exists), backing up, anonymising and deleting.

2.3 Categories of data subjects:

  • club members (adults and minors)
  • guardians and contact persons of minor members
  • coaches and officials
  • fans / followers of the club (account data and the follow only)
  • people who send a join request or receive an invitation

2.4 Categories of personal data:

  • master data: name, email address, phone number, date of birth, nationality, playing position, shirt number, team membership, role in the club
  • emergency contact (name, phone)
  • profile and membership photos
  • participation data: replies, attendance, availability including notes, line-ups, match events (e.g. goal scorers)
  • fee data: fee tier, payment status, notes by club staff (no bank details)
  • consents (per channel: internal, club website, Facebook, Instagram, press) with time and the person who gave them
  • links between guardians and children
  • account data: login email, password (stored only as a hash), sessions with IP address and browser/device identifier, push tokens, notification settings
  • content: announcements and messages sent within the club

2.5 Special categories (Art. 9 GDPR): the "medical notes" field may hold health data. The Club decides whether and how to use it. The platform shows it only to the member, their guardians, club admins and the coaches of the member's teams.

3. Instructions​

3.1 The Provider processes the data only on documented instructions from the Club. This agreement and the settings and actions the Club takes in Clubkit are instructions. Further instructions are given in text form to the email address above.

3.2 If the law requires the Provider to process data otherwise, the Provider tells the Club beforehand unless the law forbids it.

3.3 If the Provider considers an instruction unlawful, it tells the Club without delay and may suspend it until the Club confirms or changes it.

4. Club's obligations​

The Club is responsible for the lawfulness of processing, in particular the legal basis, informing members (Art. 13/14 GDPR), obtaining consents (e.g. for photos and for minors) and assigning club roles. The Club tells the Provider without delay if it notices errors or irregularities.

5. Confidentiality​

The Provider only uses people bound to confidentiality or under a statutory duty of secrecy. Currently only the owner (Mac Beagan) has access to the production systems.

6. Security (Art. 32 GDPR)​

The Provider applies the technical and organisational measures in Annex 1 (toms.en.md). It may develop them further as long as the level of protection does not drop. It documents material changes and tells the Club.

7. Sub-processors​

7.1 The Club gives general authorisation to use the sub-processors in Annex 2 (subprocessors.en.md).

7.2 The Provider tells the Club in text form at least [30] days before adding or replacing a sub-processor. The Club may object for a good data-protection reason. If the parties cannot agree, the Club may terminate the main agreement effective at the change.

7.3 The Provider binds every sub-processor by contract to data protection obligations equivalent to this agreement.

7.4 Processing outside the EU/EEA only takes place where Art. 44 et seq. GDPR are met (e.g. adequacy decision including the EU-US Data Privacy Framework, or standard contractual clauses). Annex 2 lists which services this concerns.

8. Data subject rights​

8.1 The Provider helps the Club with suitable technical means to answer data subject requests (access, rectification, erasure, restriction, portability, objection).

8.2 Clubkit offers today:

  • members edit their own profile data;
  • members export their own data as a file (access, portability);
  • members delete their own account; their membership is then anonymised (details in retention.en.md);
  • consents can be changed in the app at any time;
  • club admins can edit member data and delete members who have no account.

8.3 If a data subject contacts the Provider directly, the Provider forwards the request to the Club without delay.

9. Further assistance (Art. 32–36 GDPR)​

The Provider assists the Club with security, breach notifications, a data protection impact assessment and prior consultation of the supervisory authority, as far as it has the necessary information.

10. Personal data breaches​

The Provider notifies the Club of a personal data breach without undue delay, where possible within [48] hours of becoming aware of it, with the information in Art. 33(3) GDPR as far as known. The Club remains responsible for notifying the supervisory authority and the data subjects.

11. Deletion and return at the end​

11.1 When the service ends, the Provider gives the Club an export of its data on request (e.g. member list as CSV) and then deletes the Club's data, at the latest [90] days after the end, unless the law requires retention.

11.2 Data in backups is not deleted individually; it disappears as backups expire (currently 30 days, see Annex 1).

11.3 User accounts that are also used in other clubs remain; the data belonging to this Club is deleted.

12. Evidence and audits​

12.1 On request the Provider gives the Club the information needed to show compliance with this agreement (in particular the current TOMs).

12.2 The Club may carry out audits itself or through an auditor bound to confidentiality, with reasonable notice (usually [14] days) and without disproportionate disruption. As the systems run at Hetzner, an on-site audit covers the Provider's own way of working; for the data centre, Hetzner's evidence applies.

13. Liability​

Art. 82 GDPR applies. [Further liability rules from the main agreement, if any.]

14. Final provisions​

14.1 Changes require text form.

14.2 In data protection matters this agreement prevails over the main agreement.

14.3 If a provision is invalid, the rest remains valid.

14.4 German law applies. [Place of jurisdiction: Munich, where permitted.]

14.5 The German version prevails.

Annexes​

Place, date: ____________________

For the Club: ____________________

For the Provider (Mac Beagan – Web Development): ____________________