This is a standard template provided for transparency and is subject to review by our legal counsel before launch. For questions, please contact us.
On this page
This Data Processing Addendum ("DPA") forms part of the agreement between BallOBall ("Processor") and the customer ("Controller") and applies where we process personal data on the Controller’s behalf (e.g. the league, team, player, and official data uploaded to the Service).
1. Roles
The Controller determines the purposes and means of processing the league data; the Processor processes that data only on documented instructions from the Controller, including as set out in the agreement and the product configuration.
2. Scope of processing
Subject matter: provision of the Service. Duration: the term of the agreement plus any retention period. Nature & purpose: hosting, scoring, scheduling, analytics, and fan‑facing publication as configured. Data subjects: players, coaches, officials, guardians, staff, and fans. Data categories: contact details, roster and performance data, and any media the Controller uploads.
3. Security
The Processor maintains appropriate technical and organizational measures, including row‑level tenant isolation, encryption in transit, least‑privilege access, and audit logging, designed to protect personal data against unauthorized access, loss, or disclosure.
4. Sub‑processors
The Controller authorizes the Processor to engage sub‑processors (e.g. cloud hosting, email, payments, analytics) under written terms providing equivalent protection. We will make a current sub‑processor list available on request and give notice of material changes.
5. Assistance & data‑subject requests
The Processor will, taking into account the nature of processing, assist the Controller in responding to data‑subject requests and in meeting security, breach‑notification, and impact‑assessment obligations.
6. Personal‑data breaches
The Processor will notify the Controller without undue delay after becoming aware of a personal‑data breach affecting the Controller’s data, with information reasonably necessary for the Controller to meet its own obligations.
7. Deletion & return
On termination, the Processor will, at the Controller’s choice, delete or return the league data (subject to legal retention requirements) within a reasonable period.
8. International transfers
Where personal data is transferred across borders, the parties will rely on an appropriate transfer mechanism (such as Standard Contractual Clauses) as required by applicable law.