Data Processing Agreement (DPA)

This is a translation for convenience. The Portuguese version is the legally binding one.

The sports club is the controller responsible for the personal data it enters into the platform (athletes, parents/guardians, members, coaching staff).

ProClub acts as processor (under Article 28 of the GDPR), processing the data on behalf of and under the instructions of the club.

Purpose: operation of the club management platform, including hosting, processing, support and maintenance activities.

Duration: for the term of the contract between the club and ProClub, with confidentiality obligations continuing after its end.

Sports and administrative management processing: enrolments, training sessions, matches, evaluations, communications, payment of membership fees and shop purchases, clinical data when recorded by the club.

Purposes strictly related to the provision of the service to the club.

Data subjects: athletes (including minors), parents/guardians, members, coaching staff and club employees.

Data: identification, contact details, sports and attendance data, school and clinical data where applicable, billing data.

ProClub processes data only according to the club's documented instructions, including this platform and its permission settings.

The club declares that it has the necessary legal bases and authorizations, including, where applicable, authorization from parents/guardians for the processing of minors' data.

ProClub's authorized personnel are bound by confidentiality duties and access data only to the extent necessary to provide the service.

Appropriate technical and organizational measures: encryption in transit and at rest, role-based access control verified at the database level, segregation per club (multi-tenant with access policies), audit logs and vulnerability management.

ProClub may use sub-processors (hosting, database, transactional emails, payments), keeping them subject to the same obligations. The list of sub-processors is available upon request.

Material changes to the list of sub-processors will be communicated to the club, which may object on reasonable grounds.

Where applicable, transfers to third countries are covered by appropriate safeguards under the GDPR.

ProClub notifies the club without undue delay and within a maximum of 48 hours of becoming aware of a personal data breach attributable to it, providing the necessary cooperation for legal notifications.

ProClub assists the club in complying with its obligations regarding data subject rights, impact assessments and consultations with the supervisory authority.

Upon termination of the contract, ProClub deletes or returns the data to the club, within the agreed timeframes and conditions, except where retention is required by law.