Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Every Player ("we", "us", the "Processor") and the club, coach or organisation using the EveryPlayer platform (the "Controller"). It applies whenever we process personal data on the Controller's behalf in connection with the Service.

We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC179013.

1. Roles

The Controller determines the purposes and means of processing player, parent and coach data entered into the Service. We act as Processor in relation to that data, and only process it on the Controller's documented instructions, which include the Controller's use of the Service.

2. Subject matter and duration

We process personal data for as long as the Controller's account is active, and for up to 90 days after cancellation in line with the Privacy Policy.

3. Categories of data and data subjects

• Players and squad members (including minors): name, date of birth, position, age group, photo, assessment scores, development plans, coaching notes and attendance.
• Parents and guardians: name, email, link to their child's profile, self-assessments and concerns submitted.
• Coaches and club staff: name, email, role and team assignments.

4. Our obligations as Processor

• Process personal data only on the Controller's documented instructions.
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (encryption in transit and at rest, role-based access, audit logging, regular reviews).
• Assist the Controller in meeting requests from data subjects and obligations under Articles 32–36 of the UK GDPR.
• Notify the Controller without undue delay after becoming aware of a personal data breach.
• Delete or return personal data at the Controller's choice at the end of the Service, subject to legal retention requirements.

5. Subprocessors

The Controller authorises us to engage the subprocessors listed in our Privacy Policy (hosting, database, email delivery and payments / Paddle.com as Merchant of Record). We will inform the Controller of any intended changes and remain responsible for subprocessor performance.

6. International transfers

Where personal data is transferred outside the UK, we rely on appropriate safeguards under the UK GDPR, including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. Audits

On reasonable written request, we will provide the Controller with the information necessary to demonstrate compliance with this DPA, such as security summaries and subprocessor lists.

8. Contact

Questions about this DPA? Email hello@everyplayer.app.