Data Processing Agreement

Roles

The subscribing organisation ("the club") is the controller of the personal data of its players and staff. Day One Padel ("we") is its processor. This agreement meets Article 28 of the UK GDPR.

What we process

Subject matter and purpose: providing the platform and any services the club buys. Duration: the subscription and the 30 days after it ends.

People: the club's players, customers, members and staff. Data: names, contact details, gender and level where given, bookings, payments, memberships, marketing preferences and platform usage. We do not ask for special category data and the club should not upload it.

Our obligations

We process the data only on the club's documented instructions, which are these terms and the club's use of the platform.

Everyone who can access the data is bound to confidentiality.

We keep the data secure with measures suited to the risk: encryption in transit, hashed passwords, encrypted credentials, separation between organisations enforced in the database, and least privilege access.

We help the club answer requests from individuals and meet its duties on security, breaches and impact assessments.

We tell the club without undue delay, and within 48 hours of becoming aware, of any personal data breach affecting its data.

At the end of the subscription we let the club download its data for 30 days and then delete it, including from backups within a further 30 days, unless the law requires otherwise.

We make available the information needed to show we meet this agreement and allow reasonable audits on 30 days' notice, no more than once a year.

Subprocessors

The club authorises the subprocessors below. We give 30 days' notice by email before adding or replacing one; the club may object, and if we cannot resolve the objection the club may cancel without penalty.

Netlify, Inc.: Hosting of the website and the portal. Location: United States and global edge network.

Netlify Database (Postgres): Storage of club and player data. Location: United States (moving to London).

Anthropic, PBC: The AI behind Strategise and the written report brief. Receives club figures and, when a user asks for them, player names and activity; no data is used to train models. Location: United States.

International transfers

Where data leaves the UK we rely on UK adequacy regulations or the UK International Data Transfer Agreement, or the UK Extension to the EU Standard Contractual Clauses, with each subprocessor.

Contacting players

The club decides which players are contacted and on what lawful basis, and confirms its own terms or consents cover it. We keep each player's recorded marketing preference, include an opt out in messages sent through the platform, and remove anyone who opts out from the club's future lists.