Contakt Academy Data Processing Agreement

1. Parties, roles and precedence

This Data Processing Agreement ("DPA") is entered into between Contakt, a sole proprietorship (eenmanszaak) under Dutch law, registered with the Dutch Chamber of Commerce under KvK number 92963307, VAT identification number NL004906869B24, established in Diemen, the Netherlands ("Contakt"), acting as processor, and the organization identified in the accepted Order, acting as controller (the "Customer").

This DPA forms part of the Contakt Academy business subscription terms and applies to all personal data that Contakt processes on the Customer's behalf. Where this DPA conflicts with those terms on a data-protection matter, this DPA prevails.

The Customer is the controller for personal data concerning its members, their parents or guardians, minors, coaches, staff and other people whose data it enters into or generates through the service. Contakt is an independent controller for its own account, billing, security, and legal-compliance records relating to the Customer as a business, and that processing is described in the Contakt Academy privacy notice rather than here.

2. Subject matter, duration, nature and purpose

Subject matter: provision of the Contakt Academy club-operations service — scheduling, memberships, programs, bookings, communication, payments administration and related operational functions.

Duration: for as long as the subscription is in effect, plus the return-and-deletion period in clause 10.

Nature and purpose: hosting, storing, organizing, structuring, retrieving, transmitting and deleting personal data so that the Customer can operate its club, and no other purpose. Contakt does not process this personal data for its own commercial purposes, does not sell it, and does not use it to train general-purpose models.

3. Categories of data subjects and personal data

The service is not designed for special categories of personal data under Article 9 GDPR. The Customer must not enter health, biometric or other special-category data into free-text fields unless the parties have agreed a specific lawful arrangement in writing. Where the Customer records data about minors, the Customer is responsible for the lawful basis and for guardian consent where required.

4. Contakt's obligations as processor

• Contakt processes personal data only on the Customer's documented instructions, which include this DPA, the Order, the configuration the Customer sets in the service, and support requests the Customer makes. Contakt informs the Customer if an instruction infringes the GDPR or other Union or Member State law.
• Contakt ensures that personnel authorized to process personal data are bound by an appropriate duty of confidentiality.
• Contakt implements the technical and organizational measures in clause 6.
• Contakt respects the conditions in clause 7 for engaging another processor.
• Contakt assists the Customer with data-subject requests under clause 8, and with security, breach-notification and impact-assessment obligations under clauses 9 and 6.
• Contakt deletes or returns personal data under clause 10 at the end of the service.
• Contakt makes available the information needed to demonstrate compliance with Article 28 and allows for audits under clause 11.
• Where a legal obligation requires Contakt to process personal data beyond the Customer's instructions, Contakt informs the Customer of that requirement before processing, unless the law prohibits that notice.

5. The Customer's obligations as controller

• The Customer determines the purposes and means of the processing and is responsible for its lawful basis, for the information it gives its own data subjects, and for obtaining and recording any consent it relies on, including guardian consent for minors.
• The Customer configures roles, permissions and retention settings appropriately, and removes access when a user's authority ends.
• The Customer does not enter personal data that the service does not require, and does not use the service in a way that infringes another person's rights.
• The Customer's instructions to Contakt must comply with applicable data-protection law.

6. Security measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing as well as the risk to data subjects, Contakt implements and maintains appropriate technical and organizational measures, including:

• encryption of data in transit using current TLS, and encryption at rest for the managed database and for stored payment-provider credentials;
• logical separation of each organization's data, enforced in the application's data-access layer and verified by automated tests, so that a request scoped to one organization cannot read another organization's records;
• role-based access control inside the service, with separate owner, administrator, office, front-desk, coach and member roles;
• authentication through a managed identity provider, with password-strength enforcement and session revocation;
• least-privilege administrative access to production systems, restricted to named individuals;
• encrypted, regularly taken backups of the production database, with restore rehearsed on an isolated target before schema changes;
• audit logging of administrative and security-relevant actions;
• rate limiting and abuse protection on authentication and payment-related endpoints;
• dependency and configuration review before a production release, including automated type, lint and test gates; and
• a documented procedure for detecting, escalating and reporting a personal-data breach.

7. Subprocessors

The Customer gives Contakt general written authorization to engage the subprocessors listed below. Contakt imposes on each subprocessor, by written contract, data-protection obligations that are no less protective than those in this DPA, and remains fully liable to the Customer for the performance of that subprocessor's obligations.

7.1 Changes to the subprocessor list

Contakt gives the Customer at least 30 days' notice before adding or replacing a subprocessor, by email to the workspace's administrative contact and by publishing a new version of this DPA. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the subscription without penalty, with a pro-rata refund of prepaid charges for the unused period.

Where the Customer connects its own payment account, the Customer contracts that payment provider directly for member payments; that provider is the Customer's own processor or controller for those payments and not a Contakt subprocessor.

8. Data-subject rights

Taking into account the nature of the processing, Contakt assists the Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests to exercise data-subject rights under Chapter III GDPR.

The service provides the Customer with self-service access to view, correct, export and delete the personal data in its workspace, which will in most cases be sufficient to answer a request without Contakt's involvement. If a data subject contacts Contakt directly about data in the Customer's workspace, Contakt will not respond substantively but will refer the request to the Customer without undue delay.

9. Personal-data breaches

Contakt notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal-data breach affecting personal data processed on the Customer's behalf.

The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information. Where that information is not all available at once, Contakt provides it in phases without undue further delay.

Contakt does not notify a supervisory authority or a data subject on the Customer's behalf unless the Customer instructs it to do so in writing; the notification obligation under Articles 33 and 34 GDPR remains the Customer's.

10. Return and deletion

During the subscription and for 30 days after its effective end date, the Customer may export its personal data from the service in a structured, commonly used, machine-readable format.

After that period, and at the Customer's choice, Contakt deletes or returns the personal data it processes on the Customer's behalf and deletes existing copies, within 60 days, unless Union or Member State law requires storage. Encrypted backups age out on the standard backup cycle, which does not exceed 35 days, after which the data is unrecoverable.

Contakt may retain records it is legally required to keep, including invoices and transaction records for the statutory retention period, and limits processing of that retained data to compliance with the obligation.

11. Audits

Contakt makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates.

The Customer may request an audit at most once per calendar year, on at least 30 days' written notice, except after a personal-data breach affecting the Customer's data or where a supervisory authority requires it. An audit takes place during business hours, does not unreasonably disrupt Contakt's operations, may not access another customer's data, and is subject to confidentiality. Each party bears its own costs for the first audit in any calendar year.

12. International transfers

Personal data is hosted and primarily processed within the European Union. Where a subprocessor listed in clause 7 processes personal data outside the European Economic Area, that transfer takes place under the European Commission's Standard Contractual Clauses together with any supplementary measures required following a transfer-impact assessment.

Contakt does not transfer personal data to a country outside the EEA without such a transfer mechanism in place.

13. Liability, duration and law

The liability provisions of the Contakt Academy business subscription terms apply to this DPA, except where mandatory data-protection law provides otherwise, including Article 82 GDPR.

This DPA takes effect when the Customer accepts it and remains in force for as long as Contakt processes personal data on the Customer's behalf. It is governed by the laws of the Netherlands, and disputes are submitted to the competent court in Amsterdam, subject to any mandatory rule of jurisdiction.