DATA PROCESSING AGREEMENT
This is a translation provided for convenience. Only the German version is legally binding.
Version 2026-10-16 · Art. 28 GDPR
This data processing agreement (hereinafter the “DPA”) is entered into between the customer (club or organisation, hereinafter the “Controller”) and Lukas Musebrink, Krückenweg 61, 44227 Dortmund (hereinafter the “Processor”). It becomes part of the contract upon confirmation when the organisation is created and supplements the Terms and Conditions and the Privacy Policy.
§ 1 Subject matter, duration, roles
(1) The Processor provides the services described in the Terms and Conditions (creation of club graphics and videos, management of match and squad data, optional publication, club page) and in doing so processes personal data on behalf of the Controller.
(2) The club is the Controller for all data that it provides or whose import it configures — in particular names, photos and match data of its players.
(3) For users’ account, contract and billing data, the Processor is responsible in its own right; the Privacy Policy applies in this respect.
(4) The term is tied to the user agreement.
§ 2 Nature, purpose, categories of data, data subjects
The purpose is the creation, storage and — on instruction — the publication of club media, as well as the management of match operations. Categories of data: master data of players and team officials (name, shirt number, position), photos, match data (line-ups, goalscorers, cards), contact details of the club page, uploaded media. Data subjects: club members, players (including minors), coaches and team officials, where applicable players of opposing teams, and visitors to the club page.
§ 3 Obligations of the Controller
(1) The club ensures that a legal basis exists for all data provided — in particular valid consents for photos and names, and, in the case of minors, the consent of their legal guardians (Art. 6, 8 GDPR; §§ 22, 23 KUG).
(2) The club informs data subjects in accordance with Art. 13/14 GDPR.
(3) If it activates automatic data import or a public tournament or club page, it is responsible for the associated processing or publication.
(4) The club handles data subject requests; the Processor provides support in accordance with § 5.
§ 4 Obligations of the Processor
(1) The Processor processes the data only on documented instructions from the Controller; instructions are given via the functions of the platform or in text form. If it considers that an instruction infringes data protection law, it will inform the Controller without undue delay.
(2) Persons who have access to the data are bound to confidentiality.
(3) The Processor implements the technical and organisational measures set out in Annex 1 and assists the Controller with the obligations under Art. 32 to 36 GDPR.
(4) After the end of the contract, all data will, at the Controller’s choice, be deleted or returned (by export), unless there is an obligation to retain it; the time limits are set out in the Terms and Conditions.
(5) The Processor makes available the information necessary to demonstrate compliance with its obligations and allows for audits, including inspections, by the Controller or an auditor mandated by it. Compliance is primarily demonstrated by self-disclosure and documentation; on-site audits must be announced in good time.
§ 5 Assistance with data subject rights
The Processor provides deletion, rectification and export functions in the application and, beyond that, provides support on request at support@matchday.design.
§ 6 Sub-processors
(1) The Controller gives general authorisation for the use of the service providers (sub-processors) named in section 5 of the Privacy Policy. The Processor imposes the same data protection obligations on them by contract (Art. 28(4) GDPR).
(2) Changes will be announced by email at least 30 days in advance; the Controller may object on important data protection grounds and, if no agreement is reached, terminate the contract with effect from the date the change takes effect.
(3) Transfers to third countries take place only with safeguards under Chapter V GDPR (DPF certification or standard contractual clauses).
§ 7 Notification obligations
The Processor notifies the Controller of personal data breaches without undue delay, at the latest within 48 hours of becoming aware of them, with the information required under Art. 33(3) GDPR.
§ 8 Final provisions
German law applies; in all other respects the Terms and Conditions apply. In data protection matters, this agreement takes precedence over the Terms and Conditions.
Annex 1 — Technical and organisational measures
Operation on certified cloud platforms (database and storage in Frankfurt); tenant-separated data storage with automated security tests; transport encryption (TLS, HSTS); private storage buckets with short-lived signed access links; encrypted storage of access tokens; logging of administrative operations; pseudonymisation of IP addresses; client-side downsizing of uploads, including removal of metadata; rate limiting and upload validation.
Responsible provider: Lukas Musebrink, Krückenweg 61, 44227 Dortmund. Full details in the Legal Notice.