Data processing agreement

This agreement is between The Safe Sport Hub and each club that pays for the platform. In it, "we" and "us" mean The Safe Sport Hub, and "the club" means your club.

UK data protection law says we must have this agreement, because we look after personal information for the club. It is part of our terms of use.

1. Who is in charge

The club is in charge of the personal information it keeps on the platform. The law calls the club the "controller".

We look after that information for the club. The law calls us the "processor".

Our company name is [To add: company name]. Our company number is [To add: company number]. Our registered address is [To add: registered address].

2. What we do with the club's information

What for. We run the platform for the club.

How long. While the club pays for the platform, and after it cancels. Our privacy notice says how long each kind of information is kept.

What we do. We store the club's information, sort it, show it to the right people and send emails about it. We delete it when the club does so through the platform, or when its set time ends, as our privacy notice explains. A report or a safety check is deleted only when someone at the club chooses. Something deleted can stay in a backup for a time.

What kind of information.

• Names, email addresses and phone numbers.
• Who is in the club, and their roles.
• Emergency contacts.
• Certificates, such as PVG or other checks, and their details or reference numbers.
• Photos.
• When people sign in.
• What is written in reports and notes. This can include information about children, about health, and about possible crimes. The law calls some of this "special category" information, and gives it extra protection.

Who the information is about.

• The club's members, coaches, officials and volunteers.
• People who take part in the club's activities, including children.
• Parents and carers.
• People who make a report, and people named in a report.

3. What we promise to do

1. Only do what the club tells us. The club tells us what to do through how it uses the platform, or by writing to us. Writing to us cannot have the club's records deleted. Point 7 says what happens to them. If we think an instruction breaks data protection law, we will tell the club.
2. Keep it private. Everyone who works on the platform for us must keep the club's information private.
3. Keep it safe, in the ways listed in section 4.
4. Only use other companies as section 5 explains.
5. Help the club answer people who ask about their information. For example, someone may ask to see it or correct it. We do not delete the club's records because a person, or the club, asks us to. The club's admins can delete some records themselves, such as documents, contacts and notices. Once a report's time is up, the people looking after it can delete it. If none of them is left, the club's admins can. Admins can delete a safety check once its time is up. We will also help the club keep information safe and deal with a data breach. And we will help it check the risks of what it does.
6. Tell the club quickly about a data breach. A data breach is when information is lost, stolen, or seen by someone who should not see it. If a breach affects the club's records, we will tell the club within 48 hours of finding out.
7. At the end, let the club take its records. If the club was paid up when it cancels, it has 90 days to take a copy of its records once its paid time ends. In those days, the people looking after a report can also sign in to read it and take a copy of it. Then we archive the club. Nobody can sign in to an archived club. We keep its records with no end date, in case they are ever needed. Only what the bell told people still goes, after 90 days. If the club wants to come back, it can contact us. A club that cancels cannot have its records deleted.
8. Answer the club's questions. We will answer the club's reasonable questions about how we look after its information.

4. How we keep information safe

• Everything sent to and from the platform is encrypted.
• Each club's records are kept apart from every other club's. The platform refuses any request that would reach another club's records.
• Inside a club, people can only see what the club's settings allow.
• Our own staff can see who is in each club, their account details and the club's payments, to help with accounts and payments. Our privacy notice lists what they see. They cannot open the club's records, such as its reports and its users' profiles and certificates. Each person or club they search for or open is recorded.
• If a club has been suspended for not paying for a year, one of its admins can ask us for a copy of its records. The platform makes it for that admin, and emails the club's admins. The admin can download it, or send it to another email address. Our staff cannot open it. It is deleted after 7 days. Something deleted can stay in a backup for a time.
• Each night the platform counts some numbers for each club and month. For example, how many reports of each kind came in, how many are still open and how long they took. It also counts how many open reports in each club nobody there can look after, and no admin may be told of. Our staff can see these numbers. A number from 1 to 4 shows only as "Fewer than 5". They never see what a report says.
• Passwords are kept scrambled, so nobody can read them. Signing in on a device the person has not chosen to trust needs a code as well as the password.
• We keep a record of sign ins for 12 months.
• Uploaded photos have hidden information removed, such as where they were taken. Uploaded files cannot be reached straight from the web.
• Regular local and offsite backups are taken and kept securely.

5. Other companies we use

The club agrees that we can use these companies to help look after its information. Each one must protect the information at least as well as this agreement does.

• The System Developers, the company that builds the platform and runs it for us. Its staff can reach everything on the platform's servers, to keep it working.
• Krystal Hosting, through the System Developers. It keeps the platform on servers in the United Kingdom.
• Mailgun, through the System Developers. It sends the platform's emails from within the European Union.

If we want to add or change a company, we will email the club's admins at least 30 days before. If the club objects for a good reason about data protection, we will talk to it about the problem. If we cannot fix it, the club can cancel its subscription, as our terms of use explain.

GoCardless collects the club's Direct Debit payments. We use it directly. It is in charge of the payment details it collects, so it is not one of the companies listed here.

6. Sending information outside the UK

We only send the club's information outside the UK if the law says it will be kept safe there.

Mailgun sends the platform's emails from within the European Union. UK law accepts that information is kept safe there.

7. What we are responsible for

Section 15 of our terms of use says what we are responsible for. It applies to this agreement too.

8. The law that applies

This agreement is under the law of Scotland. Any dispute will be dealt with by the courts of Scotland.