Data processing agreement

pursuant to Article 28(3) of Regulation (EU) 2016/679 (the General Data Protection Regulation) between

• The controller: the club (association) that has created a club space in Clubroom, and whose administrator has accepted this agreement on the club's behalf, and
• The processor: Mike Hagen Eggertsen, a private individual with no CVR number, Peder Hjorts Vej 7, 2500 Valby, Denmark ("Clubroom").

1. Preamble

1. This agreement sets out the rights and obligations of the parties when Clubroom processes personal data on the club's behalf.
2. The agreement is designed to comply with Article 28(3) of the General Data Protection Regulation.
3. The processing takes place as part of providing Clubroom, a system for membership administration, fees, communication and events, under the terms of service.
4. This agreement takes precedence over similar provisions in other agreements between the parties.
5. The agreement has four appendices. Appendix A describes the processing, Appendix B the sub-processors, Appendix C the club's instructions and the security measures, and Appendix D the parties' other terms, including deletion on termination.
6. This agreement does not relieve Clubroom of the obligations that apply directly to processors under the General Data Protection Regulation.

2. The club's rights and obligations

1. The club is responsible for ensuring that the processing complies with the General Data Protection Regulation and the Danish Data Protection Act.
2. The club has the right and the obligation to decide the purposes and means of the processing.
3. Among other things, the club is responsible for having a legal basis for the data it asks Clubroom to process, and for informing members about the processing.
4. The club does not record national identification numbers (CPR), special categories of personal data (Article 9) or data about criminal offences (Article 10) in Clubroom, including in the club's own fields.

3. Clubroom acts on instructions

1. Clubroom processes personal data only on documented instructions from the club, unless required by EU or Danish law. The instructions are set out in Appendices A and C. The club's use of Clubroom's features is also an instruction.
2. Clubroom immediately informs the club if, in Clubroom's opinion, an instruction infringes data protection rules.

4. Confidentiality

1. Only people at Clubroom who need access to provide the service have access to the club's data. They are bound by confidentiality.
2. Access is reviewed regularly and removed when no longer needed.

5. Security of processing

1. Clubroom implements appropriate technical and organisational measures under Article 32, taking into account the risk to members' rights. The measures are described in Appendix C.
2. Clubroom assists the club in meeting the club's own obligations under Article 32.

6. Use of sub-processors

1. By this agreement the club gives general prior authorisation for Clubroom to use sub-processors. The authorised sub-processors are listed in Appendix B and on the Sub-processors page.
2. Clubroom notifies the club in writing (in the app or by email) of any intended addition or replacement of sub-processors at least 30 days in advance, so the club can object. If a sub-processor gives Clubroom shorter notice, Clubroom notifies the club as soon as possible.
3. If the club objects on reasonable grounds and the parties cannot find a solution, the club may terminate the agreement before the change takes effect.
4. Clubroom imposes the same data protection obligations on sub-processors as in this agreement and remains fully liable to the club for their performance.

7. Transfers to third countries

1. Personal data is transferred to countries outside the EU/EEA only on instructions and in accordance with Chapter V of the General Data Protection Regulation.
2. The club authorises the transfers and transfer bases set out in Appendix B.

8. Assistance to the club

Clubroom assists the club in responding to requests from members exercising their rights (Chapter III). Among other things, Clubroom provides these tools:

• members can see and correct their own details through a personal link
• members can download a copy of their data (JSON) and request erasure through a personal link
• the club can export members and payments (CSV) and handle erasure requests with a 30-day due date

Clubroom also assists with security, breach notification, impact assessments and prior consultation under Articles 32–36, to a reasonable extent.

9. Notification of personal data breach

1. Clubroom notifies the club without undue delay and no later than 48 hours after becoming aware of a personal data breach, so the club can meet its own 72-hour deadline towards the Danish Data Protection Agency (Article 33).
2. As far as possible, the notification contains the information the club needs to notify the Danish Data Protection Agency under Article 33(3).

10. Erasure and return of data

1. On termination, Clubroom deletes the club's personal data as described in Appendix D, unless EU or Danish law requires storage.

11. Audit and inspection

1. Clubroom makes available the information needed to demonstrate compliance with Article 28 and this agreement, and allows for audits, including inspections, by the club or an auditor the club has authorised.
2. At the club's request, Clubroom provides a written statement on the processing and the security measures, at most once a year unless there is a specific reason for more.
3. Physical inspections are agreed with at least 30 days' notice. Clubroom has no server rooms of its own; processing takes place at the sub-processors, and they are supervised on the basis of their own audit reports and certifications, which Clubroom makes available on request.
4. The club bears its own costs and those of any auditor it authorises. Clubroom bears its own costs.

12. The parties' agreement on other terms

1. The parties' other terms are set out in Appendix D.

13. Commencement and termination

1. The agreement takes effect when the club's administrator accepts it while creating the club space.
2. The agreement applies for as long as Clubroom processes personal data on the club's behalf.
3. Clubroom gives at least 30 days' notice of material changes to the agreement in the app or by email. If the club does not want the changes, it may terminate the agreement before they take effect. Changes to Appendix B follow clause 6.

14. Contacts

• The club: the administrator who owns the club space, and the email address registered for the club.
• Clubroom: hello@getclubroom.com

Appendix A — Information about the processing

Purpose

To provide Clubroom to the club: member register, fees and payments, emails to members, events with sign-up, consents and erasure requests.

Nature of the processing

Storage, organisation, searching, display, export, sending emails, passing payment details to the club's payment provider, and erasure.

Categories of data subjects

• the club's members, former members and people who join through the club's join form
• people on the club's waiting lists, and the guardian whose email a child's sign-up uses
• the club's administrators and committee members, where they appear in the club's activity log and payments

Types of personal data

• Core details: member number, name, email address, phone number, language, membership type and join date.
• Membership periods: start and end date, amount, payment date and how the period came about.
• Payments: name and member number at the time of payment, amount, currency, payment method (online through the club's payment provider, bank transfer, MobilePay number, cash or other), the provider's name and references, payment reference, who recorded the payment, and cancellations with a reason. Card details are not processed.
• The club's own fields: text, number, date, yes/no or choice fields that the club defines itself. The club decides the content, see clause 2.4.
• Tags and segments: tags on members and saved filters.
• Consents: consent to club news by email, with time and source.
• Events: responses (going, maybe, not going, waiting list), time of response and attendance.
• Communication: emails sent, with subject, content, recipient address, sender and reply-to address, and which welcome and reminder emails a member has received.
• Waiting lists: name, email address, phone number, birth date and note given at sign-up, which lists and when, place in line, offers and answers, and the yearly check on whether they still want a place. An entry no one says yes for within 30 days of the yearly check comes off the list. Closed entries are deleted after 90 days, together with the person when only the waiting lists hold their details.
• Erasure requests: member number, status, source, any reason for declining and, until the confirmation has been sent, email address and language.
• Activity log: who did what in the club, with the names of the members concerned.
• Imports: the number of members imported.
• Files: no member files today.

Special categories of personal data (Article 9), data about criminal offences (Article 10) and CPR numbers are not covered, see clause 2.4.

Duration

For as long as the club uses Clubroom, and thereafter as described in Appendix D.

Appendix B — Sub-processors

On entering into this agreement, the club authorises the sub-processors listed on the Sub-processors page with name, purpose, location and transfer basis. The list forms part of this agreement. The club's payment provider is not a sub-processor of Clubroom, as the club chooses the provider and has its own agreement with it, see the club's payment provider.

Appendix C — Instructions and security

C.1 Subject matter and instructions

Clubroom processes the club's data to provide the features the club uses, see Appendix A. The club's actions in Clubroom (for example importing members, sending an email or approving an erasure request) are instructions.

C.2 Security measures

• Encryption in transit: all traffic to the app and the site uses HTTPS (TLS).
• Separation between clubs: every row in the database belongs to one club, and every query is limited to the club the user is working in.
• Access control: administrators have roles (owner, admin, committee), and actions such as changing members require a specific permission. Administrators sign in with an emailed link that expires after 15 minutes, or with Google; there are no passwords. Sessions expire after 30 days.
• Logging: changes to members, payments, emails and settings are recorded in the club's activity log with who and when.
• Personal links for members: links in emails are signed and expire, for example after 3 days for a data download, 7 days for erasure and 14 days for correcting one's own details.
• Files: private files can only be fetched through signed links that expire after 5 minutes. Deleted files are removed after 7 days.
• Emails: personal links in sent emails are removed from Clubroom's copy once the email has been sent.
• Spam protection: the join form is protected against automated submissions.
• Operations access: Clubroom's staff have a separate administration area on its own domain with its own sign-in, for named people only. It shows clubs, administrators, counts and recent events, not the member register.
• Payment provider keys: the club's API keys for its payment provider are encrypted (AES-256-GCM) with a key the database never sees, are never logged, and are not shown again once saved.
• Backups: Clubroom takes a backup of the database every day, encrypts it with a key that only Clubroom holds offline, and keeps it for 7 days in the file storage provider's EU region.
• Encryption at rest: the database is encrypted (AES-256) at the database provider, and backups are encrypted before they leave the server. Files are encrypted at rest at the storage provider.

C.3 Place of processing

Processing takes place at the sub-processors and locations listed in Appendix B. Clubroom is run from Denmark.

Appendix D — Other terms and deletion on termination

D.1 Deletion on termination

1. Before termination, the club can export members and payments (CSV).
2. When the agreement ends, Clubroom deletes the club's personal data no later than 30 days after termination. The club's owner can delete the club in the app; it can be restored for 30 days and is then deleted automatically.
3. Data in backups is deleted when the backups expire, that is no later than 7 days after deletion from the database.
4. Clubroom confirms the deletion to the club in writing.

D.2 Keeping payments

Payment records may be accounting records for the club, which the Danish Bookkeeping Act requires to be kept for 5 years. Keeping them is the club's responsibility, for example by exporting them before termination. While the agreement runs, Clubroom does not delete payments automatically. When a member is erased, the name is removed from their payments, while member number, amounts, dates and reference are kept. Sent emails lose the recipient address and content, and the activity log loses the member's name.

D.3 Liability

Liability and limitation of liability follow the terms of service. The limitation does not apply to Clubroom's liability towards data subjects under Article 82 of the General Data Protection Regulation.

D.4 Governing law

This agreement is governed by Danish law. Disputes are settled by the Danish courts.