Data Processing Agreement

Article 1. Subject Matter

This Agreement governs the terms under which the Club (hereinafter: "Controller") entrusts personal data processing to ClubSystem (hereinafter: "Processor") in connection with the provision of the ClubSystem service described in the Terms of Service (hereinafter: "Service").

This Agreement enters into force upon conclusion of the Service agreement (i.e., completion of registration and acceptance of the Terms of Service).

Processor: Bartosz Olchówka, ul. Reja 55/54, 50-343 Wrocław, Poland, VAT ID: PL8451894280. Contact: contact@clubsystem.app.

Article 2. Scope and Purpose of Processing

Purpose of processing: provision of the Service, including handling reservations and sending SMS and email messages to the Controller's customers.

Categories of personal data processed on behalf of the Controller, in particular:

• contact data of the Controller's customers: phone number, first and last name, email address,
• reservation and game history of the Controller's customers,
• temporary SMS verification codes,
• account data of the Controller's staff: first and last name, email address.

Registration data of the club owner/administrator used to create a ClubSystem account (name, email address, phone number) is processed by ClubSystem in the capacity of an independent data controller under the Terms of Service and falls outside the scope of this Agreement.

Categories of data subjects: end customers of the Controller (persons making table reservations) and employees and administrators of the Controller (club staff).

Duration of processing: for the duration of the Service agreement and until the data is deleted in accordance with Article 9.

Processing on the Controller's computer: part of the data may also be processed on the Controller's computer, by the Processor's software installed on it and through remote access to that computer, on the terms set out in the Terms of Service.

Article 3. Obligations of the Processor

The Processor undertakes to:

1. Process personal data only on documented instructions of the Controller, unless required to do so by Union or Member State law.
2. Ensure confidentiality — persons authorised to process the data shall be bound by confidentiality obligations.
3. Take the technical and organisational measures required by Article 32 GDPR.
4. Manage sub-processors in accordance with Article 5.
5. Assist the Controller in responding to data subject rights requests (access, rectification, erasure, portability, objection).
6. Assist the Controller in ensuring compliance with Articles 32–36 GDPR (security, breach notification, DPIA, prior consultation).
7. Make available all information necessary to demonstrate compliance and allow for audits (Article 8).
8. Immediately inform the Controller if any instruction given infringes GDPR in the Processor's opinion.

Article 4. Obligations of the Controller

The Controller undertakes to:

1. Use the Service in accordance with the Terms of Service and ClubSystem's Privacy Policy.
2. Collect personal data from customers in accordance with applicable law, in particular on the basis of an appropriate legal ground under Article 6 GDPR.
3. Fulfil data subject rights requests via the Service's interface or by contacting the Processor.
4. Inform its customers (in its own privacy policy) of the use of ClubSystem as a data processor.
5. Secure the computer on which the Processor's software runs and the means of access to the Service (logins, passwords, PINs), in accordance with the Terms of Service.

Article 5. Sub-processors

The Controller grants the Processor general authorisation to engage sub-processors. The Processor shall inform the Controller by email of any addition or replacement of a sub-processor at least 14 days in advance. Within that period the Controller may object, and if the parties cannot agree, terminate the Service agreement.

The Processor imposes on its sub-processors data protection obligations corresponding to those in this Agreement and remains liable to the Controller for their performance (Article 28(4) GDPR).

Currently approved sub-processors:

For US-based sub-processors, transfers are carried out on the basis of the EU–US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCCs).

Article 6. Personal Data Breaches

The Processor shall notify the Controller of a personal data breach without undue delay after becoming aware of it (Article 33(2) GDPR), passing on the information it has that the Controller needs to report the breach.

Security disclosures and breach reports directed to the Processor should be sent to: contact@clubsystem.app.

The Controller is solely responsible for assessing whether the breach must be reported to the supervisory authority and/or communicated to affected data subjects.

Article 7. Data Subject Rights

The Processor shall promptly forward to the Controller any requests from data subjects made directly to the Processor, and shall not respond to such requests independently without the Controller's authorisation.

Article 8. Audits and Inspections

The Controller has the right to carry out audits and inspections to verify compliance with this Agreement, no more than once per year and with at least 14 days' prior notice. The cost of the audit is borne by the Controller, unless the audit reveals non-compliance by the Processor. The Processor may first answer an audit in writing, by providing information and documents.

Article 9. Return or Deletion of Data upon Termination

On a request made no later than 30 days after the end of the Service agreement, the Processor hands the Controller its data in electronic form within 30 days of the request. 30 days after the end of the agreement the Processor deletes the data, but not before handing over data requested in time, unless retention is required by applicable law. Data held in backups is deleted as those backups rotate. Data on the Controller's computer is deleted together with the Processor's software, in accordance with the Terms of Service.

Article 10. Liability

The Processor shall be liable for damage caused by processing only where it has not complied with obligations under GDPR or this Agreement, or where it has acted outside or contrary to the Controller's documented instructions.

The limitations of liability between the parties are set out in the Terms of Service.

These limitations do not apply to liability under GDPR Article 82 towards data subjects, or to liability that cannot be excluded under mandatory applicable law.

Article 11. Final Provisions

This Agreement is governed by Polish law. Matters not regulated herein shall be governed by the Polish Civil Code and applicable data protection legislation, including GDPR and the Polish Act on the Protection of Personal Data of 10 May 2018. Any disputes shall be subject to the jurisdiction of the courts of Wrocław, Poland.

This Agreement may be amended in the same way as the Terms of Service, and the sub-processor list in accordance with Article 5.

Polish version of this Agreement is available at /pl/umowa-powierzenia/. In case of any discrepancy between the versions, the Polish version prevails.