Data Processing Agreement

Parties and scope

This Agreement is entered into between the Controller (the club, the coach or the person who creates an account on My Team Manager and enters into it data about players, parents and guardians, and coaching staff) and the Processor, which provides the service:

• Name: João Carlos Neves Leonardo
• Tax number (NIF): 269514686
• Town: Odivelas
• Legal form: Sole trader (empresário em nome individual)
• Email: geral@myteammanager.pt

The Agreement forms part of the Terms and Conditions and is deemed entered into when the account is created. It applies to all personal data that the Controller enters in the application and of which we are merely the custodian. It does not apply to the account's own data (email, billing), for which we are the controller: that is described in the Privacy Policy.

Subject matter, nature and duration of the processing

• Subject matter: hosting, storing, displaying, exporting and deleting the data the Controller enters to manage their teams, and sending on their behalf the communications they order from the application (for example, a call-up by email to parents and guardians).
• Nature: automated processing, by means of a web application hosted in Portugal. We do not process the data manually, except for technical support requested by the Controller.
• Purpose: exclusively the provision of the service described in the Terms. Never advertising, commercial profiling, model training or disclosure to third parties.
• Data subjects: players (mostly minors), parents and guardians, assistant coaches, team managers and other team contacts.
• Categories of data: those listed in the section "What data is processed" of the Privacy Policy: identification, contact details, photograph, sports data and the documents the Controller uploads. Health data only if the Controller uploads it as a document, and in that case with access restricted to the Head Coach.
• Duration: for as long as the account exists, and during the period of 90 days after cancellation provided for in the section "End of processing".

The controller’s instructions

We process the data only on documented instructions from the Controller. Those instructions are: the Terms and Conditions, the Privacy Policy, this Agreement and the actions the Controller performs in the application itself: creating a record, uploading a photograph, sending a call-up, exporting, deleting. Additional instructions are given in writing, to geral@myteammanager.pt.

If an instruction appears to us to infringe the GDPR or another data protection provision, we inform the Controller immediately and may suspend carrying it out until the Controller confirms or withdraws it.

We only process data outside the instructions when required to do so by European Union or Member State law, and in that case we inform the Controller beforehand, unless that same law prohibits it.

Confidentiality

Anyone who works with us and has access to the data is bound by a duty of confidentiality, by contract or by law, and only accesses what is strictly necessary to operate the service or respond to a support request from the Controller. Administrative access to the infrastructure is restricted and sensitive actions are recorded in an audit log.

Security measures

We apply the technical and organisational measures described in the "Security" section of the Privacy Policy, which are deemed reproduced here. In summary:

• Per-account isolation enforced by the database itself (Row Level Security);
• Encryption in transit (HTTPS/TLS) for all traffic;
• Passwords stored as hashes; session via an httpOnly cookie;
• Removal of metadata (EXIF, GPS) from uploaded photographs;
• Role-based permissions; player documents visible only to the Head Coach;
• Daily backups, encrypted before they leave the server, with a rotation of 7 daily, 4 weekly and 6 monthly copies;
• Audit log of sensitive actions, kept for 24 months.

We may improve these measures at any time; we do not reduce them without giving the Controller 30 days notice.

Sub-processors

The Controller gives us general authorisation to engage other processors in providing the service, under the following conditions:

• The current list is always published in the section "Who we share it with" of the Privacy Policy;
• Before adding or replacing a sub-processor, we notify the Controller by email 30 days in advance;
• The Controller may object, in writing, within that period. If the objection is well founded and there is no reasonable alternative, the Controller may terminate the contract without penalty and export their data before the change takes effect;
• We impose on each sub-processor, by contract, data protection obligations equivalent to those in this Agreement, and we remain liable to the Controller for their compliance.

Assistance to the controller

Taking into account the nature of the processing, we help the Controller to:

• Respond to data subjects: a parent or guardian who wants to access, correct or delete their child's data contacts the Controller; the application gives the Controller the tools to do so on their own and, if a request reaches us, we forward it and provide support, as described in the section Data about minors of the Privacy Policy;
• Comply with articles 32 to 36 of the GDPR (security, breach notification, impact assessment and prior consultation) by providing the information we have about the processing;
• Demonstrate compliance, as set out in the section "Information and audit".

This assistance is included in the price of the service where reasonable. Requests that require out-of-the-ordinary work may be quoted before we carry them out.

Notification of data breaches

The notification includes, to the extent known at the time:

• The nature of the breach and the categories and approximate number of data subjects and records;
• The likely consequences;
• The measures taken or proposed to address it and mitigate its effects;
• A contact point for more information.

If we do not have all the information within the first 24 hours, we send what we have and complete it as we learn more. We do not communicate the breach to data subjects or authorities on the Controller's behalf without their instruction, unless we have a legal obligation of our own.

End of processing: export and deletion

When the account is cancelled, the Controller retains for 90 days read access and the ability to export all data to a file, from the application itself: teams, players, coaching staff, training sessions, attendance, matches, call-ups, tactics and drills. This is the return of data provided for in article 28(3)(g).

Once that period ends, or earlier if the Controller requests it in writing, we permanently delete the data and existing copies: photographs and documents are deleted from storage immediately, and backups are rotated according to the policy of 7 days on the server; encrypted remote copies with 7 daily, 4 weekly and 6 monthly copies, so they no longer contain the data at the end of that cycle.

The exception is data the law requires us to keep: tax documents relating to the subscription, for 10 years. That is data for which we are the controller, not player data.

Information and audit

We make available to the Controller the information necessary to demonstrate compliance with this Agreement: the Privacy Policy, the description of the security measures, the list of sub-processors and, on request, written answers to a reasonable security and data protection questionnaire, once a year.

The Controller, or an auditor mandated by them and bound by confidentiality, may carry out a documentary audit with 30 days notice, during business hours and without disrupting the service to other customers or exposing their data. On-site inspections of the infrastructure only when required by law or by a supervisory authority. Audits beyond one per year, or that require out-of-the-ordinary work, are borne by the Controller.

International transfers

Player data is hosted in Portugal and is not transferred outside the European Union. The only transfers outside the European Economic Area concern the account's own data (payments with Stripe, optional sign-in with Google), rely on the European Commission's standard contractual clauses and are described in the section Where the data is stored of the Privacy Policy. We do not transfer player data to third countries without the Controller's written instruction.

Liability and precedence

Each party is liable for the damage it causes by failing to meet the obligations the GDPR assigns to it, under article 82. The limitation of liability in the Terms and Conditions applies to this Agreement to the extent permitted by law; it never limits liability towards data subjects.

In the event of a conflict between this Agreement and the Terms, this Agreement prevails in matters of data protection. It is governed by Portuguese law. Changes follow the regime of the Terms: notice by email 30 days in advance.

Contact

For instructions, data subject requests, notifications or signed copies of this Agreement: geral@myteammanager.pt, on behalf of João Carlos Neves Leonardo.

The supervisory authority in Portugal is the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority, www.cnpd.pt.