Data Processing Agreement
1. Scope and status
This Data Processing Agreement ("DPA") forms part of our Terms of Service and applies whenever Datateru Ltd ("we", "Processor") processes personal data on behalf of a club or organisation subscribing to LeagueBot ("you", "Controller").
It is intended to satisfy Article 28(3) of the UK GDPR. It takes effect when you subscribe, and no separate signature is needed, though we will sign a counterpart copy on request at support@datateru.com.
Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR. "Data protection law" means the UK GDPR, the Data Protection Act 2018, and any legislation replacing or amending them.
Where this DPA conflicts with the Terms of Service or the Privacy Policy on the processing of your players' personal data, this DPA prevails.
2. Roles of the parties
You are the controller of your players' personal data. You decide to run a league, decide who is in it, and supply or authorise the collection of their details. We are your processor and act only on your instructions.
You are responsible for the lawfulness of the data you give us, for having a lawful basis, and for giving your players the information data protection law requires. We are responsible for handling that data securely and only as you have instructed.
We are an independent controller for our own business data: your administrators' contact details, billing records and website logs. That processing is described in our Privacy Policy and is outside this DPA.
3. Details of the processing
As required by Article 28(3), the processing is described as follows:
- →Subject matter: provision of the LeagueBot league management service.
- →Duration: for as long as your subscription is active, plus the retention periods set out in our Privacy Policy.
- →Nature: collection, storage, organisation, retrieval, interpretation, publication of standings, and deletion.
- →Purpose: registering players, recording and validating match results, maintaining league tables, responding to player queries via Ace, and publishing the club's standings page.
- →Categories of personal data: player display names and usernames; pseudonymous identifiers derived from phone numbers; match results and league position; the content of WhatsApp messages sent to and from Ace.
- →Categories of data subject: your club's players, including junior players where you run junior leagues.
- →Special category data: none. The service is not designed for special category data and you must not submit it.
4. Our obligations
We will:
- →Process personal data only on your documented instructions. Your use of the service, and the configuration you choose, constitute those instructions. If we believe an instruction breaches data protection law, we will tell you.
- →Ensure that anyone authorised to process the data is bound by confidentiality obligations.
- →Implement appropriate technical and organisational measures under Article 32, as described in “Security measures” below.
- →Not process the data for our own purposes, and not sell it or use it to train AI models.
- →Assist you, taking into account the nature of processing and the information available to us, in meeting your obligations under Articles 32 to 36 (security, breach notification, and data protection impact assessments).
- →Make available the information reasonably necessary to demonstrate compliance with Article 28.
5. Security measures
The measures we apply include:
- →Encryption of personal data in transit using TLS, and at rest.
- →Pseudonymisation of phone numbers, so that the number itself is not stored in our database.
- →Logical isolation of each club's data, so that one club's data cannot be reached from another club's session.
- →Role-based access control and least-privilege access for staff, with credentials held in a managed secrets store and never in source code.
- →Hosting in the United Kingdom, with managed backups.
- →Automated monitoring, access logging, and a documented deployment process with the ability to roll back.
We may update these measures as technology develops, provided the level of security is not reduced.
We describe our security measures at the level of what they assure rather than how they are built. A fuller description, including responses to security questionnaires, is available to customers on request at support@datateru.com.
6. Sub-processors
You give general authorisation for us to engage sub-processors. The current list is maintained in our Privacy Policy and forms part of this DPA.
- →Cloud infrastructure provider (Amazon Web Services): hosting, compute, storage and access logs, in the United Kingdom.
- →Managed database provider: the PostgreSQL database holding league data (player display names, pseudonymised phone identifiers, match results), in the United Kingdom.
- →Meta Platforms (WhatsApp Business Platform): delivery and receipt of the WhatsApp messages between players and Ace.
- →Telephony provider: supplies each club's phone number and carries the SMS used to verify it. Handles phone numbers in full.
- →Anthropic: interprets the content of messages sent to Ace. Processed in the United States. See “How Ace uses AI” below.
- →Stripe: subscription payments and billing. Card details are handled by Stripe and never reach us.
- →Transactional email provider: onboarding and billing notifications.
- →Form handling provider: receives contact form submissions from this website.
We identify each of these providers by name to our customers, and to anyone with a legitimate interest, on request at support@datateru.com.
We will give you at least 30 days' notice by email before adding or replacing a sub-processor that handles your players' data. If you reasonably object on data protection grounds within that period, we will work with you to find an alternative; if we cannot, you may terminate your subscription and we will refund fees paid for any period after termination.
We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for their performance.
7. Assisting with data subject rights
The service is built so that you can handle most requests yourself: an administrator can view, correct, export and delete player data from the dashboard.
Where a request cannot be resolved that way, we will provide reasonable assistance by appropriate technical and organisational measures, taking into account the nature of the processing.
If a player contacts us directly with a rights request, we will not respond to it substantively ourselves. We will tell them to contact you and forward the request to you promptly, unless you have instructed us otherwise.
8. Personal data breaches
We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your players' personal data.
The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point for more information, to the extent that information is available to us, with further detail to follow as our investigation progresses.
It is your responsibility as controller to decide whether the breach must be reported to the ICO or to affected individuals, and to make any such report. We will assist you in doing so.
9. International transfers
We will not transfer your players' personal data outside the United Kingdom except as necessary to provide the service through the sub-processors listed above, and only where a valid transfer mechanism is in place: UK adequacy regulations, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum.
Our hosting and database are located in the United Kingdom. Message content sent to Ace is processed by Anthropic in the United States, under the safeguards described above.
We will provide details of the safeguards applying to a particular transfer on request.
10. Deletion and return of data
You can export your league data from the dashboard at any time during your subscription, and we will produce an export on request.
On termination, we will delete your players' personal data within 90 days, unless you ask for it sooner or we are required by law to retain it. Backups are deleted on their own rolling schedule, and remain protected by this DPA until they are.
During your subscription, we will action any instruction from you to delete a specific player's data. Where deleting a result would corrupt the league table for other players, we will anonymise it instead, and will tell you when we do.
11. Audit
We will make available to you the information necessary to demonstrate compliance with Article 28, and will respond to reasonable written questions about our processing (including a security questionnaire) within 30 days.
You may audit our compliance no more than once in any 12-month period, on at least 30 days' written notice, during business hours, in a manner that does not disrupt our operations or compromise the confidentiality of other customers' data. You bear your own costs, and ours where an audit is repeated or unreasonably burdensome. We may satisfy an audit request by providing an independent report or certification where one is available.
Where a supervisory authority requires an audit, we will cooperate as the law requires.
12. Liability and contact
Liability under this DPA is subject to the limitations and exclusions in our Terms of Service, except where data protection law does not permit that.
This DPA is governed by the laws of England and Wales.
Questions, signature requests and sub-processor objections: support@datateru.com
Datateru Ltd
Registered in England and Wales, company number 17212478
112 Margetts Road, Bedford, MK42 8DU, United Kingdom