This agreement governs the processing of personal data that Adrià Colomer Serra, tax ID 33956328W, with address at C/Mallol, 35 2n 2a (the “processor”) carries out on behalf of each client club of Pranarp Club (the “controller”) when providing the service, in accordance with article 28 of the GDPR and article 33 of the Spanish LOPDGDD. It forms part of the Terms of service and the controller accepts it when signing up. Its current version is 2026-10.
1. Subject matter, duration and purpose
The processor processes the personal data that the controller enters or generates in the application for the sole purpose of providing the service hired: hosting, management of players and members, court and space bookings, rates, memberships, communications, reports and any other features the controller chooses to use. The processing lasts as long as the service contract and, afterwards, for the time needed to return or delete the data under section 9.
2. Types of data and data subjects
- Data subjects: the controller’s players, members and prospective customers; booking holders and attendees; their legal guardians; and the controller’s employees and collaborators.
- Data: identification and contact data (name, email, phone); booking, attendance, membership and playing-level data; licence data and internal notes; financial and billing data; communications; and anything else the controller chooses to record.
- Special categories: the application is not designed to record health data or other special categories. If the controller enters them (for example, in free-text notes), it does so under its own responsibility and must have an appropriate legal basis. The processor applies the same security measures to them as to all other data.
3. Obligations of the processor
The processor undertakes to:
- process the data only on the controller’s documented instructions, which are this agreement and the configuration and use the controller makes of the application, including as regards international transfers; if it considers that an instruction infringes the rules, it will tell the controller immediately;
- not use the data for its own purposes or disclose it to third parties, except to authorised sub-processors or where required by law;
- ensure that the persons authorised to process the data have committed to confidentiality;
- apply the security measures in section 5;
- assist the controller in handling data subjects’ requests to exercise their rights, mainly through the application’s features (viewing, correcting, exporting and anonymising records), and forward to it without delay any request it receives directly;
- assist the controller in meeting its security obligations, its obligations to notify personal data breaches and, where applicable, to carry out impact assessments and prior consultation, taking into account the nature of the processing and the information available to it;
- make available to the controller the information needed to demonstrate compliance with this agreement and allow reasonable audits, announced at least 30 days in advance, at the controller’s expense and without compromising the security or confidentiality of other clients.
4. Obligations of the controller
The controller warrants that the data it enters in the application has been lawfully obtained, that it has a legal basis to process it (including sending communications to its players), that it has informed the data subjects (for example, through the club privacy page the application publishes) and that it only records the data that is necessary. It is also responsible for managing its team’s access and the permissions it grants them.
5. Security measures
- Encrypted communications (HTTPS/TLS) and passwords stored with secure hash functions.
- Logical separation of each club’s data and access control by roles and permissions.
- Hosting in IONOS data centres in the European Union, with physical security measures.
- Regular backups and restore procedures.
- Logging of relevant activity and error monitoring.
- Security updates for the software and its dependencies.
- Access by the processor’s staff to the controller’s data limited to what is needed to provide support or resolve incidents.
6. Personal data breaches
The processor will notify the controller, without undue delay and within 48 hours at the latest after becoming aware of it, of any security breach affecting its data. The notification will include the available information: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Notifying the supervisory authority and the data subjects is the controller’s responsibility, with the processor’s assistance.
7. Sub-processors
The controller gives the processor general authorisation to use the sub-processors in the list below. The processor imposes on them by contract the same data protection obligations it assumes in this agreement and is liable for their compliance. Those marked “optional” only process data if the corresponding feature is enabled.
The processor will notify the controller of any addition or replacement of sub-processors at least 15 days in advance, by email or in the application. The controller may object on reasonable data protection grounds; if no solution is reached, it may cancel the service without penalty.
| Sub-processor | Service | Location | Safeguard |
|---|---|---|---|
| IONOS SE | Hosting of the application, database, files and backups; email delivery | EU (Germany / Spain) | Processing in the EU |
| Cloudflare, Inc. (Turnstile) | Anti-spam protection of the forms (Turnstile) | USA / EU | EU-US Data Privacy Framework and standard contractual clauses |
| Google Ireland Ltd. / Google LLC | Aggregate analytics of the website and the application, only with consent optional | EU (Ireland) / USA | EU-US Data Privacy Framework and standard contractual clauses |
| Functional Software, Inc. (Sentry) | Application error monitoring (Sentry); booking data is not sent | USA / EU | EU-US Data Privacy Framework and standard contractual clauses |
| Servicios push de navegadores (Google, Mozilla, Apple, Microsoft) | Browser push notifications (only if the user enables them); delivered through the push service of the user's browser (Google, Mozilla, Apple, Microsoft) optional | Depends on the user's browser | Standard contractual clauses |
8. International transfers
The data is hosted in the European Union. When a sub-processor processes it outside the European Economic Area, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework for certified entities) or on the European Commission’s standard contractual clauses, with the necessary supplementary measures.
9. Return and deletion of data
When the service ends, the controller may export its data for 30 days or ask the processor to hand it over in a structured, commonly used format. 90 days after the end of the contract, the processor deletes the data from its active systems, and backups are overwritten in their normal cycle. The processor may keep blocked the data strictly necessary while liabilities may arise from performance of the service.
10. Liability and term
Each party is liable for the breaches attributable to it under article 82 of the GDPR. If the processor processes the data for its own purposes or breaches this agreement, it will be considered a controller of that processing. This agreement remains in force for as long as the service contract is in force and, afterwards, for as long as the processor holds the controller’s data. For any enquiry, write to info@pranarpclub.com.