CoachTape Data Processing Agreement

This Data Processing Agreement ("DPA") applies between the Customer (the Club, organisation or User acting as controller) and Impact Atletica AB, organisation number 559571-1754, Fyrskeppsvägen 136, 121 54 Johanneshov, Sweden, acting as processor when it processes personal data contained in Content on the Customer's behalf. It forms part of the Terms of Service and Sale and applies where the GDPR applies. Where the two conflict on personal data processed on the Customer's behalf, this DPA prevails.

Subject matter: provision of the CoachTape film-review service. Duration: for as long as the Customer uses the Service, plus the deletion and backup periods described below.

Nature and purpose of processing: hosting, storing, encoding, transmitting, displaying, annotating, organising, tagging, searching, backing up, rendering requested exports, sharing as directed by the Customer, securing, supporting and deleting Content.

Categories of personal data: images, likenesses, voices, names, shirt numbers, sporting actions, coaching annotations, voice notes, session and clip titles, and technical metadata associated with Content; plus the identifiers of Users granted access.

Categories of data subjects: players (who may be children), coaches, team staff, officials, and incidental third parties such as spectators appearing in footage.

The Customer must not include special categories of data — such as health or disciplinary information — in annotations or titles unless it has established a valid lawful basis and informed us in writing.

The Customer is controller and determines the purposes and means of processing Content. The Customer is responsible for having a lawful basis; for providing required privacy notices and obtaining required permissions, including for footage involving children; for holding the copyright, broadcast and image rights needed to upload and share the footage; for deciding which Users and share recipients may access Content; and for the accuracy and lawfulness of what it uploads.

Impact Atletica AB processes such personal data only on the Customer's documented instructions, which are given through the Terms, this DPA, and the Customer's use of Service features. We will inform the Customer if we consider an instruction to infringe applicable data protection law, unless prohibited from doing so.

We limit access to Content to personnel who need it to provide, secure or support the Service. Such personnel are bound by confidentiality obligations and receive appropriate instruction on their data protection duties.

We implement appropriate technical and organisational measures having regard to the risk, including: access control and authentication; row-level authorisation so Content is private by default and reachable only by its owner and the recipients they choose; encrypted connections in transit; private storage with short-lived signed access URLs; revocable share links; separation of administrative from ordinary access; logging of administrative and security-relevant events; and managed, patched infrastructure provided by our hosting subprocessor. Measures may be improved over time provided protection is not materially reduced.

The Customer authorises the use of the subprocessors listed at /subprocessors: Lovable for application hosting, database, authentication and primary video storage, and Shotstack Pty Ltd for rendering exports the User explicitly requests. Footage is only sent to Shotstack for a requested export; we send the required clip rather than the complete source video where technically possible, use short-lived signed URLs, and do not enable optional long-term Shotstack storage.

We impose data protection obligations on each subprocessor that are no less protective than this DPA and remain responsible for their performance. We will give notice of any new or replacement subprocessor by updating that page; the Customer may object on reasonable data protection grounds by writing to leo@impactatletica.com, and if we cannot offer a reasonable alternative the Customer may terminate the affected part of the Service.

The primary backend is configured in Lovable's Europe region; the exact hosting country and backup locations are being confirmed. Rendering requested exports involves Shotstack Pty Ltd, established in Australia and using AWS infrastructure, whose DPA incorporates the EU Standard Contractual Clauses for transfers requiring safeguards. Where a transfer outside the EEA takes place, it is made on the basis of an adequacy decision or the Standard Contractual Clauses together with any additional measures required.

Taking into account the nature of the processing, we will assist the Customer, at the Customer's cost where the assistance is substantial, with: responding to data subject requests for access, correction, deletion, restriction, portability and objection; data protection impact assessments; and consultations with supervisory authorities. Where an individual contacts us directly about footage controlled by a Customer, we will refer them to the Customer where possible.

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed on the Customer's behalf, and provide the information reasonably available to us so the Customer can meet its own notification obligations. Notification is not an acknowledgement of fault.

On reasonable written request, and not more than once a year unless required by a supervisory authority, we will provide information reasonably necessary to demonstrate compliance with this DPA, including available documentation from our subprocessors. On-site audits are limited to what is necessary, arranged in advance, subject to confidentiality, and must not disrupt the Service or other customers.

The Customer may export and delete Content through the Service at any time. Deletion covers original videos, clips, thumbnails, annotations, voice notes, playlists, temporary files and active share links in active systems. On termination the Customer normally has 30 days to export Content before deletion from active systems. Deleted material may remain temporarily in routine backups until overwritten; we do not currently publish a fixed backup deletion deadline and will publish one when it is confirmed. We may retain data where required by law.

We do not use Content to train general-purpose or third-party artificial intelligence models, and we do not sell Content or use it for advertising. Uploaded video is not sent to AI models. Footage leaves our storage only for exports the User explicitly requests.

Liability under this DPA is subject to the limitations in the Terms of Service and Sale, to the extent permitted by law. Data protection contact: leo@impactatletica.com.