Personal data processing agreement

This text applies from 13 October 2026.

Service provider and contact

SPORTINI, obrt za izdavanje softvera, računalno programiranje i informatičke usluge, vl. Dario Zavišić
OIB: 30860479250
Vinkovci, Antuna Branka Šimića 11
dario@sportini.eu
+385958726449

Parties and subject matter

The club is the controller of member records and Sportini is the processor. Processing covers members, families, teams, schedules, attendance, fees, equipment, messages and documents, and available development, health and GPS records. The purpose is to provide the club workspace on the club’s instructions; the agreement continues until return or erasure is completed.

Instructions and lawfulness

Use of the service and assigned roles constitute documented club instructions, including instructions on authorised transfers. Sportini does not use member data for its own marketing. Sportini informs the club before acting on an instruction that infringes data protection law. Where law requires other processing, Sportini informs the club beforehand unless the law prohibits this.

Confidentiality and safeguards

Authorised persons are subject to confidentiality and access only necessary data. Safeguards include verified sign-in, revocation and current role/membership checks, private files, encrypted transport and denial of direct browser database/storage access. Coaches see their own uploads; management sees club documents. Sensitive records require the club’s recorded purpose, basis and evidence reference. That record is not legal approval by Sportini.

Assistance, incidents and audit

Sportini assists the club with data subject rights, security, impact assessment and prior consultation, taking account of the processing and available information. It notifies the club of a personal-data breach without undue delay. It provides information necessary to demonstrate its obligations and permits audits, including inspections, by the club or its authorised auditor, while protecting other clubs’ data.

Subprocessors and transfers

The club authorises Google Cloud and Firebase for sign-in, database, files and notifications under applicable service-specific processing terms. Primary records and files are stored in the EU; Authentication and Messaging involve processing outside the EU. Applicable agreements and transfer safeguards are recorded in the supplier register and available on request. Sportini must impose appropriate subprocessor obligations and remains responsible for their performance. It notifies the club at least 30 days before an intended subprocessor change so that the club can object. Paddle independently processes subscription sales and does not receive the member directory. PostHog does not measure the club workspace. OpenStreetMap receives an external request when a map is opened under its own privacy policy; it is not described as bound by an unverified subprocessor agreement. The club must authorise the assessed GPS purpose before use.

Club responsibility

The club documents its Article 6 basis and, for health data, an applicable Article 9(2) condition. It provides the member notice or its own complete notice and necessary parental-authority and consent evidence where consent is used. The online consent age threshold is not a general lawful basis for every club activity. The club determines retention periods and reviews legal exceptions before requesting erasure.

Return and termination

Management can download records and files before termination. A closure request stops access, and documents, member/development records, reminders and the club conversation are erased through a retryable process. An interruption leaves work pending; erasure is not complete until cleanup succeeds. Management can also request individual member erasure. Copies required by law are retained solely for that purpose, for the applicable statutory period. Backups and soft-deleted files have bounded recovery periods and are not returned to operational access without reapplying erasure requests. User accounts are erased separately.

Acceptance

The owner accepts the agreement version at setup or following a change. The version, text, text digest, time and accepting identity are recorded. Member records are unavailable without current acceptance.