Data Processing Agreement (DPA)

Last updated: 1 May 2026

Signed between the club (controller) and Klubbia (processor) when the club registers its organisation.

1. Scope

Klubbia processes on the club's behalf the personal data of its members, supporters and staff for the service.

2. Processor obligations

Adequate technical and organisational measures, confidentiality, breach notification, reasonable audits.

3. Authorised sub-processors

Vercel (hosting and analytics), Neon (database) and push-notification delivery providers (Apple, Google, Mozilla) when the user enables them. Authentication is internal to Klubbia. 30 days' notice before adding new ones.

4. International transfers

Data stored in EU regions. SCCs apply if a non-EU provider is used.

5. End of processing

Klubbia returns or destroys the club's data, except where legally required.