Data Processing Agreement (DPA)

Last updated: 1 May 2026

Signed between the club (controller) and Klubbia (processor) when the club registers its organisation.

1. Scope

Klubbia processes on the club's behalf the personal data of its members, supporters and staff for the service.

2. Processor obligations

Adequate technical and organisational measures, confidentiality, breach notification, reasonable audits.

3. Authorised sub-processors

CoopWork (server and database hosting, in the EU), Cloudflare (CDN, TLS, image storage and database backups), Amazon Web Services / Amazon SES (transactional email, servers in the EU) and Redsys (payment gateway), plus Google (sign-in, if the user uses it) and push-notification delivery providers (Apple, Google, Mozilla) when enabled. Analytics are internal to Klubbia. Klubbia will give the club 30 days' notice before adding a new sub-processor, with the right to object.

4. International transfers

The database is hosted in the EU (on CoopWork's server). Some sub-processors (e.g. Cloudflare, Amazon Web Services or Google) may process data outside the EU; in those cases transfers rely on the European Commission's Standard Contractual Clauses or other adequate GDPR safeguards.

5. End of processing

Klubbia returns or destroys the club's data, except where legally required.