Data Processing Agreement (Finisher Feedback)

Applies only to Finisher Feedback. This agreement forms part of the Terms of Service you accepted. Electronic acceptance has the value of a written contract (GDPR Art. 28(9)). Need a signed copy? Write to support@sportingscouter.com.

This Data Processing Agreement (“Agreement”) forms part of the Terms of Service available at https://trust.sportingscouter.com/en/for-organizers/terms (“Principal Agreement”) between:

the entity that accepts the Principal Agreement and acts as data controller for the participant data it provides (“Company”); and

Daniel Sousa, self-employed, taxpayer number PT229306535, fiscal domicile Rua das Escolas 148, 4520-322 Fornos, Santa Maria da Feira, Aveiro, Portugal, trading as Sporting Scouter (“Processor”).

Acceptance. The Company accepts this Agreement electronically by ticking the acceptance box when registering or at checkout. The Processor records the user, the date and time and the version accepted. Electronic form satisfies Article 28(9) GDPR.

1. Definitions

1.1 “GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as retained in the law of the United Kingdom. “Data Protection Laws” means the GDPR, the UK GDPR where applicable, and the national laws implementing or supplementing them. 1.2 “Company Personal Data” means the personal data described in Annex 1 that the Processor processes on behalf of the Company under the Finisher Feedback service. 1.3 “Subprocessor” means any third party engaged by the Processor to process Company Personal Data. 1.4 “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” and “Supervisory Authority” have the meanings given in the GDPR.

2. Scope

2.1 This Agreement applies only to the Finisher Feedback service: the participant list the Company provides, the invitations sent on its behalf, and the responses received through those invitations. 2.2 This Agreement does not apply to the following, for which the Processor acts as an independent controller under its own Privacy Policy: (a) reviews that participants submit directly on the Processor’s website or by public link or QR code (“Spontaneous Reviews”); (b) public social media comments collected for the Social Debrief; (c) the Company’s account, billing and contact data.

3. Processing on documented instructions

3.1 The Processor shall process Company Personal Data only on the Company’s documented instructions, including with regard to transfers, unless required to do so by Union or Member State law; in that case it shall inform the Company of that legal requirement before processing, unless that law prohibits it. 3.2 The Company instructs the Processor to process Company Personal Data to provide the Finisher Feedback service as described in the Principal Agreement and Annex 1. 3.3 Matching Spontaneous Reviews against the list. The Company instructs the Processor to compare the bib number and email address given in a Spontaneous Review about the Company’s event with the participant list, and authorises the Processor to record the result (matched or not matched) for its own processing of Spontaneous Reviews as an independent controller. The participant list is used for no other purpose. The Company shall inform its participants of this use in its own privacy notice. 3.4 The Processor shall immediately inform the Company if, in its opinion, an instruction infringes Data Protection Laws. 3.5 The Processor shall not use Company Personal Data to train artificial intelligence models and shall require the same of its Subprocessors.

4. Confidentiality

The Processor shall ensure that persons authorised to process Company Personal Data are bound by confidentiality and access only what is strictly necessary.

5. Security

The Processor shall implement appropriate technical and organisational measures under Article 32 GDPR, including those described in Annex 3.

6. Subprocessors

6.1 The Company gives a general written authorisation for the Processor to engage the Subprocessors listed in Annex 2. 6.2 The Processor shall notify the Company by email at least 30 days before adding or replacing a Subprocessor. The Company may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Company may terminate the affected service and receive a pro-rata refund of prepaid amounts for services not yet performed. 6.3 The Processor shall impose on each Subprocessor, by contract, the same data protection obligations as in this Agreement, in particular sufficient guarantees of appropriate technical and organisational measures. The Processor remains fully liable to the Company for its Subprocessors’ performance (Article 28(4) GDPR).

7. International transfers

7.1 The transfers listed in Annex 2 are authorised on the basis of the safeguard stated for each: an adequacy decision, the EU-U.S. Data Privacy Framework, or the standard contractual clauses (Commission Implementing Decision (EU) 2021/914) included in the Subprocessor’s terms. 7.2 Any new transfer follows clause 6.2.

8. Data subject rights

8.1 The Processor shall assist the Company, by appropriate technical and organisational measures, in responding to requests from Data Subjects. 8.2 If a Data Subject contacts the Processor about Company Personal Data, the Processor shall forward the request to the Company without undue delay and shall not respond itself except on the Company’s instructions or where required by law.

9. Personal data breaches

9.1 The Processor shall notify the Company without undue delay and in any case within 48 hours after becoming aware of a Personal Data Breach affecting Company Personal Data, with the information required by Article 33(3) GDPR as far as it is available, and shall provide the rest as soon as possible. 9.2 The Processor shall cooperate with the Company to investigate, mitigate and remediate the breach.

10. Assistance

The Processor shall assist the Company with its obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessments and prior consultation), taking into account the nature of the processing and the information available to the Processor.

11. Deletion or return

11.1 Retention by default. The Company decides how long the Processor keeps Company Personal Data. Unless the Company instructs otherwise, the Processor keeps it until the end of the Principal Agreement. For this clause, the Principal Agreement ends when the Company has no active product and 90 days have passed since its last usage right expired; for Finisher Feedback, an edition’s usage right runs until three months after the edition’s end date. We recommend that the Company asks us to delete invitee data as soon as it no longer needs to contact the participants. 11.2 Deletion. Within 30 days after (a) the Company’s request, for one edition or for all its data, or (b) the end of the Principal Agreement, the Processor shall, at the Company’s choice, delete or return Company Personal Data and delete existing copies, unless Union or Member State law requires storage. Deletion covers the invitee list, the participant list, the invitees’ name and email copied into each response, and the contacts held by the email Subprocessor. 11.3 Responses and reviews. Responses and published reviews are not deleted: the Processor removes the name and email that identify the participant and keeps the rest. The Processor may keep, as an independent controller, the minimum data needed to keep a published review’s link to the participant list (a pseudonymous participation record, without name or email), for as long as the review stays published. 11.4 On request, the Processor shall confirm in writing that it has complied with this clause and describe any data kept under clause 11.3.

12. Information and audits

The Processor shall make available to the Company all information necessary to demonstrate compliance with Article 28 GDPR and shall allow for and contribute to audits, including inspections, by the Company or an auditor it mandates, with reasonable notice and at the Company’s cost, no more than once a year unless a breach or a supervisory authority requires otherwise.

13. Duration

This Agreement lasts as long as the Processor processes Company Personal Data under the Principal Agreement, and clauses 9, 11 and 12 survive until the data is deleted or returned.

14. Changes

14.1 The Processor may change this Agreement or Annex 2 by notifying the Company by email at least 30 days before the change takes effect. If the Company does not agree, it may terminate the affected service before that date at no cost and receive a pro-rata refund of prepaid amounts for services not yet performed. 14.2 Changes required by law take effect on the date the law requires.

15. Precedence

In case of conflict with the Principal Agreement, this Agreement prevails on the processing of Company Personal Data.

16. Governing law and jurisdiction

16.1 Portuguese law. 16.2 The courts of the defendant’s domicile.

Annex 1. Details of processing

Annex 2. Authorised subprocessors

Annex 3. Security measures (summary)