Data Processing Agreement

Controller: the club using the Services (the "Club").

Processor: Thomas Koch, sole proprietorship, Seidenweg 12, 3012 Bern, Switzerland ("Racket Panda").

The Club determines the purposes and means of processing. Racket Panda processes the data only on the Club's documented instructions. Use of the Services and acceptance of the Terms constitute instructions for the purposes of this agreement.

Subject matter: hosting and making available the data the Club enters into Racket Panda, in particular its member list.

Purpose: enabling the Club to manage its presence on the platform, to reserve certain events for its members, and to send them its own announcements.

Duration: for as long as the Club holds an active account, then as set out in section 10.

Data subjects: the Club's members, as entered by the Club.

Data processed: first name, last name, email address, correspondence language, the member categories the Club itself defines (for example the sport played or the type of membership), and the date of addition to the list.

Racket Panda requests no sensitive data within the meaning of art. 5 lit. c FADP and provides no field intended to hold any: no phone number, date of birth, licence number, payment data or health data. The member categories are entered by the Club, which remains the controller responsible for their content. Racket Panda does not interpret or enrich them, and uses them for one purpose only: selecting the recipients of an announcement, on the Club's instructions.

Racket Panda processes member list data solely to:

• store it and make it available to the Club's approved administrators;
• check, when someone signs up for a members-only event, whether that person is on the list. This check returns a yes or no answer and discloses no data to third parties;
• send to the addresses on that list the announcements the Club writes itself and triggers itself from its dashboard;
• restrict, on the Club's instructions, the recipients of an announcement to part of the list, using the categories the Club has defined itself.

Racket Panda never sends an announcement on its own initiative: every send is written and triggered by the Club, which confirms at that moment that it may write to those addresses. Every announcement carries a one-click unsubscribe link, and an unsubscribe is honoured for that Club permanently.

Racket Panda uses this data for no other purpose. In particular it is not used for Racket Panda's own marketing, analytics, model training or profiling. Open and click tracking are deliberately disabled.

Persons authorised to process the data are bound by confidentiality. Administrator access is currently limited to the operator named in section 1, for support and maintenance purposes only.

• Database-level isolation. Row level security is enabled on the members table. Four separate policies (read, insert, update, delete) each require an approved claim for the club concerned. The restriction is enforced by the database engine, independently of application code.
• No public exposure. The list is not reachable from any public page, search result, export or sitemap.
• Encryption in transit (HTTPS/TLS) and at rest, provided by the sub-processors named in section 7.
• Minimisation. Only the data listed in section 3 is collected.
• Immediate deletion at the Club's request from its dashboard.
• Suppression list. An unsubscribe, a permanent delivery failure or a complaint removes the address from later sends, automatically and permanently. The new tables are readable only by the Club's approved administrators and are written only by the server.

The Club authorises the following sub-processors, which are the only ones that come into contact with the member list:

• Supabase, database and authentication. Hosting: Frankfurt, Germany (EU).
• Vercel, application hosting and processing in transit. Hosting: Washington, DC, United States.
• Resend, delivery of the announcements the Club sends to its members. Hosting: Ireland (EU). Receives only the addresses of an announcement's recipients and the content the Club wrote, at the moment of sending.

The other providers used by Racket Panda (Stripe for club billing, Mapbox for maps, Vercel Analytics for audience measurement) receive no member list data.

Racket Panda will inform the Club of any change of sub-processor affecting this data, with reasonable notice allowing the Club to object.

Racket Panda assists the Club, so far as possible, in responding to requests for access, rectification, erasure or objection. In practice the Club can handle most such requests itself: viewing, editing and deleting a member are done directly from its dashboard.

In the event of a security breach affecting the Club's data, Racket Panda will inform the Club without undue delay after becoming aware of it, with the known details: nature of the incident, data and people affected, and measures taken. The Club remains responsible for any notification to the FDPIC or to data subjects.

On termination of the contractual relationship, or at the Club's request at any time, Racket Panda deletes the member list. The Club may also delete it itself at any time from its dashboard. Residual backups are overwritten according to the host's retention cycle.

Racket Panda makes available to the Club the information necessary to demonstrate compliance with these obligations, and allows for a reasonable audit on written request and with reasonable notice.

Member list data is stored in the European Union (Frankfurt). The European Union benefits from a Swiss Federal Council adequacy decision, so this storage is not a transfer requiring additional safeguards.

Execution of the application by Vercel currently takes place in the United States, meaning processing in transit occurs outside Switzerland and the EEA. That processing relies on the appropriate contractual safeguards agreed with that sub-processor, in particular standard contractual clauses.