HandballArena Data-Processing Agreement
Last updated: 22 October 2026.
1. Parties, scope and precedence
This agreement (the "DPA") forms part of the signed Order between the Club identified in that Order (the "Controller") and PSG, Borut Grauf s.p., Pod gonjami 85, 2391 Prevalje, Slovenia, registration number 8519471000, VAT number SI54246679 (the "Processor").
It applies to personal data processed on the Club's behalf in providing HandballArena, including an agreed hosted website. It does not change the roles for processing the operator carries out for its own purposes, as described in the Privacy Notice.
GDPR terms have their meanings under Regulation (EU) 2016/679. This DPA prevails over conflicting commercial provisions concerning the processing of personal data. Mandatory law prevails.
2. Documented instructions and responsibilities
The Processor processes personal data only on the Controller's documented instructions, including this DPA, the Order and authorised settings and actions in the Service. This also applies to international transfers. If EU or Member State law requires other processing, the Processor informs the Controller before processing unless the law prohibits that information.
The Controller determines lawful purposes and legal bases, provides necessary notices, establishes retention instructions and controls authorised users. It must identify any additional condition needed for special-category data and must not instruct unlawful processing.
The Processor immediately informs the Controller if, in its opinion, an instruction infringes applicable data-protection law. It may pause the affected processing while seeking clarification or a lawful alternative, with proportionate protection of the data and service continuity.
3. Confidentiality and security
People authorised to process the data must be bound by confidentiality or an appropriate statutory duty. Access is limited to what their role requires.
The Processor implements appropriate technical and organisational measures under Article 32, taking account of the risks, including those concerning children and health-related information. Schedule B describes the measures. The Processor may improve them but must not materially reduce the agreed level of protection during processing.
4. Subprocessors and transfers
The Controller gives general written authorisation for the providers in the Subprocessor List, subject to the purposes and conditions described there. Before appointing an additional or replacement subprocessor, the Processor gives at least 14 days' written notice identifying its role, location and proposed start date.
The Controller may object within that period on reasonable data-protection grounds. The parties seek an appropriate alternative or safeguards. If they cannot resolve the objection, the Controller may end the affected Service before the proposed processing starts and receive unused prepaid fees for that Service. The Processor must not treat silence before the end of the notice period as permission to start early.
Each subprocessor is bound by a written agreement imposing the applicable data-protection obligations required by Article 28. The Processor remains responsible for the subprocessor's performance of those obligations.
Restricted international transfers require a lawful mechanism and appropriate supplementary safeguards where necessary. The Processor makes relevant information about the mechanism and safeguards available to the Controller.
5. Individuals' requests
Taking account of the nature of processing, the Processor assists the Controller with requests to exercise rights through appropriate technical and organisational measures. It promptly notifies the Controller of requests affecting Controller-controlled data, unless the Controller has given a documented instruction for an agreed category of requests.
The Controller authorises receipt and identity checking through the platform's central request channel. That channel alone does not authorise every disclosure or erasure. The Processor coordinates scope and lawful instructions with the relevant Controller, does not disclose another Club's data, and does not decide the Controller's legal grounds for retaining records. Where the operator is itself controller or the law directly requires action, it fulfils its own obligations.
Neither party may use its internal workflow to delay a request beyond applicable deadlines. The parties agree any urgent action needed where a request concerns several accounts, a child, other people's rights, or legal-preservation duties.
6. Incidents and assistance
The Processor notifies the Controller without undue delay after becoming aware of a personal-data breach affecting the data. It provides, as available, the nature of the breach, affected data and people, likely consequences, contact point, and measures taken or proposed. Information may be provided in stages without undue further delay.
The Processor takes reasonable measures to contain and remedy the breach and assists the Controller with required notifications. It also assists with security obligations, data-protection impact assessments and prior consultation with authorities, taking account of the processing and information available to it. Notification is not postponed until every detail is established.
7. Information and audits
The Processor makes available information necessary to demonstrate compliance with Article 28 and allows and contributes to audits, including inspections, by the Controller or its mandated auditor. The parties arrange reasonable notice, confidentiality and safeguards for other customers' information. Urgent incidents, regulator requests or credible non-compliance may require faster access.
Existing evidence or independent reports may satisfy an audit need where appropriate, but do not remove the Controller's statutory audit rights. This DPA does not represent that the Service holds a particular certification.
8. Return, deletion and duration
This DPA applies from the commencement of processing under the signed agreement and continues until the Processor has returned or deleted the data as required.
At the Controller's choice, the Processor returns or deletes the personal data after the processing services end and deletes existing copies unless EU or Member State law requires retention. The Controller's standard instruction is restricted retention for 90 days after termination followed by deletion, including copies, as described in Terms, section 13. The Controller may instruct earlier deletion or request return before scheduled deletion. No automatic export is prepared; a requested return is arranged securely. Mandatory data-return and retrieval rights remain unaffected, and data needed for a valid pending return request is protected until completion.
Backup copies remain protected and isolated from ordinary processing. They expire within 90 days of creation and are also subject to the end-of-service deletion deadline. If used for recovery, applicable deletion instructions are reapplied. Any legally required retention is documented, limited to that purpose and communicated where permitted. The Processor confirms completion on reasonable request.
9. Contacts and governing law
The Controller's contact is the representative designated in the Order or subsequently notified. The Processor's contact is support@handballarena.app. The governing-law and dispute provisions of the Terms apply without restricting individuals' or regulators' rights under applicable law.
Schedule A — Processing description
Subject and purpose: provide the agreed club-management and website services: member and team administration, guardian relationships, schedules, attendance, matches, evaluations, communications, participation-fee administration, public publishing, membership enquiries, support, exports, deletion and security performed on the Club's behalf.
Operations: collection, recording, organisation, storage, retrieval, authorised access, transmission, publication where instructed, export, correction, restriction and deletion.
People: members and prospective members, players including children, guardians, coaches, employees, volunteers, officials, website visitors and people contacting the Club.
Data: identity and contact details; dates of birth; photos and files; team, role and membership records; guardian links; attendance and participation; results; evaluations and development records; communications; fee records; applications; publication instructions and technical records needed for the processing.
Sensitive information: an enabled and appropriate feature may process limited health-related absence information. The Controller must establish the necessary legal basis and special-category condition, limit collection and access, and provide instructions. General notes and uploads must not be used as an unrestricted medical record. Other sensitive categories require a separate assessment and expressly agreed scope before processing.
Duration and frequency: ongoing during use of the relevant features, followed by the agreed return/deletion and backup periods. The Club must provide appropriate instructions for records that cease to be needed before its subscription ends.
Schedule B — Security measures
- Separation of Club data and controlled access according to authorised roles.
- Authentication controls, protected passwords and appropriate credential/token handling.
- Encrypted transport for service access and restricted administrative access.
- Logging and monitoring appropriate to security and fault investigation, with data minimisation.
- Protected backups, encryption before off-site transfer and controlled restoration.
- Procedures for access changes, incident handling, personal-data requests and deletion.
- Confidentiality obligations and access limited to authorised personnel and providers.
- Review and maintenance of measures appropriate to the processing risks.
The Processor supplies further relevant detail on reasonable request, subject to safeguards against exposing security-sensitive information or other customers' data.
Schedule C — Providers
The version of the Subprocessor List supplied with the Order is incorporated into this DPA. Subsequent changes follow section 4.