Privacy and personal data

Data Processing Agreement

DRAFT · Last updated: [publication date]

This agreement applies between the club that uses Matchio (the controller) and Matchio (the processor). It is accepted through the checkbox on the club request form. The agreement follows the standard contractual clauses of the European Commission (Commission Implementing Decision (EU) 2021/915). The official text is available on EUR-Lex. Dutch version: Verwerkersovereenkomst (NL).

Part A: the arrangements in plain language

• Matchio processes personal data only on behalf of the club and to provide the service.
• Matchio secures the data, limits access to those who need it, and reports a breach to the club without undue delay.
• Matchio only engages sub-processors listed in Annex IV. A new sub-processor is announced to the club in advance.
• After the service ends, Matchio deletes the data or returns it, except where the law requires keeping it.
• The club helps Matchio with data subject rights and ensures that the processing is lawful.

Annex I: parties

Controller: the club, with its name, address and the account of the club owner as entered in the app.

Processor: Matchio. Contact: matchio.info@gmail.com. Address and company number: [to be completed].

Acceptance: the date, account and version of this agreement are stored when it is accepted.

Annex II: description of the processing

• Data subjects: players, coaches, delegates, supporters and club administrators.
• Data: name, shirt number, positions, preferred foot, previous club, optionally height and weight, attendance, selection, match data and account data of the user.
• Purpose: managing matches, training sessions and teams, and sharing progress with the right roles.
• Public view: per match, supporters see the score, the goals, the selection without positions, and the approved report. They do not see line-ups.
• Duration: as long as the club uses Matchio.

Annex III: technical and organisational measures

• Access per role: club owner, coach, delegate and supporter. Each role only sees what belongs to that role. The access rules are tested automatically.
• Team codes are unique and there is a limit on failed attempts.
• A club is only created after Matchio approves the request.
• Two-step verification on the administrator accounts: [to be confirmed].
• Back-ups: [to be confirmed and completed].
• Deletion: the club can delete the team or the club itself. On request, Matchio deletes the data within [period].

Annex IV: sub-processors

• Google Firebase (accounts and database): Firestore in europe-west3 (Frankfurt, Germany).
• Microsoft Azure (hosting and the API): West Europe (Netherlands) region.
• AI providers, depending on the configuration and any fallback in the event of an outage:
  • Google Gemini (Generative Language API, Google LLC): processing in the US or EU. When the paid version is used, data is not used for training.
  • Groq (Groq LLC, fallback): processing in the United States of America.
  • NVIDIA (NVIDIA Corporation, fallback): processing in the United States of America.
  Transfer outside the EEA for Groq and NVIDIA. Transfer basis per provider: [to be checked]. Assume that the AI models of Groq and NVIDIA use the input for training. Matchio cannot enforce this with those providers.
• Open-Meteo (weather): processing in Switzerland/EU. Location and date only.
• Komoot (Photon) and OSRM (address and travel time): processing in Germany/EU. Field addresses only.
• E-mail: Gmail (Google) for sending club requests.

Part B: additional arrangements

• Liability and fines: [to be completed].
• Applicable law and competent court: Belgian law; the court of the judicial district [to be completed].