Data processing agreement

Between the club (controller) and Klybrix (test stand) (processor), under Article 28 GDPR. Part of the terms of service.

Subject and duration

Klybrix (test stand) processes the personal data the club enters into the service, only to provide the service and only on the club's documented instructions — which are given by the club's use of the service and its settings. It lasts as long as the club's account.

Data and people concerned

Athletes (often minors), their parents or guardians, coaches and staff: identification and contact details, membership, attendance, payments, health documents the club chooses to upload, results, messages and photos.

Klybrix (test stand)'s obligations

• Confidentiality of everyone with access; access limited to what support and operation need.
• Security: data of each club kept apart (row-level isolation, per-club file storage), encryption in transit, access control by role, backups, logging.
• Sub-processors listed in the privacy policy; the club is told of changes 30 days ahead and may object by closing its account.
• Help with data subjects' requests: export of all club data, erasure of an athlete's personal data, account deletion.
• Notice of a personal data breach without undue delay, and in any case within 48 hours of becoming aware of it.
• At the end: the club exports its data, and it is erased 30 days after closing; backups roll over within 30 days.
• Information needed to demonstrate compliance, and audits on reasonable notice.

Questions: smnrnd@proton.me.