Data Processing Agreement

1. How this agreement applies

This DPA forms part of the VenueManage Terms of Service and applies automatically to every Club that uses VenueManage. No signature is needed for it to take effect. If you would like a signed copy for your records, email support@venuemanage.com.

If this DPA and the Terms conflict on the protection of personal data, this DPA takes priority. Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended.

2. Roles

For personal data the Club or its users put into VenueManage ("Club Personal Data"), the Club is the controller and VenueManage is the processor. The Club is responsible for having a lawful basis for the processing, including any condition needed for special category or criminal offence data, and for giving data subjects the privacy information the law requires.

VenueManage is a separate controller for the account and billing details of the Club's contacts and users, as described in our Privacy Policy.

3. Subject matter, duration, nature and purpose

• Subject matter: providing the VenueManage apps the Club subscribes to.
• Duration: for as long as the Club uses VenueManage, and afterwards until the Club Personal Data is deleted or returned under clause 12.
• Nature: storing, organising, displaying, sending (by email, SMS and push notification), analysing on request (including the optional AI features), backing up and deleting data, as the apps require.
• Purpose: to provide, support, secure and maintain the service for the Club.

The categories of data subjects and personal data are set out in Schedule 1. They depend on which apps and features the Club chooses to use.

4. Instructions

VenueManage will process Club Personal Data only on the Club's documented instructions, including for transfers outside the UK, unless the law requires otherwise. In that case VenueManage will tell the Club first, unless the law forbids it. The Terms, this DPA and the Club's use and configuration of the apps are the Club's documented instructions. VenueManage will tell the Club straight away if it believes an instruction breaks Data Protection Law.

5. Confidentiality

VenueManage will make sure that anyone it authorises to process Club Personal Data is bound by a duty of confidentiality, by contract or by law, and only has access where they need it to provide or support the service.

6. Security

VenueManage will take the technical and organisational measures required by Article 32 of the UK GDPR, taking into account the nature of the data and the risks involved. The measures in place are listed in Schedule 2. VenueManage may change them over time, but not in a way that lowers the overall level of protection.

7. Sub-processors

• The Club gives general authorisation for VenueManage to use sub-processors. The current list is in Schedule 3.
• VenueManage will give the Club at least 30 days' notice before adding or replacing a sub-processor, by email to the Club's account contact or by a notice in the app, and by updating Schedule 3.
• The Club may object on reasonable data protection grounds within that 30 days by emailing support@venuemanage.com. The parties will discuss the objection in good faith. If it cannot be resolved, the Club may stop using the affected app or feature, or end its subscription, without penalty.
• VenueManage will put data protection terms in place with each sub-processor that give at least the same protection as this DPA, and remains responsible to the Club for its sub-processors.

8. Helping with data subject rights

Taking into account the nature of the processing, VenueManage will help the Club respond to requests from people exercising their data protection rights. Most requests can be handled by the Club directly in the apps (finding, exporting, correcting or deleting records). If VenueManage receives a request about Club Personal Data, it will pass it to the Club without undue delay and will not respond to it itself unless the Club asks.

9. Helping with security, DPIAs and consultation

VenueManage will give the Club reasonable help, using the information available to it, with the Club's obligations on security, breach notification, data protection impact assessments (DPIAs) and prior consultation with the Information Commissioner's Office (ICO).

10. Personal data breaches

VenueManage will notify the Club without undue delay, and in any case within 48 hours, of becoming aware of a personal data breach affecting Club Personal Data. The notice will include, as far as it is known at the time:

• what happened, and the categories and rough numbers of people and records affected;
• the likely consequences;
• the steps taken or proposed to deal with it and reduce its effects; and
• a contact for more information.

Where not everything is known at once, VenueManage will provide information in stages as it becomes available. This is so the Club can make its own notification to the ICO, and to the people affected where required.

11. International transfers

VenueManage will only transfer Club Personal Data outside the UK where the transfer is covered by UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework (for certified US providers) or the EU Standard Contractual Clauses with the ICO's International Data Transfer Addendum, or another safeguard allowed by Data Protection Law. Schedule 3 shows where each sub-processor is located.

12. End of the service

When the Club stops using VenueManage, VenueManage will, at the Club's choice, delete the Club Personal Data or return it in a commonly used format, on request. Copies in backups expire within 90 days. VenueManage may keep data only where the law requires it, and will keep it protected and process it for no other purpose.

13. Audit and information

VenueManage will make available to the Club the information reasonably needed to show that it meets the obligations in this DPA and Article 28, for example by answering security and due diligence questionnaires. It will allow for and contribute to audits, including inspections, by the Club or an auditor the Club appoints, on reasonable notice, during normal working hours, no more than once a year unless there has been a breach or a regulator requires it, and subject to confidentiality. Each party bears its own costs.

14. General

This DPA lasts for as long as VenueManage processes Club Personal Data. It is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction. Limits of liability in the Terms apply to this DPA, except where the law does not allow them to.

Schedule 1: Data subjects and personal data

The data processed depends on the apps the Club uses. The full description by app is in section 4 of our Privacy Policy. In summary:

Data subjects

• the Club's staff, volunteers, stewards and drivers;
• contractors, suppliers, sponsors and partners;
• guests, visitors and parking holders;
• supporters and fans, including ticket claimants, prediction league players and photo buyers;
• people involved in matchday incidents, ejections, arrests and banning orders;
• children and young people, and their parents or guardians (Safeguard and FoundUp);
• foundation programme participants; and
• police, Safety Advisory Group and other reviewers the Club shares information with.

Personal data

• identity and contact details (name, email, phone, address, date of birth, photo);
• employment and HR details (leave, probation, emergency contacts);
• vehicle and driving details (registration, licence number, National Insurance number, penalty points, licence checks, journeys);
• matchday incident, injury and ejection records;
• attendance, consents, survey answers, quiz scores and read receipts;
• payments, orders and shipping addresses; and
• technical data (IP address, browser details, push notification tokens, audit logs).

Special category and criminal offence data

Only where the Club uses the relevant features: health and injury details, ethnicity, religion or belief, sexual orientation, disability and additional needs, and safeguarding information about children; and criminal offence data such as arrests, police references and Football Banning Orders.

Schedule 2: Technical and organisational measures

• Thryve Apps Ltd is Cyber Essentials certified, company-wide. The certificate is available on request.
• Encryption in transit: all connections use TLS, with HSTS.
• Encryption at rest: AES-256, provided by our hosting and storage providers.
• Field-level encryption (AES-256-GCM) for safeguarding concern content and payment provider secrets.
• Access control: separate roles in each app, so users only see what their role allows.
• Audit logs of activity in the apps, including IP addresses.
• Private file storage, opened only through short-lived signed links.
• Logged, individual share links for external reviewers in Control Room.
• Rate limiting and Cloudflare Turnstile bot protection.
• Strong password rules, with checks against known breached passwords.
• Nightly off-site backups, encrypted at rest and kept for 90 days.
• Core data (database, sign-in and file storage) hosted in the UK and EEA.
• Location (GPS) data removed from Snaps photos; only plate text kept from Parking plate photos.
• Automatic retention rules in some apps, as described in our Privacy Policy.
• No facial recognition or biometric processing, and Club data never used to train AI models.

Schedule 3: Sub-processors

Some sub-processors are only used when the Club turns on the app or feature that needs them.

Contact

Questions about this DPA, or to request a signed copy: support@venuemanage.com. Data protection matters, including breach notices and objections to sub-processors, can also go to our Data Protection Officer at dpo@stafflo.co.uk.