Legal
Data Processing Agreement
This agreement is under review. We publish it because a written processor agreement is required and a club should be able to read the terms it is being offered, and we will post the reviewed version here when it is ready.
If your club needs a signed copy in the meantime, or would rather we worked from its own template, email hello@infacta.com.
This Data Processing Agreement (“DPA”) forms part of, and is incorporated into, the Infacta Terms of Service. It governs how Infacta processes personal data on behalf of the clubs, societies and organisations that use Infacta Account and the Infacta products: ClubCards, FloorTime and CampGenie. Infacta is a registered business name of Groupmail Ltd. (registered in Ireland, company no. 284930, registered office Unit 15, SocoLab, Strandhill, Co. Sligo, F91 E426, Ireland) (“Infacta”, “we”, “us”, the “Processor”). It is designed to meet the requirements of Article 28 of the EU and UK GDPR.
The body of this agreement applies to every Infacta product. What each product actually processes differs, so there is a separate Annex 1 for each of them — that is the part to read if you want to know what we hold about your people.
Whether you need to sign anything
You do not have to. This DPA applies by default to every club account, because it is part of the Terms your club accepted. Publishing it means a club is covered without having to ask.
Some clubs still want a countersigned copy — typically those with a data-protection officer, a public-body funder or an insurer that asks for one. If that is you, email us and we will sign and return it. If your organisation has its own DPA template it would rather use, send it along and we will read it.
You do not need a DPA for your own personal Infacta account. For that, we are the controller and our Privacy Policy applies.
Scope and incorporation
This DPA is between Infacta and the customer that operates an Infacta club account (the “Club”, “you”, the “Controller”). It governs our processing of personal data that a Club enters into, uploads to, or generates within Infacta Account or any Infacta product about people other than the Club’s own account holders (“Club Data”). Where this DPA conflicts with the Terms of Service on the subject of personal-data processing, this DPA prevails.
Roles of the parties
For Club Data, the Club is the controller and Infacta is the processor, processing Club Data only to provide the service and only on the Club’s documented instructions, including those given through normal use of the platform.
For account data about the people who run a Club’s account — their name, email address and sign-in credentials — Infacta is the controller. That processing is described in our Privacy Policy, not in this DPA.
Our obligations as processor
We will:
- process Club Data only on your documented instructions, including for international transfers, unless required by law — in which case we will tell you, unless the law forbids it;
- ensure that personnel authorised to process Club Data are bound by confidentiality;
- implement and maintain the technical and organisational security measures set out in Annex 2;
- respect the conditions for engaging sub-processors set out below;
- assist you, taking into account the nature of the processing, to respond to data-subject requests and to meet your security, breach-notification and data-protection-impact-assessment obligations; and
- at your choice, delete or return Club Data at the end of the service, and delete existing copies unless we must keep them by law.
Sub-processors
You give general authorisation for us to engage sub-processors to help provide the service. The current list is published at infacta.com/subprocessors, says which products use each provider, and forms part of this DPA as Annex 3.
We impose data-protection terms on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance.
We will give at least 30 days’ notice, by updating that list and notifying account admins, before adding or replacing a sub-processor. If you have a reasonable, data-protection-based objection, tell us within that period and we will work in good faith to resolve it; if we cannot, you may terminate the affected part of the service.
Data location and international transfers
Infacta Account and every Infacta product host their application, database and stored files in the European Union (Frankfurt, Germany). Club Data is processed in the EU by default.
Where a sub-processor processes Club Data outside the European Economic Area or the United Kingdom in a country without an adequacy decision — for example a transactional-email or payment provider — we rely on the European Commission’s 2021 Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, together with any supplementary measures required. The transfers that occur are identified in Annex 3.
Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting Club Data, and provide the information you reasonably need to meet your own notification duties under applicable law.
Audit and information
On reasonable written request, and no more than once a year unless required by a supervisory authority or following a breach, we will make available the information reasonably necessary to demonstrate compliance with Article 28 GDPR — for example our security documentation and any third-party audit reports or certifications we hold — and will contribute to audits conducted by you or your mandated auditor on reasonable notice, subject to confidentiality.
Deletion and return
You can delete people and records at any time from within the products. On termination of the account, we will delete or, if you ask, return Club Data within 30 days, except for copies in routine backups, which age out on our daily backup cycle, and anything we must retain by law.
One product deletes a category of data sooner than that, on its own schedule and without waiting for an account to close:
The medical, allergy, medication, additional-needs, collection and emergency-contact answers are deleted when the club archives the event. They are collected per event, used for that event, and purged when it is over — the registration keeps the fact that someone attended and what they paid, not their health details.
Annex 1 — Details of the processing
Article 28(3) requires the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject to be set out. Those differ by product, so there is one Annex 1 for each. In all three, the duration is the term of the Club’s account, except where a shorter period is stated.
- Subject matter — operation of the central account and club-management service.
- Nature and purpose — holding a club’s membership, inviting people to it, recording their roles and product access, and passing that to the products the club uses.
- Types of personal data — names, email addresses, club roles, product access, invitations and audit records of administrative actions.
- Categories of data subjects — the people a Club invites to its account: its staff, coaches and volunteers.
- Subject matter — provision of the ClubCards credential-issuing and verification service.
- Nature and purpose — storing, displaying, generating (wallet passes, PDFs, QR codes), emailing and verifying digital credentials on the Club’s instructions.
- Types of personal data — member names, email addresses, phone numbers, photos, credential classifications, add-ons and status; and verification events.
- Categories of data subjects — the Club’s members and credential holders, which may include children where the Club issues credentials to under-18s.
- Subject matter — provision of the FloorTime venue and session booking service.
- Nature and purpose — recording a Club’s venues, spaces, availability, seasons, teams and closures, and the bookings its coaches make in them; and publishing a read-only schedule where the Club chooses to.
- Types of personal data — the name and contact details of the Club’s own people who make and own bookings, and the names, mobile numbers and optional email and collection addresses of venue contacts and keyholders the Club records.
- Categories of data subjects — the Club’s staff, coaches and volunteers, and the venue contacts and keyholders it deals with. FloorTime holds no player rosters and no data about the children who attend. A team in FloorTime is a name on a calendar, not a list of people.
- Subject matter — provision of the CampGenie registration, payment and organisation service for the camps and trips a Club runs.
- Nature and purpose — taking registrations and payment for a Club’s events, holding the registration and family records behind them, and producing the lists, groups and messages an organiser needs to run the event; and, where the Club uses the camp album, keeping the photos the event’s staff take so that an organiser can share them with faces blurred.
- Types of personal data — guardian names, email addresses and phone numbers; each child’s name and date of birth; consent records; order and payment status, including the reference Stripe returns (card numbers never reach CampGenie); and, per event, special category data under Article 9 — medical conditions, allergies, medications, additional needs and dietary requirements — together with collection arrangements and emergency contacts; and, where the Club uses the camp album, photos taken at its events, with where each face in a photo is and whether it is blurred — faces are located on the organiser’s device, never identified.
- Categories of data subjects — the guardians who register for a Club’s events, the children who attend them, and the people in photos taken at them.
- Duration — as above, except that the health, allergy, medication, additional-needs, collection and emergency-contact answers are deleted when the Club archives the event. They are collected per event, used for that event, and purged when it is over; they are never kept as a standing profile of a child. An event’s album photos are deleted when it is archived too.
Annex 2 — Technical and organisational measures
We maintain measures appropriate to the risk, including:
- application hosting and the PostgreSQL database in the European Union (Frankfurt, Germany), on Render’s EU region;
- uploaded files and generated artifacts in Amazon S3 in the EU (Frankfurt, eu-central-1) for ClubCards, FloorTime and CampGenie;
- passwords held only by the central account service and only as secure hashes — no Infacta product stores a password — with single-use sign-in and reset links;
- encryption of data in transit (TLS) for all connections to the service;
- logical tenant isolation, so one Club cannot access another Club’s data;
- cryptographic signing of requests between the account service and the products;
- multi-factor authentication on the infrastructure and code-hosting accounts we use (Render and GitHub), and least-privilege access controls for staff and service credentials;
- protections against common web attacks, including server-side request forgery and cross-tenant access, security headers, and token-gated public links;
- daily backups of the database; and
- use of reputable cloud sub-processors that themselves maintain recognised security standards.
Two limits, stated plainly rather than left out: we rely on encryption in transit and the platform-level protections above, and do not currently apply application-level encryption at rest to the database or stored files; and operational logs are retained for a variable period, typically around 30 days.
Annex 3 — Sub-processors
The current sub-processor list — each provider, what it does, where it processes data, the transfer safeguard relied on and which products use it — is published at infacta.com/subprocessors and updated as described above. It forms part of this agreement.
Contact
Data-protection questions, or to request a countersigned copy of this DPA: email hello@infacta.com with your club’s full legal name, the country it is established in, and who will sign.