Data Processing Agreement

Last updated: 28/09/2026

This Data Processing Agreement (the “DPA”) is entered into between the club that subscribes to CtrlCourt (the “Club”, acting as controller) and DEVBOX (the “Processor”), in accordance with Article 28 of the General Data Protection Regulation (GDPR).

1. Parties and acceptance

The Processor is:

This DPA forms an integral part of the Terms of Service. It is accepted electronically by the Club when its account is created, together with the Terms, and applies for as long as the Processor processes personal data on behalf of the Club.

2. Subject matter

This DPA sets out the conditions under which the Processor processes personal data on behalf of the Club in order to provide the CtrlCourt service (the “Service”). It does not cover data for which the Processor acts as controller (the Club's account, subscription and billing), which is governed by the Privacy Policy.

3. Duration

This DPA applies for the duration of the Club's use of the Service (trial and subscription) and until the data has been deleted or returned in accordance with Article 11.

4. Nature and purpose of the processing

The processing consists of hosting, storing, organising, consulting, modifying, displaying and deleting data through the Service, as well as sending transactional emails, for the following purposes:

• management of player, coach and staff accounts;
• court bookings, coaching sessions and courses, events and tournaments;
• management of prepaid credits (tokens) and recording of payment methods chosen by the Club;
• sending of service emails (booking confirmations and reminders, password reset);
• statistics for the Club's own use;
• support, maintenance and security of the Service.

5. Categories of data subjects and data

Data subjects: the Club's players and members, coaches, staff and administrators who use the Club's space.

Categories of data:

• identification and contact data: name, email address, phone number;
• account data: password (hashed), role, language, optional playing level;
• activity data: bookings, attendance, course enrolments, event registrations;
• financial data relating to the club: credit balance and transactions, amounts and payment methods recorded by the Club (no payment card data);
• for coaches: availability, bio, hourly rate;
• technical data: IP address, connection and security logs.

The Service is not designed to process special categories of data (health, etc.). The Club undertakes not to enter such data in it.

6. Obligations of the Club

The Club, as controller, is responsible for: the lawfulness of the processing and its legal basis; informing data subjects; the accuracy of the data it enters; responding to data subjects' requests; and the instructions it gives to the Processor. Its instructions are documented by these Terms, this DPA and the settings it applies in the Service.

7. Obligations of the Processor

The Processor undertakes to:

• Instructions: process the data only on the documented instructions of the Club, including with regard to transfers, unless required to do so by law; in that case, it informs the Club beforehand, unless the law prohibits it. It informs the Club if it considers that an instruction infringes data protection rules.
• Confidentiality: ensure that persons authorised to process the data are bound by an obligation of confidentiality and only access it where necessary.
• Security: implement the technical and organisational measures required by Article 32 GDPR, described in Article 8.
• Sub-processors: comply with the conditions of Article 9.
• Data subjects' rights: assist the Club, as far as possible, in responding to requests to exercise rights (access, rectification, erasure, restriction, portability, objection), in particular through the Service's features or by providing an export on request. If a data subject contacts the Processor directly, it forwards the request to the Club without delay and does not respond to it itself, unless instructed by the Club.
• Assistance: assist the Club, taking into account the information available to it, with its security obligations, impact assessments and prior consultation of the supervisory authority where required.
• Breaches: notify the Club of any personal data breach within 48 hours of becoming aware of it, providing the information available (nature of the breach, categories and approximate number of persons concerned, likely consequences, measures taken or proposed), and supplement it as information becomes available.
• Records: maintain a record of processing activities carried out on behalf of the Club.
• Transparency: make available to the Club the information necessary to demonstrate compliance with this DPA (Article 10).

8. Security measures

• encryption of communications (HTTPS);
• a separate database for each club, isolating its data from that of other clubs;
• passwords stored in hashed form, never in plain text;
• regular backups of the databases;
• role-based access control within the Service (administrator, coach, player);
• access to production systems restricted to authorised persons;
• hosting in data centres located in France (OVH SAS), with physical security provided by the host;
• security logs and updates of software components.

The Processor may change these measures provided that the overall level of security is not reduced.

9. Sub-processors

The Club gives its general authorisation for the use of the following sub-processors:

Paddle.com only processes the sale and payment of the Club's subscription, as Merchant of Record and independent controller; it does not receive players' data and is therefore not a sub-processor under this DPA. When the Club enables online payment of bookings, CtrlCourt sends, on the Club's instructions, the information needed for the payment (amount, player's email) to the Club's own Stripe account: Stripe then acts on behalf of the Club, under the agreement the Club has entered into directly with Stripe.

The Processor informs the Club of any intended addition or replacement of a sub-processor, by email or in the administration area, at least 30 days in advance. The Club may object on reasonable grounds relating to data protection; if no solution is found, the Club may terminate its subscription before the change takes effect. The Processor imposes on each sub-processor data protection obligations equivalent to those of this DPA and remains liable to the Club for their performance. Any transfer outside the European Economic Area is governed by appropriate safeguards (in particular the European Commission's Standard Contractual Clauses).

10. Audits

The Club may request the information necessary to verify compliance with this DPA. Where that information is not sufficient, the Club may carry out an audit, at its own expense, no more than once a year, with at least 30 days' written notice, by itself or through an independent auditor bound by confidentiality, in a manner that does not disrupt the Service or compromise the security or confidentiality of other clubs' data. Audits of sub-processors are carried out through the certifications and reports they make available.

11. End of the processing

At the end of the subscription, the Club may request an export of its data within the period set out below. The data is then deleted 30 days after the end of the subscription (or of an unconverted trial), including the Club's database, subject to the retention required by law; backups are overwritten in their normal rotation cycle. The Processor confirms the deletion on request.

12. Liability and precedence

The liability of each party is governed by the Terms of Service, without prejudice to the provisions of the GDPR. In the event of a conflict between this DPA and the Terms concerning personal data, this DPA prevails.

13. Contact

For any question relating to this DPA or to report an incident: contact@ctrlcourt.com.