Data processing agreement

• Process personal data only on the controller's documented instructions, which are given through the product's settings and features, unless EU or member-state law requires otherwise, in which case the processor informs the controller before processing.
• Ensure that people authorised to process the data are bound by confidentiality.
• Apply the security measures in section 5.
• Engage sub-processors only as set out in section 4.
• Help the controller respond to data-subject requests, including by forwarding requests received directly and by providing the “not me” dismissal control to athletes.
• Assist the controller with security, breach notification, data-protection impact assessments and consultations with the supervisory authority, taking into account the nature of the processing.
• Delete or return all personal data at the end of the service, as the controller chooses, and delete remaining copies unless law requires storage.
• Make available the information needed to demonstrate compliance and allow audits, on reasonable notice and no more than once a year unless a breach or a supervisory authority requires otherwise.
• Notify the controller without undue delay, and in any case within 48 hours, after becoming aware of a personal-data breach affecting the controller's data.

The controller authorises the following sub-processors. We give 30 days' notice by email before adding or replacing one; the controller may object on reasonable data-protection grounds, in which case either party may terminate the affected service.

• Tenant isolation enforced in a single shared access layer on every query.
• Encryption in transit (TLS 1.2+) and at rest at the hosting and storage providers.
• Secrets (passwords, share tokens, API keys) stored only as hashes.
• Least-privilege, scoped, expiring API keys; instant revocation.
• Biometric templates held per controller in a dedicated collection; deleted on removal of the person or reference photo.
• Rate limiting on authentication and public endpoints; audit records of gallery access.
• No advertising or analytics trackers; self-hosted fonts; no use of Cloudflare.

• Have a lawful basis for all processing it instructs, including explicit consent for biometric processing of each registered person and guardian consent for minors, and keep records of it.
• Inform data subjects about the processing, including how to dismiss a match and how to exercise their rights.
• Keep its own account, roles and API keys secure, and remove access when people leave.

Where a sub-processor processes data outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses (2021/914) or an adequacy decision, with supplementary measures where needed.

Data-protection matters under this agreement: privacy@mvt.sh.