Contents22 sections

Platform legal

Data Processing Agreement

Version: 2.1 Effective date: 12 October 2026

Between the subscribing Club (the "Club", acting as Controller) and Reload IT Ltd (the "Provider", acting as Processor)

This Data Processing Agreement (the "DPA") forms part of, and is incorporated into, the Platform Terms of Service (the "Terms") between the Provider and the Club for the use of The Full Squad platform. It takes effect on the date the Club accepts the Terms and applies for as long as the Provider Processes Personal Data on the Club's behalf.

Plain-English summary (not part of the operative terms): your club decides why and how your members' data is used, so the law calls the club the "controller". Reload IT Ltd runs the software and stores the data strictly on your club's behalf and on your instructions, so the law calls us the "processor". This document sets out the rules both sides must follow under UK data protection law, including for children's data, medical information and safeguarding records. Reload IT provides software only; every footballing, coaching, childcare, payment and safeguarding duty stays with the club, and the club carries the cost of any claim or fine that its own handling of data causes.

1. Parties

1.1 The Provider: Reload IT Ltd, a company registered in England and Wales with company number 10106178, whose registered office is at 124 City Road, London, EC1V 2NX. The Provider is registered with the Information Commissioner's Office under registration number ZC200891. Contact for data protection matters: info@thefullsquad.com.

1.2 The Club: the club, association or organisation identified in the Club's account on the Platform, being the entity (or, where the Club is an unincorporated association, the members and officers of that association, see clause 17) that has accepted the Terms.

2. Definitions and Interpretation

2.1 In this DPA the following terms have the following meanings. Terms defined in the Terms have the same meaning here unless redefined below.

"Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" (and "Process"), "Special Category Data" and "Supervisory Authority" have the meanings given to them in Data Protection Law.
"Data Protection Law" means the UK GDPR (as defined in the Data Protection Act 2018), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003, the Data (Use and Access) Act 2025 to the extent relevant to the Processing, and any other applicable law of England and Wales relating to the Processing of Personal Data, each as amended or replaced from time to time.
"Club Data" means all Personal Data that the Provider Processes on behalf of the Club in connection with the Platform, as described in Annex 1. Club Data does not include Personal Data for which the Provider is itself the Controller (see clause 3.4).
"Platform" means The Full Squad software-as-a-service platform made available at thefullsquad.app (including club tenant subdomains in the form {club}.thefullsquad.app and any custom domain a club connects) together with related services provided under the Terms.
"Sub-processor" means any third party appointed by the Provider to Process Club Data on the Club's behalf.
"UK IDTA" means the International Data Transfer Agreement issued by the Information Commissioner under section 119A of the Data Protection Act 2018, and "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses so issued, in each case as amended or replaced from time to time.

2.2 Headings are for convenience only. References to clauses and Annexes are to clauses of and Annexes to this DPA. The Annexes form part of this DPA.

2.3 If there is a conflict between this DPA and the Terms in relation to the Processing of Club Data, this DPA prevails to the extent of the conflict. Nothing in this DPA increases the Provider's liability beyond, or otherwise displaces, the exclusions and limitations of liability in the Terms, except as clause 16.2 requires by law. The Terms alone set the Provider's financial cap; this DPA sets no separate figure.

3. Roles of the Parties

3.1 The parties agree that, for the purposes of Data Protection Law, in respect of Club Data the Club is the Controller and the Provider is the Processor.

3.2 The Club decides why Club Data is collected and how it is used. The Provider Processes Club Data only on the Club's behalf and only as this DPA and the Club's Documented Instructions (clause 4) allow.

3.3 Software provider only. The Provider is a software provider only. Nothing in this DPA makes the Provider a provider of footballing, coaching, childcare or safeguarding services, and nothing in this DPA transfers to the Provider any of the Club's legal or operational duties towards its members, including its duties as Controller, its safeguarding duties, its duties as the merchant and provider of every service and payment it takes through the Platform, and its duty to have a lawful basis (and, where required, an Article 9 UK GDPR condition) for every category of Club Data it collects. No Platform feature, alert, report, template or default setting creates a duty of care owed by the Provider to the Club, its members or anyone else, and the presence, absence or failure of any such feature transfers no responsibility to the Provider.

3.4 For the avoidance of doubt, the Provider acts as an independent Controller, and this DPA does not apply, in respect of: (a) club administrator and billing account data held for the Provider's own contract with the Club; (b) marketing-site visitor data; (c) support tickets raised with the Provider; (d) the Provider's own business records; and (e) the Platform account and sign-in security data of every person who holds a login (including players, parents and guardians), meaning the sign-in email address, password credentials, emailed sign-in codes (held only as a one-way hash), trusted-device records, session records and security logs, which the Provider holds to run one secure login across all clubs. That Processing is described in the Provider's Platform Privacy Policy. The Club's own Processing of its members' data inside its tenant remains Club Data.

3.4A Cross-club profile. A person's profile (phone number, postal address and photograph) is held once against that person's Platform account and is shown to a Club only while the person has an active membership of that Club, under the access rules built into the Platform. The Club instructs the Provider to operate the Platform in that way. The Club is the Controller of its own use of that profile data, and is responsible for the lawfulness of what its authorised users do with it.

3.5 Anonymised and aggregated data. The Provider may create and use data that has been fully anonymised or aggregated so that it is no longer Personal Data and no individual (or club) can be identified from it, for the purposes of operating, securing, benchmarking and improving the Platform. Such data is not Club Data and this DPA does not apply to it. The Provider does not use Club Data relating to persons under 18 for enrichment from web or other external sources.

4. Documented Instructions

4.1 The Provider shall Process Club Data only on the Club's documented instructions (the "Documented Instructions"), including with regard to transfers of Club Data outside the United Kingdom, unless Processing is required by law to which the Provider is subject; in that case the Provider shall inform the Club of that legal requirement before Processing, unless that law prohibits it on important grounds of public interest.

4.2 The parties agree that the Documented Instructions are:

(a) this DPA, including Annex 1; (b) the Terms; (c) the Club's use and configuration of the Platform through its documented features (for example: registering members, uploading the Club's own onboarding terms and conditions, configuring retention periods, configuring consent texts, granting or revoking role-based access, initiating exports, publishing squad pages, sending messages and invitations, raising fees and bookings, and actioning data-subject requests through the Platform); and (d) any further written instructions agreed between the parties.

4.3 The Provider shall inform the Club without undue delay if, in the Provider's opinion, a Documented Instruction infringes Data Protection Law. The Provider is not obliged to carry out an instruction it reasonably believes to be unlawful, and may suspend the affected Processing until the instruction is confirmed, varied or withdrawn. The Provider provides this information as a processor safeguard only; it is not legal advice, and the Provider gives no warranty and assumes no duty that it will detect an unlawful instruction. Responsibility for the lawfulness of all instructions remains with the Club at all times.

4.4 An instruction that falls outside clause 4.2 (including any bespoke Processing, non-standard export or non-standard configuration), or that would involve categories of Personal Data or Data Subjects beyond those described in Annex 1, may be declined, or accepted subject to reasonable additional charges and a written change to this DPA.

5. Club Obligations and Warranties

5.1 The Club warrants and undertakes that:

(a) it is, and will remain, the sole Controller of the Club Data and has authority to instruct the Provider to Process it; (b) it has, and will maintain, a lawful basis under Article 6 UK GDPR for all Processing of Club Data it instructs, and, for Special Category Data such as medical and safeguarding information, an applicable condition under Article 9(2) UK GDPR and, where required, Schedule 1 of the Data Protection Act 2018; (c) it has provided Data Subjects (including parents and guardians on behalf of children) with all required transparency information, including a privacy notice, before their data is collected (the Platform provides a template the Club may adapt; the notice, as issued, remains solely the Club's responsibility); (d) it has obtained, recorded and will keep up to date all consents its Processing requires, including consent given by a person with parental responsibility for a child, consent to medical and other Special Category Data, consent to photographs and to appearing on a public squad page, and consents relating to children in line with the Platform's age model (Annex 1, A1.6) and the Club's own legal duties; (e) the Club Data it uploads, imports or causes to be collected is accurate, relevant and lawfully obtained, its Documented Instructions will comply with Data Protection Law, and it will correct inaccurate data promptly; (f) it will configure and use the Platform's data protection features (access roles, retention settings, consent versions) appropriately for its own compliance; (g) it will maintain a data-protection complaints process that facilitates complaints by Data Subjects, acknowledges them within the statutory period, investigates them appropriately and communicates outcomes without undue delay; (h) it will not instruct or cause the Processing of categories of Personal Data or Data Subjects materially beyond those described in Annex 1 without first agreeing a written change under clause 4.4; (i) before it imports people, it has the right to do so and a lawful basis for holding their data, and it will not put medical information into an import; (j) (not used); (k) before it publishes a squad page, it has the agreement of each player shown, it will remove any player who asks, and it accepts that a player's own choice to hide themselves overrides the Club; (l) before it emails or notifies the manager of an opposing club, or any other person who is not a Platform user, it has the right to contact that person; (m) it is the sender of every message sent through the Platform in its name, including every camp booking, offer, fee reminder, payment and cancellation notice (which the Platform sends as service messages about a booking and not as marketing) every message to the family of a child booked for a camp day and not ticked in on the camp register (also a service message), and every camp invitation (which is direct marketing of the Club's camps that the Platform sends, at the Club's instruction, to the parent of a child who booked an earlier camp at the Club or is on a current academy cohort, with a permanent "Stop camp invites" link in every email), it is responsible for compliance with the Privacy and Electronic Communications (EC Directive) Regulations 2003 (including that the soft opt-in conditions in regulation 22(3) are satisfied for each family it invites, and honouring every "Stop" request), and it will not use the Platform to send marketing to anyone who has opted out or to a child; and (n) it is the merchant, seller and provider for every payment, camp booking, academy fee and refund taken through the Platform, it is responsible for its own pricing, refund policy and tax treatment, and it has accepted Stripe's terms for its own Stripe account. For every camp it is also responsible for deciding who may book, for checking that the person booking is entitled to book for the child, and for who it gives the camp link to, because anyone who holds the link can create an account, become a parent member of the Club and book without the Club approving them first.

5.2 The Club acknowledges that the Provider has no visibility of, and no responsibility for, the Club's operational relationship with its members, and that the Provider cannot and does not verify the accuracy or lawfulness of Club Data or of the Club's instructions.

5.3 Authorised users act for the Club. Every person the Club authorises to access Club Data through the Platform (including officers, committee members, managers, coaches, staff and volunteers) accesses it on the Club's behalf. Their acts and omissions in relation to Club Data, including what they view, record, export or disclose, are treated as the Club's acts and omissions for the purposes of this DPA. The Club is responsible for choosing, training and supervising its authorised users and for revoking access promptly when no longer appropriate.

5.4 Club-uploaded terms and Template Documents the Club adopts. Where the Club uploads its own onboarding terms and conditions or other membership documents, or adopts a Template Document (as defined in the Terms), for presentation and acceptance through the Platform, the Platform hosts, versions and records acceptance of those documents as a Processing operation on the Club's instructions only. The Provider records the Club's adoption (person, time, template version and a hash of the final text) as a Processing operation on the Club's instructions. Those documents, their content and their legal effect are solely the Club's responsibility; the Provider does not review, approve or warrant them.

6. Confidentiality

6.1 The Provider shall ensure that every person it authorises to Process Club Data (including its employees and contractors) is subject to a binding obligation of confidentiality (contractual or statutory) in respect of that data, and Processes Club Data only as needed to perform the Provider's obligations under the Terms and this DPA.

6.2 The Provider shall limit access to Club Data to personnel who need it to operate, support, secure or improve the Platform, in line with the access controls in Annex 2.

7. Security

7.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risks to Data Subjects, the Provider shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 UK GDPR. The measures in place at the date of this DPA are described in Annex 2.

7.2 The parties acknowledge that the risk profile of the Club Data is elevated because it includes children's data and Special Category Data (medical and safeguarding records), and Annex 2 reflects that: UK-resident primary storage, encryption in transit and at rest, role-based tenant-scoped access, private storage buckets for sensitive files, and audit logging of access to sensitive records.

7.3 The Provider may update the Annex 2 measures from time to time, provided the updates do not materially reduce the overall level of protection for Club Data during the term of this DPA.

7.4 The Club is responsible for the security of matters within its own control, including: the devices and networks its officers, volunteers and members use; the strength and confidentiality of account credentials; its choice of who is granted which role on the Platform (clause 5.3); and the handling of any Club Data it exports out of the Platform. Exported data leaves the Platform's protections, and its subsequent security, storage and use are entirely the Club's responsibility.

8. Sub-processors

8.1 General authorisation. The Club gives the Provider general written authorisation to appoint, replace and remove Sub-processors to Process Club Data. The Sub-processors appointed at the date of this DPA are listed in Annex 3 and in the Provider's published Sub-processor schedule.

8.2 Notice. The Provider shall give the Club at least 30 days' notice before a new or replacement Sub-processor starts to Process Club Data. Notice is validly given by updating the published Sub-processor schedule and by email to the Club's administrator account or a notice within the Platform. Where a replacement is needed urgently to protect the security or continuity of the Platform (for example because a Sub-processor fails or is compromised), the Provider may appoint it first and shall give notice as soon as reasonably practicable.

8.3 Objection right. If the Club objects to a new or replacement Sub-processor, it must do so in writing within 14 days of the notice, on reasonable data protection grounds that it explains. The parties shall discuss the objection in good faith. If the Provider cannot reasonably accommodate the objection (for example by not using the Sub-processor for that Club's data), the Club may terminate its subscription for the affected services by written notice, in which case the Provider shall refund the prepaid fees for the period after termination. That right of termination and refund is the Club's sole and exclusive remedy for a Sub-processor change or objection. If the Club does not object within the 14 days, or continues to use the Platform after the notice period, it is treated as having accepted the change.

8.4 Flow-down. The Provider shall appoint each Sub-processor under a written contract imposing data protection obligations that provide materially the same level of protection for Club Data as this DPA, in particular the obligations of Article 28(3) UK GDPR. The Provider remains liable to the Club for the performance of each Sub-processor's data protection obligations, subject always to the exclusions and limitations in clause 16 and the Terms.

8.5 Services that are not Sub-processors. Some services are used by the Club's own choice, or receive no Club Data from the Provider. These are not Sub-processors: (a) video the Club chooses to embed in its public pages (for example from YouTube or Vimeo), which a visitor's own browser loads directly from the video provider; (b) Stripe acting as an independent Controller for payment, fraud-prevention and identity-verification data under the terms the Club accepts when it opens its own Stripe account; and (c) public reference sources the Platform reads without sending personal data, such as league table sources. The Club is responsible for its choice of embedded content and for describing it in its own privacy and cookie information.

9. International Transfers

9.1 The Provider's primary storage of Club Data (database, authentication and files) is in the United Kingdom (Supabase, AWS eu-west-2, London). That is not the whole picture: application hosting, email delivery, payment processing, browser push delivery, bot checks and error monitoring are provided by Sub-processors that may Process limited Club Data outside the United Kingdom, including in the United States. The locations of each Sub-processor are stated in Annex 3.

9.2 The Provider shall not transfer Club Data outside the United Kingdom (and shall not permit a Sub-processor to do so) unless the transfer is:

(a) to a country or territory covered by UK adequacy regulations under section 17A of the Data Protection Act 2018, which includes the European Economic Area and the United States where the recipient is certified under the UK extension to the EU-US Data Privacy Framework; or (b) subject to appropriate safeguards under Article 46 UK GDPR, being the UK IDTA or the UK Addendum (as applicable), together with any supplementary measures reasonably required; or (c) otherwise permitted by Data Protection Law.

9.3 The Club's general authorisation in clause 8.1 extends to those transfers on those terms. Where Squad Assist is made available, its AI processing runs on AWS Bedrock in European regions (not necessarily the United Kingdom) and the Provider does not send Club Data to the AI model developer directly. The Provider will tell the Club which transfer mechanism applies to a given Sub-processor on written request.

10. Assistance with Data Subject Rights

10.1 Taking into account the nature of the Processing, the Provider shall assist the Club, by appropriate technical and organisational measures and insofar as reasonably possible, in fulfilling the Club's obligations concerning Data Subject rights under UK data-protection law.

10.2 The Platform provides a My Data / Privacy Request route through which a Data Subject (or linked parent/guardian where appropriate) may export their data (including payments, attendance and availability) and submit a correction or deletion request. Requests concerning Club Data are routed to the relevant Club as Controller and the request/action history is audit logged.

10.3 The Club remains responsible for assessing and answering the request within the statutory deadline. Where a request cannot be fulfilled through ordinary Platform functions, the Provider will provide reasonable processor assistance.

10.4 Erasing a person in the Platform removes or anonymises their member record. It does not edit or delete content the Club has written or uploaded to its website or elsewhere, such as news posts, match reports, photos and programmes. The Club is responsible for finding and editing or removing that content where the law requires it.

10.4 Club exports. A Club-wide export is not self-service. On a normal written export request from the Club's administrator, the Provider will generate the export and make it available by a short-lived secure download link, in a commonly used electronic format, within 5 working days. A safeguarding-record export is made only on a written request from a Club administrator and after the Provider has verified and recorded who is asking. Unusually complex, repeated or bespoke export work may be subject to reasonable charges agreed in advance, except where Data Protection Law requires assistance without additional charge.

11. Personal Data Breach

11.1 The Provider shall notify the Club without undue delay after becoming aware of a Personal Data Breach affecting Club Data. The Provider's operational target is to give the Club an initial notification within 48 hours of becoming aware, by email to the Club's administrator account. That target is given in good faith, is not a contractual guarantee and is not a deadline; the binding obligation remains notification without undue delay. The Provider is "aware" when it has reasonable certainty that a breach affecting Club Data has occurred. Initial notification may be supplemented in phases as further information becomes available.

11.2 The notification shall, to the extent then known (and may be supplemented in phases as information becomes available), describe: the nature of the breach; the categories and approximate numbers of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point.

11.3 The Provider shall provide reasonable cooperation and assistance to the Club in the Club's investigation of the breach and in the Club's compliance with its own obligations under Articles 33 and 34 UK GDPR.

11.4 Notifying the Information Commissioner and affected Data Subjects in respect of Club Data is the Club's obligation as Controller, and the Club decides whether such notification is required. The Provider shall not notify a Supervisory Authority or Data Subjects of a breach affecting Club Data on the Club's behalf unless required by law or agreed in writing.

11.5 The Provider's notification of, or assistance with, a Personal Data Breach is not an admission of fault or liability by the Provider.

11.6 Where a Personal Data Breach arises from the acts or omissions of the Club or its authorised users (for example compromised Club credentials, misconfigured Club roles, or misuse of exported data), the Provider may charge reasonable fees for its assistance under this clause 11 at its then-current rates, and the Club's indemnity in clause 16.5 applies. The Club must keep its administrator email address on the Platform current, because notice sent to it under this clause is validly given.

12. DPIAs and Prior Consultation

12.1 Taking into account the nature of the Processing and the information available to it, the Provider shall provide reasonable assistance to the Club with data protection impact assessments under Article 35 UK GDPR and with prior consultation of the Information Commissioner under Article 36 UK GDPR, in each case solely in relation to the Processing of Club Data on the Platform.

12.2 The Provider's assistance under this clause 12 will ordinarily be satisfied by making available this DPA, its Annexes and the Provider's standard security and Sub-processor documentation. Material additional work may be charged under clause 10.4 as if it were rights assistance. Conducting, adopting and acting on any DPIA remains the Club's responsibility as Controller.

13. Return and Deletion at End of Processing

13.1 On termination or expiry of the Terms, the Club's account moves to a cancelled state and the Provider shall, subject to law, return and/or delete Club Data as follows. In this clause 13 the "Cancellation Date" is the date the Platform records the subscription as cancelled, as section 18.3 of the Terms explains.

(a) Export window: for 30 days after the Cancellation Date, the Provider keeps the Club Data and the Club may request an export under clause 10.4. A normal request is fulfilled within 5 working days.

(b) Automatic deletion: a daily Platform process permanently deletes the Club Data held for a cancelled Club, without any request from the Club. It deletes the data, and does not merely anonymise it. Deletion takes place no earlier than 30 days after the Cancellation Date and no earlier than 7 days after the final notice, so it can be later but not earlier. The Provider sends the final notice once, by email, to each person who is an active administrator of the Club in the Platform at that time, normally once the Cancellation Date is 23 days past. It is not sent to Data Subjects. If the Club has no active administrator, no notice can be received and deletion still goes ahead. If the Club has administrators and none can be reached, deletion does not go ahead until a notice has been sent. The process deletes the Club's records in the Platform's database and the Club's files in the Platform's file storage. After deletion nothing can be restored. Until deleted, Club Data stays held under this DPA, protected by the measures in Annex 2 and used for no purpose other than holding it.

(c) Backups: backups are overwritten in the normal course. Backup copies are not used for ordinary processing and are not restored to the Club.

(d) Pauses and holds: the process does not delete a Club's data while a retention hold recorded in the Platform for the Club has not been released, a safeguarding concern record is held and has not been released, or a data export request logged in the Platform for the Club has not been completed. It checks again each day. These are the only pauses the Platform applies. The Provider has no knowledge of the Club's disputes, claims, investigations or legal duties, and it preserves identified material only if the Club has recorded a hold in the Platform, or gives a lawful documented instruction in writing to preserve identified safeguarding, complaint, dispute or legal-hold material and the Provider confirms in writing that it has placed a hold, in each case before the deletion date. Where the law itself requires the Provider to preserve data, the Provider may do so. Any data preserved remains protected by this DPA and is not used for unrelated purposes.

(e) What the Provider keeps: deletion under clause 13.1(b) does not remove the subscription record (plan, status, dates, the amount of the last invoice and Stripe references), the Club's registry entry, the reference to its Stripe Connect account, the Squad Assist usage record and balance, the record of database changes applied to the Club, the Provider's audit trail of events for the Club (event types, dates, counts and account identifiers, which is not designed to hold member records), the Club's sign-up record (the Club's name and the identity of the signer), and complaints register entries. The Platform accounts of the Club's users are not deleted by it, because an account belongs to the person and may serve other clubs. The Provider holds these as controller for its own accounting, security and legal purposes, and the Platform Privacy Policy describes them.

(f) Outside the Platform: deletion under clause 13.1(b) does not reach exports and copies the Club or others hold, records that Stripe holds under its own legal obligations, or records held by other Sub-processors under their own retention rules.

13.2 The final notice under clause 13.1(b) states the date of deletion and that deletion cannot be undone, lists the main kinds of record that will go (players, registrations, medical and emergency contact details, consents, fixtures, messages, photos and uploaded documents), and gives a last opportunity to request an export by replying before that date. It does not name safeguarding records separately. Deletion also destroys safeguarding records, including concern files the Club has released, and they are not kept for any longer period after deletion. Responsibility for identifying any longer safeguarding or legal retention, and for exporting those records in time, remains with the Club.

13.3 On written request, the Provider shall confirm completion of the live-system deletion process.

13.4 During the term, the Platform deletes or anonymises certain classes of Club Data (those for which the Platform has a retention class) through a nightly retention job at about 03:30 UTC, applying the retention periods the Club has configured or the Platform defaults. The defaults for medical information (3 years), emergency contacts (2 years) and consent records (6 years) are counted from the later of the date of the record and the end date of the last season in which the player held a submitted, approved or active registration, and none of those three classes is deleted while the player holds such a registration in a season that is not archived and is either the current season or has not yet ended (an academy cohort place has no season and counts for as long as its status is live). The Platform does not record the day a registration lapses, so the period starts at the end of that season, and a cohort place has no end date to count from. Nothing else in this clause protects other classes of Club Data from the periods the Club has set. Other Club Data is not deleted automatically and stays until the Club deletes it or an erasure request is carried out. Clause 13.1(b) deletes a cancelled Club's data whatever its retention class or period. The Club is responsible for choosing those periods and for any longer retention that safeguarding or law requires.

14. Audit and Information

14.1 The Provider shall make available to the Club all information reasonably necessary to demonstrate compliance with its obligations under Article 28 UK GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Club or an auditor mandated by the Club, on the terms of this clause 14.

14.2 Reports first. The Club agrees that the Provider satisfies its obligations under clause 14.1 in the first instance by providing: this DPA and its Annexes; the current Sub-processor list; summaries of security measures, policies and testing; and any third-party certifications, attestations or audit reports the Provider holds, including those it obtains from its Sub-processors. The Club shall review such documentation before requesting any further audit. The Club may not audit or inspect a Sub-processor directly; the Provider's Sub-processors are assessed by their own reports and certifications.

14.3 On-site or remote inspection. Only where the documentation under clause 14.2 is reasonably insufficient to demonstrate compliance, or where an audit is required by a Supervisory Authority or by Data Protection Law, the Club may conduct an audit or inspection, subject to all of the following:

(a) not more than once in any 12-month period, except following a Personal Data Breach affecting the Club Data or where required by a Supervisory Authority; (b) at least 30 days' prior written notice, with a proposed scope agreed in advance; (c) during normal business hours, without unreasonable disruption to the Provider's business; (d) at the Club's cost, including reimbursement of the Provider's reasonable time (at its then-current rates) and expenses in supporting the audit; (e) subject to the auditor (who must not be a competitor of the Provider) entering into reasonable confidentiality undertakings; and (f) not extending to any data of other clubs or tenants, any other customer's confidential information, or any matter that would compromise the security of the Platform; multi-tenant systems are audited by documentation, logs and interview rather than direct system access wherever direct access would create risk to other tenants.

14.4 The Club shall provide the Provider with a copy of any audit findings, which are the confidential information of both parties.

15. Special Category and Children's Data

15.1 The parties record that Club Data includes children's data and Special Category Data (medical and safeguarding records, extended to injury records, suspension records and safeguarding-concern records). The Platform's technical handling of that data is described in Annex 2 (private storage, gated and audited access, versioned consent records) and its account age model is summarised in Annex 1 (A1.6).

15.2 These features are technical measures only. They do not make the Club compliant with its safeguarding, welfare or data protection duties, and the Provider assumes no duty of care, no safeguarding role and no responsibility for the Club's decisions about who may access which records, what is recorded, or how long safeguarding records must be kept. The presence, absence or failure of any Platform feature, alert or report transfers no responsibility to the Provider (clause 3.3).

16. Liability and Indemnity

16.1 The Provider's liability. The Provider's liability arising out of or in connection with this DPA (whether in contract, tort (including negligence), breach of statutory duty, under Data Protection Law as between the parties, or otherwise) is subject to, and counts towards, section 20 of the Terms (limitation of liability), including its cap in section 20.3 and its excluded heads of loss in section 20.2. Section 20.8 of the Terms applies to compensation claimed by Data Subjects. This DPA sets no separate figure and creates no separate or additional pool of liability.

16.2 Statutory carve-outs. Nothing in this DPA (or the Terms) excludes or limits either party's liability for: (a) death or personal injury caused by its negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability that cannot lawfully be excluded or limited.

16.3 Data Subjects and regulators. Nothing in this DPA excludes or limits any direct statutory right a Data Subject may have, or either party's liability to Data Subjects or Supervisory Authorities under Articles 82, 83 and 84 UK GDPR, which are allocated by Data Protection Law itself. As between the parties only, recovery of any such amounts from one another is governed by this clause 16.

16.4 Article 82 allocation. As between the parties, each party is responsible for the share of any compensation under Article 82 UK GDPR that corresponds to its own responsibility for the damage, as Article 82(5) contemplates. The Provider is not responsible for damage caused by Processing that follows the Club's Documented Instructions. The Provider's share is subject to clause 16.1. Where the Provider has paid compensation to a Data Subject for damage for which the Club is wholly or partly responsible, the Club shall reimburse the Provider the part of that compensation that corresponds to the Club's responsibility.

16.5 Club indemnity. The Club shall indemnify and hold harmless the Provider against all losses, claims, fines, penalties, damages, regulatory costs and other costs (including reasonable legal and expert costs) suffered or incurred by the Provider arising out of or in connection with: (a) the Club's breach of its warranties and obligations in clause 5; (b) Processing carried out in accordance with the Club's Documented Instructions; (c) the Club's failure to comply with its own obligations as Controller (including transparency, lawful basis, consent, parental consent, marketing rules, data-subject deadlines, and safeguarding-related retention decisions); (d) the acts or omissions of the Club's authorised users (clause 5.3); or (e) any claim by a member, parent, guardian or other person about a payment, booking, fee or refund the Club has taken or declined, or about the Club's services, except in each case to the extent the loss is caused by the Provider's breach of this DPA or of its obligations as a Processor under Data Protection Law. To the extent the law does not allow an indemnity for a fine, the Club shall instead reimburse the Provider for its other losses and costs connected with that fine.

16.6 Cap protects the Provider only. The cap and exclusions referred to in clause 16.1 limit the Provider's liability. They do not limit: (a) the Club's liability under the indemnity in clause 16.5 or the reimbursement in clauses 11.6 and 16.4; or (b) the Club's obligation to pay fees and charges properly due under the Terms or this DPA.

16.7 Conduct of claims. The Provider shall tell the Club promptly of any claim, complaint or regulatory enquiry that is likely to give rise to a claim under clause 16.5. The Provider may conduct the response to any claim, complaint or enquiry that is addressed to it, taking the Club's reasonable views into account, and the Club shall reimburse the Provider's reasonable costs of doing so as they are incurred and cooperate promptly with the Provider's reasonable requests.

16.8 Costs of assistance. The Provider may charge the Club its reasonable costs, at its then-current rates, of any assistance it gives under clauses 10 to 12 that is unusual, repeated, or needed because of the Club's own acts or omissions.

17. Unincorporated Associations; Authority

17.1 Where the Club is an unincorporated association, the officer or committee member accepting the Terms and this DPA warrants that they are authorised by the Club's committee (or equivalent governing body) to bind the Club and its members for the time being, and accepts this DPA both on behalf of the Club and, to the extent the Club cannot be bound as an entity, on behalf of and binding the members of its committee from time to time.

17.2 The Club shall ensure that any change of committee or officers does not interrupt the discharge of its obligations under this DPA, and shall keep its administrator contact details on the Platform current, since notices under this DPA (including Sub-processor change notices under clause 8.2 and deletion notices under clause 13.2) are validly given to those details.

18. General

18.1 Duration. This DPA takes effect on acceptance of the Terms and continues until the Provider ceases to Process Club Data (including completion of deletion under clause 13), notwithstanding earlier termination of the Terms. Clauses 13, 16 and 18 survive termination.

18.2 Changes. The Provider may update this DPA on notice to the Club where reasonably required to reflect changes in Data Protection Law, ICO guidance, or the Platform's Sub-processors or architecture, provided the update does not materially reduce the protection of Club Data or the Club's rights under Article 28 UK GDPR. Other changes require agreement in accordance with the Terms.

18.3 Severance. If any provision of this DPA is or becomes invalid or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid and enforceable; if that is not possible, it is deemed deleted, and the remainder of this DPA continues in force. Any deemed modification or deletion shall not affect the validity of the rest of this DPA and shall preserve, so far as lawful, the parties' original commercial intent.

18.4 Third parties. Except as required by Data Protection Law, a person who is not a party to this DPA has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any of its terms.

18.5 Governing law and jurisdiction. This DPA and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims) are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1 - Details of Processing

A1.1 Subject matter. The Processing of Club Data by the Provider in the course of providing, supporting, securing and improving The Full Squad platform to the Club under the Terms.

A1.2 Duration. The term of the Terms, plus the export window and automatic deletion described in clause 13. During the term, the Platform's default retention periods for medical information (3 years), emergency contacts (2 years) and consent records (6 years) are counted from the later of the date of the record and the end date of the last season in which the player held a submitted, approved or active registration, and none of those three classes is deleted while the player holds such a registration (clause 13.4). Other periods are described in the Club's retention policy and in clause 13.4.

A1.3 Nature and purpose of Processing. Hosting, storage, backup, retrieval, display, transmission, structuring, organisation, analysis for the Club's own reporting, communication delivery (email, in-app message and push notification), registration and enrolment (including parent, guardian and adult-player sign-up, guardian acceptance and duplicate-record matching), a cross-club person profile, payment facilitation records (the Club is the merchant and takes payments through its own Stripe Connect account; the Provider records payment status and passes the payer's email address to Stripe), academy cohort monthly fee records and reminders, holiday-camp set-up, staffing, booking (including creating a parent account and parent membership for a person who books through a camp link, and the child's registration record), per-day places, waiting list and offer, camp payment, fee reminder, cancellation and refund records, camp booking notices by email and push notification, the camp register (a tick per child per camp day, with the time and the identity of the staff member who ticked), messages to the families of children not ticked in, camp invitations to past campers' and academy families and the permanent record of each person who stops them, and the publication of public camp pages that show no personal data (as and when the Club uses those features), hosting and versioning of the Club's own uploaded terms and conditions and of Template Documents the Club adopts, and recording their adoption and acceptance (solely the Club's documents, clause 5.4), recording the Club's safeguarding confirmation and each family's acknowledgement that they have read the Club's safeguarding policy (the Provider does not write, review or approve the policy), consent versioning and acceptance records, training-session scheduling and attendance recording, staff qualification and credential tracking and expiry reminders, match-event recording, imported-person provenance recording, club-event and RSVP recording, publication of public squad pages and club news at the Club's instruction, display of a shared library of club crests from which the Club may choose a crest (reference material containing no personal data), emailed sign-in codes and trusted-device records, retention-schedule execution as configured by the Club, export, deletion, and such other operations as the Platform's documented features perform, in each case for the purpose of operating the Platform for the Club and on its instructions, and not for the Provider's own purposes (save as clause 3.5 permits for anonymised data). Squad Assist is not yet available; AWS Bedrock (EU regions) is named as its intended Sub-processor and will process Club Data only once Squad Assist launches, and only the data required for the requested feature. Squad Assist is designed not to receive medical records, safeguarding records, criminal-record-check information or other highly sensitive Club Data. The person import uses manual, admin-driven column mapping and excludes medical information; if an AI-assisted import mapping accelerator is added later it will use column headings only or anonymised or redacted sample values and must not include identifiable Member Data or Special Category Data. The Platform does not use Club Data relating to persons under 18 for web enrichment. The Platform displays ticket information only; it does not sell match tickets online. The Platform does not send SMS.

A1.4 Categories of Data Subjects.

Members of the Club, including players who are children (see A1.6);
Parents, guardians and other linked responsible adults;
Club staff, officers, managers, coaches and volunteers;
Adult players who register and pay for themselves;
Camp attendees and their families, and families of academy cohort players;
Managers and other contacts at opposing clubs and other third parties whose email address the Club asks the Platform to use; and
Supporters and other individuals whose data the Club records on the Platform.

A1.5 Categories of Personal Data.

Identity and contact details (name, date of birth, address, email, phone), including the cross-club profile (phone, postal address and photograph) held once for a person and shown to a Club only while the person is an active member of it;
Family/guardian linkage and household relationships, and guardian acceptance records for 16 and 17 year olds;
Team, squad, registration, enrolment status, selection, availability and attendance data, including training-session and attendance records (with check-in/check-out times where recorded), kit size, and academy cohort membership;
Holiday-camp records: camp, camp staff, booking (child and parent), booking days, waiting list and offer times, cancel requests, fee reminder records, refund setting and refund reason, the child's registration record created when a new family books through a camp link, the camp register (child, camp day, time ticked in and the staff member who ticked), the record of each camp invitation sent (camp, parent, time), and the record of each parent who has stopped camp invites (account identifier and time; kept permanently as a suppression record, including after that parent's other data is erased), all of which are included in the Club's data export;
Match events (scorers and cards, by player where recorded);
Club events and RSVP responses (whole-club and team events, including an adult's own response);
Imported-person provenance data (a marker that a record originated from an import, for data-quality and audit purposes);
Staff qualification/credential tracking records (type, reference, check and renewal dates, and status; not certificates, see below) and the reminders sent about them;
Staff and volunteer contact details, including the name, email address and telephone number of the Club's welfare officer (or equivalent role) entered with the Club's safeguarding confirmation, and the Club's own safeguarding policy file or link, which is the Club's own document (clause 5.4);
Photographs and video, subject to consent records held on the Platform; public squad page data (photo, shirt number, name, position and profile line) for adult players where the Club publishes a page, with each player's own opt-out;
Communications sent and received through the Platform (text only; the Platform does not currently support message attachments), per-recipient delivery status, and notification preferences;
Push notification subscriptions (a device endpoint held per account; the notification itself carries no message content);
Payment-related records for club-collected money (payment status and history, academy monthly fee records, camp payment records, fee reminders and refund records; card data is processed by Stripe, not stored by the Provider), and the Club's Stripe account identifiers and status flags;
Consent records (versioned texts, acceptance, withdrawal) and acceptance records for the Club's uploaded terms;
Family safeguarding tick records (that a parent or guardian ticked that they had read the Club's safeguarding policy, at enrolment or at camp booking, with the time and the policy shown; an acknowledgement and not a consent);
Template adoption records (the person at the Club who adopted a Template Document, the time, the template version, the Club details inserted, a hash of the final text);
Audit "before" snapshots (the prior state of a record, captured at the time of a change, for accountability);
Special Category Data: optional medical information (extended to injury and suspension records) and welfare/safeguarding records where the Club chooses to use those features, including safeguarding-concern records held under a legal hold;
Emergency contact details;
Disciplinary records and restricted criminal-record-check verification metadata (status/reference/check/review dates, not scanned disclosure certificates);
Names and email addresses of managers and contacts at opposing clubs, where the Club asks the Platform to send them match information;
Audit and access logs relating to the above;
Geolocation data only if a future location-dependent feature is enabled after the required privacy/DPIA review.

Sign-in data (emailed sign-in codes, trusted-device records and security logs) is held by the Provider as Controller under clause 3.4 and is not Club Data.

A1.6 Children's data and the age model. Date of birth is required for player/member records. Under 16: no independent login, managed through a parent or guardian. Age 16 to 17: own login permitted only after a parent or guardian accepts the link and the Club approves; they see club broadcasts read-only and cannot send or receive direct messages, and Club permissions remain age-appropriate. Age 18 and over: adults register themselves after invitation and pay their own fees. Under-18 private adult-to-child messaging is blocked and supervised group rules apply.

A1.7 Documented Instructions. As set out in clause 4.

Annex 2 - Technical and Organisational Security Measures

The Provider implements and maintains measures appropriate to the risk profile of a multi-tenant youth-sport platform, including:

A2.1 UK-primary hosting. Primary database, authentication and file storage are located in the United Kingdom (Supabase/AWS London). Application hosting, email delivery, payment processing, browser push delivery, bot checks and error monitoring are provided by Sub-processors that may Process limited data outside the United Kingdom under clause 9 safeguards (see Annex 3).

A2.2 Encryption. TLS or equivalent encryption in transit and storage/backups encrypted at rest. Messages are not end-to-end encrypted because authorised access may be required for safeguarding, legal or security investigations.

A2.3 Tenant and Club separation. Logical multi-tenant separation, row-level/tenant-scoped controls and Club-context checks prevent one Club from accessing another Club's data. A global user may belong to multiple Clubs, but role and permission evaluation is performed separately for each Club.

A2.4 Role-based access. Fixed core roles include Club Admin, Safeguarding Officer, Coach/Manager, Treasurer (who sees fees pages but not medical records), Player and Parent/Guardian. Additional custom roles may be supported but must not inherit sensitive permissions by default. Medical, safeguarding and criminal-record-check verification data is limited to specifically authorised roles; emergency-contact data may be team-scoped to relevant coaches/managers.

A2.5 Higher-risk authentication. Authentication is by email address and password. Every user, whatever their role, must also enter a six digit single-use code emailed to their verified address on a device the platform does not recognise. A code expires after 10 minutes, five wrong entries cancel it, and new codes are limited to five an hour. A device a user chooses to trust is remembered for up to 30 days, is forgotten after 7 days without use, and is forgotten when the user's password is changed. The platform operator's own accounts are never remembered and are asked for a code at every sign-in. Parents and players who sign in with an emailed link do not need a second code. Sign-in uses no SMS. Invitations must be accepted and passwords set before account activation.

A2.6 Sensitive-data audit. Create, view, edit and delete activity for medical, safeguarding and DBS/PVG/AccessNI verification records is audit logged with user/action/time and relevant record context. DOB corrections, role changes, parent links and privacy-request actions are also auditable.

A2.7 Private storage. Sensitive files are held in non-public storage. The Platform does not currently support message attachments. If they are introduced, file-type and size limits and malware controls will be in place first.

A2.8 Backups. Backups are encrypted. Data deleted from live systems remains in backups only until they are overwritten in the normal course, subject to lawful holds.

A2.9 Secure development and operations. Version control, review before deployment, separation of production privileges, least-privilege access, monitoring/alerting, incident handling and prompt revocation of staff access on role change/departure.

A2.10 AI data minimisation. Squad Assist is not yet available; once launched it will run on AWS Bedrock in EU regions (the code refuses any other region), will receive opaque identifiers only for children, and will be blocked from medical, safeguarding, criminal-record-check and other highly sensitive data. Import mapping ships manual and admin-driven first; if an AI-assisted mapping accelerator is added later it will use column headings or anonymised/redacted samples only, and special-category data and identifiable Member Data must not be included in AI samples.

A2.11 Children's privacy defaults. Public squad pages show adult players only, and the Platform has no public profile for a player under 18; geolocation is off by default and any future live-location feature requires a separate privacy/DPIA review before activation.

The Provider may improve or vary these measures under clause 7.3 provided the overall level of protection is not materially reduced.

Annex 3 - Approved Sub-processors

General authorisation under clause 8 covers the following Sub-processors as at the date of this DPA:

Sub-processor	Service	Processing location(s)	Status
Supabase	Database, authentication, file storage, backups and scheduled jobs	United Kingdom (AWS eu-west-2, London)	Active
Vercel	Application and site hosting and delivery	International, including the United States, under Article 46 safeguards (clause 9)	Active
Stripe	Payment processing (Stripe Billing for the Club's subscription; Stripe Connect for club-collected money). Stripe is also an independent Controller for some payment and verification data	UK and international, under Article 46 safeguards (clause 9)	Active
Resend	Email delivery (sign-in codes, invitations, notifications and club messages)	International, including the United States, under Article 46 safeguards (clause 9)	Active
Cloudflare (Turnstile)	Bot check on sign-in and sign-up forms	International, under Article 46 safeguards (clause 9)	Used only while the check is switched on
Browser and device push services (run by Google, Apple, Mozilla and other browser vendors)	Deliver a content-free wake-up to a device that has subscribed to notifications; the Provider sends the device endpoint and timing only, never message content	Set by the vendor, may be outside the United Kingdom	Active for users who turn notifications on
Sentry	Application error monitoring (error reports may contain limited personal data)	International, under Article 46 safeguards (clause 9)	Dormant until enabled
Amazon Web Services (AWS Bedrock)	AI-assisted features (Squad Assist)	European regions (EU cross-region), not necessarily the United Kingdom	Appointed, not yet processing Club Data; will begin only once Squad Assist launches

Google and Apple sign-in are not offered and no sub-processor is appointed for them. The Platform does not send SMS, and no SMS provider is appointed. If either is ever introduced, the supplier will be added to this list under clause 8.2 first. Embedded video and other services described in clause 8.5 are not Sub-processors. Changes to this list are notified under clause 8.2, and the Club's objection right in clause 8.3 applies.

What changed in this version

Version 2.1, effective 12 October 2026.

Clause 10.4: erasing a person removes or anonymises their member record. It does not edit or delete content the Club has written or uploaded to its website or elsewhere. The Club finds and edits or removes that content where the law requires it.
Clause 5.4: now covers Template Documents the Club adopts. The Provider records each adoption (the person, the time, the template version and a fingerprint, or hash, of the final text) as processing on the Club's instructions. The adopted text is solely the Club's responsibility (Terms clause 11.12).
Annex 1, A1.3 and A1.5: new processing and data categories for template adoption records, for the Club's safeguarding confirmation and for family safeguarding tick records. The confirmation covers the safeguarding policy file or link the Club enters, which is the Club's own document, and the name, email address and telephone number of its welfare officer, held as staff and volunteer contact details. A family tick is a parent's or guardian's acknowledgement, at enrolment or camp booking, that they have read the Club's safeguarding policy. The Provider does not write, review or approve any safeguarding policy.
Clause 5(j), A1.3 and A1.5: paper enrolment is withdrawn before use. Clause 5(j) is marked not used and the lettering of the other warranties is unchanged. A1.3 and A1.5 no longer mention paper enrolment evidence scans. No paper form or scan was ever processed on the Platform.

Earlier versions

Version 2.0, effective 11 October 2026.

Clause 3.4: the Provider's own controller role now covers every user's Platform account and sign-in security data, and the cross-club profile is explained.
Clause 5: Club warranties are widened to cover parental consent and medical data, accuracy of instructions, imports, paper enrolment evidence, public squad pages, opponent-manager emails, camp invitations under PECR, and the Club's role as merchant for every payment.
Clause 8 and Annex 3: sub-processor authorisation and objection are clarified (30 days' notice, a 14-day written objection window, emergency replacement). AWS Bedrock (EU) replaces Anthropic. Cloudflare Turnstile and browser push services are added. Google and Apple sign-in are removed.
Clause 9: international transfers are stated provider by provider, including EU inference.
Clauses 10.4 and 13: Club exports and end-of-term return and deletion are described as the product does them, and the 30-day window is stated.
Clause 11: the breach notification target moves from 24 hours to 48 hours and remains a target only.
Clause 14: audit rights are tightened (reports first, and sub-processors by their own reports).
Clause 16: liability refers to the Terms and sets no separate figure. The Club indemnity and reimbursement are widened.
Clauses 13.1(b), 13.1(c), 13.2 and A2.8: a cancelled Club's data is deleted automatically 30 days after cancellation, with a final notice to the Club's administrators 7 days before. Nothing can be restored afterwards. Backups are overwritten in the normal course, and no backup period is stated.
Clause 13.4 and A1.2: medical information (3 years), emergency contacts (2 years) and consent records (6 years) are counted from when the player last held a live registration, and nothing is deleted while a player is registered. Clause 13.4 also says the nightly job covers only classes of information that have a retention period.
Clauses 2.3 and 16.1: liability refers to Terms clause 20.3, whose cap is the greater of 12 months' Subscription Fees and £5,000. This DPA sets no figure of its own.
Annex 1 and Annex 2 (A1.5, A2.2, A2.7, A2.11): say the Platform has no message attachments or message reporting, and no public profile for under-18s.
Annex 1: new processing and data categories for the cross-club profile, paper enrolment evidence, academy fees, holiday camps, Stripe Connect payments, push notifications, sign-in codes and trusted devices, imports, public squad pages, opponent invitations, the crest library and data exports. The age for a person's own login changes from 13 to 16.

End of Data Processing Agreement.

The canonical, machine-readable source for this document is held by Reload IT Ltd. Questions: info@thefullsquad.com.