Clutch Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Clutch General Terms and Conditions or other agreement governing a customer’s use of the Clutch Services (the “Agreement”) between Clutch ApS, CVR number 42195030, Rosenvængets Alle 19, Copenhagen, Denmark (“Clutch”) and the customer (“Customer”).

This DPA applies only to the extent that Clutch processes Personal Data on behalf of Customer in connection with the Services.

Capitalised terms not defined in this DPA have the meanings given in the Agreement. “Personal Data”, “Controller”, “Processor”, “Data Subject” and “Personal Data Breach” have the meanings given under Applicable Data Protection Law.

“Applicable Data Protection Law” means applicable laws governing the processing of Personal Data, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR where applicable, and other applicable data protection laws.

“Customer Personal Data” means Personal Data processed by Clutch on behalf of Customer in connection with the Services.

Where Clutch processes Customer Personal Data on Customer’s documented instructions, Customer acts as Controller and Clutch acts as Processor.

Where Clutch independently determines the purposes and means of processing Personal Data, Clutch acts as an independent Controller for that processing and such processing falls outside this DPA.

Clutch will process Customer Personal Data only on documented instructions from Customer, including as necessary to provide, maintain, secure and support the Services and otherwise perform the Agreement.

The Agreement, this DPA, Customer’s configuration and use of the Services, and additional written instructions agreed between the parties constitute Customer’s documented instructions.

If Clutch believes an instruction infringes Applicable Data Protection Law, Clutch will inform Customer unless prohibited by law.

Clutch will ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations and access Customer Personal Data only as necessary for their responsibilities.

Clutch will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

The current measures are summarised in Annex 2.

Customer grants Clutch general written authorisation to engage subprocessors where necessary to provide the Services.

Clutch’s current subprocessors relevant to Customer Personal Data are identified in Annex 3.

Clutch will provide reasonable advance notice by email or other reasonable electronic means of intended additions or replacements of subprocessors and give Customer an opportunity to raise reasonable objections on data-protection grounds.

Clutch will impose applicable data-protection obligations on its subprocessors and remains responsible to Customer for their performance to the extent required by Applicable Data Protection Law.

Customer authorises Clutch and its subprocessors to process Customer Personal Data in the locations reasonably necessary to provide the Services.

Where Customer Personal Data is transferred outside the European Economic Area or United Kingdom and Applicable Data Protection Law requires safeguards for that transfer, Clutch will ensure that an appropriate lawful transfer mechanism is used.

Taking into account the nature of the processing, Clutch will provide reasonable assistance to Customer in responding to requests from Data Subjects exercising applicable data-protection rights.

If Clutch receives a request relating primarily to Customer Personal Data for which Customer acts as Controller, Clutch may direct the Data Subject to Customer unless otherwise required by law.

Clutch will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

Clutch will provide information reasonably available to Clutch that Customer may require to assess the incident and fulfil applicable notification obligations.

Taking into account the nature of the processing and information available to Clutch, Clutch will reasonably assist Customer with applicable obligations relating to security, Personal Data Breaches, data protection impact assessments and consultations with supervisory authorities.

Upon termination of the applicable Services, Clutch will, at Customer’s choice, delete or return Customer Personal Data and delete existing copies unless Applicable Data Protection Law requires continued storage.

Clutch will also provide reasonable assistance with deletion requests during the term where required under Applicable Data Protection Law.

Customer Personal Data contained in backups may remain until the applicable backup cycle expires, provided that it remains appropriately protected and is not processed for other purposes.

Clutch will make available information reasonably necessary to demonstrate compliance with its obligations as Processor under Applicable Data Protection Law.

Clutch will allow for and contribute to reasonable audits or inspections required under Applicable Data Protection Law, subject to reasonable notice and appropriate confidentiality, security and operational safeguards.

Where appropriate, Clutch may first satisfy an audit request by providing relevant privacy, security or compliance documentation.

Customer is responsible for ensuring that it has an appropriate lawful basis for Customer Personal Data it instructs Clutch to process.

Customer is responsible for providing notices required by Applicable Data Protection Law where Customer acts as Controller.

Where Customer uses Clutch to record video or audio at its venues, Customer is responsible for satisfying applicable transparency and other legal requirements relating to that recording.

Customer will not instruct Clutch to process Customer Personal Data in violation of Applicable Data Protection Law.

If this DPA conflicts with the Agreement regarding the processing of Customer Personal Data, this DPA will control.

Except as modified by this DPA, the Agreement remains in effect.

This DPA is governed by the governing-law and dispute-resolution provisions of the Agreement.

For clarity, the limitations and exclusions of liability set out in the Agreement apply to this DPA to the fullest extent permitted by applicable law. Nothing in this DPA limits any liability that cannot lawfully be limited.

Subject matter

Processing of Personal Data in connection with Clutch’s camera, video and audio recording, streaming, hosting, booking integrations and related Services to the extent performed on behalf of Customer.

Duration

For the duration of Customer’s use of the Services and thereafter for the period necessary to complete deletion or return of Customer Personal Data or comply with applicable legal obligations.

Nature and purpose

Collection, recording, transmission, hosting, storage, organisation, retrieval, display, streaming, analysis, integration, support, security and deletion as necessary to provide the Services on Customer’s behalf.

Categories of Data Subjects

• Players and other individuals appearing in match recordings • Booking participants • Club members • Customer employees and venue administrators • Customer business contacts and authorised users

Categories of Personal Data

• Names and contact information • Account and user identifiers where applicable • Booking and court information • Video recordings and, where enabled, audio recordings • Player images and tags • Match participation and related match data • Device and technical information • Support and administrative information

Clutch maintains technical and organisational measures designed to protect Personal Data appropriate to the nature of the Services, including:

• encryption of data in transit • encryption of data at rest through Clutch’s cloud infrastructure • restricted access to production systems • authentication and access controls • regular backups • logging and operational monitoring • secure and authenticated camera communications • incident monitoring and escalation processes

Clutch may update these measures as its systems and technology evolve, provided that the overall level of protection is not materially reduced.

The following providers may act as subprocessors where they process Customer Personal Data on behalf of Clutch in connection with the Services. Not every provider processes data relating to every Customer.