Some of the company data has not yet been completed by the administrator - it is marked in square brackets in the document.
1. Roles of the parties
The facility operator is the controller of its customers’, class participants’ and staff data. The service provider acts as a processor on behalf of the facility operator under Article 28 of the GDPR, solely to provide the NexaSport service.
The service provider is a separate controller of the contact details of people representing the facility operator in connection with the subscription agreement.
2. Data processing agreement
Before production launch, the parties conclude an agreement entrusting the processing of personal data, specifying the subject, time, nature and purpose of processing, types of data and categories of persons, obligations and rights of the administrator.
A data processing agreement template is available on request: [email address — complete in the admin panel: Company details].
3. Security measures
Isolation of organisation data in the database (Row Level Security), roles and permissions, MFA of administrators, encryption of connections and integration keys, audit log with tracking ID, backups with recovery test.
4. Subprocessors
Server hosting in the European Union. Payment and invoicing operators are included only by decision of the Facility Operator and operate on the basis of contracts concluded directly by him.
5. Children's details
The child's registration is performed by an authorized guardian with the required consent. We do not collect health data; descriptive fields should not contain special category data.