Data Processing Agreement

Data Processing Agreement

Between: Tadpole SAAS Club Management Ltd ("Processor", "we", "us") And: The subscribing organisation ("Controller", "you", "Club")

Effective Date: On your club's acceptance, or as set out in Section 10 Version: 2026-10-v3

1. Introduction

This Data Processing Agreement ("DPA") forms part of the agreement between Tadpole SAAS Club Management Ltd and the Club for the provision of membership management services. This DPA sets out the terms under which we process personal data on your behalf.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person
• "Processing" means any operation performed on personal data
• "Data Subject" means the individual to whom the personal data relates
• "Sub-processor" means any third party engaged by us to process personal data
• "Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data

3. Scope of Processing

3.1 Subject Matter

We process personal data to provide membership management services including:

• Member registration and profile management
• Membership card generation and wallet passes
• Payment processing facilitation
• Email communications on your behalf
• Text messages to members (only where the Club has switched them on)
• Boat bookings and day permit management
• Reporting and analytics
• AI help assistant for members and club officials (only where the Club has switched AI Help on)

3.2 Duration

Processing continues for the duration of our service agreement plus any retention periods required by law.

3.3 Categories of Data Subjects

• Club members
• Membership applicants
• Day permit purchasers
• Emergency contacts
• Parents or guardians of junior members

3.4 Types of Personal Data

• Identity data (name, date of birth, photograph)
• Contact data (email, phone, address)
• Membership data (member number, tier, status)
• Financial data (payment records - not card numbers)
• Consent records
• Communication preferences

4. Processor Obligations

We commit to:

4.1 Instructions

• Process personal data only on your documented instructions
• Inform you if we believe an instruction infringes GDPR (unless prohibited by law)

4.2 Confidentiality

• Ensure all personnel processing data are bound by confidentiality obligations
• Limit access to personal data to those who need it

4.3 Security (Article 32)

We implement appropriate technical and organisational measures including:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Role-based access control with audit logging
• Row-level security enforcing multi-tenant data isolation
• Regular security assessments
• Incident response procedures
• Independent, encrypted backups of all personal data taken nightly to a second provider, retained under object-lock, with the decryption key held only by us
• Restore procedures tested on a defined schedule and recorded; targets published (RPO 24 hours, RTO one working day)

4.4 Sub-processors

• Maintain a list of approved sub-processors (see Section 7)
• Notify you of any intended changes to sub-processors, or promptly after an urgent replacement under Section 7
• Ensure sub-processors are bound by equivalent data protection obligations
• Remain liable for sub-processor compliance

4.5 Data Subject Rights

• Assist you in responding to data subject requests
• Provide necessary information within reasonable timeframes
• Not respond directly to data subjects (unless instructed)

4.6 Breach Notification

• Notify you of any data breach without undue delay (within 72 hours)
• Provide sufficient information to meet your notification obligations
• Document all breaches including facts, effects, and remedial actions

4.7 Audit Rights

• Make available all information necessary to demonstrate compliance
• Allow for and contribute to audits and inspections (with reasonable notice)
• Audits limited to once per year unless a breach has occurred

5. Controller Obligations

You commit to:

• Ensure lawful basis for all processing you instruct
• Provide clear, documented instructions
• Respond to data subject requests within statutory timeframes
• Notify us promptly of any changes affecting processing

6. Data Transfers

6.1 Location

Personal data is stored within the European Economic Area (EEA), specifically (some sub-processors process data outside the EEA, as set out in Section 6.2 and the sub-processor list):

• Primary database: Ireland (EU)
• File storage: Ireland (EU)
• Email processing: France (EU)
• Backup copies: EU (Cloudflare R2, EU jurisdiction — data never leaves the EU)

6.2 International Transfers

We do not transfer personal data outside the EEA except:

• Where covered by an EU adequacy decision
• Where Standard Contractual Clauses are in place
• AI help assistant: questions typed into the help chat are processed by Anthropic PBC in the United States under Standard Contractual Clauses, with names, contact details and identifiers replaced by placeholders where recognised before sending (see Section 7). No member records are stored there
• Where the EU-US Data Privacy Framework applies (Stripe)

7. Sub-processors

We use the sub-processors listed at tadpole.club/sub-processors; the same list is at /sub-processors on your club's app address. That list forms part of this agreement. For each sub-processor it shows what it does, the data it receives, where it processes that data and the safeguard for any transfer outside the EU. We bind each sub-processor to data-protection terms that give at least the protection set out in this agreement. Where a service runs on your club's own account with the provider (for example your club's Stripe or Brevo account), your club's own agreement with that provider governs it; it is listed so you can see every company involved.

Notification: We will tell you at least 14 days before a new sub-processor begins processing your club's data, through the platform and by email to your administrators. You may object within those 14 days by writing to privacy@tadpole.club; if you do, we will discuss alternatives with you, which may include switching off the feature concerned for your club. If we cannot resolve an objection to a sub-processor the service cannot run without, your club may end the service before the change applies to it. If we do not hear from you within the 14 days, the change takes effect. Where a sub-processor serves an optional feature, your club can switch that feature off at any time afterwards and nothing further is sent to that sub-processor.

Urgent replacement: If an existing sub-processor suffers a security incident, stops providing its service or can no longer meet the commitments in this agreement, and waiting would put your club's data or the service at risk, we may replace it with a provider doing the same job without the advance notice above. We will tell you within 72 hours of the change, in the same way, and you may object within 14 days of that notice on the same terms.

8. Data Retention & Deletion

8.1 During Agreement

We retain data as necessary to provide services and comply with legal obligations.

8.2 On Termination

Within 30 days of agreement termination:

• We will provide you with a complete export of your data (CSV format)
• We will delete or anonymise all personal data (except where retention is legally required)
• We will provide written confirmation of deletion

8.3 Legal Retention

Some data must be retained for legal compliance:

• Financial records: 7 years (Irish tax law)
• Audit logs: 3 years
• Backups: daily copies 31 days, monthly copies 401 days, encrypted. A data subject erased from the live platform remains in backups until they expire. Backups are never restored selectively; if a backup is restored, erasure requests made after it was taken are re-applied before the platform returns to service

9. Liability

Our liability under this DPA is subject to the limitations set out in our main service agreement. We are not liable for:

• Processing carried out in accordance with your instructions
• Breaches caused by your failure to comply with GDPR
• Actions of sub-processors where we exercised due diligence

10. Term & Termination

This DPA:

• Comes into effect upon your acceptance during onboarding
• Continues for the duration of our service agreement
• Survives termination for any processing required by law

Changes to this agreement: We may update this agreement. We will tell your administrators at least 30 days before an updated version takes effect, through the platform and by email, and say what is changing. Your administrators will be asked to accept it when they next sign in. If your club does not agree, tell us at privacy@tadpole.club before it takes effect; we will discuss it with you, and your club may end the service before the change applies to it. If your club has neither accepted nor objected by the date it takes effect, the updated version applies from that date. Changes to the list of sub-processors are made under Section 7, not this paragraph.

11. Governing Law

This DPA is governed by Irish law and subject to the exclusive jurisdiction of the Irish courts.

12. Contact

Data Protection Contact Tadpole SAAS Club Management Ltd Registered Office: 20 Steeple Crescent, Trim, Co. Meath C15 YR90 Company Number: 808674 Email: privacy@tadpole.club

13. Acceptance

By checking the acceptance box, during club onboarding or when asked at sign-in, you confirm that:

1. You have authority to bind your organisation to this DPA
2. You have read and understood the terms
3. You accept this DPA as part of our service agreement