Data processing agreement (DPA)
Version of 2026-10-01
This is a courtesy translation. The German version is binding: Deutsche Fassung
Agreement under Art. 28 GDPR between the club as controller and Richi AI, owner Yves-Marcel Richel, Homburger Landstraße 851, 60437 Frankfurt am Main, Germany, info@richi.solutions ("PadelLeague") as processor. The German version is binding.
1. Subject and duration
PadelLeague processes personal data on behalf of the club to the extent needed for court management and bookings through PadelLeague Clubs. The agreement applies as long as the club uses PadelLeague Clubs and ends with the terms for clubs.
2. Types of data and data subjects
Data subjects are bookers (players with a PadelLeague account and guests), customers the club enters itself and the club's team members. Processed are name, e-mail address, phone number, booking data (court, time, price, payment and cancellation status), the club's notes and change logs.
3. Purpose
Creating, showing, changing and cancelling bookings, sending booking confirmations and cancellations by e-mail, the customer list and the accounting export for the club.
4. Instructions
PadelLeague processes the data only on the club's documented instructions; settings and actions in the club app count as such instructions. If PadelLeague considers an instruction unlawful, it informs the club without delay.
5. Confidentiality and security
People working with the data at PadelLeague are bound to confidentiality. PadelLeague takes technical and organisational measures under Art. 32 GDPR, in particular encrypted transfer (TLS), role-based access rights at database level (row level security), change logs, regular backups and hosting in the EU.
6. Subprocessors
The club consents to the following subprocessors: Supabase Inc. (database, sign-in, storage; hosted in the EU, Ireland), Vercel Inc. (web hosting; Frankfurt), Resend Inc. (e-mail delivery). Transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses. PadelLeague announces new subprocessors at least 30 days in advance; the club may object for an important data protection reason.
7. Assistance
PadelLeague assists the club with data subject requests (access, rectification, erasure), with notifying personal data breaches and with data protection impact assessments. PadelLeague notifies the club of personal data breaches without delay, where possible within 48 hours of becoming aware.
8. Deletion and return
After the contract ends, the club can export its data for 30 days. PadelLeague then deletes the data processed on its behalf unless a statutory retention obligation applies.
9. Evidence and audits
On request, PadelLeague provides the club with the information needed to demonstrate compliance with Art. 28 GDPR and allows audits with reasonable prior notice.
10. Final provisions
The terms for clubs apply otherwise. In case of conflict, this agreement prevails on data protection matters.