Data Processing Agreement

1.1Parties. The Club is the controller of personal data and the Operator its processor within the meaning of Article 28 of Regulation (EU) 2016/679 (the "GDPR"). The parties are identified in the Contract.

The Club decides what is recorded about people. The Operator only provides the technical means.

1.2Subject matter. The Operator processes personal data for the Club solely to operate the Platform: member records, lessons, groups, events, attendance, payments, results, communication and the Club Website.

The data is not used for any other purpose, such as advertising.

1.3Duration. Processing lasts for the term of the Contract and until the data is deleted under Article 12.7 of the Terms.

It ends no later than 90 days after the end of the Contract.

1.4Instructions. The Club's instructions are the Contract, the Terms, this agreement and the Platform settings the Club selects. Further instructions are given by the Club's contact person by e-mail.

Whatever the Club sets in the portal is its instruction.

2.1Data subjects. Members of the Club including children, their legal guardians, coaches, the Club's management and people interested in courses and events.

Whom rhythmees holds records about.

2.2Categories of data. Identification and contact data (name, e-mail, telephone, date of birth); parent–child links and dance couples; membership, payments and their status; lessons, groups, events, attendance, absence notices and the training diary; competition results and ČSTS ID number; photos uploaded by the Club or Users; technical data (logins, change logs, notification subscriptions).

Only what the Club needs to operate.

2.3Special categories. The Club does not upload special categories of data under Article 9 GDPR, such as health data, to the Platform unless the parties expressly agree otherwise.

Health information about children does not belong in the portal.

2.4Nature of processing. Storage, display to authorised Users, sending of e-mails and notifications, export, backup and deletion.

Ordinary work with data in the application.

3.1Only on instruction. The Operator processes data only on documented instructions from the Club. The Operator shall inform the Club without delay of any instruction which, in its opinion, infringes the law.

The Operator does nothing with the data of its own accord.

3.2Confidentiality. Only the Operator and persons bound by confidentiality have access to the data, and only to the extent necessary for operation and support.

Only those who must look at the data do so, for example when fixing a bug.

3.3Security. The Operator takes measures under Article 32 GDPR: encrypted connections (HTTPS), a dedicated database for each club, role-based access control at database level, daily backups, change logs and two-factor login for administrator accounts with suppliers.

A parent sees only their own child, a coach only what they need for their work, and another club sees nothing.

3.4Data subjects' rights. The Operator assists the Club in handling data subjects' requests (access, rectification, erasure, portability) within 10 working days of the Club's request.

If a parent wants to know what the Club records about their child, the Operator helps find and export the data.

3.5Cooperation. The Operator provides the Club with the information needed for a data protection impact assessment and for dealings with the Office for Personal Data Protection.

If the authority asks, the Operator supplies the documents.

3.6Personal data breach. The Operator notifies the Club of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, with a description, its scope and the measures taken.

The Club then has 72 hours to notify the authority, so it finds out in time.

3.7Audit. The Operator allows the Club to verify compliance with this agreement, at most once a year and by prior arrangement, primarily by means of a written description of the measures.

The Club can ask how the data is protected and will get an answer.

4.1General authorisation. The Club authorises the Operator to engage the sub-processors listed in the table below. The Operator binds them to the same data protection obligations as its own and is liable for their performance.

Hosting and the database are run by large suppliers, not on servers at home.

4.2Change of supplier. The Operator notifies the Club by e-mail 30 days in advance of any new or replacement sub-processor. The Club may object and, if the parties cannot agree, terminate the Contract with effect from the date of the change, with a pro rata refund of the price.

A supplier is not changed without notice.

4.3Data location. The application and the Club's database and files are in the EU. Transfers outside the EU (e-mails, the content delivery network, sign-in with a Google account if the Club enables it, encrypted backups and the delivery of push notifications) are protected by the EU–US Data Privacy Framework or by standard contractual clauses. The content of push notifications is encrypted; the service that delivers them cannot read it.

The data sits in Ireland. What leaves the EU: e-mails, website content through the content delivery network, sign-in with a Google account (only if the Club enables it), phone notifications and encrypted backups.

5.1Return and deletion. After the Contract ends, the Operator returns the data by export and deletes it under Articles 12.5 to 12.7 of the Terms, unless the law requires it to be retained. At the Club's request, the Operator confirms the deletion by e-mail.

The Club gets its data and nothing stays with the Operator.

5.2Records. The Operator keeps records of processing activities under Article 30(2) GDPR.

The Operator keeps track of what it processes and for whom.

5.3Liability. The parties' liability is governed by Article 82 GDPR and Article 11 of the Terms.

Whoever breaches their obligations bears the consequences.