Data Processing Agreement

1. Parties and scope

The Club is the organisation that creates or operates a club workspace. CricketRight is the operator of the cricketright.com service identified in the Club's trial, order or subscription record. Together they are the parties.

This agreement covers personal data processed by CricketRight on the Club's behalf to provide availability, fixtures, selection, team sheets, training, registration, role-based access and club communications.

2. Processing details

• Subject matter: hosting and operating the CricketRight service for the Club.
• Duration: from creation of the Club workspace until deletion or return of Club data after the service ends.
• Nature: collection, storage, organisation, retrieval, display, transmission, calculation, restriction, deletion and backup.
• Purpose: providing, securing, supporting and maintaining the features the Club chooses to use.
• Data subjects: club officials, admins, coaches, captains, volunteers, parents, guardians, players and prospective members, including children.
• Personal data: identity and contact details, account identifiers, role and eligibility information, parent/player relationships, fixtures, availability, selection, participation, training responses, team sheets, operational messages and technical logs.
• Special-category data: not required by the standard service. The Club must not enter it unless necessary, lawful and expressly supported by the relevant product field.

3. Documented instructions

CricketRight will process Club personal data only on the Club's documented instructions, including the Terms, this agreement, the Club's product configuration and authorised users' use of the service. CricketRight may process data where UK law requires it, in which case it will inform the Club before processing unless the law prohibits this.

CricketRight will tell the Club if, in its reasonable opinion, an instruction infringes applicable data-protection law. It may pause the affected processing while the parties resolve the issue.

4. Confidentiality and personnel

CricketRight will ensure that people authorised to process Club personal data are subject to an appropriate duty of confidentiality, receive access only where needed for their role and are made aware of relevant data-protection and security responsibilities.

5. Security

CricketRight will maintain technical and organisational measures appropriate to the risk, including authentication, role- and club-scoped access controls, encrypted connections in transit, managed infrastructure, security logging, backup/recovery controls, vulnerability remediation and procedures for responding to incidents.

The Club is responsible for configuring roles carefully, using strong passwords, removing leavers and ensuring its users handle downloaded or emailed information securely. See the Security overview.

6. Sub-processors

The Club gives CricketRight general written authorisation to use sub-processors necessary to provide the service. Current principal providers include Vercel for application hosting, Supabase for database and authentication services, and Amazon Simple Email Service (Amazon SES) for transactional email.

CricketRight will place equivalent data-protection obligations on each sub-processor and remains responsible for its sub-processors' performance of those obligations. CricketRight will give reasonable advance notice of a material new or replacement sub-processor where practicable. A Club may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Club may stop using the affected service and terminate before that provider is used for its data.

7. Individual rights

Taking account of the nature of the processing, CricketRight will provide reasonable assistance to help the Club respond to requests to access, correct, erase, restrict, object to or export personal data. If CricketRight receives a request relating to Club-controlled data, it will direct the person to the Club and will not respond on the Club's behalf unless authorised or legally required.

8. Breaches, DPIAs and regulator enquiries

CricketRight will notify the Club without undue delay after becoming aware of a personal-data breach affecting the Club's data. As information becomes available, CricketRight will describe the nature of the incident, likely consequences, data affected and measures taken or proposed.

CricketRight will provide reasonable assistance with the Club's security obligations, breach notifications, data-protection impact assessments and prior consultation with a regulator, taking account of the nature of the processing and information available to CricketRight.

9. Return and deletion

During an active subscription, the Club should use available product tools to maintain and retrieve its records. When the service ends, CricketRight will, at the Club's choice and where reasonably requested, return or delete Club personal data unless UK law requires retention. Backup copies may remain until they expire through the normal recovery cycle, during which they remain protected and unavailable for ordinary use.

10. Information and audits

CricketRight will make available information reasonably necessary to demonstrate compliance with this agreement. No more than once per year, unless following a relevant incident or regulator request, the Club may request an audit on reasonable notice. Audits must protect other clubs' information, avoid unnecessary service disruption and use existing reports or remote evidence first. The Club bears its audit costs unless the audit identifies a material breach by CricketRight.

11. International transfers

CricketRight will not make a restricted transfer of Club personal data unless it uses an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another lawful transfer mechanism, together with any required transfer assessment and supplementary measures.

12. Club obligations and contact

• Use CricketRight only for lawful purposes and provide lawful instructions.
• Give parents, players and staff an appropriate club privacy notice.
• Collect no more information than the Club needs.
• Keep roles, records and access permissions accurate.
• Handle individual requests and safeguarding responsibilities as controller.

Data-processing questions may be sent through the contact form.

13. Order of precedence

If this agreement conflicts with the Terms on the protection of Club personal data, this agreement takes priority. The remainder of the Terms, including liability, governing law and termination provisions, continues to apply.