Data processing agreement (DPA) - template for customers acting as controllers

Version 0.9 (template, draft) · Processor: JIWA HOLDING AS · Applies when an agreement to process data on the customer’s behalf is concluded

1. Parties and background

[Customer] (controller) and JIWA HOLDING AS (processor) enter into this agreement as part of the STATIQ service agreement. The template must be completed for the customer’s processing under GDPR Article 28. It applies when the customer is the controller and JIWA processes player data on their behalf, regardless of subscription, including Personal. Where the recorder acts under a club’s authority, the club is identified as the responsible party. JIWA is a separate controller for its own account, security and operational purposes. Purely personal or household use does not itself make the user a customer with controller obligations under the GDPR.

2. Nature and purpose of processing

The processor processes personal data about the customer's players, coaches and users to provide statistics recording, quality control, reports and workspace administration. Categories: jersey numbers, nicknames, performance data, users' email addresses, display names, membership roles and access history. Membership invitations are stored on the server as token hashes with roles and timestamps, never as raw tokens or recipient email addresses. The same fragment-based protection applies to group, game and complimentary-access invitations. The recipient client may hold the raw token locally for no more than one hour through sign-in and onboarding, under the retention schedule. Duration: the term of the service agreement plus the retention schedule.

3. Processor obligations

• Process only under documented instructions (the service, this agreement, customer settings).
• Ensure personnel confidentiality; access only with MFA and time-limited, audited support access.
• Technical and organizational measures as set out in the security overview (RLS, encryption, redacted logging, append-only log, recovery exercises).
• Assist the customer with data subject rights (built-in access, export, correction, deletion and anonymization functions) and with DPIAs/supervisory authorities.
• Notify the customer of personal data breaches without undue delay and no later than 48 hours after becoming aware of them, with the information needed for the customer's notification to the authority.
• Delete or return all data at the end of the agreement (structured export), subject to statutory retention.
• Enforce role and seat limits in the database. A workspace ID or role stored on the client never grants access without active membership.

4. Subprocessors

Approved subprocessors appear in the subprocessor list. Changes are notified at least 30 days in advance; the customer may object on reasonable grounds.

5. Transfers to third countries

Transfers take place only on a valid transfer basis (EU standard contractual clauses, DPF) as stated in the subprocessor list.

6. Audit

The customer may annually request documentation (security overview, test evidence, recovery evidence) and, where there is reasonable suspicion, conduct an audit on reasonable notice.

7. Liability and governing law

Liability follows the service agreement. Norwegian law, venue [place].

Signatures: [Customer] · JIWA HOLDING AS

Official rosters - addition to processing instructions

For enabled organizational use under an active team policy, the protected roster may contain first name, last name, date of birth or birth year only, and a paid-licence flag. The customer limits fields to data necessary for documented roster administration, age checks or authorized matching. A birth date is not a national identity number, and the licence flag does not prove payment. Import does not activate an external registry connection. Contact details and health data must not be imported. Protected fields do not enter ordinary statistics, offline data or shared reports. The customer specifies the purpose, legal basis, participant information, recipients and a specific deletion date. Access, inspection, correction, deletion and any necessary history must be covered by the instructions before use with real data.

For name imports in Personal, instructions may cover first and last names in the protected roster under an active team policy and the importer’s responsibility declaration. Birth data, licence flags, images, health data and free-form player notes remain excluded. Names do not enter ordinary statistics, offline data or shared reports. The customer determines the purpose, basis, information and deletion date; importer confirmation is not the players’ consent. This agreement grants no wider access or right to new data fields.