Data processing agreement

You, the organiser with an account on play.darttournament.app, are the data controller: you decide which players you enter and what happens with the tournament. DartsTournament.app (sole proprietorship, KvK 69565678, address below) is the processor: we carry out the service and do nothing else with that data.

As soon as you accept the terms when creating your account. This agreement is part of that, and there is nothing for you to sign. If you want a signed copy for your club or company, email support@dartstournament.app. It applies for as long as your account exists. For the offline edition, once it exists, there is no processor: there, the data stays on your own laptop.

• Data subjects: the players you put into a tournament.
• Data: the names or nicknames you enter, with their group draw, matches, results, standings and the timestamps of those.
• Purpose: drawing up, tracking and showing the tournament, on your control screen, on the phones by the boards and on the big screen, and giving you an export. For nothing else: not for advertising, not for analytics and not for resale.
• Special categories of data (such as health) do not belong in here. Do not enter them.

We process the data only the way you direct in the app: entering, storing, changing, showing, exporting and deleting it. Beyond that, we follow what you ask us in writing. That also goes for any transfer outside the EU. If we are legally required to do something else, we let you know beforehand, unless the law forbids that. If we think an instruction of yours conflicts with GDPR, we say so.

On our side, only the administrator of DartsTournament.app can reach the stored data, and only looks when that is needed: to fix a fault, or because you ask for help. Cloudflare manages the storage technically, as a sub-processor (see point 7). Whoever has access to it is bound to confidentiality.

• Connections to the service go over https; anyone using http is redirected.
• Each tournament has its own, isolated storage, in the European Union.
• Logging in only works with a link or code from your email. There are no passwords that could leak.
• The links for the boards and the big screen carry a random key; we only keep a one-way fingerprint (hash) of it. A board link can see the tournament and submit results, nothing else; a big-screen link can only view. You can replace them at any time, after which the old ones stop working.
• Automatic request logging is switched off, and we deliberately write no names or email addresses to our own log lines.
• Tournaments can be restored to a point up to 30 days back and account data up to 7 days back, in case something goes wrong.

We use Cloudflare, Inc. for storage and for running the service. Tournament and account data is stored in the European Union. Cloudflare is based in the United States; any transfer falls under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses, as laid down in the data processing agreement Cloudflare has with us. Login emails go through Brevo (Sendinblue SAS, France). Brevo gets your email address and the sign-in email itself (the link and the code), no data about your players. We impose the same obligations on a sub-processor as in this agreement, and remain responsible to you for how it meets them (GDPR Article 28(4)). You give us permission to use these sub-processors. If we engage a new or replacement sub-processor for your players' data, we will tell you at least thirty days beforehand, by email to your account's address. If you object, you can close your account and export your data, at no cost.

You are the point of contact for your players. In the app you can change a name, export a tournament and delete a tournament; that lets you handle most requests yourself. If a request reaches us directly, we forward it to you. If you cannot resolve it yourself, we help.

If we discover a personal data breach that affects your data, we report it without undue delay, and at the latest 48 hours after we discovered it. We tell you what we know: what happened, which data is affected and what we are doing about it. You decide whether it needs to be reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to your players; we help you with that. The same goes for a data protection impact assessment (DPIA) and for prior consultation with the supervisory authority, if you need either.

If you delete a tournament or your account, the data is gone immediately from the storage the service uses. Only the storage's built-in recovery capability keeps an earlier state: of a tournament for up to 30 days, of account data for up to 7 days; after that, it is gone too. If you want to take your data with you, export it before deleting: you can always do that, per tournament and for your whole account.

If we stop the service, or block your account (article 7 of the terms), you get at least thirty days to export your data, unless the law or acute abuse makes that impossible.

Ask us, and you get the information you need to demonstrate that this agreement is being honoured. An on-site audit, or one by someone you appoint for it, can happen after reasonable notice, at your expense.

For liability, article 9 of the terms and conditions applies, and it also applies to this agreement. If the terms and this agreement contradict each other on personal data, this agreement applies. For changes, article 10 of the terms applies. Dutch law applies.