Draft — legal review (version 1). This is the data-processing agreement a founder accepts on the club’s behalf when creating a club. It describes the arrangement as designed and is pending legal review before launch.

Club data-processing agreement

This agreement is between your club (the “controller”) and Dobl Ltd, trading as ClubTitan (the “processor”). It governs the personal data ClubTitan processes on the club’s behalf and forms part of the terms.

Roles

The club decides what member data is collected and why — the club is the controller. ClubTitan processes that data only on the club’s documented instructions (the platform itself being those instructions), as the processor. ClubTitan is a separate controller only for its own account data and its own/group marketing, covered by the privacy notice.

Subject matter, duration, nature and purpose

Subject matter:running the club’s management on ClubTitan.
Duration: for as long as the club uses ClubTitan, then per the retention and deletion terms below.
Categories of data subject: members, guardians, players (including children), coaches and volunteers.
Types of data: contact and membership details, family/guardian links, consents, availability, fixtures, results, messages and payment records. DBS numbers and dates only (never certificates). Card data is never held — Stripe processes payments.

ClubTitan’s obligations

Process only on the club’s instructions, and tell the club if an instruction appears unlawful.
Keep the data confidential and ensure staff are bound by confidentiality.
Apply appropriate technical and organisational security — encryption in transit, row-level tenant isolation, least-privilege access, and the children-first defaults (guardian-owns model, no child geolocation, closed-loop coach→minor messaging).
Assist the club with data-subject requests, security, breach notification and impact assessments.
Notify the club without undue delay on becoming aware of a personal-data breach.
On termination, return or delete the club’s personal data at the club’s choice (export is built in), save where retention is legally required.
Make available the information needed to demonstrate compliance and allow reasonable audits.

Sub-processors

The club authorises ClubTitan to use vetted sub-processors (hosting, database, payments, messaging) under written terms no less protective than this agreement. The current list and any changes are published at [to be confirmed before launch], with notice of additions so the club may object.

International transfers

Any transfer outside the UK/EU relies on an adequacy decision or the Standard Contractual Clauses (with the UK Addendum), as set out in the privacy notice.

Children

A child’s data is owned and controlled by their verified guardian; ClubTitan enforces the ICO Children’s Code defaults in the platform itself and never markets to children.

Version 1 · draft, last updated July 2026. The accepted version is recorded against the club when a founder accepts these terms.