Data Processing Agreement

1. Parties

This DPA is entered into between:

Together referred to as “the Parties.” This DPA takes effect on the date of last signature below or, where incorporated by reference, on the effective date of the Agreement.

2. Definitions

• “Agreement”: The subscription agreement between the Controller and SpiralXO, comprising the SpiralXO Terms and Conditions, the EU Terms and Conditions Addendum, and any order form.
• “Controller Data”: Personal data processed by SpiralXO on behalf of the Controller in connection with the Agreement, including the personal data of the Controller's users, players, and Payers.
• “Data Protection Laws”: The GDPR, the UK GDPR and UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, the EU ePrivacy Directive and its national implementations, and any other data protection law applicable to the processing of Controller Data.
• “GDPR”: Regulation (EU) 2016/679 (General Data Protection Regulation).
• “Payer”: Any person who makes a donation, sponsorship, membership, or dues payment to the Controller through the SpiralXO Finance & Fundraising Module. Payers are not required to hold a SpiralXO account.
• “Processing”: Has the meaning given in Article 4(2) GDPR.
• “Sub-Processor”: Any third party engaged by SpiralXO to process Controller Data on SpiralXO's behalf.

Capitalised terms not defined in this DPA have the meanings given in the GDPR, the SpiralXO Terms and Conditions, or the EU Terms and Conditions Addendum.

3. Subject Matter, Duration, and Nature of Processing

4. Processor Obligations

4.1 Instructions

SpiralXO shall process Controller Data only on the Controller's documented instructions, including as set out in the Agreement and this DPA, unless required to do otherwise by Union or Member State law to which SpiralXO is subject; in that case SpiralXO shall inform the Controller of that legal requirement before processing, unless the law prohibits this. SpiralXO shall immediately inform the Controller if, in its opinion, an instruction infringes Data Protection Laws. The Controller's configuration and use of the platform — including publishing a Give Page, Player Fundraising Page, or Recruiting Page, connecting Station Devices and Display Devices, and designating Treasurers — constitutes the Controller's documented instructions.

4.2 Confidentiality

SpiralXO shall ensure that persons authorized to process Controller Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, have received appropriate data protection training, and have access only to the extent necessary to provide the platform.

4.3 Security

SpiralXO shall implement appropriate technical and organisational measures in accordance with Article 32 GDPR, including:

• Industry-standard encryption of personal data in transit (TLS 1.2 or higher) and at rest (AES-256)
• Password hashing using bcrypt or equivalent; plain-text passwords are never stored
• Role-based access controls enforced at the database level, so that no customer can access another customer's data and users access only the data permitted by their role
• Hashed, expiring, revocable access tokens for Station Devices and Display Devices
• Private storage of expense receipts, opened only through short-lived links, and private payment links for Player Dues
• Handling of card and bank details exclusively by Stripe
• Security monitoring and logging, including logging of all administrative and support access
• Regular vulnerability assessments and penetration testing
• Infrastructure security controls provided by SpiralXO's hosting providers

4.4 Data Subject Rights

Taking into account the nature of the processing, SpiralXO shall assist the Controller by appropriate technical and organisational measures in fulfilling the Controller's obligation to respond to requests from data subjects exercising their rights under Articles 15–22 GDPR. Where SpiralXO receives a request directly from a data subject, including a Payer, SpiralXO shall promptly forward it to the Controller and shall not respond to it except on the Controller's instructions or as required by law.

4.5 Personal Data Breaches and Assistance

SpiralXO shall notify the Controller of a personal data breach affecting Controller Data without undue delay and in any event within 48 hours of becoming aware of it, with the information required by Article 33(3) GDPR to the extent then available, supplemented as further information becomes available. SpiralXO shall assist the Controller in meeting its obligations under Articles 32–36 GDPR, including data protection impact assessments and prior consultation, taking into account the nature of processing and the information available to SpiralXO.

4.6 Deletion and Return

On termination of the Agreement, at the Controller's election, SpiralXO shall either:

• Delete Controller Data within 180 days of termination (including the 90-day grace period during which the Controller may recover its account or export its data); or
• Provide an export of Controller Data in CSV or JSON format within 30 days of the Controller's written request, following which SpiralXO shall delete the exported Controller Data within the same 180-day period.

The following exceptions apply:

• Financial records. Financial records created in the Finance & Fundraising Module — the income ledger, Player Dues bills, expenses and receipts, the financial audit log, and the Payer information they contain — form the Controller's permanent financial records and are retained after termination, as described in the SpiralXO Privacy Policy and the EU Privacy Policy Addendum. On the Controller's request, SpiralXO shall provide an export of these records. Where retention is no longer required, SpiralXO shall restrict processing of these records to storage and to providing them to the Controller or as required by law.
• Athletic performance data. A player's athletic performance data is deleted when that player's account is deleted, during or after the term.
• Retention schedule and legal retention. SpiralXO may retain Controller Data for the periods set out in the EU Privacy Policy Addendum retention schedule, and where Union or Member State law requires storage, including tax and accounting law, for as long as that law requires.

SpiralXO shall certify deletion in writing on the Controller's request. Retained data remains subject to this DPA for as long as it is retained.

4.7 Audits

SpiralXO shall make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. The Controller shall give at least 30 days' written notice, conduct audits during normal business hours, and bear the cost of any third-party auditor. Audits shall be conducted in a manner that minimizes disruption to SpiralXO's operations. SpiralXO may satisfy audit requests by providing current SOC 2 Type II, ISO 27001, or equivalent third-party reports where available.

5. Sub-Processors

5.1 General Authorization

The Controller grants SpiralXO general written authorization to engage the Sub-Processors listed in Annex I. SpiralXO shall impose on each Sub-Processor, by written contract, data protection obligations equivalent to those in this DPA, and remains fully liable to the Controller for each Sub-Processor's performance.

5.2 Changes

SpiralXO shall notify the Controller at least 14 days before engaging any new Sub-Processor or replacing an existing one. The Controller may object on reasonable data protection grounds within 14 days of receiving the notice. If the Parties cannot resolve the objection in good faith within 30 days, either Party may terminate the Agreement without penalty on 30 days' written notice.

5.3 Stripe

For payments made through the Finance & Fundraising Module, the Controller contracts directly with Stripe for its Connected Stripe Account. Stripe processes card and bank details, performs its own identity, fraud, and regulatory checks, and issues receipts as an independent controller under its own privacy policy. Stripe acts as SpiralXO's Sub-Processor only for the transaction records it shares with the platform.

6. International Transfers

Controller Data is stored and processed in the United States. SpiralXO shall ensure that any transfer of Controller Data outside the EEA, UK, or Switzerland is subject to appropriate safeguards under Chapter V GDPR, namely the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Two: Controller to Processor), set out in Annex III, and, where a Sub-Processor is certified under it, the EU–US Data Privacy Framework. SpiralXO has implemented supplementary measures including encryption in transit and at rest, access controls, and contractual limits on processing.

7. Controller Obligations

The Controller warrants that:

• It has a lawful basis under Article 6 GDPR for all processing of Controller Data it instructs, including the publication of any personal data on a Give Page, Player Fundraising Page, or Recruiting Page.
• It has provided data subjects, including Payers, with the information required by Articles 13 and 14 GDPR, and has obtained any consent required for the processing and publication it instructs.
• All users of its account, and all players whose information it records or publishes through the platform, are 18 years of age or older.
• It will not submit special categories of personal data, including health data.
• It is responsible for the individuals it designates as Treasurers and Parent Admins and for their use of Controller Data.
• It holds a valid VAT identification number and has provided accurate VAT details to SpiralXO.
• It will promptly inform SpiralXO of any change to its instructions that affects SpiralXO's obligations under this DPA.

8. Liability

Each Party's liability under this DPA is subject to the limitations and exclusions in the Agreement, except that:

• Liability for wilful misconduct or gross negligence is not limited or excluded.
• Liability for personal injury or death caused by negligence is not limited or excluded.
• Liability that cannot be limited or excluded under Data Protection Laws or other mandatory law is not limited or excluded.

9. Term and Termination

This DPA takes effect on the date of last signature below or, where incorporated by reference, on the effective date of the Agreement, and remains in force for the duration of the Agreement. Termination of the Agreement automatically terminates this DPA, subject to SpiralXO's obligations under Section 4.6, which survive for as long as SpiralXO retains any Controller Data.

10. Governing Law and Jurisdiction

This DPA is governed by the laws of the State of Wyoming, United States, without regard to its conflict of law principles, except where mandatory provisions of the law of an EU Member State, the UK, or Switzerland apply. The Standard Contractual Clauses in Annex III are governed by the law specified in them. The jurisdiction and dispute resolution provisions of Section 6 of the EU Terms and Conditions Addendum apply to disputes under this DPA. In the event of a conflict between this DPA and the Agreement, this DPA prevails with respect to the processing of Controller Data; in the event of a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

11. Execution

By signing below, each Party confirms that it has read, understood, and agrees to be bound by this DPA. This DPA may be executed in counterparts, each of which is an original and all of which together form one instrument. Electronic signatures are acceptable.

Annex I — Authorized Sub-Processors

Annex III — Standard Contractual Clauses

The Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (Controller to Processor), are incorporated into this DPA by reference and must be completed before execution. For the purposes of the Standard Contractual Clauses: the Controller is the data exporter; SpiralXO is the data importer; the details of processing are as set out in Section 3; the technical and organisational measures are as set out in Section 4.3; and the authorized Sub-Processors are as set out in Annex I. The full text of the Standard Contractual Clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj. Where the UK GDPR or Swiss law applies, the Standard Contractual Clauses apply as amended by the UK International Data Transfer Addendum or as required by the Swiss Federal Data Protection and Information Commissioner, as applicable.

Version 1.1  ·  Last updated: October 19, 2026  ·  FieldIQ Holdings LLC  ·  legal@spiralxo.com