EU Privacy Policy Addendum

1. Scope and Application

Who This Addendum Applies To

This EU Privacy Policy Addendum applies to any individual or organization that accesses or uses SpiralXO from within the European Economic Area, the United Kingdom, or Switzerland, including any person located there who makes a donation, sponsorship, or dues payment to an organization through SpiralXO's Finance & Fundraising Module. It supplements and, where it conflicts, supersedes SpiralXO's global Privacy Policy for those users.

Important: SpiralXO's European operations are restricted exclusively to B2B customers — registered business entities, sports clubs, schools, and football programs — purchasing on behalf of adult users aged 18 or older. SpiralXO does not serve individual consumers or organizations whose users include individuals under 18 in the European market. By accessing SpiralXO as a European customer, your organization warrants that all platform users are 18 years of age or older, and that any player whose information is recorded in the Strength & Conditioning Module or displayed on a Give Page or Player Fundraising Page is 18 years of age or older.

EU Representative

FieldIQ Holdings LLC has designated its European management team as its EU Representative pursuant to Article 27 of the GDPR, on the basis of the management team's residence in Germany. The EU Representative can be contacted at legal@spiralxo.com with the subject line “GDPR — EU Representative Inquiry.”

The lead supervisory authority for SpiralXO's processing activities, based on our management team's location in Germany, is the Federal Commissioner for Data Protection and Freedom of Information (BfDI). See Section 4 for full contact details.

2. Legal Basis for Processing

How We Determine Our Legal Basis

Under Article 6 of the GDPR, SpiralXO identifies a specific legal basis for each category of personal data we process. We do not rely on a generic or catch-all basis. The four legal bases we rely on are:

• Contract Performance (Article 6(1)(b)): Processing is necessary to perform the contract between SpiralXO and your organization, or to take steps prior to entering into that contract.
• Legitimate Interests (Article 6(1)(f)): Processing is necessary for our legitimate business interests, where those interests are not overridden by your rights and freedoms. Where we rely on this basis, a Legitimate Interests Assessment (LIA) has been conducted.
• Legal Obligation (Article 6(1)(c)): Processing is necessary to comply with a legal obligation applicable to SpiralXO.
• Consent (Article 6(1)(a)): You have given clear, specific, and freely withdrawable consent. We rely on consent only where no other basis applies — primarily for non-essential cookies. Consent is not used as a fallback for processing activities properly covered by contract performance or legitimate interests.

Legal Basis by Processing Activity

3. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights in respect of your personal data processed through SpiralXO. If you are a donor, sponsor, or other payer, the organization you paid is the Controller of your personal data; you may exercise your rights against the organization, and SpiralXO will assist the organization in responding. You may also contact SpiralXO directly, and we will forward your request to the organization and assist as required.

Right of Access (Article 15)

You have the right to obtain confirmation of whether we process personal data about you, and to receive a copy of that data along with information about how it is processed, the legal basis, retention periods, and third parties with whom it is shared.

Right to Rectification (Article 16)

You have the right to request correction of inaccurate personal data we hold about you, or completion of incomplete data.

Right to Erasure (Article 17)

You have the right to request deletion of your personal data where: the data is no longer necessary for the purpose collected; you withdraw consent (where consent was the legal basis); you successfully object to processing; or the data has been unlawfully processed. This right is subject to legal and operational retention requirements described in Section 6, including the retention of financial records.

Right to Restriction of Processing (Article 18)

You have the right to request that we restrict processing of your personal data in certain circumstances, such as while you contest the accuracy of the data or while we assess an objection you have raised.

Right to Data Portability (Article 20)

Where we process your personal data on the basis of contract performance or consent, and that processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON), and to request that we transmit it to another controller where technically feasible.

To request a data export, contact privacy@spiralxo.com with the subject line “Data Portability Request — [Your Organization Name].”

Right to Object (Article 21)

You have the right to object at any time to processing based on legitimate interests. Upon receipt of an objection, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims.

Right to Withdraw Consent (Article 7(3))

Where we process personal data on the basis of your consent (primarily non-essential cookies), you may withdraw consent at any time through our cookie preference centre without affecting the lawfulness of processing carried out before withdrawal.

Right Not to Be Subject to Automated Decision-Making (Article 22)

SpiralXO does not make decisions producing legal or similarly significant effects based solely on automated processing. Quiz tracking, usage analytics, estimated training records, and leaderboards are informational tools for coaches and administrators only, and automated filtering of supporter messages is subject to review by the organization.

How to Exercise Your Rights

To exercise any of the above rights, contact us at privacy@spiralxo.com with the subject line “GDPR Rights Request — [Type of Request] — [Your Name / Organization].” We may ask you to verify your identity before processing your request. We will not charge a fee for reasonable requests.

Response Timelines

We will respond to all valid data subject requests in accordance with Articles 12–22 of the GDPR:

Right to Lodge a Complaint

If you believe SpiralXO has processed your personal data inconsistently with the GDPR, you have the right to lodge a complaint with the supervisory authority in your country of residence or the country where the alleged infringement occurred.

Based on our management team's location in Germany, our lead supervisory authority is:

You may also contact the supervisory authority in your own EU member state. We encourage you to contact us at privacy@spiralxo.com before filing a complaint so we can attempt to resolve the matter directly.

4. Data Breach Notification

Our Internal Response Process

SpiralXO maintains an internal data breach response procedure. Upon becoming aware of a personal data breach, we will immediately contain and assess the breach; document its scope, cause, and the categories of data affected; assess the risk to affected individuals; and notify the relevant supervisory authority and affected users within the timeframes below.

Notification to the Supervisory Authority (Article 33 GDPR)

Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, SpiralXO will notify the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach. Where notification cannot be made within 72 hours, it will be accompanied by a reasoned explanation of the delay.

The notification will include, to the extent available: the nature of the breach and categories of data affected; the name and contact details of our data protection contact (privacy@spiralxo.com); the likely consequences of the breach; and the measures taken or proposed to address it.

Notification to Affected Individuals (Article 34 GDPR)

Where a breach is likely to result in a high risk to the rights and freedoms of natural persons, SpiralXO will notify affected individuals without undue delay via the email address associated with their account or, for donors, sponsors, and payers, the email address provided at payment. The notification will describe in plain language: the nature of the breach; our data protection contact details; the likely consequences; the steps we have taken; and any recommended steps individuals should take to protect themselves.

Individual notification is not required where: (a) appropriate technical measures such as encryption render the data unintelligible; (b) subsequent measures ensure the high risk is no longer likely to materialise; or (c) direct notification would involve disproportionate effort, in which case a public communication will be used instead.

5. International Data Transfers

Overview

SpiralXO is operated by a US-based entity. All of SpiralXO's data servers and infrastructure are located in the United States, including our database and storage provider (Supabase, hosted on Amazon Web Services US regions) and our application hosting provider (Vercel). When personal data of EEA, UK, or Swiss users is transferred to and stored on these US-based servers, we ensure that appropriate safeguards are in place as required by Chapter V of the GDPR.

Transfer Mechanisms

We rely on the following transfer mechanisms as applicable:

• Standard Contractual Clauses (SCCs): We use the European Commission's 2021 Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) for transfers to vendors and sub-processors in the United States and other countries without an adequacy decision. SCCs are incorporated into our Data Processing Agreements with each relevant vendor.
• EU–US Data Privacy Framework (DPF): Where our vendors are certified under the EU–US Data Privacy Framework administered by the US Department of Commerce, transfers to those vendors may also rely on the DPF adequacy decision. We verify vendor certification before relying on this mechanism.

Vendor and Sub-Processor List

The following vendors process EEA personal data on our behalf. All data is stored and processed on servers located in the United States unless otherwise indicated.

Transfer Impact Assessment

Where we rely on SCCs as a transfer mechanism for transfers to the United States, we have assessed the relevant US legal framework and have implemented supplementary measures including encryption of data in transit and at rest, access controls, and contractual limitations on processing beyond the agreed purpose.

6. Data Retention

Retention Principles

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, in compliance with the storage limitation principle under Article 5(1)(e) of the GDPR. Financial records are an exception justified by the organization's need for complete and accurate books and by applicable tax and accounting obligations, as set out below.

Retention Schedule

Upon account termination, active user access is disabled immediately, the organization's Give Page is taken offline, and no further payments can be accepted. A 90-day grace period is provided for account recovery or data export. After this period, personal data is deleted or irreversibly anonymized, subject to longer retention obligations set out above.

You may request early deletion of specific data at any time by contacting privacy@spiralxo.com. Requests are processed in accordance with Section 3 response timelines, subject to applicable legal retention obligations.

7. Cookies and Tracking Technologies

Our Approach to Cookie Consent

For users accessing SpiralXO from the EEA, UK, or Switzerland, we operate the following cookie framework:

• Essential cookies are placed automatically as they are strictly necessary for the platform to function.
• Google Analytics cookies and functional or preference cookies are blocked by default and only activated after you provide active, informed consent through our cookie preference centre.
• PostHog product analytics is currently an exception: it loads for all users without prior consent. See the cookie table below.
• Pre-ticked boxes and consent inferred from continued platform use are not used.
• You may withdraw or modify consent at any time through the cookie preference centre, accessible at the bottom of every platform page.

Cookie Categories

Google Analytics cookies are used to understand platform usage in aggregate. IP anonymisation is enabled for all EEA users. No cross-site tracking or advertising data is shared. Analytics cookies are only activated upon your explicit consent and all data is transferred to Google's US servers under 2021 SCCs (see Section 5).

PostHog is used to understand how features are used and to record sessions, with sensitive input fields masked. It currently loads for all users without prior consent. PostHog data is transferred to PostHog's US servers under 2021 SCCs (see Section 5).

8. Data Controller and Processor Roles

Role Clarification

Under the GDPR, the distinction between a Data Controller (the entity that determines the purposes and means of processing) and a Data Processor (the entity that processes data on behalf of a Controller) determines which obligations each party bears.

Data Processing Agreement (Article 28 GDPR)

GDPR Article 28 requires the controller–processor relationship to be governed by a written Data Processing Agreement (DPA). SpiralXO's standard EU DPA covers: the subject matter, duration, nature, and purpose of processing; the types of personal data and categories of data subjects (including, where the organization uses the relevant modules, donors, sponsors, payers, and athletic performance data); SpiralXO's obligations as processor including security, sub-processor management, and assistance with data subject rights; sub-processor authorization and notification; and data return and deletion on termination, subject to the retention of financial records described in Section 6.

European customers are required to execute a DPA with SpiralXO at or before subscription. To request our standard EU DPA, contact legal@spiralxo.com with the subject line “GDPR DPA Request — [Organization Name].”

9. Contact Us