Data processing agreement

This agreement is made under Article 28 of the General Data Protection Regulation between:

• the club — the controller, being the club whose website is provided under this agreement; and
• Imperial Resources Limited, trading as The Crest, of 25 The Willows, Castlemagner, Mallow, Co. Cork — the processor.

It takes effect when the club's site goes live and lasts as long as the subscription. It forms part of the terms of use.

Article 28(3) requires this to be in writing. It is here rather than in an attachment because a contract nobody has read protects nobody.

1. Which of us is which

The club decides why and how personal data is processed on its website: whose bookings it takes, what it asks them, what it sells, whether it runs a lottery. The club is the controller.

The Crest runs the software and the servers, and does what the club's use of the system tells it to do. The Crest is the processor and has no purpose of its own for any of it.

The exception is a club officer's own account with The Crest — their name, email address and login. For that, The Crest is the controller, and the privacy policy covers it.

2. What is processed

Categories of data subject. Adults who book the club's facilities, buy from its shop, donate to its fundraising, enter its lottery or send it an enquiry; the club's own officers and committee; and, where the club has enabled it for a particular event, the people its camp or course places are booked for — who may be children.

Categories of personal data. Names, email addresses, phone numbers, postal addresses where given, booking and order details, payment references, lottery entries, the contents of enquiries, and — for camp and course places only — a first name per place.

Special category data. None. The system has no field for it. Health, dietary and medical information is refused at the point of entry by the application and by a constraint in the database, so it cannot be stored even where somebody tries.

Children's data. Limited, deliberately, to one first name per booked place at an event where the club has asked for it, and nothing else. There are no member, player or parent records; no date of birth, age, school, address, photograph or contact detail for any child, and no field in which to put one. Every booking, order and lottery entry still carries a confirmation that the person making it is eighteen or over.

That first name is deleted automatically thirty days after the event, and within a day where the place was never paid for. The club can delete one sooner on request, and it is visible only to users the club has given management rights, not to every user who can edit the website.

The club must not use any other field in the system to hold information about anybody under eighteen, and must not attempt to record health, dietary or medical information about anybody through it.

Nature and purpose. Storage, retrieval, display on the club's website, transmission by email, and the taking of payments — for the purpose of running the club's website, its bookings, its shop and its lottery.

Duration. For the term of the subscription, and then as set out in clause 9.

3. The Crest's obligations

The Crest will:

1. process personal data only on the club's documented instructions, which are this agreement and the club's use of the system, unless required to do otherwise by law — and in that case will tell the club first, unless the law forbids it;
2. ensure everybody with access is under a duty of confidence;
3. take the security measures in clause 5;
4. engage no other processor except under clause 4;
5. help the club respond to requests from data subjects, as clause 6;
6. help the club with security, breach notification and impact assessments, as clauses 7 and 8;
7. delete or return the data at the end, as clause 9;
8. make available what the club needs to demonstrate compliance, and submit to audits, as clause 10.

4. Sub-processors

The club gives general authorisation for The Crest to engage the sub-processors listed at https://thecrest.ie/subprocessors, which forms part of this agreement.

The Crest will give the club thirty days' notice by email before adding or replacing one. The club may object within that period; if the objection cannot be resolved, the club may terminate the subscription and be refunded the unused part of the fee.

Every sub-processor is engaged under written terms imposing the same obligations as this agreement, and The Crest remains fully liable to the club for what they do.

5. Security

The Crest will take the measures required by Article 32, which include:

• encryption in transit — the whole site is served over TLS — and encryption at rest for payment credentials and other secrets;
• access control: club data is separated by club at the database level, and every screen that reaches it checks that the person asking belongs to that club;
• two-factor authentication required for administrative accounts;
• rate limiting on forms and payment endpoints;
• backups, tested by restoring them, and held no longer than needed;
• logging of administrative actions, including any occasion on which The Crest support staff access a club's admin area;
• regular dependency and vulnerability scanning.

6. Requests from data subjects

Requests come to the club, because the club is the controller and the club is who its members know.

The Crest will not answer such a request itself. If one arrives at The Crest, it will be passed to the club without undue delay.

The Crest will give the club the means to find, export, correct and delete an individual's data within the system, and will help by other means where the tools do not reach.

7. Breaches

The Crest will notify the club without undue delay, and in any event within 24 hours, of becoming aware of a personal data breach affecting the club's data — by email to the club's registered contact, and by telephone where the matter is serious.

The notification will describe what happened, the categories and approximate number of people and records affected, the likely consequences, and what is being done about it — so far as that is known at the time, with the rest to follow rather than delaying the first notification.

The club, as controller, decides whether to notify the Data Protection Commission and the individuals concerned.

8. Impact assessments

The Crest will provide reasonable assistance with any data protection impact assessment or prior consultation the club has to carry out.

9. What happens at the end

Within thirty days of the subscription ending, the club may ask for its data as a complete export. The Crest will provide it in a machine-readable form at no charge.

At the end of that thirty days, The Crest will delete the club's data, including from backups as those backups expire on their ordinary cycle — and will confirm in writing that it has done so.

Nothing is retained afterwards except where the law requires it, and in that case only for as long as it requires.

10. Audit

The Crest will make available to the club the information needed to show that these obligations are met, and will allow and contribute to an audit by the club or an auditor it appoints — on reasonable notice, no more than once a year unless there has been a breach, and at the club's cost.

11. Transfers outside the EEA

The club's data is stored in the European Economic Area.

Where a sub-processor processes data outside it — the sub-processor list says which, and why — that transfer is made under Standard Contractual Clauses adopted by the European Commission, together with any additional measures the circumstances require.

12. Liability and law

Each of us is liable for our own compliance. This agreement is governed by Irish law and subject to the Irish courts.

If any part of this agreement conflicts with the general terms of use, this agreement wins on anything to do with personal data.

Version v2. Questions about this agreement go to privacy@thecrest.ie.