CoachTools Data Processing Agreement (DPA)

Version: 1.0
Version date: 16 October 2026
Effective for each Controller: when accepted in writing as described in Section 9.

This Data Processing Agreement (the DPA) forms part of the CoachTools service agreement or written order between Plan&Care Sports Oy, Finnish Business ID 2845110-2, Lahti, Finland (the Processor or Provider), and the customer identified as the Controller in the relevant service agreement or written order. Together, they are the Parties.

A club or federation is the Controller when it determines the purposes and essential means of processing within its CoachTools workspace. For individual or small-team orders, the Controller is the person or legal entity actually making those decisions. The payer of an invoice is not necessarily the Controller, and payment alone does not establish authority to accept this DPA. A written order must identify the actual Controller and the person authorised to accept this DPA on its behalf.

Unless the Controller designates a separate privacy and security contact in writing, its named contracting contact will act as that contact. Where the payer and Controller differ, the contact must be authorised by the Controller. Contact details, the agreed version and evidence of acceptance form part of Schedule 1.

This DPA covers personal data that the Provider processes on behalf of the Controller through CoachTools (Customer Personal Data). Plan&Care Sports Oy may act as an independent controller for personal data it processes for its own customer relationship management, invoicing, legal compliance, and its own administration and security purposes, as described in its privacy notice. A processing activity performed for the Controller does not fall outside this DPA merely because it also supports the operation or security of the service. The Parties’ actual roles take precedence over labels.

Where the processing of Customer Personal Data is concerned, this DPA prevails over conflicting provisions of the service agreement, subject to mandatory law. Other commercial matters remain governed by the service agreement. This DPA is not itself a mechanism for international transfers of personal data.

1. Processing, instructions and responsibilities

  1. The subject matter, duration, nature and purposes of processing, categories of data subjects and types of personal data are specified in Schedule 1. Processing covers the service term and the limited return and deletion activities described in Schedule 4.
  2. The Controller instructs the Provider to process Customer Personal Data only to deliver and secure the CoachTools functions selected and configured by the Controller, provide requested support, carry out the Controller’s documented instructions, and comply with this DPA. The service agreement, documented configuration choices and instructions from an authorised Controller contact to dev@coachtools.net constitute documented instructions to the extent consistent with applicable law and this DPA. The Provider shall not use Customer Personal Data for its own marketing, independent athlete profiling or unrelated purposes.
  3. The Provider processes Customer Personal Data only on documented instructions, including instructions concerning transfers outside the European Economic Area (EEA), unless European Union or Member State law requires otherwise. If legally permitted, the Provider shall inform the Controller of such a requirement before processing.
  4. The Provider shall promptly inform the Controller if, in its opinion, an instruction infringes applicable data protection law, and may pause the disputed action pending clarification.
  5. The Controller determines the lawful purposes of processing, the appropriate legal basis under GDPR Article 6 and, where relevant, a separate condition under Article 9 for special-category data such as health data. It is responsible for informing data subjects, determining authorised users and access rights, and making its own decisions about processing children’s data and the use of feedback, tests, absence reasons, comments and media. Use of the application does not in itself constitute explicit consent to health-data processing. The Provider remains responsible for all duties applicable to it as Processor.
  6. The Controller shall minimise personal data entered into the service and shall not place confidential or special-category information in a feature or media file that is made accessible through a shareable link unless an appropriate legal basis and access arrangement have been established. Section 2 and Schedule 2 describe the Provider’s existing security arrangements and their limitations; the Controller’s obligations do not release the Provider from its own GDPR duties.

2. Confidentiality and security

  1. The Provider shall ensure that anyone authorised to access Customer Personal Data is subject to confidentiality obligations and has access only as required for their duties.
  2. The Provider shall implement and maintain technical and organisational measures appropriate to the risks of the processing under GDPR Article 32, including the risks relating to children, communications, feedback and potentially sensitive information. The service’s current measures and relevant limitations are described in Schedule 2. The Provider may improve or replace measures, provided that the overall level of protection is not materially reduced, and shall inform Controllers of material changes affecting protection.
  3. The Controller manages its own invitations, user memberships, roles, visibility choices and permissions within the available CoachTools functionality. The Parties will cooperate to address security or access issues arising from the platform’s operation or configuration.
  4. A complex file name or UUID can reduce the risk of a link being guessed, but does not itself constitute user authentication or an access-control check. Where media is accessible through a direct link, the Parties shall account for that characteristic when selecting and uploading content. The Provider shall not describe such media as access-restricted merely because its URL is difficult to guess.

3. Subprocessors

  1. The Controller gives general written authorisation to the Provider to engage the subprocessors or provider groups identified in Schedule 3 for the purposes described there. The Provider shall maintain an up-to-date list identifying the relevant services and available details of processing locations and transfer safeguards. A material expansion of the list is subject to paragraph 2.
  2. The Provider shall give the Controller at least 30 days’ advance written notice of an intended addition or replacement of a subprocessor that will process Customer Personal Data. The Controller may object within 15 days of the notice on reasonable data-protection grounds. The Parties shall seek a reasonable alternative. If an objection cannot be resolved, the Controller may terminate the affected processing service before the change takes effect; the financial consequences are governed by the applicable service agreement and mandatory law. Prepaid charges are not automatically refundable solely because of such termination, unless separately agreed in writing or required by mandatory law. No objection procedure authorises unlawful processing or transfers.
  3. The Provider shall impose on subprocessors data-protection obligations providing substantially the same protection for the relevant processing as this DPA, and remains responsible to the Controller for each subprocessor’s fulfilment of those obligations.

4. Transfers outside the EEA

  1. The Provider’s own administrators do not routinely access Customer Personal Data from outside the EEA. This does not mean that all of the suppliers’ processing, support, network routing, push messaging or content delivery takes place exclusively in the EEA. Schedule 3 describes known regional services and relevant possibilities of international processing.
  2. The Provider shall not make or authorise restricted international transfers without a valid mechanism under Chapter V GDPR and any supplementary safeguards required in the circumstances. Where standard contractual clauses or another transfer mechanism are required, the relevant supplier arrangements must provide them; this DPA by itself is not a set of international transfer standard contractual clauses.
  3. On reasonable request, the Provider will supply available information concerning the relevant supplier, destination and transfer mechanism. The Parties shall cooperate if an arrangement requires an updated assessment or additional measures.

5. Assistance and data-subject requests

  1. Taking into account the nature of the processing and information available, the Provider shall assist the Controller in meeting its obligations concerning access, rectification, erasure, restriction, portability and objections. A request received directly from an athlete, guardian or other data subject relating to Customer Personal Data shall be forwarded to the Controller’s designated contact without undue delay, unless the Provider is acting as an independent controller for that request.
  2. The Provider shall assist the Controller as required under GDPR Articles 28 and 32–36 regarding security, personal-data breaches, data protection impact assessments and prior consultation. Mandatory assistance is not dependent on purchasing a separate support package. Additional bespoke work that exceeds these duties may be charged only where a price has been agreed in advance.
  3. The Controller makes the necessary decisions concerning its notifications to the supervisory authority or affected data subjects; the Provider shall supply information and cooperation needed for those decisions.

6. Personal-data breaches

  1. The Provider shall notify the Controller without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. The notice shall be sent to the Controller’s designated privacy/security contact. The Provider’s security contact is dev@coachtools.net.
  2. The first notification may be preliminary. As information becomes available, the Provider shall describe the nature and known scope of the breach, likely consequences, measures taken or proposed, and a contact point, and shall provide further updates without undue delay.
  3. The Provider shall document and investigate the incident, cooperate in containment and remediation, and shall not notify authorities or data subjects on the Controller’s behalf unless instructed or legally required. Any obligations the Provider has as an independent controller remain its own responsibility.

7. Accountability and audits

  1. The Provider shall make available information reasonably necessary to demonstrate compliance with GDPR Article 28 and this DPA, including available security descriptions, the subprocessor register and relevant documentation.
  2. The Provider shall allow for and contribute to audits and inspections by the Controller or its appointed independent auditor, subject to reasonable notice, confidentiality, appropriate security procedures and protection of other customers’ data. The Parties shall first consider appropriate documentation and remote assessment when sufficient. These practical arrangements do not remove the audit rights required under GDPR Article 28.
  3. The Provider shall notify the Controller if it considers an audit instruction contrary to applicable data protection law.

8. Return, deletion and end of service

  1. When the processing service ends, the Controller may choose return or deletion of its Customer Personal Data, and the Provider shall delete existing copies unless EU or Member State law requires their retention. The authorised Controller contact sends its instruction to dev@coachtools.net; the Provider may verify the requester’s authority. Details are in Schedule 4.
  2. A Controller wishing to obtain its data should notify the Provider no later than 30 days after the service ends. The Provider does not promise continued self-service access during that period, but will process a verified return request through available manual or system export methods. The return may include several file formats; bespoke reorganisation or conversion is not part of the standard return obligation. The Provider shall not make legally required return conditional on an additional fee.
  3. As a documented default instruction accepted with this DPA, if the Controller has not requested return or given another lawful instruction during the 30-day post-service request period, it instructs the Provider to delete its Customer Personal Data. The Provider shall complete deletion from active systems within a further 30 days. Where the Controller requests earlier deletion, the Provider shall perform it within 30 days of the verified request unless a lawful reason requires retention or a specific legal obligation requires a different timetable. The Provider shall not extend this process into a 12-month dormant-storage period: no such service is included in version 1.0.
  4. Database backups currently consist of one periodically replaced copy. Following an end-of-service deletion, the Provider shall arrange for the existing database backup containing the deleted Customer Personal Data to be securely replaced with a new backup of the cleaned live data or otherwise removed within the same 30-day deletion period. If a backup is restored before replacement, applicable deletion instructions must be re-applied before the restored data is made available for normal use. Schedule 4 describes media files and other operational details.
  5. Historical records may be retained only when they are genuinely anonymised so that individuals are no longer reasonably identifiable, including by combination with reasonably available information; pseudonymised data remain personal data. Individual user account removal and deletion of a Controller’s entire workspace are separate operations. Where records relate to several persons or Controllers, requests shall be assessed against the applicable instructions and rights.
  6. The Provider shall provide written confirmation of an end-of-service deletion on request, identifying any data retained because law requires it. Personal data processed by the Provider as an independent controller is handled under its privacy notice and applicable law, not under a Controller’s instruction concerning Customer Personal Data.

9. Duration, versions, acceptance and language

  1. This DPA applies from its documented written acceptance for as long as the Provider processes Customer Personal Data on the Controller’s behalf, including agreed return and deletion work. Obligations concerning confidentiality and the handling of any lawfully retained data continue as required by law.
  2. For club and federation contracts, this DPA is incorporated by reference into the service agreement signed by an authorised representative, including a contract signed through Visma Sign. For individual or smaller team orders, the Controller may accept version 1.0 by an explicit written email or other recorded written confirmation from a person authorised to act for the Controller, identifying the Controller and the accepted DPA version. A paid invoice, without such confirmation from the actual Controller, is not treated by the Provider as sufficient evidence of DPA acceptance.
  3. The Provider shall retain the accepted version or an immutable copy, the Controller’s identity, the accepting person, the acceptance date and the corresponding email, signed agreement or written-order evidence. An online acceptance mechanism may be implemented later; it is not a current acceptance method under this DPA.
  4. Material amendments to this DPA require written agreement by the Parties. The Provider may update security measures and the subprocessor list through the procedures in Sections 2 and 3. Posting a new version on the website alone does not replace an existing accepted version.
  5. Language: For a Controller that accepts this DPA in Finnish, the Finnish version is authoritative; for a Controller that accepts it in English, the English version is authoritative. The versions are intended to have materially corresponding content.
  6. The service agreement governs governing law, dispute resolution and commercial matters, subject to this DPA’s priority for Customer Personal Data and mandatory data protection law.

Schedule 1 — Parties and description of processing

Item Description
Controller The legal entity or natural person identified as the Controller in the signed service agreement or written order; includes its name and contact details. The invoice payer is not necessarily the Controller.
Controller privacy/security contact The named contracting contact by default, unless a different contact is designated by the Controller in writing. Where the payer differs from the Controller, use the Controller’s authorised contact.
Processor Plan&Care Sports Oy, Finnish Business ID 2845110-2, Lahti, Finland; dev@coachtools.net.
Accepted version and evidence DPA version 1.0 (16 October 2026); signed agreement or explicit written confirmation retained with the Controller identity, authorised accepting person and acceptance date.
Service, duration CoachTools coaching platform throughout the contracted service, followed by the limited return and deletion process in Schedule 4.
Processing operations Collecting, recording, storing, organising, retrieving, displaying, role-based sharing, transmitting, modifying, analysing on instruction, exporting, erasing and anonymising.
Purposes Club and team administration, training and season planning, events and attendance, coaching content, communications, athlete feedback, training load, tests, development and selected service features.
Data subjects Athletes including children, guardians, coaches, club/team staff, authorised users and persons appearing in uploaded material.
Ordinary personal data Account details, identifiers, contact information, team memberships and roles, attendance, events, training plans, messages, comments, questionnaires, goals, test results, images, video, files and operational data associated with service use.
Sensitive information potentially included Health, injury or other special-category information may occur in free-text notes, questionnaires, absence reasons, uploaded media or related records. Wellness and exertion data may also amount to health data depending on context. The Controller determines its applicable GDPR Article 6 basis and Article 9 condition.
Access and sharing instructions Sharing through the Controller’s configured team, club and guardian roles and service features. Federation workspaces are separately scoped; licensing statistics shared with a federation do not by themselves include athlete-identifying coaching records. Certain media objects may also be accessible via a direct shareable URL as explained in Schedule 2.
Processor security and privacy contact dev@coachtools.net.

The actual Controller shall be recorded in the service agreement or written order before acceptance, including where a coach purchases a license on behalf of a club or another organisation.

Schedule 2 — Technical and organisational measures (current operational model)

  1. Access and administration. CoachTools uses application roles for club staff, team staff, athletes and guardians. The Provider’s direct database administration is restricted to its principal administrator. Administrative accounts for the infrastructure services used by the Provider have multi-factor authentication; administrative permissions are reviewed and obsolete access is removed. Individual customers manage their own application memberships and visibility settings.
  2. Transmission and storage. Application web connections use HTTPS/TLS. AWS S3 applies server-side encryption by default to newly stored objects; the encryption status of older objects and encryption of the application database at the disk or database layer have not been independently verified and are not warranted as implemented by this document. The Provider maintains administrative access controls but does not represent the entire storage environment as end-to-end encrypted.
  3. Media link access. Some S3-hosted videos, images and other practice-library materials are accessible to anyone holding their exact URL. Addresses may use long random identifiers or UUIDs; this is link obscurity, not user-specific authorisation or expiring signed URL access. The same restriction cannot be assumed for all uploaded materials. Controllers must exercise care when uploading identifiable or sensitive content; the Provider must assess and address the resulting risks under GDPR Article 32. The Parties shall not rely on an assumption that such media is private solely because links are difficult to guess.
  4. Infrastructure. The production application environment uses AWS infrastructure in the Stockholm region (eu-north-1). Video processing and certain email services use AWS Frankfurt (eu-central-1). CloudFront delivers media/content, Cloudflare carries relevant web or WebSocket traffic, Laravel Forge supports server provisioning and deployments, and Laravel Reverb runs as part of the Provider’s own real-time application components. Some supplier processing and network edge locations may be outside the EEA, as discussed in Schedule 3.
  5. Backups and recovery. A database backup is taken when application updates are deployed, sometimes more than once in a week. Only one backup copy is retained and the previous copy is replaced. It is stored on a device that is not accessible from the public Internet. A database restoration has been tested. The Provider does not separately back up S3 media. The Provider does not warrant continuous backup, a specific daily/weekly backup interval, or a particular recovery point. Backup storage encryption has not been confirmed.
  6. Logs and incident management. Laravel application logs are normally retained for no longer than seven days. Server, database and third-party infrastructure logs may be kept for longer according to their operational purpose and configured retention. An internal incident-response process is in place. Log access is restricted to authorised administration.
  7. Notifications and messaging. CoachTools uses Firebase Cloud Messaging to deliver push notifications. Event comment notifications use a general message such as “New comment on event” rather than copying the user’s free-text comment. Other notifications and their metadata remain subject to data minimisation and confidentiality assessment. AWS SES delivers service email and AWS MediaConvert processes videos.
  8. Separation and permissions. Team, club and federation data are separated by application permissions and related access checks. This describes application access, not a guarantee that every directly accessible media URL enforces the same permissions.
  9. Manual operations. Data return and deletion may require authorised administrative work. There is no currently implemented 12-month inactive subscription storage or automatic post-termination erasure feature. Schedule 4 establishes manual deadlines and instructions for end-of-service processing.

Schedule 3 — Authorised subprocessors and international transfer information

The following are the service providers or provider groups used in the current operating model. Their contracting entities and exact processing or remote-support locations depend on the Provider’s supplier agreements and services. Listed EEA regions refer to particular regional AWS workloads, not an assurance that all processing stays within the EEA.

Supplier or supplier group Function and categories of access Known region / international processing consideration
Amazon Web Services (AWS) Hosting, compute and storage, S3 media, CloudFront content delivery, MediaConvert video processing, SES service email; may process Customer Personal Data, media and service metadata. Regional application workloads in Stockholm and certain video/email workloads in Frankfurt. CloudFront edge delivery, supplier support and related services may involve processing or access elsewhere.
Google / Firebase Firebase Cloud Messaging; device tokens, notification routing and limited notification payload information. Delivery and provider processing may involve locations outside the EEA; actual arrangement follows the relevant Google/Firebase service terms.
Cloudflare, Inc. / relevant Cloudflare contracting entity Proxying applicable traffic and related network and security metadata; some content may pass through the proxy. Global network and provider-access arrangements may involve locations outside the EEA.
Laravel Holdings Inc. / Laravel Forge Provisioning, managing and deploying application infrastructure; may process administrator/account data, technical configuration and potentially information or credentials needed for server operation. Provider-side administration and support may involve processing or access outside the EEA.

For international transfers, the Provider shall use legally valid transfer arrangements where required, such as the applicable supplier data-processing agreement and standard contractual clauses or another mechanism permitted by Chapter V GDPR. Relevant supplier documents include:

The exact supplier account contracting entities, optional vendor services, support-access locations and applicable transfer mechanisms must be checked against the Provider’s supplier agreements and configurations. The list is a description of the current provider set, not a representation that every possible supplier transfer or risk assessment has already been independently audited. Laravel Reverb is an application component operated by the Provider rather than a separate third-party supplier.

Schedule 4 — Return, erasure and retention procedures

Item Agreed procedure for version 1.0
Requester and verification The Controller’s authorised contact emails dev@coachtools.net. The Provider may check authority, especially when a payer, coach or guardian is not the actual Controller.
During the subscription Available in-app exports may be used. Individual practice cards and plans can be exported as PDF; other exports depend on the type of data and the existing service functions.
Return of Customer Personal Data On a verified request, the Provider arranges a reasonably usable export of relevant Customer Personal Data using existing functions and, where needed, authorised manual extraction. Event and attendance data are among the records that can be prepared manually. The Provider and Controller coordinate scope, format and secure delivery; no universal one-click CSV/Excel export of all data is promised.
Request after service termination The Controller must request return no later than 30 days after the end date. Continued direct app access is not guaranteed. The Provider responds without undue delay and normally arranges the return within 30 days of a verified request, depending on its scope. A verified timely return request is honoured before final deletion.
Default end-of-service instruction Unless the Controller requests return or gives another lawful written instruction within the 30-day period, the Controller instructs deletion after that period; this instruction is accepted together with this DPA. No 12-month dormant-storage period applies.
Deletion from active systems Normally within 30 days of a verified deletion instruction; where the default deletion instruction applies, within 30 days after the 30-day request period ends. Individual rights requests are assessed separately and without undue delay.
Database backup following deletion A single backup is retained on a device without public-Internet access. Following end-of-service deletion, the backup containing erased Customer Personal Data is replaced with a new copy of cleaned live data or securely removed during the same 30-day deletion period. If an older copy must be restored before its replacement, the relevant erasure is re-applied before normal use.
S3 media Media files are not included in the separate database backup. Where Customer Personal Data is contained in media, the Provider includes relevant media objects in the instructed active-system deletion, taking account of any content legitimately shared by or belonging to another Controller and the need to verify ownership or authority.
User account deletion User access is revoked; associated records are deleted or genuinely anonymised as appropriate, while lawful aggregates that no longer identify an individual may be retained. Removing a membership does not necessarily remove all historical records controlled by the club.
Additional custom work Bespoke data restructuring or special-format conversion beyond required ordinary return/assistance may be charged only by prior written agreement; ordinary return, deletion and statutory assistance may not depend on an extra purchase.
Exceptions and confirmation Data required to be kept by EU or Member State law may be retained only for that obligation, subject to access restrictions. On request, the Provider confirms completion and explains any lawful exceptions. The Provider’s own independent-controller records are governed separately.

Acceptance record

The Controller, authorised accepting person, contact address, DPA version, date and method of acceptance are recorded in the signed service agreement or written order and its retained correspondence, rather than filled into this public master version. Acceptance must be explicit and attributable to the actual Controller; a mere payment by a third party does not suffice.

Provider: Plan&Care Sports Oy, Business ID 2845110-2, Lahti, Finland
DPA: Version 1.0, dated 16 October 2026