Commercial Data Processing Agreement (DPA)

1. Roles and scope

For personal data that you and your authorised users submit to the services — for example player names, squad lists, training notes, documents, images and team member account details — you are the Controller and we are the Processor. We process that data only to provide the services to you.

For data where we decide the purposes and means of processing — for example your billing details, account administration, website analytics and our own business records — we act as a Controller, and our Privacy Policy applies instead of this DPA.

2. Details of processing

• Subject matter — provision of the DGM AI Sports services, including the AI Sports Assistant (Nova), the Sports Business Tool, the Learning Academy, dashboards and the client portal.
• Duration — the term of your subscription, plus any wind-down period described in Section 10 (Return and deletion).
• Nature and purpose — hosting, storage, transmission, AI-assisted analysis and generation of responses, account and team management, and customer support.
• Types of personal data — names, contact details, account credentials, role/position information, and any personal data contained in content you choose to submit (messages, documents, images, plans and notes).
• Categories of data subjects — your staff, coaches, authorised users, players and other individuals whose personal data you include in submitted content.
• Special category data — the services are not designed for special category data (e.g. health or medical records). You should not submit it; if you do, you are responsible for ensuring a lawful basis under Article 9.
• Children's data — where you submit personal data relating to under-18s (e.g. youth squad information), you confirm you have the authority and lawful basis to do so. Our Safeguarding Policy also applies.

3. Your obligations as Controller

• You are responsible for the accuracy and lawfulness of the personal data you submit, including having an appropriate lawful basis and providing any required privacy notices to your data subjects.
• You instruct us to process personal data only as needed to provide the services, as set out in this DPA, our Terms of Service, and your use of the product features (your "documented instructions").
• You will not submit data that you are not entitled to share, and you will use the services in line with our Acceptable Use Policy.

4. Our obligations as Processor

We will:

• Process personal data only on your documented instructions, unless required to do otherwise by law (in which case we will inform you before processing, unless the law prohibits this).
• Ensure that all personnel authorised to process personal data are bound by confidentiality obligations.
• Implement appropriate technical and organisational security measures as described in Section 6.
• Not sell your personal data, and not use it to train AI models or for any purpose other than providing the services.
• Assist you, taking into account the nature of the processing, in responding to data subject rights requests (access, rectification, erasure, restriction, portability and objection). If a data subject contacts us directly about data we process for you, we will refer them to you without undue delay.
• Assist you with your obligations regarding security, breach notification, data protection impact assessments (DPIAs) and prior consultation with the ICO, taking into account the information available to us.
• Notify you without undue delay after becoming aware of a personal data breach affecting your data, providing sufficient information to allow you to meet your own notification obligations.
• Maintain records of our processing activities as required by Article 30.

5. Sub-processors

You give us general written authorisation to engage the following sub-processors, each bound by a written agreement imposing data protection obligations no less protective than this DPA:

• Anthropic (United States) — AI model processing to generate assistant responses. Conversation content is processed under Anthropic's commercial terms and is not used to train their models.
• Supabase (cloud infrastructure) — database, authentication and account storage.
• Stripe (United States/Ireland) — payment processing. For payment card data, Stripe acts as an independent controller under its own terms.
• Netlify (United States) — website and application hosting, including serverless functions that relay AI requests.

We will give you at least 14 days' notice (by email or a prominent notice on this page) before adding or replacing a sub-processor. If you reasonably object on data protection grounds and we cannot offer a workable alternative, you may terminate the affected services and receive a pro-rata refund of any prepaid fees for the remaining term. We remain liable to you for the performance of our sub-processors.

6. Security measures

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, we implement measures including:

• Encryption in transit — all data is transmitted over HTTPS/TLS; data is stored encrypted at rest by our providers.
• Access control — access to production systems is limited to authorised personnel, protected by strong credentials and multi-factor authentication where supported.
• Tenant isolation — one customer's data, uploads and conversations are never visible to another customer.
• Data minimisation — we collect only what is needed to run the services and delete what we no longer need.
• Provider assurance — we use reputable providers (listed in Section 5) that maintain their own certified security programmes.

7. International transfers

Personal data may be transferred to and processed in the United Kingdom, the European Economic Area and the United States, where our sub-processors operate. Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place — including the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, or an adequacy decision (such as the UK–US Data Bridge / EU–US Data Privacy Framework where the recipient is certified).

8. Audits and information

We will make available to you the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. In the first instance we satisfy this through written responses, summaries of our security measures and our sub-processors' audit reports and certifications. On-site audits require at least 30 days' written notice, must not occur more than once per 12-month period (except following a personal data breach), and are at your cost.

9. Confidentiality

In addition to this DPA, the commercial confidentiality commitments in our Data Privacy & Confidentiality Policy apply to all business customers — including our commitment not to disclose your tactical, commercial or strategic information and not to reference your organisation in marketing without written permission. For organisations that require a separate signed agreement or NDA, contact business@dgmaisports.com.

10. Return and deletion of data

On termination or expiry of your subscription, we will, at your choice, return or delete the personal data we process on your behalf within 30 days, unless UK law requires us to retain it (e.g. accounting records). Chats saved locally on your devices remain under your control at all times. Deletion requests can be sent to business@dgmaisports.com.

11. Liability and order of precedence

Each party's liability under this DPA is subject to the limitations and exclusions of liability in our Terms of Service. Nothing in this DPA limits either party's liability where it cannot lawfully be limited. If there is a conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA prevails.

12. Term, changes and governing law

This DPA applies for as long as we process personal data on your behalf. We may update this DPA from time to time to reflect changes in law or our services; the effective date above shows the latest version, and material changes will be communicated by email or a prominent notice on our website. This DPA is governed by the laws of Northern Ireland, and the courts of Northern Ireland have exclusive jurisdiction, in line with our Terms of Service.

13. Contact

Data processing enquiries: business@dgmaisports.com

Supervisory authority (UK): Information Commissioner's Office — ico.org.uk

D G MCCLEAN LTD · Company No. NI726037 · Registered in Northern Ireland, United Kingdom