Data Processing Addendum
TABLE OF CONTENTS
Last updated: November, 2026
Between
Sport AI AS
(org. nr. 932 754 843) Madserud Allé 34, 0274 Oslo, Norway (hereinafter "Sport AI")
And
Client
as defined in the relevant order form (hereinafter "Client")
(individually, the "Party" and collectively, the "Parties")
1. Purpose
1. This Data Processing Addendum (the "DPA") forms part of the Master Subscription Agreement (the "MSA") between Sport AI and the customer identified in the applicable Order Form (the "Client", referred to as the "Customer" in the MSA). The MSA, together with each Order Form, this DPA and any other document expressly incorporated by reference, constitutes the "Agreement".
2. The Parties have entered into the Agreement for the provision of the Sport AI services as set out in the Order Form. This DPA, including its appendices, applies to the Processing of Personal Data by the Parties in connection with the provision and receipt of the Services under the Agreement and sets out the Parties' rights and obligations under applicable Data Protection Laws.
3. To provide the Services in accordance with the Agreement, Sport AI processes Personal Data as further described in Appendix 1.
4. Each Party shall comply with its respective obligations under applicable Data Protection Laws with respect to the Processing of Personal Data covered by this DPA.
5. This DPA, including its appendices, constitutes the entire agreement between the Parties with respect to the allocation of their data protection roles and obligations in relation to the Processing of Personal Data under the Agreement and supersedes all prior agreements, understandings and arrangements relating to that subject matter. The licences, permissions and rights of use granted to Sport AI under the Master Subscription Agreement, including Sections 10.2 and 10.3, are preserved, subject to the requirements and safeguards set out in this DPA and applicable Data Protection Laws.
2. Definitions
"Services" means the services provided by Sport AI under the Agreement.
"Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including, where applicable, Regulation (EU) 2016/679 (the General Data Protection Regulation) ("GDPR"), national laws implementing or supplementing the GDPR, the UK GDPR, the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP"), and any amendments or replacements thereof.
Article 4 of the GDPR and the terms defined in the Agreement shall apply to terms not defined in this DPA, unless a different meaning is given within the DPA.
3. Duration of the assignment/notice of termination
1. This DPA shall enter into force upon execution of the Agreement by the Parties and shall remain in force for as long as Sport AI Processes Personal Data in connection with the provision of the Services under the Agreement.
2. The term of this DPA shall be linked to and coextensive with the term of the Agreement. Expiration or termination of the Agreement shall automatically result in the expiration or termination of this DPA, subject to any obligations that survive in accordance with this DPA or applicable Data Protection Laws.
3. Expiration or termination of this DPA shall not relieve either Party of its obligations under applicable Data Protection Laws or any provisions of this DPA which by their nature are intended to survive such expiration or termination.
4. Relationship of the Parties
1. Depending on the relevant Processing activity, Sport AI may act as an independent Controller, a Joint Controller together with the Client, or a Processor acting on behalf of the Client.
2. Sport AI acts as an independent Controller in relation to the Processing of Personal Data for its own purposes, to the extent permitted under applicable Data Protection Laws and in accordance with this DPA and the Agreement, including to: (a) manage its relationship with the Client; (b) administer billing and invoicing; (c) provision, administer and secure access to the Services for its own operational and security purposes, as distinct from administering users and permissions on the Client's instructions; (d) comply with its legal and regulatory obligations; (e) market and provide additional services aimed directly at the end-user; and (f) prepare, process and annotate data, including video recordings and corresponding annotations, and develop, train, test, validate, maintain and improve its AI models, underlying technology, Platform and Services, as contemplated by Sections 10.2 and 10.3 of the Master Subscription Agreement. Such independent Processing is distinct from Processing carried out solely on the Client's behalf under Clause 6, even where it concerns the same underlying data.
3. To the extent the Parties jointly determine the purposes and means of Processing Personal Data in connection with the provision of game-time services to players, the Parties shall act as Joint Controllers and Process such Personal Data in accordance with Clause 5.
4. To the extent Sport AI Processes Personal Data on behalf of the Client in connection with the provision of the Services and the Client determines the purposes and means of such Processing, Sport AI shall act as Processor and the Client shall act as Controller. In such circumstances, Sport AI shall Process Personal Data only on the documented instructions of the Client and in accordance with Clause 6.
5. As between the Parties, the Client grants Sport AI the licences and permissions set out in Sections 10.2 and 10.3 of the MSA, including the perpetual, royalty-free, worldwide, sublicensable licence to use Customer Data for the purposes permitted thereunder, subject to confidentiality and applicable Data Protection Laws. The inclusion of a Processing activity or data category in Appendix 1, or the application of the security measures in Appendix 2, does not restrict those licences or permissions, determine Sport AI's role for any Processing activity, or prevent Sport AI from using anonymised data as permitted under the MSA. Any anonymisation involving Personal Data must comply with this DPA and applicable Data Protection Laws.
6. Where the Client or its Authorised Users disclose Personal Data to Sport AI, the Client shall ensure it is entitled to make that disclosure and permit the uses contemplated by the Agreement and this DPA, including AI model training and service improvement where applicable. The Client shall provide required notices and obtain any rights, permissions and consents for which it is responsible, while Sport AI shall remain responsible for identifying and documenting its own lawful basis and complying with applicable obligations in relation to its independent Controller Processing. The Client's contractual permission does not, by itself, constitute a lawful basis for Processing or consent on behalf of any Data Subject. The licences and permissions in this Clause survive termination or expiry to the extent provided in the Master Subscription Agreement, but do not authorise Processing or retention beyond what applicable Data Protection Laws permit. Sport AI shall carry out its independent Controller Processing in accordance with the applicable privacy policy, including the retention periods and Data Subject rights described therein.
5. Joint Controller Provisions
1. To the extent the Parties act as Joint Controllers pursuant to this DPA, each Party shall:
(i) independently comply with its obligations under applicable Data Protection Laws in respect of the Joint Processing Activities and remain solely responsible for any Processing carried out for its own independent purposes;
(ii) ensure that access to Personal Data is limited to personnel who have a legitimate need to access such Personal Data and who are subject to appropriate confidentiality obligations;
(iii) acknowledge that Sport AI shall have the sole right, at its discretion, to enter into, modify, or terminate any data processing agreements with its data processors in connection with the Joint Processing Activities;
(iv) comply with the requirements of Chapter V GDPR and other applicable Data Protection Laws in respect of any transfer of Personal Data to a third country or international organisation;
(v) promptly notify the other Party of any complaint, request, communication or inquiry received from a Supervisory Authority relating to the Joint Processing Activities and provide reasonable cooperation and assistance as necessary to enable the Parties to comply with their respective obligations under applicable Data Protection Laws;
(vi) reasonably cooperate with the other Party in complying with the Parties' respective obligations under applicable Data Protection Laws; and
(vii) remain responsible for the acts and omissions of its employees, personnel, affiliates and any third parties engaged by it in connection with the Joint Processing Activities.
2. The Parties acknowledge that Sport AI shall act as the primary point of contact for the management and coordination of Personal Data Breaches relating to the Joint Processing Activities. Each Party shall nevertheless remain independently responsible for assessing and complying with its own notification and other obligations under applicable Data Protection Laws.
3. Upon termination of the Agreement, the Parties shall cease the Joint Processing Activities unless continued Processing is required or permitted under applicable law or otherwise agreed between the Parties.
4. As between the Parties, each Party shall be responsible for its own compliance with applicable Data Protection Laws and the allocation of responsibility below and shall bear liability arising from its breach thereof. Nothing in this DPA shall limit any rights of Data Subjects under Article 82 GDPR. As between the Parties, Sport AI's liability under this Clause 5 shall be subject to the limitations of liability set out in the Agreement.
5. Allocation of responsibilities as Joint Controllers:
| No. / Obligation under GDPR | Sport AI | Client |
|---|---|---|
| 1. Article 6: Lawfulness of processing | Responsible for ensuring that it has a valid legal basis for the Personal Data it Processes in connection with the Joint Processing Activities, including where users manually initiate the Service by scanning the relevant QR code. |
Responsible for ensuring that it has a valid legal basis for the Personal Data it Processes in connection with the Joint Processing Activities, including where the club facilitates or initiates the Services on behalf of users, such as during training sessions, coaching activities or events, or where the Services are made available to users through a separate court-booking platform.
|
| 2. Article 13 and 14: Provision of privacy information | Responsible for preparing, maintaining and making available the privacy information applicable to the Joint Processing Activities, including ensuring that such information is accurate, complete, up to date, and easily accessible to Data Subjects through the QR codes displayed at the relevant courts and through the SportAI website. Each Party shall be responsible for complying with its respective transparency obligations towards Data Subjects in relation to the Personal Data Processing activities for which it is responsible under this arrangement and shall provide the other Party with such assistance as may reasonably be required to ensure compliance with applicable transparency requirements under applicable Data Protection Laws. |
The Client shall be responsible for ensuring that the QR codes made available by SportAI are clearly, correctly, and prominently displayed at each court where the Services are offered and remain accessible to Data Subjects at all times. Where courts are booked through a third-party or separate booking platform that includes information about, or facilitates access to, the Services, the Client shall also ensure that clear and easily accessible links to the applicable privacy information are made available through such booking platform (if needed along its own).
|
| 3. Article 26(2): Making available the essence of the Joint Controller arrangement | Responsible for making available the essence of the Joint Controller arrangement through its privacy notice, upon request by the Data Subject, or by other appropriate means in line with what is set out above. |
Responsible for making available the essence of the Joint Controller arrangement through its privacy notice, upon request by the Data Subject, or by other appropriate means in line with what is set out above.
|
| 4. Articles 15-21: Data Subject rights |
Sport AI shall act as the primary point of contact for Data Subjects in relation to the Joint Processing Activities and shall coordinate the Parties' response to Data Subject requests. Sport AI may respond directly to such requests where appropriate and shall keep the Client reasonably informed of any material requests received.
|
The Client shall provide reasonable cooperation, information and assistance as may be required for Sport AI to respond to Data Subject requests relating to the Joint Processing Activities and shall promptly notify Sport AI of any such requests received directly by the Client. The Parties acknowledge that the allocation of responsibilities set out above is intended to facilitate the efficient handling of Data Subject requests. Notwithstanding such allocation, each Party shall remain responsible for complying with its obligations under applicable Data Protection Laws. The Parties further acknowledge that a Data Subject may exercise his or her rights under applicable Data Protection Laws against either Party. |
| 5. Article 32: Security of processing | Responsible for implementing and maintaining appropriate technical and organisational measures, including the measures set out in Appendix 2, in relation to the Joint Processing Activities. |
Responsible for implementing and maintaining appropriate technical and organisational measures, including the measures set out in Appendix 2 to the extent applicable, in relation to the Joint Processing Activities.
|
| 6. Article 33 and 34: Personal Data Breaches |
Shall be responsible for investigating, managing and responding to Personal Data Breaches arising from or relating to the operation of the Services, including Sport AI's systems, platform, infrastructure, personnel and technical environment. Sport AI shall coordinate any actions required in connection with such breaches, including any investigations, mitigation, notifications, measures and communications relating thereto, and the Client shall provide reasonable cooperation, assistance and information as may be reasonably requested by Sport AI.
|
Shall be responsible for investigating, managing and responding to Personal Data Breaches arising from or relating to the Client's systems, premises, booking platform, camera placement, physical security measures, personnel, user access controls or other circumstances within the Client's control. The Client shall notify Sport AI without undue delay upon becoming aware of any such Personal Data Breach and provide all information reasonably required by Sport AI in relation thereto. |
| 7. Article 35: Data Protection Impact Assessments | Shall provide reasonable cooperation and information required for any DPIA relating to the Joint Processing Activities. |
Shall provide reasonable cooperation and information required for any DPIA relating to the Joint Processing Activities.
|
6. The Parties acknowledge that, in accordance with Article 26 GDPR, the allocation of responsibilities set out above reflects their respective roles in relation to the Joint Processing Activities. Nothing in this DPA shall relieve either Party of its obligations under applicable Data Protection Laws or prevent a Data Subject from exercising their rights against either Party where permitted by law.
7. If any competent court, Supervisory Authority or other authority determines that the Parties do not act as Joint Controllers in relation to all or part of the Joint Processing Activities, but instead act as separate and independent Controllers, each Party shall be solely responsible for its own Processing activities and compliance with applicable Data Protection Laws in respect of the Personal Data Processed by or on behalf of that Party. In such circumstances, neither Party shall be responsible or liable for the other Party's Processing activities, purposes of Processing, or compliance with applicable Data Protection Laws.
6. Controller to Processor Provisions
In respect of the Personal Data processed by Sport AI as a Processor acting on behalf of the Client as Controller under this DPA, Client will ensure that:
(a) the Processing of Personal Data is for a specified and explicit purpose and is based on valid legal grounds;
(b) the Data Subjects have received the necessary information concerning the processing of the Personal Data;
(c) the Controller has carried out adequate risk assessments; and
(d) Sport AI at all times has adequate instructions and information to fulfil its obligations under this Section 6 and applicable Data Protection Laws.
In respect of the Personal Data processed by Sport AI as a Processor acting on behalf of the Client as Controller under this DPA, Sport AI will:
(e) process the Personal Data only on the Client's written instructions, which both Parties agree is provided in the Agreement and this DPA, unless required by law to process it differently;
(f) ensure that persons engaged in the Processing of Personal Data are bound by appropriate confidentiality obligations;
(g) comply without undue delay with any lawful request from Client requesting access to, copies of, or the amendment, transfer or deletion of the Personal Data to the extent the same is necessary to allow Client to fulfil its own obligations under the Data Protection Laws, including Client's obligations arising in respect of a request from a data subject;
(h) notify Client without undue delay if it receives any complaint, notice or communication (whether from a data subject, competent supervisory authority or otherwise) relating to the processing, the Personal Data or to either party's compliance with the Data Protection Laws as it relates to this DPA, and provide Client with reasonable co-operation, information and other assistance in relation to any such complaint, notice or communication;
(i) only transfer Personal Data outside of the European Economic Area in accordance with applicable Data Protection Laws and only where an appropriate transfer mechanism or safeguard has been implemented, where required. The Controller agrees that where Sport AI engages a Sub-processor for carrying out specific processing activities on behalf of the Controller, and those processing activities involve a transfer of personal data within the meaning of Chapter V of the GDPR, the Processor and the Sub-processor may ensure compliance with Chapter V of the GDPR by using standard contractual clauses adopted by the European Commission in accordance with Article 46(2) of the GDPR, provided the conditions for the use of those standard contractual clauses are met. The Processor shall also conduct any other required assessments, such as a Transfer Impact Assessment;
(j) inform Client without undue delay and within forty-eight (48) hours after having become aware of a breach if any Personal Data processed under this DPA is lost or destroyed or becomes damaged, corrupted, or unusable or is otherwise subject to unauthorised or unlawful processing including unauthorised or unlawful access or disclosure;
(k) promptly provide Client with full cooperation and assistance in respect of the Personal Data Breach and all reasonable information in the Processor's possession concerning the Personal Data Breach, including the following:
(i) the possible cause and consequences of the Personal Data Breach;
(ii) the categories of Personal Data and the approximate number of data subjects involved; and
(iii) the measures taken by the Processor to mitigate any damage;
(l) inform Client without undue delay if it receives a request from a Data Subject exercising their Data Subject rights and provide Client with reasonable cooperation and assistance in relation to such request;
(m) provide reasonable assistance to the Client in complying with its obligations under Data Protection Laws with respect to security, breach notifications, data protection impact assessments, and consultations with supervisory authorities or regulators;
(n) provide Client with reasonable information necessary to enable Client to monitor the Processor's compliance with the Data Protection Laws and its obligations under this DPA. Sport AI may satisfy Client's right of audit under applicable Data Protection Laws in relation to Personal Data, by providing an audit report not older than eighteen (18) months, prepared by an independent external auditor demonstrating that Sport AI's technical and organisational measures are sufficient and in accordance with an accepted industry audit standard. Sport AI reserves the right to refuse audit requests from an entity that is a competitor of Sport AI.; and
(o) delete or return that Personal Data to Client at the end of the duration of the Processing, and at that time delete or destroy existing copies held as Processor. If return or destruction is impracticable or prohibited by law, rule or regulation, Sport AI shall take measures to block such Personal Data from any further processing as Processor (except to the extent necessary for processing required by law, rule or regulation) and shall continue to appropriately protect the Personal Data remaining in its possession, custody, or control. This obligation does not require deletion of data rendered anonymous so that neither the Client nor any individual can be identified, or of Personal Data separately and lawfully held by Sport AI as an independent Controller in accordance with Clause 4. Any such Personal Data shall remain subject to applicable Data Protection Laws, including applicable retention limits and Data Subject rights; the existence or survival of a contractual licence alone does not justify its retention.
(p) the Client provides a general authorisation for the Processor to engage Sub-processors in connection with the provision of the Services under the Agreement. A list of Sport AI's current Sub-Processors is made available to Client via the following link: https://coach.sportai.com/services, or as otherwise provided to the Client.
(q) the Processor may engage, replace or remove Sub-processors from time to time. The Processor shall inform the Client of any intended changes concerning the addition or replacement of Sub-processors by providing prior notice no less than fifteen (15) days before such change takes effect. The Controller may object to the appointment of a new Sub-processor on reasonable grounds relating to the protection of personal data within such notice period. Upon receiving such objection, the Parties shall discuss the objection in good faith and seek to achieve a commercially reasonable resolution. If the Parties are unable to resolve the objection, the Processor may elect not to appoint the relevant Sub-processor or, to the extent the appointment of the Sub-processor is reasonably necessary for the provision or development of the Services, either Party may terminate the affected Services upon written notice. Discontinuation shall not relieve Client of any fees owed to Sport AI under the Agreement.
(r) the Processor shall conclude an agreement with each Sub-processor imposing on the Sub-processor materially the same level of data protection obligations as those imposed on the Processor under this Data Processing Agreement.
(s) if the Sub-processor fails to fulfil its data protection obligations, the Processor shall remain liable to the Controller for the performance of the Sub-processor's obligations in the same way as if the Processor itself were performing the processing, subject to the same limitation of liability provided herein.
7. Technical and organisational measures
1. Sport AI shall implement and maintain appropriate technical and organisational measures designed to ensure a level of security appropriate to the risks associated with the Processing of Personal Data, including the measures set out in Appendix 2.
2. Sport AI may update or replace the technical and organisational measures described in Appendix 2 from time to time to reflect technological developments, industry standards, operational changes or changes to the Services, provided that any such update or replacement does not result in a material reduction in the overall level of security afforded to the Personal Data.
8. Liability
The liability of each Party arising out of or in connection with this DPA, whether in contract, tort (including negligence), breach of statutory duty or otherwise, shall be subject to the exclusions, limitations and other liability provisions set out in the Agreement, which are incorporated into this DPA by reference and shall apply as if fully set out herein.
9. Final Provisions
1. If any provision of this DPA is held to be invalid, illegal or unenforceable, in whole or in part, the validity and enforceability of the remaining provisions shall not be affected. The Parties shall replace the affected provision with a valid and enforceable provision that most closely reflects the purpose and economic intent of the original provision.
2. In the event of any conflict or inconsistency between this DPA and the Agreement or any other agreement between the Parties, the provisions of this DPA shall prevail to the extent such conflict or inconsistency relates to the Processing of Personal Data.
3. Sport AI may amend this DPA from time to time to the extent reasonably necessary to comply with applicable Data Protection Laws, implement or maintain lawful international transfer mechanisms, or reflect changes to the Services (e.g. in Appendix 1), including changes to the underlying technology, infrastructure, security measures or processing activities. Sport AI shall provide reasonable notice of any material amendments. Any such amendments shall become effective upon the date specified in the notice, unless otherwise required by applicable law.
Appendix 1: Personal data
Personal Data Sport AI and Client processes as Joint Controllers
The Joint Processing Activity
The "Joint Processing Activity" means the limited Processing of Personal Data necessary to: (i) set up, enable and activate the camera functionality required for the provision of the Game-Time Services on the relevant court; (ii) facilitate the booking and access process required for the relevant individual to use the Game-Time Services, including through a booking platform or QR code; (iii) record and process the relevant playing session for the purpose of generating the Game-Time Services in accordance with the commercial arrangement agreed between the Parties; and (iv) deliver the initial highlight, analysis or other Game-Time output to the relevant end-user.
The Parties acknowledge and agree that the Joint Processing Activity is limited to the Processing activities expressly described above. Upon delivery of the initial highlight, analysis or other Game-Time output to the relevant individual, the Joint Processing Activity shall be deemed completed.
For the avoidance of doubt, any Processing carried out thereafter by Sport AI, including the creation or administration of user accounts, implementation of users to its platform, retention, hosting, storage or further use of clips, videos, highlights, recordings, analyses, statistics or other content, the provision of additional products, features or services, customer relationship management, marketing activities, product development, service improvement, or other Processing relating to the Sport AI platform, shall, to the extent carried out for Sport AI's own purposes rather than on the Client's behalf under Clause 6, be carried out by Sport AI as an independent Controller pursuant to its separate relationship with the relevant individual.
The Client acknowledges that the Joint Processing Activity and the Joint Controllership is only a concept for Processing Personal Data under Data Protection Laws, and does not confer upon the Client any ownership rights, access rights, usage rights, control rights or other interest in any user account, clip, video, highlights recording, analysis, statistic or other content made available, generated, retained or otherwise processed by Sport AI. Ownership and contractual access and usage rights in such content are governed by the Agreement, including the Client's rights in Customer Data and its permitted access to the Platform and Outputs. This does not exclude the Processing necessary to generate and deliver the initial Game-Time output from the Joint Processing Activity or affect either Party's obligations under this DPA.
Categories of data subjects
The Personal Data processed concerns the following categories of Data Subjects:
✔ Players participating in sessions, matches, trainings or other activities recorded or analysed through the Services
✔ Coaches, club administrators, trainers and other team personnel participating in or associated with such activities
✔ Individuals who book a court, access a court or scan a QR code in connection with the activation, provision or use of the Services at the relevant court.
Categories of personal data
The Personal Data processed may include:
✔ Video and image recordings of players participating in activities recorded through the Services, and associated player and session data, statistics, highlights, heatmaps and other analysis results to the extent generated and delivered as part of the initial Game-Time output
✔ Booking-related information, including full name, date of birth, email address, telephone number and other information necessary to facilitate the booking and provision of the Game-Time Services
✔ Contact information relating to the individual designated to receive the initial highlight, analysis or other Game-Time output, including full name, email address and telephone number
Sensitive Categories
No sensitive categories of personal data will be Processed.
Duration of processing
The Parties shall Process Personal Data as part of the Joint Processing Activity for as long as necessary to facilitate the Game-Time Services in accordance with the Agreement.
Personal Data Sport AI processes as Processor
Sport AI acts as a Processor where it Processes Personal Data on behalf of the Client and in accordance with the Client's documented instructions in connection with (i) recording, streaming, hosting or similar technical services in relation to matches, training sessions, events or other activities determined by the Client, or (ii) Client's access to and use of the Platform, and if relevant, the Dashboard, which Client and its dedicated Authorised Users may gain access to via the MSA, including to access and manage the Services.
Inclusion of the Platform, Dashboard, Inputs, Outputs or any category of Personal Data in this processor description does not mean that all Processing relating to them is carried out as Processor. Sport AI's separate Processing for its own purposes, including AI model training and service improvement, is governed by Clause 4 and the permissions preserved thereunder, including as agreed in the MSA.
Categories of data subjects
The Personal Data processed concerns the following categories of Data Subjects:
✔ Individuals appearing in recordings, live streams, events, training sessions, matches or other activities recorded, streamed or otherwise made available through the Services on behalf of the Client
✔ Players, coaches, officials, spectators and other individuals captured by the relevant recording or stream
✔ The Client's Authorised Users, including employees, service providers, consultants, coaches, members, players and parents or guardians acting on behalf of minor players, accessing or using the Platform or Dashboard on the Client's behalf, and individuals accessing or viewing content made available through the Services on the Client's behalf, where applicable.
Categories of Personal Data
The Personal Data processed may include:
✔ Video and audio recordings of individuals appearing in the relevant recording or stream
✔ Metadata associated with the recording or stream, including date, time, court, venue and technical identifiers
✔ User identification and contact details, including names and email addresses; account identifiers, roles and access permissions; licence allocations and subscription-related user information; and access, usage and viewing records, to the extent Processed on the Client's behalf to provide or administer the Services
✔ Personal Data contained in booking information, player and session data, communications and other inputs submitted or made available by the Client or its Authorised Users, and in resulting analyses, statistics and other outputs, to the extent Processed on the Client's behalf
Sensitive Categories
No sensitive categories of personal data will be Processed, except where special categories of Personal Data are incidentally captured as part of the recording. This is Controller's responsibility to avoid with the placement of the camera.
Processing operations
The Personal Data may be processed in accordance with the Agreement and the Client's documented instructions for the following purposes:
✔ Facilitating recording, streaming and other content capture services for Platform use on behalf of the Client
✔ Enabling the Client and its designated Authorised Users to access and use the Platform and, where included in the Client's subscription, the Dashboard; implementing the Client's instructions concerning user access, roles and permissions; administering licence allocations; and making usage information available to the Client for its administration of the Services
✔ Capturing, transmitting, hosting and making available live or recorded content
✔ Receiving, organising, analysing, storing, retrieving and managing Personal Data in content and other inputs submitted, uploaded, recorded, streamed or otherwise made available by or on behalf of the Client or its Authorised Users, and generating and making available resulting analyses and other outputs on the Client's behalf
✔ Providing technical support and maintaining the Platform infrastructure necessary to provide the Services
✔ Complying with applicable legal and regulatory requirements
Duration of processing
Sport AI shall Process Personal Data as a Processor for the duration of the Services, in accordance with the Agreement.
Appendix 2: Technical and Organisational Measures
Sport AI has implemented comprehensive organisational and technological measures to ensure the safety of personal data as well as undisturbed operation in an optimal manner.
The following technical and organisational measures have been taken:
a) Admission control:
Measures to prevent unauthorised persons from gaining access to the data processing equipment used to process personal data.
| Implemented | Measure |
|---|---|
| Y | Access control guidelines and regulations |
| Y | Access only for authorised persons (company employees and external persons) |
| Y | External staff is accompanied by Sport AI staff |
b) Access control:
Measures and procedures to prevent unauthorised persons from using the data processing equipment.
| Implemented | Measure |
|---|---|
| Y | Regulation of user authorizations (administration incl. assignment of rights, assignment of special rights, revocation of authorizations, regular reviews). |
| Y | Password policy (secure passwords, regular changes, regular reviews). |
c) Access monitoring:
Measures to ensure that those authorised for data processing can only access the personal data subject to their access authorization.
| Implemented | Measure |
|---|---|
| Y | Control of access authorization (differentiated authorizations via profiles, roles, time limit) |
| Y | Provision of appropriate authentication technologies |
| Y | Security Logs (ex: unsuccessful and successful authentication attempts). |
| Y | Guidelines for the pseudonymization/anonymization of personal data |
d) Transfer control:
Measures to ensure that personal data cannot be read, copied, altered or removed without authorisation during electronic transmission, transport or storage on data carriers.
| Implemented | Measure |
|---|---|
| Y | Guidelines for the exchange of information of all kinds |
| Y | Encryption during data transmission and at rest (network encryption, TLS) |
| Y | Logging during the transmission of data |
| Y | Method for detecting and protecting malware |
| Y | Access Control |
| Y | Controlled destruction of data |
e) Input control:
Measures to ensure authenticated entry of personal data.
| Implemented | Measure |
|---|---|
| Y | Access control |
| Y | Data security policy |
| Y | Process, program and workflow organisation |
f) Order control:
Measures to ensure that personal data is processed within the boundaries and conditions as set out in this DPA
| Implemented | Measure |
|---|---|
| Y | Contract in writing with determination of the data protection agreements |
| Y | Formalised order placement |
| Y | Careful selection of the subcontractor |
| Y | Monitoring the proper execution of the contract |
| Y | Separation of duty |
g) Availability control:
Measures to ensure that personal data is protected against accidental destruction or loss.
| Implemented | Measure |
|---|---|
| Y | Controlled process to ensure business operations |
| Y | Contingency plans |
| Y | Regular back-ups according to a backup plan |
| Y | Protection of systems against database failure, service level agreements with IT service providers |
| Y | Antivirus/Firewall |
| Y | Redundant hardware |
h) Separation control:
Measures to ensure that data collected for different purposes can be processed separately.
| Implemented | Measure |
|---|---|
| Y | Client separation |
| Y | Functional separations |
i) Procedures for periodic review and evaluation
Procedures for regular review, evaluation and evaluation of the effectiveness of technical and organisational measures
| Implemented | Measure |
|---|---|
| Y | Data Protection Management |
| Y | Incident response management |