CourtFlow

Data Processing Agreement (DPA)

Last updated: 3/14/2026

DATA PROCESSING AGREEMENT (DPA)

  1. Scope and Roles This DPA applies to the processing of personal data by Court Flow ("Processor") on behalf of the Club ("Controller").

  2. Subject Matter and Duration The subject matter is the management of club logistics. The duration of processing is for the length of the Service provision.

  3. Processor Obligations The Processor shall:

  • Process personal data only on documented instructions from the Controller.
  • Ensure that persons authorized to process the personal data have committed themselves to confidentiality.
  • Implement appropriate technical and organizational measures (HTTPS, Row-Level Security via Supabase, Environment Variable protection) to ensure a level of security appropriate to the risk.
  1. Sub-processors The Controller grants a general authorization for the use of sub-processors. The current sub-processors are:
  • Vercel Inc. (Cloud Infrastructure & Hosting)
  • Supabase Inc. (Database, Authentication & Storage)

  1. Data Subject Rights Processor shall assist the Controller in fulfilling its obligations to respond to requests for exercising data subject rights (e.g., access, erasure).

  2. Data Breach Notification Processor shall notify the Controller without undue delay after becoming aware of a personal data breach.

  3. Deletion or Return Upon termination, the Processor shall delete all personal data within 30 days unless required by law to retain it.