Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between:

DigitalOne Software Ltd, a company registered in England and Wales under company number 17429558 ("SailOne" or "Processor"); and

the club, association or other organisation subscribing to the SailOne Service ("Customer" or "Controller").

This DPA applies where SailOne processes Personal Data on behalf of the Customer in connection with the Service.

1. Definitions

In this DPA:

"Data Protection Legislation" means applicable UK data protection and privacy legislation, including the UK GDPR and Data Protection Act 2018, as amended from time to time.

"UK GDPR" means the UK General Data Protection Regulation as it forms part of UK law, as amended from time to time.

"Personal Data", "Data Subject", "Processing", "Controller", "Processor", "Personal Data Breach" and "Special Category Data" have the meanings given in applicable Data Protection Legislation.

"Sub-processor" means a third party appointed by SailOne to process Personal Data on behalf of the Customer.

"Customer Data" has the meaning given in the Terms of Service.

2. Roles of the Parties

The Customer is the Controller of Personal Data processed through the Service for the Customer's own purposes, including member, applicant, event, racing, qualification, booking, boat, duty and related club administration.

SailOne is the Processor of that Personal Data.

The Customer determines the purposes and means of processing and is responsible for ensuring that its processing is lawful and transparent.

SailOne may independently act as a Controller for Personal Data it processes for its own purposes, including account administration, billing, security, support, fraud prevention and legal compliance. Such processing is outside the scope of SailOne's role as Processor and is covered by SailOne's Privacy Policy.

For payments taken from the Customer's own members, the Customer connects its own Stripe account using Stripe Connect. Stripe acts as an independent Controller (and, under Stripe's own terms, as the Customer's processor) for cardholder and payment-method data. That data is entered directly into Stripe and is not transmitted through or stored by SailOne. SailOne processes only payment references and status metadata, such as amounts, order identifiers, success or failure status and payout references, as Processor on the Customer's behalf.

3. Subject Matter, Duration and Purpose

The subject matter of the processing is the provision of the SailOne Service.

The duration of processing is the period during which SailOne provides the Service and any subsequent period during which Personal Data is retained in accordance with the Customer's documented instructions, this DPA, the Terms of Service or applicable law.

The Processor may process Personal Data for purposes including:

• Storing and managing club records
• Processing membership applications and renewals
• Managing membership status
• Managing boats and boat spaces
• Managing events and event participation
• Managing racing entries and results
• Recording qualifications and certifications
• Managing duties and volunteer rosters
• Managing facility and resource bookings
• Processing payment references and status metadata through integrated payment services (see Section 2 regarding card data)
• Sending transactional communications
• Providing website and form functionality
• Generating reports and exports
• Providing support
• Maintaining backups
• Maintaining security and availability
• Otherwise providing and maintaining the Service

4. Documented Instructions

SailOne will process Personal Data only:

• On the Customer's documented instructions
• As necessary to provide the Service in accordance with the Terms of Service
• As otherwise instructed by the Customer in writing or through the Service
• Where required to do so by applicable law

If SailOne reasonably believes that an instruction infringes applicable Data Protection Legislation, it will inform the Customer unless prohibited by law.

5. Categories of Data Subjects

Personal Data may relate to:

• Current and former club members
• Prospective members and applicants
• Parents or guardians
• Event participants
• Race competitors
• Volunteers
• Duty-roster participants
• Boat owners and users
• Facility users
• Guests and visitors
• Emergency contacts
• Club administrators and authorised users
• Other individuals whose information the Customer chooses to process through the Service

6. Categories of Personal Data

Depending on the features used by the Customer, Personal Data may include:

• Names
• Postal addresses
• Email addresses
• Telephone numbers
• Dates of birth or age information where collected
• Membership and application information
• Membership type, status and dates
• Payment references and transaction records (amounts, dates, order identifiers and payment status; not full card details)
• Boat and boat-space information
• Event participation
• Race entries and results
• Qualifications, certifications and expiry dates
• Duty and volunteer assignments
• Facility and resource bookings
• Communications and preferences
• Emergency contact information
• Account and authentication information
• Other information submitted by or on behalf of the Customer

7. Special Category Data

The Customer must not instruct SailOne to process Special Category Data unless the Customer has identified an appropriate lawful basis and Article 9 condition, where required, and has provided any necessary privacy information.

Where the Service permits free-text or other fields capable of containing Special Category Data, the Customer remains responsible for determining whether and how such information should be collected and used.

SailOne will apply the security and processing obligations in this DPA to Personal Data, including Special Category Data where it is lawfully instructed to process it.

8. Processor Obligations

8.1 Confidentiality

SailOne will ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations.

8.2 Security

SailOne will implement appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures may include:

• Encryption in transit and at rest
• Access controls and authentication
• Least-privilege access
• Logging and monitoring
• Backup and recovery measures
• Security testing and reviews
• Vulnerability management
• Incident response procedures

8.3 Assistance with Data Subject Rights

Taking into account the nature of the processing, SailOne will reasonably assist the Customer with requests concerning Data Subject rights, including access, rectification, erasure, restriction, objection and data portability, where applicable.

SailOne will not normally respond to a Data Subject request as Controller where the request relates to Customer Data processed by SailOne as Processor. The Customer remains responsible for determining how such requests should be handled.

8.4 Assistance with Compliance

Taking into account the nature of the processing and information available to SailOne, SailOne will reasonably assist the Customer with obligations relating to:

• Security of processing
• Personal Data Breaches
• Data protection impact assessments
• Consultation with the ICO or another supervisory authority where required

8.5 Personal Data Breaches

SailOne will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA.

Where available, the notification will include information reasonably necessary for the Customer to assess and respond to the incident.

The Customer remains responsible for determining whether notification to the ICO or affected Data Subjects is required.

8.6 Records and Compliance Information

SailOne will make available information reasonably necessary to demonstrate compliance with the obligations applicable to processors under this DPA and Data Protection Legislation.

9. Sub-processors

The Customer generally authorises SailOne to use the Sub-processors listed in Schedule 3.

SailOne may appoint or replace Sub-processors provided that:

• The Sub-processor is subject to written data protection obligations appropriate to the processing
• SailOne remains responsible for the Sub-processor's performance of those obligations to the extent required by applicable law
• SailOne provides the Customer with reasonable prior notice of material changes to the Sub-processor list

The Customer may object to the appointment of a new Sub-processor on reasonable data protection grounds by notifying SailOne within 14 days of receiving notice.

If the parties cannot resolve a reasonable objection, SailOne may, where commercially and technically practicable, provide an alternative solution or allow the Customer to terminate the affected Service.

10. International Transfers

SailOne will not transfer Personal Data outside the UK except where an appropriate transfer mechanism under applicable Data Protection Legislation is available.

Depending on the recipient and circumstances, this may include:

• A UK adequacy regulation or data bridge
• The UK International Data Transfer Agreement
• The UK Addendum to the EU Standard Contractual Clauses
• Another lawful transfer mechanism

Where a US-based Sub-processor participates in the UK Extension to the EU-US Data Privacy Framework, SailOne may rely on that mechanism where applicable.

11. Return and Deletion of Personal Data

Following termination of the Service, SailOne will, at the Customer's choice, delete or return Customer Data processed as Processor, subject to:

• The Customer's ability to export its data using functionality made available by SailOne
• Legal obligations requiring retention
• Information that SailOne processes independently as Controller
• Routine backup systems

Personal Data remaining in routine backups will be deleted or overwritten in accordance with SailOne's normal backup lifecycle and will not be restored or otherwise processed except where necessary for disaster recovery, security or legal purposes.

12. Audits

The Customer may request information reasonably necessary to demonstrate SailOne's compliance with this DPA.

Where the information provided is insufficient to satisfy a reasonable compliance concern, the Customer may conduct, or appoint an independent auditor to conduct, an audit of relevant processing activities, subject to:

• Reasonable prior written notice
• Reasonable frequency
• Normal business hours
• Confidentiality obligations
• Reasonable security requirements
• No unreasonable disruption to SailOne's operations
• The Customer bearing its own audit costs

Where reasonably available, SailOne may satisfy audit requests through security documentation, questionnaires, certifications, independent audit reports or other relevant information.

13. Customer Responsibilities

The Customer shall:

• Comply with applicable Data Protection Legislation
• Establish an appropriate lawful basis for processing
• Provide appropriate privacy information to Data Subjects
• Ensure its instructions to SailOne are lawful
• Determine the purposes and means of processing
• Ensure that Personal Data provided to SailOne is accurate and appropriate
• Respond to Data Subject requests
• Comply with applicable requirements concerning Special Category Data and children's data

14. Children and Minors

The Service may be used by clubs whose membership includes children or young people.

The Customer is responsible for ensuring that its collection and use of children's Personal Data complies with applicable law and that appropriate privacy information and safeguards are provided.

15. Liability

The liability of each party under this DPA is subject to the liability provisions in the Terms of Service, except to the extent otherwise expressly agreed in writing.

Nothing in this DPA excludes or limits liability that cannot lawfully be excluded or limited.

16. Conflict with the Terms of Service

If there is a conflict between this DPA and the Terms of Service concerning the processing of Personal Data by SailOne as Processor, this DPA will prevail to the extent of that conflict.

17. Governing Law

This DPA is governed by the laws of England and Wales.

The courts of England and Wales will have exclusive jurisdiction over disputes arising under this DPA, subject to any mandatory jurisdiction that cannot lawfully be excluded.

Schedule 1 — Details of Processing

Subject Matter

Processing Personal Data through the SailOne platform to provide club management and associated services.

Duration

For the duration of the Customer's subscription and for any subsequent period permitted by this DPA, the Terms of Service or applicable law.

Nature of Processing

Processing may include:

• Collection
• Recording
• Organisation
• Storage
• Retrieval
• Consultation
• Use
• Transmission
• Reporting
• Export
• Deletion
• Other processing necessary to provide the Service

Purposes

The purposes are those described in Section 3 of this DPA and the features enabled by the Customer.

Data Subjects

The categories listed in Section 5.

Personal Data

The categories listed in Section 6. Full payment-card details are not in scope: for member payments these are entered directly into Stripe under Stripe Connect (see Section 2), and SailOne processes only payment references and status metadata.

Special Category Data

Potentially, where lawfully instructed by the Customer, subject to Section 7.

Schedule 2 — Technical and Organisational Measures

This schedule describes the measures SailOne has in place today. It will be updated as the underlying implementation changes.

Access control

• Role-based access control across the platform, with defined permission keys covering member data, financial data and administrative functions
• Club data is logically separated per tenant (subdomain-based multi-tenancy), with server-side scoping to the current club on every request
• Two-factor authentication is available to accounts, using time-based one-time passcodes with recovery codes and optional trusted devices
• Least-privilege principles applied to administrative and infrastructure access

Encryption

• All traffic to the Service is served over HTTPS/TLS; secure session cookies are enforced
• Data at rest (database and file/object storage) is encrypted using the hosting providers' managed encryption
• Two-factor authentication secrets and recovery codes are additionally encrypted at the application level

Logging and monitoring

• Record-level activity (creates, updates and deletes on club-scoped records) is written to a per-club audit trail
• Application and platform logs are captured through the hosting platform; security and technical logs are retained for up to 12 months
• Application errors and performance metrics are captured through a third-party monitoring service (see Schedule 3); error context can incidentally contain Personal Data

Backups and recovery

• Production database backups run automatically on a managed daily schedule
• Documented incident response procedures cover detection, containment, notification and recovery

Authentication security

• Login attempts are rate-limited to reduce brute-force risk
• Standard password-reset and email-verification flows are in place

Organisational measures

• Personnel with access to production systems are subject to confidentiality obligations
• Changes are deployed through an automated build and deployment pipeline
• No formal external penetration test has been carried out to date

Schedule 3 — Sub-processors

This is the current list of Sub-processors. It is kept in sync with the services the platform actually uses and may be updated in accordance with Section 9.