Data Processing Agreement

1The parties

• Controller: your club ("the Club"), the organisation named in its Reskoo account. The Club decides what member data to record and why.
• Processor: Reskoo. Reskoo is operated by BN3 Consulting Limited, trading as "Reskoo", a company registered in England and Wales (company number 12848799). Reskoo processes the Club's member data on the Club's instructions.

ICO registered: ZC178630 (BN3 Consulting Limited). You can check our entry on the Information Commissioner's Office register. For any data-protection question, contact us at hello@reskoo.app.

This agreement forms part of, and is subject to, the Reskoo Terms of Service. If there is a conflict on data-protection matters, this agreement prevails.

2What this agreement covers

These are the Article 28(3) details of the processing:

• Subject matter. Reskoo's provision of membership-management software to the Club.
• Duration. For as long as the Club has a Reskoo account, plus the wind-down and retention periods in section 8.
• Nature and purpose. Hosting and processing the Club's member records so the Club can take the register, manage members and households, take payment, record awards, manage safeguarding and incidents, equipment, rotas, and communications.
• Type of personal data. Identity and contact details; dates of birth; household and guardian relationships; attendance; awards; consent decisions; payment metadata (amounts in pence and payment-method tokens, not card numbers); and, where the Club chooses to record it, health information and safeguarding records (special-category data).
• Categories of data subject. The Club's members (including children), parents and guardians, emergency contacts, and the Club's own staff and volunteers.

3Reskoo processes only on your instructions

Reskoo processes the Club's personal data only on the Club's documented instructions (including this agreement and the Club's use of the product), unless required by law, in which case Reskoo will tell the Club first unless the law prohibits it. Reskoo does not sell the Club's data and does not use it for Reskoo's own purposes.

4Confidentiality

Reskoo ensures that the people it authorises to process the Club's data are under appropriate confidentiality obligations.

5Security

Reskoo maintains appropriate technical and organisational measures under Article 32, including:

• data held in AWS's London region (eu-west-2); encryption in transit;
• each Club's data isolated from every other Club's, enforced server-side and checked by an automated isolation test suite;
• safeguarding records gated behind a separate, role-independent permission;
• mandatory two-step verification for staff sign-in; passwordless one-time-code sign-in for members;
• audit trails on sensitive records (money, roles, consent, safeguarding);
• card payments handled by Stripe so card numbers never reach Reskoo;
• least-privilege server-side access controls and automated dependency monitoring.

Our public Security and trust page sets these out in more detail.

6Sub-processors

The Club authorises Reskoo to use the sub-processors below. Reskoo imposes data-protection terms on each that are no less protective than this agreement, and remains responsible for their performance.

Reskoo will give the Club reasonable notice, by email to the account Owner, of any intended change (adding or replacing a sub-processor) so the Club can object. International transfers outside the UK are covered by appropriate safeguards (the UK International Data Transfer Agreement or an adequacy decision).

7Helping you with data-subject rights

Taking into account the nature of the processing, Reskoo assists the Club with requests from individuals (access, rectification, erasure, restriction, objection, portability) by providing in-product export and permanent-erasure tools, and reasonable support where those tools do not cover a request.

8Breaches, and help with your obligations

Reskoo assists the Club with its obligations under Articles 32 to 36, and will notify the Club without undue delay after becoming aware of a personal-data breach affecting the Club's data, with the information the Club reasonably needs to meet its own notification duties.

9Return or deletion at the end

On termination, and at the Club's choice, Reskoo will delete or return the Club's personal data. In practice: after account closure, personal data is kept for a 90-day wind-down (so the Club can export and reconcile) and then deleted, except where retention is required by law. Financial and transaction records are retained for 6 years (de-identified where practical) to meet HMRC and accounting obligations. Safeguarding records follow the Club's own retention instructions.

10Records and audits

Reskoo makes available the information reasonably necessary to demonstrate compliance with Article 28, and allows for and contributes to reasonable audits, including inspections, by the Club or an auditor it mandates, on reasonable notice and subject to confidentiality and to not compromising other clubs' security or data.

11Who is responsible for what

The Club is the controller for its member data and decides what to record and why. Reskoo is the controller only for the Club's account and billing data and the identities of the people who administer the account. For those, Reskoo's Privacy Policy applies. Governing law, jurisdiction and notices follow the Reskoo Terms of Service (England and Wales).