Data Processing Addendum

1. Parties and status

The parties are Janis Zarins, operator of MyTeamTravel, and the Customer identified in the applicable Workspace agreement. This DPA applies when validly accepted for that Workspace.

2. Roles

The Customer acts as controller for instructed Club, member and travel operations, and MyTeamTravel acts as processor for that scope. MyTeamTravel may act as an independent controller for account security, abuse prevention, provider administration and legal obligations where it determines those purposes.

3. Subject matter and duration

Processing supports account, Club/team and TravelPlan operation for the term of the service plus agreed return/deletion and legally required retention periods.

4. Purposes and instructions

Instructions arise from the agreement, configured features and authorised Customer actions. MyTeamTravel will process instructed data only to provide, secure and support the service unless law requires otherwise.

5. Data subjects and categories

• Admins, Managers, Coaches, Staff, Players, minors, Parents/Family, drivers, Persons in Charge, invitees and support contacts.
• Identity/contact, memberships/roles/relationships, addresses/locations, TravelPlans/timing, selections/carpools, notes, acknowledgements, notifications, exports, driver access, audit/security and subscription/promo data.

6. Confidentiality

Persons authorised to process Customer data must be bound by appropriate confidentiality and access restrictions.

7. Security measures

• Password hashing and verified-email authentication.
• Role, active-membership, Club/team and subscription checks.
• Server-side provider keys; hashed or signed tokens in security-sensitive flows where implemented.
• Encryption in transit through deployed HTTPS and provider controls.
• Audit records, expiry or revocation checks, provider backups and incident handling.

8. Providers and subprocessors

The current provider list includes Vercel, Supabase/PostgreSQL and Resend. Google Maps Platform is listed separately because its role depends on the feature and processing context. Material provider changes will be communicated through the current Service Providers information where required.

9. International transfers

The primary database project is configured in Zurich, but provider support or subprocessors may process elsewhere. Safeguards and transfer mechanisms apply as required by the processing context and applicable law.

10. Rights assistance

MyTeamTravel will provide reasonable assistance for access, correction, deletion, restriction, portability or objection requests, taking account of processing nature and Customer instructions.

11. Incidents and DPIA assistance

MyTeamTravel will notify the Customer without undue delay after confirming a relevant personal-data breach, provide available facts and assist with legal notifications and DPIA or authority consultation where required by applicable law.

12. Return and deletion

Current Club offboarding uses a 30-day recovery period and soft deletion. Complete self-service export, physical purge and verified backup rotation are not technical guarantees. Additional lawful retention or deletion instructions will be handled according to the applicable Customer agreement and law.

13. Audit and government requests

MyTeamTravel will provide reasonable evidence and audit cooperation subject to confidentiality, security, proportionality and reasonable cost arrangements. Government requests will be assessed and the Customer notified where legally permitted.

14. Liability and precedence

The Customer Terms govern liability and general contractual matters. For conflicts concerning instructed processing of personal data, this DPA governs to the extent necessary for that processing, subject to mandatory law.

Annex — technical and organisational measures

• Access control and least-privilege role scoping.
• Credential hashing, verification, token expiry/revocation and secure server secrets.
• Application logging, incident procedure and provider monitoring.
• Data minimisation in user read models and exports.
• Soft-deletion recovery and protected finalizer, with physical-purge gap recorded.
• Change control, tests and environment separation.