Data processing agreement

1. Parties and roles

This data processing agreement applies between the sports club using NaarDeMatch and Louis De Jaeger, Cornelis De Schepperestraat 36, 9810 Nazareth, company number BE0642719921.

• The club is the controller for the personal data in its environment: supporters, subscribers, members and its own staff. It decides why and how that data is processed.
• NaarDeMatch is the processor. We process that data solely on the club’s instructions and never for our own purposes.

Our privacy policy states the same distinction. For the data we are ourselves the controller of — visitors to our website, club requests and our own commercial communication — that policy applies rather than this agreement.

This agreement forms an integral part of the terms and conditions and adds the obligations of article 28 GDPR to them. Where the two conflict on the processing of personal data, this agreement prevails.

2. Subject matter, duration, nature and purpose

Subject matter and purpose. We process personal data to enable the club to sell and manage tickets and season passes: online sales, payment handling through the club’s Mollie account, ticket delivery by email and in Apple and Google Wallet, access control at the door, exchange and refund, and the invoicing and reporting of those sales.

Nature of the processing. Collecting, recording, storing, consulting, altering, disclosing to sub-processors, exporting and erasing — each time limited to what the service requires.

Duration. This agreement runs for as long as the club uses NaarDeMatch and ends together with the terms and conditions. The provisions on erasure, confidentiality and liability continue to apply afterwards insofar as needed.

3. Categories of data subjects and personal data

Category of data subjects	Personal data
Ticket buyers	Name, email address, order number, tickets bought, payment status and reference, language
Subscribers and season-card holders	Name, email address, pass type, validity period, and a lent card where applicable
Visitors at the door	The moment their ticket was scanned, and whether entry was allowed or refused
Club staff and administrators	Name, email address, role, sign-in details, actions in the audit log
Billing contacts	Name, email address, invoicing address, VAT number

We process no special categories of personal data (article 9 GDPR) and the platform does not ask for any. If the club nevertheless puts such data in free-text fields, that is its own responsibility.

The payment details themselves — card numbers, account numbers — never enter our system. They are processed directly by Mollie, under the agreement between the club and Mollie. We only see the status and the reference of a payment.

The QR code on a ticket contains no personal data: it is a random code that points to a ticket only within the club’s database.

4. Instructions from the controller

We process the personal data solely on documented instructions from the club. This agreement, the terms and conditions, and the club’s use of the platform’s features together constitute those instructions. The club sends any further instructions to info@naardematch.be.

• We do not use the data for our own purposes, never resell it, and do not use it to approach one club’s supporters on behalf of another.
• If Union law or Belgian law requires us to carry out processing the club has not instructed, we say so beforehand, unless that law prohibits such notice.
• If we believe an instruction infringes the GDPR, we tell the club immediately.

5. Confidentiality

Everyone at our end with access to the club’s data is bound to confidentiality, including after the collaboration ends. Access is granted only insofar as it is needed to deliver the service or to handle a specific support request.

6. Security measures

We take appropriate technical and organisational measures (article 32 GDPR). The list below describes what the platform actually does today — not intentions:

• Encrypted transport. All traffic to the platform runs over TLS.
• Encryption at rest of sensitive fields. Ticket tokens and pass tokens are stored encrypted, as are the credentials the club entrusts to us: the Mollie API key, SMTP passwords and the access keys of invoices.
• Role-based access control. The platform has four roles — club administrator, ticket manager, scanner and finance viewer — and each role gives access to exactly what it needs. The club manages those assignments itself.
• Separation per club. Each club has its own environment; data belonging to different clubs is kept apart at every layer.
• Audit log. Actions on sensitive objects are logged with who performed them and when, so what happened can be reconstructed afterwards.
• Hosting in the European Union. The platform and the database run at Scaleway in Paris.

We review these measures periodically and adapt them when the risks or the state of the art call for it. This list may therefore change, as long as the level of protection remains at least equivalent.

The club carries the part of security that is within its own reach: strong and unique passwords, timely withdrawal of access from departed staff, and assigning the narrowest role that fits.

7. Sub-processors

The club gives us general authorisation to engage sub-processors. We impose the same obligations on every sub-processor as in this agreement, and remain liable to the club for their acts.

This is the complete list of sub-processors we work with:

Processor	What for	Where
Brevo (Sendinblue, FR)	Mailings, contact management and the website tracker	EU (France, Germany, Belgium)
Scaleway (FR)	Hosting the platform and the database	EU (Paris)
Scaleway Transactional Email (FR)	Sending our emails	EU (Paris)
Cloudflare (US)	Spam protection on our forms	US, under the EU–US Data Privacy Framework and standard contractual clauses
Mollie (NL)	Payments in clubs’ ticket shops	EU (Netherlands)
European Commission (VIES)	VAT number verification	EU

The payment flow through Mollie additionally runs under the club’s own agreement with Mollie; we only connect the club’s account to its ticket shop.

If we want to add or replace a sub-processor, we give at least 30 days’ notice. If the club raises a reasoned objection, we look for a solution together; if we cannot find one, the club may terminate the agreement as of the date the change takes effect, free of charge.

8. Assisting with data subject rights

Where the club receives a request from a supporter, subscriber or staff member about access, rectification, erasure, restriction, objection or portability, we help it answer within the statutory deadline.

• For most requests the admin’s own features are enough: the club consults, corrects, exports or deletes the data itself.
• Where that is not enough, we help on simple request and at no extra cost, as long as the effort remains proportionate.
• If a data subject approaches us directly, we do not answer the request ourselves: we refer them to the club and notify the club without delay.

9. Assisting with the controller’s obligations

Taking into account the nature of the processing and the information available to us, we assist the club with its obligations under articles 32 to 36 GDPR: the security of processing, the notification of data breaches, and a data protection impact assessment or prior consultation where one proves necessary.

10. Data breaches

If we become aware of a personal data breach affecting the club’s data, we notify the club without undue delay after becoming aware of it, at the contact address we hold for the club — even where not all details are known yet.

The notification contains, insofar as available at that moment:

• the nature of the breach, the categories of data involved and an estimate of the number of data subjects;
• the likely consequences;
• the measures we have taken or propose to address the breach and limit its effects;
• a contact point for further information.

Missing details follow as soon as we have them. The club itself decides whether notification to the Data Protection Authority and to the data subjects is required; we do not make those notifications on its behalf. We supply the information it needs to do so.

11. Audit and information rights

We make available to the club all information needed to demonstrate compliance with article 28 GDPR, and allow for audits.

• We answer an information request within a reasonable period.
• An audit or inspection is announced at least 30 days in advance, takes place during office hours, does not disrupt the service, and is carried out under confidentiality. Absent a specific trigger — a data breach, for instance — one audit per calendar year is reasonable.
• The club bears the cost of an audit it commissions itself, unless that audit reveals a failure on our part.

12. Retention periods during the agreement

We do not keep data longer than the purpose it is processed for requires:

Data	Period
Orders, tickets, season passes and billing data	7 years, the period accounting law requires
Door scans and admission decisions	1 year after the match has taken place
Audit log of actions in the admin	7 years, as part of the accountability obligation

Scan and admission data exist to control access to a single match and to settle a dispute shortly afterwards; they are not accounting records and therefore disappear sooner. The period runs from the date of the match itself, not from the moment of scanning or of purchase.

The club can delete data it no longer wants to keep itself, from the admin. Where its own retention policy requires a shorter period than the ones above, it requests that at info@naardematch.be and we look at what is feasible together. For the data the law requires us to keep — in practice the billing records — we cannot go below what the law allows.

13. Erasure or return after termination

At the end of the agreement the club chooses whether we erase or return the personal data.

• For as long as the environment exists, the club exports its own data from the admin, in CSV format. We provide an export on request where that does not work.
• If the club makes no choice within 30 days of the end of the agreement, we erase the data.
• Where an environment is suspended for non-payment, it is permanently deleted 30 days after that suspension, with an email warning beforehand. The timelines are set out in clause 6 of the terms and conditions.
• We retain only what Union law or Belgian law requires of us, in practice the invoicing records for our accounting obligation. Those stay protected under this agreement for as long as we hold them.
• Backups expire as well: they are overwritten on their own rotation schedule.

14. Transfers outside the European Union

The club’s data is processed within the European Economic Area. Hosting, the database and email sending run at Scaleway in Paris.

The only sub-processor outside the EU is Cloudflare, for the spam protection on our forms. That transfer relies on the EU–US Data Privacy Framework and on the European Commission’s standard contractual clauses. Cloudflare gets no access to the club’s ticket or subscriber data.

If we want to process data elsewhere outside the EEA, the sub-processor procedure in clause 7 applies and we make sure a valid transfer mechanism is in place beforehand.

15. Final provisions

This agreement is governed by Belgian law; the competent courts are the same as in the terms and conditions.

If we adapt this agreement, the date at the top changes and we notify the club by email. The club’s environment lives at https://naardematch.app.

Questions about this data processing agreement? Email info@naardematch.be.