Data Processing Agreement

1. Introduction and scope

This agreement governs the processing of personal data that ProEvolution Lab carries out on behalf of each club when providing the platform service. It is part of the service contract and is the personal data transmission contract provided for in Colombian rules (Decree 1377 of 2013, compiled in Decree 1074 of 2015).

2. Definitions

• Controller: the club that contracts the service and decides on the processing of the data.
• Processor: ProEvolution Lab, which processes the data on the club's behalf.
• Data subject: the person whose data is processed (club users and athletes).
• Sub-processor: a provider that helps ProEvolution Lab deliver the service and processes data on its behalf.
• Security incident: unauthorized access to, loss, alteration or disclosure of personal data.

3. Roles and instructions

ProEvolution Lab processes data only to provide the service, according to the platform's functions and the settings the club chooses, which are its instructions. It does not use the data for its own purposes, sell it or use it to train artificial intelligence models. If an instruction from the club seems contrary to the law, ProEvolution Lab will tell the club.

4. Confidentiality and security

ProEvolution Lab staff with access to the data are bound by confidentiality and access it only when needed to provide or support the service. Security measures are described in Annex 2.

5. Sub-processors

The club authorizes ProEvolution Lab to use the sub-processors published in Service Providers. ProEvolution Lab requires each of them to meet protection obligations equivalent to this agreement and will notify club administrators at least 30 days before adding a new one. The club may object on reasonable data-protection grounds.

6. Data subject rights and assistance

The platform lets the club view, correct and export data, and request the anonymization or deletion of an athlete. ProEvolution Lab will help the club answer data subjects' requests within the legal timeframes and will forward any it receives directly.

7. Security incidents

If ProEvolution Lab detects an incident affecting the club's data, it will notify the club without undue delay and, at the latest, within 72 hours [PENDING LEGAL REVIEW: confirm the 72-hour deadline] of confirming it, with the available information on what happened, the data affected and the measures taken. ProEvolution Lab will support the club in the reports it must make to the Superintendence of Industry and Commerce and to data subjects.

8. International transfers

Data is stored in São Paulo, Brazil. Sub-processors that process data in other countries do so with adequate protection safeguards; among them, OpenAI, L.L.C. processes the AI assistant's questions in the United States, with names replaced by codes. If the club connects its own AI account, that provider processes the data on its own infrastructure, under the club's contract with that provider. [PENDING LEGAL REVIEW]

9. Retention, return and deletion

While the service is active, ProEvolution Lab keeps the data for the periods in the Privacy Policy. When the service ends, the club can export its data; after a waiting period of 30 days it is deleted, except for the minimal record of the deletion and the change history that must be kept for 2 years. Backups are deleted when they expire.

10. Audits and verification

ProEvolution Lab will make available to the club the information needed to show compliance with this agreement. The club may request a verification with 30 days' notice, at most once a year, except after a security incident.

Annex 1. Details of the processing

A. Data subjects

• Club users: administrators, technical directors, coaches and support staff.
• The club's athletes, including minors.

B. Data processed

• Users: name, e-mail address, role, optional profile photo, preferences and technical security records.
• Athletes: name, date of birth, positions, number, team, physical measurements, background, call-ups, achievements, evaluations, participation, attendance and coaching notes; photo and video only with a recorded authorization.

C. Data requiring special care

Data of athletes who are minors, processed with their legal guardian's authorization and respecting their best interests. The platform is not designed to collect health data: the reason for not playing (for example “injured”) is recorded as availability only, without diagnoses.

D. Nature and purpose

Storage, organization, consultation, statistical analysis and presentation of the club's sports performance data, to support the coaching staff's work.

E. Duration

For as long as the service lasts, plus the deletion periods described in section 9.

Annex 2. Technical and organizational measures

• Encryption in transit (HTTPS) and at rest; additional encryption of notes, free text and credentials.
• Isolation of each club's data enforced in the database.
• Access by role and assigned team; only the Administrator manages users.
• Two-step verification and sign-out after inactivity, configurable by the club.
• An audit log of sensitive actions that cannot be modified.
• Passwords handled by the authentication service, never stored as text.
• Photos in private storage, delivered through temporary access links.
• AI assistant: names replaced by codes before leaving the platform, no passwords, contact details or medical information sent, and misuse attempts recorded.
• Backups managed by the database provider.
• Automated security and isolation tests before every release.

Annex 3. Approved sub-processors

The current list of sub-processors, with their purpose, the data they process and their location, is in Service Providers.

The platform's artificial intelligence provider is OpenAI, L.L.C. (United States): it answers the AI assistant's questions with the statistics the user can see, with athletes' and teams' names replaced by codes. It keeps the traffic for up to 30 days, only for abuse monitoring, and does not use it to train its models. [PENDING LEGAL REVIEW]

Contact

Write to us at privacy@proevolutionlab.com.