Data Processing Addendum (DPA)This version applies when incorporated into the applicable agreement; earlier agreements retain their accepted version.This Data Processing Addendum (“DPA”) applies where Loqzone processes Personal Data on behalf of a Customer (e.g., a club, athlete organization, or sponsor) as a processor under applicable data protection laws.This DPA forms part of the agreement between the Customer and the relevant Loqzone contracting entity identified before processing begins in the applicable order, checkout or in-product acceptance screen (“Agreement”). If there is any conflict between this DPA and the Agreement, this DPA controls solely to the extent of the conflict for Personal Data processing terms.Previous versions: 2026-08-20
1. Definitions“Controller”, “Processor”, “Personal Data”, “Processing”, “Data Subject”, “Supervisory Authority” have the meanings given in the GDPR (and equivalent terms under applicable laws).“Customer Data” means Personal Data processed by Loqzone on behalf of Customer.
2. RolesFor Customer Data processed by Loqzone on behalf of Customer under Customer’s documented instructions:
- Customer is the Controller; and
- the applicable Loqzone contracting entity is the Processor.
3. Processing Details3.1 Subject matterProvision of the Platform and related services to Customer.3.2 DurationFor the term of the Agreement, plus any period required to return or delete Customer Data in accordance with this DPA.3.3 Nature and purposeHosting, storing, transmitting, and otherwise processing Customer Data to provide Platform features, support, and security.3.4 Categories of Data SubjectsCustomer’s authorized users, staff, representatives, and end users whose data Customer submits or makes available through the Platform.3.5 Types of Personal DataAccount identifiers (email, user ID), profile information, content submitted to the Platform, usage logs, and any other data Customer uploads or generates through use of the Platform.3.6 Customer rights and obligationsCustomer determines the purposes and lawful instructions for Customer Data processed by Loqzone as Processor.Customer is responsible for ensuring that its instructions and its disclosure of Customer Data to Loqzone comply with applicable data-protection law.The applicable Agreement or processing schedule identifies the actual services, data categories, data subjects and any specific instructions before processing begins. This DPA does not authorize unrelated processing or expand the agreed purpose.
4. Processor ObligationsLoqzone will:4.1 Documented instructionsProcess Customer Data only on documented instructions from Customer, including instructions provided through Customer’s use and configuration of the Platform, unless applicable Union or Member State law requires otherwise.Where legally permitted, Loqzone will inform Customer before processing Customer Data pursuant to such a legal requirement.4.2 Unlawful instructionsLoqzone will immediately inform Customer if, in Loqzone’s opinion, a Customer instruction infringes the GDPR or other applicable Union or Member State data-protection law.4.3 ConfidentialityEnsure that persons authorized to process Customer Data are subject to appropriate confidentiality obligations.4.4 SecurityImplement appropriate technical and organizational measures as required by Article 32 GDPR, taking into account the nature and risks of the processing.4.5 Data-subject rightsTaking into account the nature of the processing, assist Customer by appropriate technical and organizational measures, insofar as reasonably possible, with Customer’s obligations to respond to requests by Data Subjects exercising their rights under applicable data-protection law.4.6 Compliance assistanceTaking into account the nature of the processing and information available to Loqzone, reasonably assist Customer with its obligations under Articles 32 to 36 GDPR, including where applicable:
- security of processing;
- Personal Data Breach obligations;
- data protection impact assessments; and
- prior consultation with supervisory authorities.
5. Personal Data BreachesLoqzone will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data.Loqzone will provide reasonably available information necessary to assist Customer with applicable breach-notification obligations.Information may be provided in phases where all relevant information is not immediately available.
6. Sub-ProcessorsCustomer grants Loqzone general written authorization to engage sub-processors where necessary to process Customer Data on Customer’s behalf.Loqzone will maintain a current list of such sub-processors and make it available to Customer on request at privacy@loqzone.com.Loqzone will inform Customer of intended additions or replacements of sub-processors and provide Customer a reasonable opportunity to object on legitimate data-protection grounds.Loqzone will require each sub-processor to protect Customer Data through data-protection obligations consistent with the requirements applicable to Loqzone under this DPA.Loqzone remains responsible for the performance of its sub-processors’ applicable data-protection obligations as required by law.
7. International TransfersWhere Customer Data subject to the GDPR is transferred to a country outside the EEA, Loqzone will ensure that the transfer is made in accordance with applicable data-protection law and Customer’s documented instructions.Where required, Loqzone will establish an applicable lawful transfer mechanism before the transfer, such as an applicable adequacy decision or completed Standard Contractual Clauses with required supplementary measures. A reference to Standard Contractual Clauses in this DPA is not itself their execution; any required modules, annexes and parties must be completed for the actual transfer.
8. SecurityLoqzone will maintain appropriate technical and organizational measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.Such measures will be appropriate to the nature and risk of the relevant processing and may evolve over time.
9. Return and DeletionUpon termination or expiry of the relevant processing services, Loqzone will, at Customer’s choice, delete or return Customer Data and delete remaining copies, unless applicable law requires continued storage.Where immediate deletion from backup systems is not technically practicable, Customer Data may remain in protected backups until overwritten in the ordinary backup cycle and will not be used for ordinary processing purposes.This obligation applies to Customer Data processed by Loqzone as Processor and does not require deletion of Personal Data that Loqzone lawfully processes separately as an independent Controller.
10. Audits and ComplianceLoqzone will make available to Customer information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR.Loqzone will allow for and contribute to reasonable audits or inspections by Customer or an auditor appointed by Customer where necessary to verify compliance.Audits and inspections will be subject to reasonable confidentiality, security, notice, and non-disruption requirements, provided those requirements do not prevent the exercise of rights required by applicable data-protection law.