This Data Processing Agreement (“DPA”) forms part of the Football Studio Terms of Service where Bux Create processes personal data on behalf of a club or organisation using Football Studio.
1. Parties and roles
The club or organisation using Football Studio is the “Controller” for personal data it chooses to enter or upload to its workspace. Bux Create, as operator of Football Studio, is the “Processor” for that data. Each party will comply with its obligations under applicable UK data-protection law.
2. Processing details
Subject matter: operation of the Football Studio club-management, media and graphics service. Duration: for the period the club uses the service and any limited retention period required for secure deletion, backups or law. Nature and purpose: hosting, storing, retrieving, organising, displaying, rendering, backing up, securing and otherwise processing data as needed to provide Football Studio on the Controller’s instructions.
3. Personal data and data subjects
Data subjects may include club users, players, youth players, staff, officials and other individuals whose information the Controller chooses to enter. Personal data may include names, account/contact details, roles, squad numbers, positions, nationality, date of birth, photographs, club-related records and technical/audit data associated with use of the service. The Controller should not upload special-category or other highly sensitive information unless Football Studio has expressly agreed to support that processing.
4. Controller responsibilities
The Controller determines the purposes and lawful basis for its processing; provides required privacy information; ensures personal data supplied to Football Studio is lawful, relevant and limited to what is necessary; gives particular consideration to children and youth players; manages authorised users; and provides documented processing instructions to Football Studio.
5. Documented instructions
Bux Create will process Controller personal data only on documented instructions from the Controller, including the instructions inherent in the Controller’s configuration and use of Football Studio, unless UK law requires otherwise. If legally permitted, we will inform the Controller before processing required by law.
6. Confidentiality
People authorised by Bux Create to process Controller personal data will be subject to an appropriate duty of confidentiality.
7. Security
Bux Create will maintain appropriate technical and organisational measures proportionate to the risk, including access controls, authentication and session protections, separation of club workspaces, appropriate hosting and backup practices, and measures intended to preserve the confidentiality, integrity and availability of the service and its data.
8. Sub-processors
The Controller gives general authorisation for Bux Create to use sub-processors reasonably required to operate Football Studio, such as hosting, email, payment and infrastructure providers. Bux Create will ensure relevant sub-processors are bound by appropriate data-protection obligations. Where required, we will provide reasonable notice of material changes to sub-processors so the Controller can raise legitimate data-protection objections.
9. Individual rights
Taking account of the nature of the processing, Bux Create will provide reasonable assistance to enable the Controller to respond to requests by individuals exercising applicable data-protection rights, including access, rectification, erasure and restriction.
10. Compliance assistance and breaches
Taking account of the nature of processing and information available to us, Bux Create will provide reasonable assistance with the Controller’s obligations relating to security, personal-data breaches, data-protection impact assessments and regulatory consultation where applicable. We will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Controller personal data.
11. Return and deletion
At the end of the service, at the Controller’s choice and where technically available, Bux Create will return or delete Controller personal data and delete remaining copies unless UK law requires storage. Data held in protected backups may remain until the applicable backup cycle expires, provided it is kept protected and is not returned to active use except for legitimate recovery purposes.
12. Information, audits and compliance
Bux Create will make available information reasonably necessary to demonstrate compliance with the processor obligations applicable to this DPA and will allow for and contribute to reasonable audits or inspections required under UK GDPR, subject to reasonable notice, confidentiality, security and measures designed to avoid unnecessary disruption.
13. International transfers
Bux Create will not make a restricted transfer of Controller personal data without an appropriate lawful transfer mechanism or other applicable safeguard where required.
14. Liability and precedence
The liability provisions in the Football Studio Terms of Service apply to this DPA to the extent permitted by law. If this DPA conflicts with the Terms on the processing of Controller personal data, this DPA takes precedence for that issue.
15. Contact
Data-protection enquiries relating to Football Studio can be sent to support@footballstudio.co.uk.