1. Roles and scope
The Club determines why swimmer information is collected and how it is used for club administration, training, attendance, testing, competition and swimmer-development purposes. For that Club information, the Club is the controller and AthlyraX acts as its processor.
AthlyraX remains a controller for its own business information, including coach account administration, service security, billing, support correspondence and legal compliance.
2. Processing details
Subject matter: provision, hosting, maintenance, support and security of the AthlyraX coaching and swimmer-management platform.
Duration: for the period the Club account remains active, followed by the return, deletion or protected backup-retention period described below.
Nature and purpose: storing, organising, displaying, calculating, backing up and securely transmitting information entered by authorised Club users so the Club can manage squads, attendance, training, tests, competitions and development records.
Data subjects: child and adult swimmers, Club coaches, administrators and other authorised Club personnel.
Personal data: names, full dates of birth, gender, squad and membership identifiers, attendance, training records, test and competition results, performance information, coach observations and account/audit information.
AthlyraX is not intended for medical records or other special-category information. The Club must not upload health, medical, disability or similarly sensitive information unless AthlyraX has expressly enabled that processing and the Club has established the additional lawful basis and safeguards required.
3. Documented instructions
AthlyraX will process Club personal data only on the Club's documented instructions, including the instructions represented by the Club's use and configuration of the platform, unless UK law requires otherwise. AthlyraX will inform the Club before processing required by law unless the law prohibits that notification.
AthlyraX will notify the Club when it reasonably believes an instruction infringes applicable data-protection law and may pause the affected processing while the matter is resolved.
4. Confidentiality
People authorised by AthlyraX to process Club personal data are subject to confidentiality obligations and may access the information only where needed to operate, secure, maintain or support the service.
5. Security
AthlyraX will maintain appropriate technical and organisational measures proportionate to the processing. These include authenticated access, role controls, separate tenant storage for different Clubs or teams, restricted production administration, security logging, controlled backups, rate limiting, secure session controls and procedures for maintaining and restoring service data.
The Club is responsible for selecting authorised users, protecting account credentials, promptly removing access that is no longer required and ensuring users only access information needed for their duties.
6. Sub-processors
The Club gives general written authorisation for AthlyraX to use sub-processors required to provide the service. Current categories include application and persistent-storage hosting, frontend delivery, transactional email and essential technical support services. Current principal providers may include Render, Netlify and the configured transactional-email provider.
AthlyraX will require sub-processors to protect the information through written terms materially consistent with this DPA and remains responsible for their processing obligations. AthlyraX will provide reasonable notice of a material new sub-processor, allowing the Club to raise a reasonable data-protection objection before the change takes effect.
7. International transfers
AthlyraX will not make a restricted transfer of Club personal data outside the United Kingdom without an applicable lawful transfer mechanism and appropriate safeguards. The Club authorises transfers necessarily made by approved sub-processors under those safeguards.
8. Individual rights
Taking account of the nature of the processing, AthlyraX will provide reasonable technical and organisational assistance so the Club can respond to requests for access, correction, deletion, restriction, portability or objection. AthlyraX will send a request received directly from a Club swimmer or parent to the Club unless legally required to respond itself.
9. Security incidents
AthlyraX will notify the Club without undue delay after becoming aware of a personal-data breach affecting that Club's information. The notification will provide available information about the nature of the incident, likely consequences, affected information and mitigation, and will be updated as further information becomes available.
10. Compliance assistance
Taking account of the processing and information available to it, AthlyraX will reasonably assist the Club with security obligations, breach assessment and notification, data-protection impact assessments and regulatory consultation where these relate to the AthlyraX service.
11. Return and deletion
At the end of the service, AthlyraX will, at the Club's choice and subject to available product functions, return or delete the Club's personal data unless UK law requires retention. Data remaining in protected backups will be placed beyond ordinary use and removed through the applicable backup-destruction cycle.
12. Information and audits
AthlyraX will make available information reasonably necessary to demonstrate compliance with this DPA. The Club may conduct or appoint an audit where reasonably necessary, subject to appropriate confidentiality, security, scope, timing and cost arrangements and without compromising other customers' information.
13. Club responsibilities
The Club confirms that it has a lawful basis for the information it uploads; has supplied appropriate privacy information to swimmers and, where relevant, parents or guardians; collects only information necessary for stated purposes; keeps information accurate; limits access to authorised personnel; and applies an appropriate retention period.
The Club remains responsible for decisions about full date-of-birth collection, age-group administration, permitted users and responses to individuals exercising their rights.
14. Order of precedence and updates
If this DPA conflicts with general service terms about the processing of Club personal data, this DPA takes priority. AthlyraX may update the DPA to reflect legal, security or service changes. A new version will apply to new registrations and will be presented for acceptance where a material change requires renewed agreement.
15. Contact
Data-protection enquiries: athlyrax@outlook.com
