Data processing agreement

Last updated: October 12, 2026

This is a translation for convenience. The Spanish version prevails in case of discrepancy.

This agreement (art. 28(3) of Regulation (EU) 2016/679, GDPR, and art. 33 of Spanish Organic Law 3/2018, LOPDGDD) forms part of the terms of service and is accepted with them. The parties are:

• Controller: the customer (the club, organisation or person holding the account).
• Processor: Tomás Hernández, tax ID 02648307H, Calle Padre Antonio Salelles 7, Oliva, Valencia, owner of HandBrain.

1. Subject matter, duration, nature and purpose

• Subject matter: the personal data the customer enters into HandBrain.
• Processing operations: hosting, recording, consultation, statistics calculation, report generation and export, sending to the AI provider the customer configures (only when it uses those features) and erasure.
• Purpose: solely to provide the service to the customer.
• Duration: that of the account; when it ends, section 10 applies.

2. Types of data and data subjects

• Data:
  • basic identification data (name or nickname, shirt number, position);
  • sports and statistical data (game actions, minutes, line-ups);
  • email of the club's users.
  No special categories of data (health, etc.) are processed, and the customer must not enter them.
• Data subjects: players (including minors), coaching staff and club users, and opposing players identified by shirt number or name.

3. Customer obligations

• Have a legal basis for the processing. For minors, obtain the authorisation of parents or guardians where the law requires it; in Spain, for children under 14 (art. 7 LOPDGDD).
• Inform the data subjects.
• Enter only the data that is necessary.
• Give instructions that comply with the law.
• Handle data subjects' rights.

4. HandBrain's obligations as processor

1. Process the data only on the customer's documented instructions: these terms and the way it uses the application. This includes international transfers. If an instruction seems unlawful, HandBrain will inform the customer immediately.
2. Ensure that the people authorised to process the data are bound by confidentiality.
3. Apply the security measures in section 5 (art. 32 GDPR).
4. Use sub-processors only under the conditions in section 6.
5. Help the customer, as far as possible, to respond to data subjects' requests. If HandBrain receives a request directly, it will pass it on without delay.
6. Help the customer with security, breach notification, impact assessments and prior consultation (arts. 32 to 36 GDPR).
7. Notify the customer of any personal data breach affecting its data without undue delay and within 48 hours of becoming aware of it, with the information available.
8. When the service ends, erase the data as set out in section 10.
9. Make available to the customer the information needed to demonstrate compliance and allow reasonable audits. Audits are requested with 30 days' notice, at most once a year except after a breach, and their cost is borne by the customer.
10. Not disclose the data to third parties, except to authorised sub-processors or where required by law.
11. Keep a record of processing activities as processor (art. 30(2) GDPR).

5. Security measures

• Encrypted communications (HTTPS).
• Passwords stored as hashes (bcrypt).
• Protected session cookies.
• Third-party keys encrypted in the database.
• Logical separation of each customer's data and per-user access control.
• HandBrain staff access limited to what is needed to provide support or handle a customer request.
• Dependency updates and review of changes before release.

6. Sub-processors

The customer gives a general authorisation to use sub-processors. HandBrain will notify any addition or replacement by email at least 15 days in advance. The customer may object on reasonable grounds and, if no agreement is reached, terminate the contract. Each sub-processor is bound by the same data protection obligations. Current sub-processors:

The AI provider (Anthropic, OpenAI or Azure OpenAI) is contracted directly by the customer, with its own key and under its own terms. HandBrain only sends it data when the customer uses those features, on the customer's instructions, and that provider is not a sub-processor of HandBrain.

7. International transfers

Transfers outside the European Economic Area take place only with the safeguards of Chapter V GDPR: an adequacy decision (EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

8. Support access

HandBrain staff access the customer's data only when needed to resolve an incident, handle a request from the customer or comply with a legal obligation, and under a duty of confidentiality.

9. Liability

Each party is liable for its own breaches under art. 82 GDPR, subject to the limits in the terms of service to the extent the law allows.

10. End of the processing

Before closing the account, the customer can export its data (PDF and Excel). When the account is closed, HandBrain erases the data within 30 days at most. Backups held by the hosting provider are deleted in their ordinary cycles. Only data the law requires to be kept is retained, blocked, for the required period.