Data processing agreement

This is the English translation of the Dutch data processing agreement on selevy.nl/verwerkersovereenkomst.

Version 1.0 · 4 October 2026

Parties

1. The club that uses Selevy, as stated in the confirmation of the sign-up ("controller");
2. tInteractive Media Solutions, based in Heiloo, the Netherlands, Chamber of Commerce (KvK) number 42121582 ("processor").

The parties have entered into an agreement on the use of Selevy. In this context the processor processes personal data on behalf of the controller. In this data processing agreement the parties set out the arrangements on this, as required by Article 28 of the General Data Protection Regulation (GDPR).

Article 1. Definitions

Terms such as personal data, processing, data subject, sub-processor and personal data breach (data breach) have the meaning given to them in the GDPR. Other terms have the meaning given to them in the Selevy terms and conditions.

Article 2. Subject and term

1. The processor only processes personal data in order to provide Selevy, as described in Annex 1.
2. This data processing agreement runs for as long as the agreement on Selevy, and thereafter for as long as the processor still holds personal data of the controller.

Article 3. Instructions

1. The processor only processes the personal data on the documented instructions of the controller. Use of Selevy as intended, including the settings the club chooses in it (such as switching Selevy AI on or off), counts as an instruction.
2. If the processor considers an instruction to infringe the GDPR, the processor reports this immediately.
3. The processor does not process the data for its own purposes. It does not use the data to train AI models and does not sell it.

Article 4. Responsibility of the club

1. The controller determines which data is processed in Selevy and ensures a valid legal basis, including for data of minors and for health data (such as injuries).
2. The controller informs players, parents and staff about the processing in Selevy.

Article 5. Confidentiality

1. The processor keeps the personal data confidential.
2. Only employees of the processor who need it for their work have access to the personal data, for example for support at the club's request or to resolve a fault. They are bound by a duty of confidentiality.

Article 6. Security

1. The processor takes appropriate technical and organisational measures to secure the personal data, taking into account the nature of the data, which includes data of minors and health data. The measures are set out in Annex 2.
2. The processor may change the measures, provided the level of security does not decrease.

Article 7. Sub-processors

1. The controller gives general authorisation for engaging the sub-processors listed in Annex 3.
2. If the processor wishes to engage a new sub-processor or replace one, it gives at least 30 days' notice by email. The controller may object on reasonable grounds within that period. If the parties cannot reach agreement, the controller may terminate the agreement as of the date on which the change takes effect, with a refund of the amount paid in advance for the remaining period.
3. The processor imposes the same obligations on sub-processors as those in this data processing agreement, and remains responsible for their work.

Article 8. Transfers outside the EEA

1. The processor stores the personal data in the Netherlands.
2. A transfer outside the European Economic Area only takes place where the GDPR allows it. This can only happen with Selevy AI, and only if the club switches Selevy AI on. For the AI services in Annex 3 this is based on the standard contractual clauses of the European Commission (Decision 2021/914), which form part of the data processing agreements with those services.
3. With Selevy AI, the processor only sends the data listed in Annex 4 to the AI service. Players are only identified there by a temporary code, created for each request.

Article 9. Rights of data subjects

1. Through Selevy, the controller can view, correct, export and delete data itself.
2. If the processor itself receives a request from a data subject, it forwards it to the controller immediately and does not handle it itself.
3. The processor reasonably assists the controller with requests that cannot be handled through Selevy itself.

Article 10. Data breaches

1. If the processor discovers a data breach affecting the controller's personal data, it reports this without undue delay, and in any event within 48 hours of discovery, to the club's contact person.
2. The report contains, as far as known:
   • the nature of the breach;
   • the data and persons concerned;
   • the likely consequences;
   • the measures the processor has taken or proposes.
3. The controller decides whether the breach is reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and to data subjects. The processor assists with this.
4. The processor records all data breaches.

Article 11. Assistance and audits

1. The processor reasonably assists the controller with a data protection impact assessment (DPIA) and with questions from the Dutch Data Protection Authority.
2. The processor provides the controller with the information needed to demonstrate compliance with this data processing agreement.
3. The controller may, after consultation and at most once a year, have an audit carried out by an independent expert bound by a duty of confidentiality. The costs are borne by the controller, unless the audit reveals a material shortcoming.

Article 12. End: return and deletion

1. After the end of the agreement, the controller's administrators can still log in for 30 days to view their data and export it themselves (read only). Other users and parents then no longer have access.
2. No later than 60 days after the end of the agreement, the processor deletes all personal data of the controller, unless the law requires it to be kept longer. Backups are kept for 3 months; the data therefore also disappears from the backups no later than 3 months after deletion. On request, the processor confirms the deletion.

Article 13. Liability

The provisions of the Selevy terms and conditions apply to the liability of the processor, insofar as the GDPR permits.

Article 14. Final provisions

1. In the event of a conflict concerning personal data, this data processing agreement prevails over the terms and conditions.
2. This data processing agreement is governed by Dutch law.
3. This data processing agreement is also available in Dutch. In the event of differences between the Dutch and the English text, the Dutch text prevails.

---

Annex 1. Processing

Purpose: following and assessing the development of players, selecting teams, sharing information with players and parents, and managing the club's users.

Particular attention:

• data of minors;
• health data (injuries);
• assessments and notes that may be sensitive for data subjects.

Annex 2. Security measures

• Location: servers in a data centre in the Netherlands.
• Connections: always encrypted over https (TLS).
• Storage: sensitive data is stored encrypted; passwords only as an irreversible hash; API keys of AI services encrypted.
• Access for users:
  • roles and permissions per club;
  • optional two-factor authentication or login with Google;
  • a limit on the number of login attempts;
  • sessions expire after a period of inactivity.
• Separation: every club only sees its own data; this is checked on every request.
• Parent portal: access through a personal link that can be used once and expires after 7 days.
• Administration:
  • only authorised employees of the processor have administrative access;
  • administrative actions carried out on behalf of a club are logged.
• Software: security updates are applied in good time; input is validated and database queries are protected against injection.
• Backups: automatically every day, in the Netherlands, with a retention period of 3 months.
• Demo environment: a completely separate installation with its own database, containing only fictional data.
• Selevy AI: only if the club switches it on, and without names or contact details of players (Article 8).

Annex 3. Sub-processors

The AI services do not use the data sent by the processor to train their models. A new sub-processor, such as another AI service, is only added in accordance with Article 7.

Annex 4. Data for Selevy AI

Only if the club switches Selevy AI on, and only for the requested summary or team selection.

Sent to the AI service

• a temporary code per player (created for each request)
• scores per area and criterion, team averages
• match statistics and match ratings
• notes on evaluations and from staff, with names replaced by codes; only the role of the author
• position and age group
• for the team selection only: year of birth, gender (if a team has a rule for it) and "injured: yes/no"

Never sent to the AI service

• names of players, parents, staff and the club
• email addresses, phone numbers, addresses
• full dates of birth
• photos
• details of injuries
• certificates, nationality and extra profile fields

Names in free text are replaced automatically as far as possible. Because this does not always work for nicknames or typing errors, the processor advises users not to use names or other identifying details in notes.