Data Processing Addendum

1. Scope and applicability

This Data Processing Addendum (“DPA”) supplements the Touchline360 Terms of Service and applies where Trequa processes Personal Data on behalf of your club, academy, federation, or sports organization (“Customer”) in connection with the Touchline360 platform (including Debrief, Kickoff Pulse cloud sync, and Performance Intelligence).

In respect of such processing, Customer is the Data Controller (or a Processor acting on behalf of a third-party Controller), and Trequa is the Data Processor under Regulation (EU) 2016/679 (“GDPR”), the UK Data Protection Act 2018 (“UK GDPR”), and the California Consumer Privacy Act (“CCPA”).

2. Nature and purpose of processing

Trequa processes Customer data exclusively to provide, maintain, and secure the coaching workspace and performance analytics services requested by Customer. Processing includes:

• Ingestion, transcoding, and frame-accurate playback of match video and training recordings.
• Detection of pitch geometry, ball coordinates, and player bounding boxes to generate spatial tracking and physical load telemetry.
• Storage and indexing of coach findings, tactical annotations, team lineups, and training plan documents.
• Provision of exportable reports, video reels, and coaching debrief packages for authorized staff.

3. Categories of data and data subjects

Data Subjects: Registered team staff, coaches, match analysts, and players appearing in match recordings or squad rosters.

Personal Data Categories: Account identifiers (email, name, organizational role), squad rosters (player names, squad numbers, assigned positions), spatial coordinates (pitch location timestamps, sprint vectors), and audio-visual recordings of sporting events.

Special Categories / Biometrics: Touchline360 does not extract facial biometric templates, emotional profiles, or genetic data. Spatial telemetry is derived from optical tracking of player silhouettes and jersey markings.

4. Controller and Processor obligations

Trequa warrants and agrees that it will:

• Process Personal Data only on documented, lawful instructions from Customer, including regarding transfers of Personal Data outside the EEA or UK, unless required to do so by applicable law.
• Ensure that all personnel authorized to process Customer Personal Data are subject to binding confidentiality agreements or statutory confidentiality duties.
• Never sell, rent, or monetize Customer Personal Data or match footage.
• Never use Customer match footage or coaching records to train machine learning models for third parties without explicit, written opt-in consent under Customer’s governance settings.

5. Technical and Organizational Measures (TOMs)

Trequa implements and maintains robust technical and organizational security controls designed to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data:

• Organization Partitioning: Every database query and API request strictly validates organizational tenant boundaries. No cross-tenant access path exists.
• Encryption: TLS 1.3 encryption for all data in transit across public networks; AES-256 cryptographic encryption for video assets and database records at rest.
• Access Control: Role-based access control (RBAC) enforcing least-privilege principles, with mandatory multi-factor authentication for administrative operations.
• Vulnerability Management: Automated dependency scanning, continuous integration testing, and formal incident response workflows.

6. Sub-processors

Customer provides general authorization for Trequa to engage infrastructure sub-processors to deliver the hosted service. The current list of authorized sub-processors is maintained in our Sub-processors Directory.

Trequa will provide Customer at least thirty (30) days’ prior notice before onboarding any new sub-processor. Customer may object to a new sub-processor on reasonable data protection grounds by notifying us in writing within that notice period.

7. Data subject rights and youth safeguarding

Taking into account the nature of the processing, Trequa provides Customer with administrative tools and API endpoints to assist Customer in fulfilling its obligations to respond to data subjects exercising their rights (access, rectification, erasure, and portability).

Where youth academy players (under 18) are recorded, Customer remains responsible for obtaining parental or guardian recording consents pursuant to league and national governing body rules. See our Safeguarding Policy for operational guidance.

8. Incident management and breach notification

In the event of a confirmed Personal Data Breach impacting Customer data, Trequa will notify Customer without undue delay and, in any event, within 48 hours of becoming aware of the incident. Trequa will provide all reasonable details, impact assessments, and remediation measures taken.

9. International data transfers

Where personal data originating in the European Economic Area (EEA), United Kingdom, or Switzerland is transferred to a country not recognized as offering an adequate level of data protection, the parties agree to abide by the European Commission Standard Contractual Clauses (Module 2: Controller-to-Processor) and the UK International Data Transfer Addendum, which are hereby incorporated into this DPA by reference.

10. Return and deletion of customer data

Upon termination of Customer’s subscription or upon written request, Trequa will provide Customer with thirty (30) days to export match footage and tactical data via standard formats. Following this window, Trequa will securely delete and overwrite all Customer Personal Data from production systems and backups within thirty (30) days, unless retention is required by applicable law.

11. Contact and execution

For questions, DPA countersignatures, or audit requests, please reach our data protection team via our contact form or by writing to dpo@touchline360.com. You can also download our pre-executed printable DPA (PDF) for offline submission.