Dugout Data Processing Agreement

Last updated: 2 September 2026

This Data Processing Agreement (“DPA”) forms part of the Dugout Terms of Service between Pounce & Flow Ltd (“Dugout”, “we”, “us”, “Processor”), company number 17324576, registered office at 128 City Road, London, EC1V 2NX, and the Club using the Service (“Club”, “Controller”). It applies automatically when a Club accepts Dugout's Terms of Service, without any further signature required.

Capitalised terms not defined here have the meaning given in the Terms of Service.

1. Subject matter and duration

Dugout processes personal data on the Club's behalf for the purpose of providing the Service (squad management, match stats, availability tracking, and related features) for as long as the Club maintains an active subscription, plus the retention period set out in Dugout's Privacy Policy following termination.

2. Nature and purpose of processing

Dugout processes personal data solely to:

• Operate Club accounts and Memberships
• Record and display squad, match, and stats data as entered by the Club and its Members
• Send transactional emails (login codes, invites, join-link notifications, availability requests)
• Provide product analytics on an aggregated basis to improve the Service
• Provide customer support

Dugout does not process Club data for its own marketing purposes, and does not sell personal data.

3. Categories of data subjects

• Club Admins
• Coaches and non-playing staff (Memberships without a Player record)
• Players

4. Categories of personal data

• Name and email address
• Role and Membership status
• Squad, match, and performance data (goals, assists, clean sheets, awards, formations)
• Availability responses
• Login and account activity logs

Dugout does not require or knowingly process special category data (for example, health data) as part of the Service.

5. Processor obligations

Dugout will:

• 5.1 Process personal data only on the Club's documented instructions (including as set out in the Terms of Service and this DPA), unless required otherwise by UK law, in which case Dugout will inform the Club before processing, unless prohibited from doing so.
• 5.2 Ensure that anyone authorised to process the data (for example, Dugout employees or contractors) is subject to a duty of confidentiality.
• 5.3 Implement appropriate technical and organisational security measures, including encrypted connections (HTTPS), one-time login codes rather than stored passwords, and role-based access controls.
• 5.4 Not engage a sub-processor without giving the Club general notice of sub-processor changes (see Section 6) and ensuring equivalent data protection obligations are imposed on that sub-processor by contract.
• 5.5 Assist the Club, at the Club's reasonable request and cost, in responding to data subject requests (access, rectification, erasure, restriction, portability, objection) relating to data the Club controls.
• 5.6 Assist the Club with its obligations around security, breach notification, data protection impact assessments, and consultation with the ICO, taking into account the nature of processing and information available to Dugout.
• 5.7 Notify the Club without undue delay after becoming aware of a personal data breach affecting the Club's data, and provide reasonably requested information to help the Club meet its own notification obligations.
• 5.8 At the Club's choice, delete or return all personal data at the end of the Service relationship, except to the extent Dugout is required by law to retain it (see Dugout's Privacy Policy for retention periods).
• 5.9 Make available to the Club information reasonably necessary to demonstrate compliance with this DPA, and allow for audits (including inspections) conducted by the Club or an auditor mandated by the Club, on reasonable notice and subject to reasonable confidentiality and scheduling constraints. Given the scale of the Service, Dugout may reasonably satisfy audit requests by providing documentation (for example, security summaries and a sub-processor list) rather than an on-site audit, unless there is a specific and material reason for further investigation.

6. Sub-processors

The Club provides general authorisation for Dugout to engage the following sub-processors, and any others added in the future:

Dugout will give the Club at least [14 / 30] days' notice (for example, by email or a notice on dugoutapp.com) before adding or replacing a sub-processor that will process the Club's personal data, giving the Club the opportunity to object on reasonable data-protection grounds. If the Club objects and the parties cannot resolve the concern, either party may terminate the affected part of the Service.

7. International transfers

Where a sub-processor is located outside the UK or the European Economic Area, Dugout will ensure an appropriate transfer mechanism is in place, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or reliance on a UK adequacy regulation, before any such transfer takes place.

8. Liability

Liability under this DPA is subject to the limitation of liability set out in the Terms of Service, except where such limitation cannot apply as a matter of law (for example, in respect of a party's own regulatory liability to the ICO or data subjects).

9. Governing law

This DPA is governed by the laws of England and Wales, consistent with the Terms of Service.

10. Contact

For any questions about this DPA, or to exercise the notice/objection rights in Section 6, contact legal@dugoutapp.com.

This document is a starting draft. Before publication, it should be reviewed by a qualified solicitor, and the sub-processor location column (Section 6) should be confirmed directly against each provider's current data processing/sub-processor documentation, since these can change.