Data processing agreement (DPA)

1. Subject matter and duration

klubfish processes personal data on behalf of the Verein, to the extent the Verein uses klubfish to run the club (Art. 28 GDPR). The agreement applies as long as the Verein exists in klubfish and ends when the Verein is deleted or stops using klubfish.

Not covered by this agreement is what each member does as a klubfish user in their own right: their own logbook, their own catches, photos and visibility settings. klubfish itself is the controller for that; the privacy policy applies.

2. Nature and purpose of the processing

Storing, showing, evaluating, exporting and deleting data to run the Verein in klubfish: member list and joining, roles and titles, fee overview, events and competitions, announcements, rules and waters, and evaluations of the catches shared with the Verein (catch list, annual catch report, records, rankings).

3. Types of data and data subjects

The data subjects are the Verein's members and people who ask to join. The data processed:

• member list: display name, initials, profile photo, date joined, join requests,
• roles and titles (admin, member, founder, board),
• fee status (paid or open; no money moves through klubfish),
• replies to events and competition results, announcements read,
• catches members share with the Verein, in the catch list and annual catch report, with location at most at the level the member allows,
• exports created by the Verein's admins.

No special categories of data (Art. 9 GDPR) are processed.

4. Instructions

klubfish processes the data only on the Verein's documented instructions. The instructions are this agreement and the settings and actions the Verein's admins carry out in the app. If klubfish believes an instruction is unlawful, it tells the Verein without delay.

The Verein is responsible for processing its members' data in klubfish lawfully and informs its members about it.

5. Confidentiality

At klubfish only the provider has access to the data, and only as far as needed for operation, security or a request from the Verein. Anyone else given access is bound to confidentiality beforehand.

6. Technical and organisational measures

klubfish takes measures including these (Art. 32 GDPR):

• database and files in a data centre in Frankfurt am Main (EU),
• transfer only encrypted (HTTPS with HSTS); encryption of stored data by the hosting provider,
• access rules in the database (row level security) for every table: the server decides who sees what, never the app; every rule is covered by automated tests,
• privacy by default: new fields start private, the location belongs to the member, a Verein can only narrow spots further, never widen them,
• photos only through links that expire; capture data (EXIF, GPS) is removed before storage,
• password-less sign-in with a one-time code by e-mail; limits on requests and join attempts,
• no advertising, no tracking, no analytics tools; backups by the hosting provider.

klubfish may develop the measures further as long as the level of protection does not drop.

7. Sub-processors

The Verein agrees to these sub-processors:

• Supabase Inc. (USA): database, sign-in, file storage, server functions; data in Frankfurt am Main (EU),
• Vercel Inc. (USA): hosting of the app,
• Resend (USA): sending e-mails,
• OpenStreetMap Foundation (United Kingdom): map tiles and place search,
• Open-Meteo (Switzerland): weather data, only with a position rounded to about 5 km.

Transfers to the USA are safeguarded by the EU Standard Contractual Clauses and, where the provider is certified, by the EU-U.S. Data Privacy Framework. klubfish announces a new or different sub-processor in the app at least 30 days in advance; the Verein can object on important data protection grounds and stop using klubfish.

8. Assisting the Verein

klubfish helps the Verein answer members' requests about their rights (access, rectification, erasure, restriction, portability, objection). Admins can do much of this directly in the app (remove members, change roles, export the catch list); members can download and delete their own data themselves. If a member sends klubfish a request that concerns the Verein, klubfish forwards it to the Verein.

klubfish also assists the Verein with security, notifying personal data breaches and, if needed, a data protection impact assessment, as far as klubfish has the information for it.

9. Personal data breaches

If klubfish becomes aware of a personal data breach affecting the Verein, klubfish informs the Verein without undue delay, where possible within 48 hours, by e-mail to its admins or in the app: what happened, which data and people are affected, the likely consequences and what klubfish is doing about it.

10. Deletion and return at the end

Before the end the Verein can export its data (catch list, reports). When an admin deletes the Verein, the Verein's data is deleted: memberships, roles, fee status, events, announcements, rules, waters and join codes. The catches stay with the members who logged them, because they belong to their own logbook. The hosting provider's backups are overwritten after a short time.

11. Evidence and audits

On request klubfish gives the Verein the information needed to show compliance with this agreement. On-site audits are possible by arrangement with reasonable notice, as a rule at most once a year and at the Verein's cost; written information comes first.

12. Final provisions

Dutch law applies. Where they conflict, this agreement takes precedence over the terms of use as far as processing on behalf of the Verein is concerned. klubfish announces changes in the app beforehand; for significant changes an admin accepts the agreement again.