Data Processing Agreement (Organizers)

This Data Processing Agreement ("DPA") supplements the Organizer Terms between Pistaclub (Pistaclub s.r.o., pending incorporation, "Pistaclub", "Processor") and the event organizer named in the organizer account ("Organizer", "Controller"). It reflects the parties' respective obligations under Regulation (EU) 2016/679 (GDPR) and, where applicable, the UK GDPR and Swiss nFADP.

1. Subject-matter, duration & nature of processing

Subject-matter. Pistaclub processes personal data relating to riders on the Controller's behalf for the sole purpose of enabling the Controller to receive, manage, and communicate with rider registrations for its events.

Duration. Processing continues for the term of the Organizer Terms and ends when the Controller's organizer status is terminated, subject to legally required retention (§9).

Nature and purpose. Collection via the platform's registration flow; storage on Pistaclub's infrastructure; onward disclosure to the Controller via the organizer dashboard and participant-list exports; associated support and troubleshooting.

2. Categories of data subjects & personal data

Data subjects: riders who register for the Controller's events via the platform, and (where the rider chose to include one) the rider's emergency contact.

Categories of personal data:

• Identity: full name, display name, profile photo.
• Contact: email address, phone number (where the rider provided one).
• Rider profile: motorcycle details, riding experience, previous events.
• Booking data: event registered, chosen package, pricing tier, payment status, payment method (card / bank-transfer / free), consent snapshot.
• Registration form answers set by the Controller (varies per event).
• Emergency contact name and phone number (default).
• Special categories (GDPR Art. 9): emergency medical information (blood type, allergies, medications, conditions) — only where the rider gave a specific, per-booking consent at the time of registering for the Controller's event. Absent that per-booking consent, the Controller does not receive this data.

Controller / processor split (rider-facing table). The controller/processor split is set out in the Privacy Policy and is binding as between the parties.

3. Controller instructions

Pistaclub processes rider personal data only on documented instructions from the Controller. The Organizer Terms, the platform configuration the Controller sets in the organizer dashboard (registration form fields, event visibility, chat settings, ticket resale policy), and this DPA together constitute those documented instructions.

If Pistaclub is legally required by EU or Member State law to process rider data beyond those instructions (for example, in response to a lawful court order), we will inform the Controller of that requirement before processing, unless the law prohibits disclosure on important grounds of public interest.

4. Confidentiality

Pistaclub ensures that persons authorised to process rider data are bound by a duty of confidentiality of at least equivalent scope to this DPA.

5. Security measures (Art. 32)

Pistaclub implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data in transit (TLS 1.2+) and at rest on managed cloud storage.
• Role-based access control on the admin plane and organizer dashboard; principle of least privilege.
• Audit-log ledger for administrative access to rider records (visible via the platform's transparency panel).
• Regular backup with tested restoration; point-in-time recovery of the operational database.
• Continuous security monitoring for anomalous read/write patterns.
• Vulnerability scanning and dependency patch cycle.
• Incident-response runbook with a defined severity taxonomy and 72-hour Art. 33 notification pathway.

The full technical control set is available on request to enterprise organizers under NDA. The Controller is responsible for implementing its own equivalent measures in respect of rider data once it has been exported or downloaded from the platform.

6. Sub-processors

The Controller gives its general written authorisation for Pistaclub to engage the sub-processors listed below. We will inform the Controller of any intended additions or replacements at least 30 days in advance through the organizer dashboard; the Controller may object on reasonable data-protection grounds and, in that case, either party may terminate the affected part of the Organizer Terms without penalty.

Pistaclub imposes on every sub-processor written data-protection obligations that provide sufficient guarantees to meet GDPR Art. 28 requirements and remains fully liable to the Controller for the performance of the sub-processor's obligations. The public, always-current list — including data categories reaching each sub-processor and the specific safeguards in place — is on the Sub-processors page.

7. International transfers

Where a sub-processor processes rider data outside the European Economic Area, transfers are covered by the European Commission's Standard Contractual Clauses (Decision 2021/914) or an adequacy decision. Details are available on request.

8. Data subject rights assistance

Where a rider exercises a right under GDPR Art. 15–22 in respect of data held by the Controller, Pistaclub assists the Controller — at the Controller's cost for non-routine requests — by:

• Providing the Controller with copies of the rider's records held on the platform (rider profile export, participant export, chat logs relating to the Controller's events);
• Executing rectifications, erasures, or restrictions on the Controller's instruction within 5 business days;
• Forwarding to the Controller any rider request received directly by Pistaclub that concerns data held by the Controller as its own controller (event-specific registration data, medical information shared per-booking, offline communications).

9. Return & deletion at end of processing

On termination of the Organizer Terms, Pistaclub will, at the Controller's choice made within 30 days:

• Return the Controller's rider records via a final export (CSV / JSON); OR
• Delete the Controller's rider records from the platform.

In either case, Pistaclub may retain data for as long as required by EU or Member State law (accounting: up to 10 years for payment transactions; DSA Art. 15 statement-of-reasons records; hash-chain integrity ledger entries), and such retained data continues to be protected under this DPA.

10. Audit rights

The Controller may audit Pistaclub's compliance with this DPA no more than once every 12 months, or more often after a personal-data breach, subject to reasonable notice, working-hours execution, and protection of Pistaclub's confidential information and other organizers' data. In lieu of an on-site audit, Pistaclub may provide the Controller with an SOC 2 / ISO 27001 report or an equivalent third-party attestation once available. Reasonable audit costs are borne by the Controller.

11. Personal-data breach notification

Pistaclub notifies the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal-data breach that affects rider data processed on the Controller's behalf. The notification will describe the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, measures taken and proposed to address it, and contact points for further information. The Controller is responsible for its own notifications to the supervisory authority (GDPR Art. 33) and to data subjects (Art. 34), unless the parties agree otherwise in writing.

12. Liability

Each party's liability under this DPA is subject to the liability cap in the Organizer Terms (§13), save that neither party's liability for its own gross negligence, wilful misconduct, or death or personal injury caused by it is limited by that cap or by this DPA.

13. General

In case of conflict between this DPA and the Organizer Terms on any matter of personal-data processing, this DPA prevails. This DPA is governed by the laws of the Czech Republic and subject to the jurisdiction of the courts of Prague, aligned with the Organizer Terms §15. Amendments follow the process in Organizer Terms §16.

14. Contact

Data-protection queries: privacy@pistaclub.app
DPO: dpo@pistaclub.app
Legal / contract: legal@pistaclub.app