Data Processing Agreement

Under GDPR, when a club uses VectorPitch to manage data about its players and staff, VectorPitch acts as a data processor on the club's behalf. This agreement sets out what that means in practice and the obligations it creates for both sides.

Last updated: 2026-10-18 · v1.0

Version: 1.0
Effective Date: 2026-10-18
Processor: Vector Sport Solutions Limited
Privacy Contact: privacy@vectorpitch.com
Security Contact: security@vectorpitch.com

Clause

Provision

Section 1 — Status of this Data Processing Agreement

This document forms part of your contract and governs how we handle personal data on your behalf. On data protection matters it takes precedence over the main Terms. It covers only processing we do for you — our own processing is covered by the Privacy Notice.

1.1

This Data Processing Agreement forms part of the Terms of Service Agreement between VectorPitch and the Customer.

1.2

This DPA applies where VectorPitch processes Customer Personal Data as processor on behalf of the Customer.

1.3

If there is a conflict between this DPA and the Terms, this DPA will prevail in respect of the processing of Customer Personal Data.

1.4

This DPA does not apply to processing for which VectorPitch acts as controller or independent controller, including account administration, billing, security, support, website analytics, product analytics, business operations, or model evaluation or improvement carried out by VectorPitch for its own purposes, except to the extent expressly stated otherwise.

1.5

For clarity, this DPA does not itself authorise VectorPitch to process Customer Personal Data for VectorPitch's own controller purposes. Any such processing must be separately described in the Privacy Notice, AI and Model Improvement Notice, applicable Subscription Plan, product notice or other customer-facing notice.

1.6

Capitalised terms not defined in this DPA have the meanings given in the Terms.

Section 2 — Definitions

Terms used throughout, including which data protection laws apply, what counts as your personal data, and what a data subject request or personal data breach means here.

Applicable AI Laws has the meaning given in the Terms.

Applicable Data Protection Laws means all data protection, privacy, electronic communications and similar laws applicable to the processing of Customer Personal Data under this DPA, including, where applicable, the GDPR, the UK GDPR, the Data Protection Act 2018 of Ireland, the UK Data Protection Act 2018, the Privacy and Electronic Communications Regulations, and equivalent laws.

Customer Personal Data means personal data processed by VectorPitch as processor on behalf of the Customer under the Terms.

Data Subject Request means a request from or on behalf of a data subject to exercise rights under Applicable Data Protection Laws.

DPA means this Data Processing Agreement and its schedules.

GDPR means Regulation (EU) 2016/679.

Personal Data Breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

Restricted Transfer means a transfer of Customer Personal Data to a country, territory or recipient that requires an international transfer safeguard under Applicable Data Protection Laws.

SCCs means the European Commission's standard contractual clauses for international transfers of personal data, as amended, replaced or updated from time to time.

Special Category Data means personal data that is subject to additional protection under Applicable Data Protection Laws, including where applicable personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a person, health data, sex life or sexual orientation data, and equivalent categories under applicable law.

Sub-processor means another processor engaged by VectorPitch to process Customer Personal Data.

TIA means a transfer impact assessment, transfer risk assessment or equivalent assessment of Restricted Transfers required or recommended under Applicable Data Protection Laws, regulatory guidance or applicable transfer mechanisms.

UK Addendum means the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses or any replacement UK transfer mechanism.

UK GDPR has the meaning given in the UK Data Protection Act 2018.

2.2

The terms "controller", "processor", "personal data", "processing", "data subject" and "supervisory authority" have the meanings given in Applicable Data Protection Laws.

2.3

VectorPitch becomes aware of a Personal Data Breach when VectorPitch has a reasonable degree of certainty that a security incident has led to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

Section 3 — Roles of the Parties

The standard GDPR relationship: you decide how and why personal data is used as controller, we process it on your instructions as processor. What gets uploaded and how the service is configured is yours to control.

3.1

For Customer Personal Data processed under this DPA, the Customer is the controller and VectorPitch is the processor, unless the parties agree otherwise in writing.

3.2

The Customer determines the purposes and means of processing Customer Personal Data within the Customer's organisation, workspace, teams, squads and workflows.

3.3

VectorPitch processes Customer Personal Data only to provide, secure, support and maintain the Service, and otherwise in accordance with the Customer's documented instructions.

3.4

The Customer's documented instructions include:

(a) the Terms;
(b) this DPA;
(c) the Customer's configuration and use of the Service;
(d) instructions given by the Customer or Authorised Users through the Service; and
(e) any written instructions agreed between the parties.

3.5

Where the Customer acts as processor on behalf of another controller, the Customer represents and warrants that it has authority from the relevant controller to appoint VectorPitch as sub-processor and to issue instructions to VectorPitch. In that case, references to the Customer's instructions include instructions authorised by the relevant controller, and the Customer remains responsible for ensuring that its agreement with the controller permits the processing described in this DPA.

3.6

VectorPitch will notify the Customer if, in VectorPitch's opinion, an instruction infringes Applicable Data Protection Laws, unless prohibited from doing so by law.

3.7

VectorPitch is not required to comply with an instruction that VectorPitch reasonably believes would violate applicable law, compromise security, infringe third-party rights, disclose another customer's data, or materially disrupt the Service.

3.8

VectorPitch does not verify the Customer's lawful basis, permissions, notices, consents, safeguarding approvals, broadcast rights or third-party rights in Customer Personal Data. The Customer remains responsible for the lawfulness of its instructions and Customer Content.

Section 4 — Processing Details

What we process and why, set out in Schedule A. Footage of under-18s is covered where you use the service for youth teams. Don't upload health or medical data, and don't use the service for biometric identification — neither is designed for.

4.1

The subject matter, duration, nature and purpose of processing, types of personal data and categories of data subjects are set out in Schedule A.

4.2

The Customer acknowledges that the Service may be used in environments involving children or young players, including academies, schools, youth teams and similar programmes.

4.3

The Service is not intended for health, injury, medical, wellness or similar Special Category Data. The Customer must not upload or enter such data into the Service unless VectorPitch has expressly agreed in writing.

4.4

The Service is not intended to be used for biometric identification, biometric categorisation, emotion recognition, health assessment, medical assessment or other Special Category Data processing unless expressly agreed in writing with VectorPitch and permitted by applicable law.

4.5

Incidental appearance of sensitive characteristics in video footage does not mean the Service is intended for Special Category Data processing. The Customer must not configure or use the Service to process Special Category Data unless expressly agreed in writing with VectorPitch and permitted by applicable law.

Section 5 — Customer Obligations

Your obligations as controller: a lawful basis, privacy notices to the people involved, any consents needed, accurate data, managed access controls, protection for children's data, and no breach of third-party rights.

5.1

The Customer will comply with Applicable Data Protection Laws in connection with Customer Personal Data.

5.2

The Customer is responsible for ensuring that:

(a) it has a lawful basis for the processing of Customer Personal Data;
(b) it has provided all required privacy notices to data subjects;
(c) it has obtained all required rights, permissions, consents, authorisations and legal bases;
(d) Customer Personal Data is accurate and relevant for the Customer's use of the Service;
(e) Authorised Users are permitted to access the Customer Personal Data they access through the Service;
(f) access to footage and data involving children or young players is limited to appropriate Authorised Users;
(g) Customer Personal Data is not uploaded, used or shared in breach of law, safeguarding requirements, league rules, competition rules, club rules, school rules, contracts or third-party rights; and
(h) its instructions to VectorPitch are lawful.

5.3

Where Customer Personal Data includes children or young players, the Customer is responsible for ensuring appropriate safeguards, notices, lawful bases, consents or authorisations are in place, including parent or guardian consent where required by applicable law.

5.4

The Customer must not use the Service to process Special Category Data unless it has a valid Article 9 GDPR condition or equivalent legal basis under applicable law and VectorPitch has expressly agreed in writing to such processing where required.

5.5

The Customer must notify VectorPitch promptly if it believes that Customer Personal Data has been uploaded, used or shared unlawfully or in breach of this DPA.

5.6

VectorPitch will provide reasonable assistance to the Customer in responding to regulatory inquiries concerning the lawful basis for processing Customer Personal Data, taking into account the nature of the processing and information available to VectorPitch.

Section 6 — VectorPitch Processor Obligations

Ours as processor: process only on your instructions, keep staff under confidentiality, maintain appropriate security, and give you what you need to answer data subject requests. If the law forces us to depart from your instructions we'll tell you first, unless we're barred from doing so.

6.1

VectorPitch will process Customer Personal Data only on documented instructions from the Customer, including with regard to transfers of Customer Personal Data to a third country or international organisation, unless required to do so by law. Where VectorPitch is required by law to process Customer Personal Data otherwise than on the Customer's instructions, VectorPitch will inform the Customer of that legal requirement before processing, unless prohibited by law.

6.2

VectorPitch will ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.

6.3

VectorPitch will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data, as described in Schedule B.

6.4

VectorPitch will comply with the sub-processor requirements in clause 8.

6.5

Taking into account the nature of the processing, VectorPitch will assist the Customer by appropriate technical and organisational measures, insofar as reasonably possible, for the fulfilment of the Customer's obligations to respond to Data Subject Requests.

6.6

Taking into account the nature of processing and information available to VectorPitch, VectorPitch will assist the Customer with obligations relating to security of processing, Personal Data Breach notifications, data protection impact assessments and prior consultation with supervisory authorities, as further described in this DPA.

6.7

On expiry or termination of the relevant Subscription Plan, VectorPitch will delete or return Customer Personal Data in accordance with clause 13, unless retention is required by law or permitted for VectorPitch controller purposes described in the Privacy Notice.

6.8

VectorPitch will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits in accordance with clause 14.

6.9

VectorPitch will maintain records of processing activities where required by Applicable Data Protection Laws.

6.10

VectorPitch will not sell Customer Personal Data or share Customer Personal Data for targeted advertising.

6.11

VectorPitch will not use Customer Personal Data for third-party AI provider model training.

6.12

VectorPitch will maintain logical separation between customer organisations designed to prevent one customer from accessing another customer's Customer Personal Data.

Section 7 — Security Measures

Security appropriate to the data and the risk, detailed in Schedule B. We can update measures over time, but only in ways that maintain or improve protection. Managing who has access to your account stays with you.

7.1

Taking into account the nature, scope, context and purposes of processing, VectorPitch will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

7.2

The technical and organisational measures in Schedule B apply as at the Effective Date.

7.3

VectorPitch may update or replace the technical and organisational measures from time to time, provided that such updates do not materially reduce the overall level of protection for Customer Personal Data.

7.4

The Customer is responsible for using available security controls, managing Authorised Users, assigning appropriate roles, removing users who no longer require access and keeping credentials secure.

7.5

Security measures are described at a control level. Nothing in this DPA requires VectorPitch to disclose sensitive infrastructure implementation details, security configurations or information that could reasonably compromise the security of the Service or other customers.

Section 8 — Sub-processors

You authorise us to use sub-processors such as cloud hosting providers. The current list is published, they're contractually bound to the same standards we are, and you get notice of changes.

8.1

The Customer gives VectorPitch general authorisation to engage Sub-processors to process Customer Personal Data.

8.2

An up-to-date list of Sub-processors is maintained at vectorpitch.com/legal/subprocessors and incorporated into this DPA by reference. The Sub-processor List identifies each Sub-processor, its purpose, relevant data categories, processing location or transfer posture, and whether the Sub-processor is current, optional or planned.

8.3

VectorPitch will impose written data protection obligations on each Sub-processor that are no less protective in substance than those imposed on VectorPitch under this DPA, to the extent applicable to the Sub-processor's processing.

8.4

VectorPitch remains responsible to the Customer for the performance of its Sub-processors' obligations in respect of Customer Personal Data.

8.5

VectorPitch may add or replace Sub-processors from time to time.

8.6

VectorPitch will provide at least 30 days' prior written notice of a new or replacement Sub-processor where practicable. Where urgent replacement or appointment is required for security, availability, legal, operational or continuity reasons, VectorPitch may appoint the Sub-processor sooner and will notify the Customer without undue delay.

8.7

The Customer may object to a new or replacement Sub-processor on reasonable data protection grounds by notifying VectorPitch in writing within 30 days after receiving notice of the new or replacement Sub-processor. The objection must explain the reasonable data protection grounds for objection.

8.8

If the Customer objects to a new or replacement Sub-processor under clause 8.7, the parties will work in good faith to resolve the objection.

8.9

If the objection cannot reasonably be resolved and no commercially reasonable alternative is available, VectorPitch may suspend the affected feature, provide an alternative where reasonably available, or terminate the affected Subscription Plan. If VectorPitch intends to proceed with the new or replacement Sub-processor notwithstanding the Customer's objection, the Customer may terminate the affected Service on 30 days' written notice without penalty.

8.10

Where the affected Service is terminated under clause 8.9, VectorPitch will refund prepaid unused fees for the terminated affected Service.

8.11

The Customer acknowledges that inability to use a Sub-processor may prevent VectorPitch from providing all or part of the Service.

8.12

VectorPitch will not enable a new third-party AI Sub-processor to process Customer Personal Data without listing it in the Sub-processor List and applying the notice process in this clause 8, unless the Sub-processor is used only in an emergency or temporary continuity scenario and notice is provided without undue delay.

Section 9 — International Transfers

Data may be stored or processed in the United States under an approved transfer mechanism — Standard Contractual Clauses, an adequacy decision, or the EU-US Data Privacy Framework. The EU SCCs are incorporated into this DPA, governed by Irish law.

9.1

The Customer acknowledges that Customer Personal Data may be processed outside the Customer's country, including in the United States.

9.2

Where VectorPitch makes a Restricted Transfer of Customer Personal Data, VectorPitch will use an appropriate transfer mechanism under Applicable Data Protection Laws.

9.3

Such transfer mechanisms may include:

(a) an adequacy decision;
(b) the EU-US Data Privacy Framework, only where the relevant recipient is certified and the transfer falls within the scope of that certification;
(c) the SCCs;
(d) the UK Addendum or UK International Data Transfer Agreement; or
(e) any equivalent safeguard, derogation or replacement mechanism permitted by Applicable Data Protection Laws.

9.4

Where the SCCs apply to a Restricted Transfer between the Customer and VectorPitch, the parties agree that:

(a) Module Two applies where the Customer is controller and VectorPitch is processor;
(b) Module Three applies where the Customer is processor and VectorPitch is sub-processor;
(c) the optional docking clause applies;
(d) the audits clause is subject to the audit provisions in this DPA, except where the SCCs require otherwise;
(e) the governing law is the law of Ireland, where permitted;
(f) the competent supervisory authority is the Irish Data Protection Commission, where permitted; and
(g) the information in the schedules to this DPA is deemed to populate the relevant annexes of the SCCs.

9.5

Where VectorPitch engages a Sub-processor that makes a Restricted Transfer of Customer Personal Data and relies on the SCCs for that transfer, VectorPitch will ensure that the relevant transfer is governed by appropriate SCCs, including Module Three where the transfer is processor-to-processor or processor-to-sub-processor.

9.6

Where the UK Addendum applies, the SCCs as amended by the UK Addendum apply to Restricted Transfers subject to the UK GDPR.

9.7

If there is a conflict between the SCCs or UK Addendum and this DPA, the SCCs or UK Addendum will prevail to the extent of the conflict in respect of the relevant Restricted Transfer.

9.8

VectorPitch will take commercially reasonable steps to ensure that Sub-processors involved in Restricted Transfers are subject to appropriate transfer safeguards.

9.9

Where VectorPitch relies on SCCs as the transfer mechanism for a Restricted Transfer, VectorPitch will carry out and document a TIA in accordance with applicable regulatory guidance before commencing such transfer or, for transfers already in place at the Effective Date, as soon as reasonably practicable.

9.10

VectorPitch will periodically review TIAs for Restricted Transfers where required or appropriate, including where there is a material change to the transfer, the transfer mechanism, the law or practice of the destination country, the relevant Sub-processor, or the technical and organisational measures supporting the transfer.

9.11

On reasonable request, VectorPitch will make available a summary of its relevant TIA information reasonably necessary for the Customer to assess Restricted Transfers relating to the Service, subject to appropriate confidentiality, security and redaction requirements.

9.12

Where VectorPitch relies on the EU-US Data Privacy Framework for a Restricted Transfer to itself or a Sub-processor, VectorPitch will rely on that mechanism only while the relevant recipient maintains applicable certification and the transfer falls within the scope of that certification. VectorPitch will take commercially reasonable steps to notify affected Customers if it becomes aware that a relevant certification lapses, is withdrawn or is revoked.

Section 10 — Data Subject Requests

If a player, coach or anyone else asks to access, correct or delete their data, answering is yours as controller. We won't respond directly without your instruction — we route the request to you and help you answer it.

10.1

The Customer is responsible for responding to Data Subject Requests relating to Customer Personal Data.

10.2

VectorPitch will not respond substantively to a Data Subject Request relating to Customer Personal Data except on documented instructions from the Customer or as required by law.

10.3

If VectorPitch receives a Data Subject Request relating to Customer Personal Data and can reasonably identify the relevant Customer, VectorPitch will notify the Customer of the request within 5 business days after receipt, unless prohibited by law.

10.4

If VectorPitch cannot reasonably identify the relevant Customer, VectorPitch may provide a neutral response explaining that VectorPitch provides services to customer organisations and cannot identify or act on customer-controlled content without further information.

10.5

Taking into account the nature of the processing and the information available to VectorPitch, VectorPitch will provide reasonable assistance to the Customer to help the Customer respond to Data Subject Requests.

10.6

VectorPitch will respond to reasonable written requests from the Customer for information required to respond to a Data Subject Request within 5 business days, unless the request is complex, excessive, legally restricted, technically infeasible within that period, or outside standard product functionality. In those cases, VectorPitch will respond without undue delay and keep the Customer reasonably informed.

10.7

VectorPitch may charge reasonable fees for assistance with Data Subject Requests where the assistance is complex, repetitive, excessive, outside standard product functionality or caused by the Customer's configuration or use of the Service, unless prohibited by law.

Section 11 — Personal Data Breach

We aim to notify you within 24 hours of becoming aware of a breach and always within 72, so you have time to meet your own reporting deadline. Whether it must be reported to a regulator or to the individuals is your decision as controller.

11.1

VectorPitch will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

11.2

Where practicable, VectorPitch will provide an initial notice within 24 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data and in any event within 72 hours after becoming aware.

11.3

VectorPitch's notice under clause 11.1 will include information reasonably available to VectorPitch at the time, which may include:

(a) the nature of the Personal Data Breach;
(b) categories and approximate number of affected data subjects, where known;
(c) categories and approximate number of affected records, where known;
(d) likely consequences of the Personal Data Breach, where known;
(e) measures taken or proposed to address the Personal Data Breach; and
(f) contact details for further information.

11.4

VectorPitch may provide information in phases as it becomes available.

11.5

The Customer is responsible for determining whether the Personal Data Breach must be notified to a supervisory authority, data subjects or any other person.

11.6

VectorPitch will provide reasonable assistance to the Customer in relation to the Customer's breach notification obligations, taking into account the nature of the processing and information available to VectorPitch.

11.7

A notification under this clause is not an acknowledgement of fault or liability.

Section 12 — Assistance with Compliance

We help with DPIAs, breach notifications, regulator consultations and rights requests. Standard support is included; complex or unusual requests may carry a fee.

12.1

Taking into account the nature of processing and information available to VectorPitch, VectorPitch will provide reasonable assistance to the Customer with the Customer's obligations under Applicable Data Protection Laws relating to:

(a) security of processing;
(b) Personal Data Breach notifications;
(c) data protection impact assessments;
(d) prior consultation with supervisory authorities; and
(e) Data Subject Requests.

12.2

VectorPitch may charge reasonable fees for assistance under this clause where the assistance is outside standard product functionality, complex, repetitive, excessive or caused by the Customer's configuration or use of the Service, unless prohibited by law.

Section 13 — Deletion and Return

You can delete content yourself while the subscription is live. When it ends you have 30 days to export or request deletion, after which data comes out of live systems within 60 days. Backups persist briefly on the timeline in clause 13.7.

13.1

During the Subscription Plan, the Customer may delete certain Customer Content through available product functionality.

13.2

On expiry or termination of the Subscription Plan, the Customer may elect, within 30 days after expiry or termination, to return Customer Personal Data through the Service's export functionality or to request deletion of Customer Personal Data, unless the account has been suspended or terminated for serious breach, security risk, non-payment, unlawful use or misuse.

13.3

The Service's export functionality is the primary mechanism for return of Customer Personal Data.

13.4

If the Customer does not make an election within the 30-day period described in clause 13.2, VectorPitch may treat expiry of that period as an instruction to delete Customer Personal Data in accordance with this DPA and the Terms.

13.5

After the applicable export period or deletion election, VectorPitch will delete or disable access to Customer Personal Data from live production systems within 60 days, unless retention is required by law or permitted for VectorPitch controller purposes described in the Privacy Notice.

13.6

Deleted Customer Personal Data may remain in backups, logs or archival systems for a limited period until overwritten or deleted through normal retention cycles.

13.7

Backups are normally deleted or overwritten within 90 days.

13.8

VectorPitch may retain limited information where required or permitted for legal, tax, accounting, security, fraud prevention, dispute or compliance purposes, where VectorPitch acts as controller or is required by law.

13.9

Deletion of Customer Content from the Customer's active workspace does not require deletion or retraining of models previously developed using De-identified Training Material, unless required by law or the applicable Subscription Plan.

13.10

The position in clause 13.9 relies on the principle that De-identified Training Material that has been processed in a manner that cannot reasonably be used to re-identify any individual, whether by VectorPitch alone or in combination with other information reasonably likely to be used, constitutes anonymous data for the purposes of Applicable Data Protection Laws and is not subject to erasure obligations under Article 17 GDPR or equivalent erasure rights.

13.11

The anonymisation position in clause 13.10 is intended to be assessed in accordance with Recital 26 of the GDPR and the criteria set out in Opinion 05/2014 of the Article 29 Working Party on anonymisation techniques, as endorsed, replaced or supplemented by the European Data Protection Board or applicable supervisory authorities from time to time.

13.12

VectorPitch will periodically reassess its de-identification measures for model improvement datasets, including whether those measures remain appropriate having regard to available technology, the nature of the data, reasonably likely means of re-identification, and applicable legal requirements.

13.13

If the Customer or a data subject reasonably challenges whether specific De-identified Training Material has been effectively anonymised, VectorPitch will review the challenge in good faith, taking into account the information reasonably available to VectorPitch and the nature of the material concerned.

13.14

The parties will attempt to resolve any dispute under clause 13.13 in good faith within 30 calendar days of written notice of the dispute. If unresolved within that period, either party may refer the matter to its Data Protection Officer or equivalent privacy lead for escalation.

13.15

While a challenge under clause 13.13 is being reviewed, VectorPitch will apply appropriate protective measures to the disputed material where reasonably practicable, which may include restricting further use, restricting access, reprocessing the material or applying additional de-identification measures.

13.16

If VectorPitch determines, or is required by a competent supervisory authority or court to treat, specific De-identified Training Material as personal data, VectorPitch will take appropriate remedial steps in accordance with Applicable Data Protection Laws. Such steps may include deletion, further de-identification, restriction of processing, exclusion from future training datasets, or other measures reasonably appropriate to the risk and legal requirement.

13.17

Nothing in this clause requires VectorPitch to retrain models already developed using De-identified Training Material unless required by Applicable Data Protection Laws, a competent supervisory authority, a court, or the applicable Subscription Plan.

Section 14 — Audits and Information Rights

You can request information about our security and data protection measures once a year, and more often after a breach, at a regulator's request, or if processing materially changes. If that isn't sufficient you can request a formal audit; costs sit with you unless the audit finds a material breach by us.

14.1

VectorPitch will make available information reasonably necessary to demonstrate compliance with this DPA.

14.2

The Customer may request information about VectorPitch's data protection and security measures no more than once in any 12-month period, unless a Personal Data Breach affecting Customer Personal Data has occurred, a material security incident has occurred, a supervisory authority requests information, there is a material change to processing, or Applicable Data Protection Laws require otherwise.

14.3

Where the information provided under clause 14.1 is insufficient to demonstrate compliance with this DPA, the Customer may request an audit.

14.4

Any audit must be:

(a) conducted on at least 30 days' prior written notice, except where a shorter period is required by Applicable Data Protection Laws, a supervisory authority or a Personal Data Breach affecting Customer Personal Data;
(b) limited to matters relevant to Customer Personal Data;
(c) conducted during normal business hours;
(d) subject to appropriate confidentiality obligations;
(e) conducted in a manner that does not disrupt VectorPitch's operations or compromise the security or confidentiality of other customers;
(f) carried out by the Customer or an independent auditor approved by VectorPitch, acting reasonably; and
(g) where possible, conducted remotely or through review of documentation before any on-site or systems-level audit is requested.

14.5

VectorPitch will not unreasonably withhold or delay approval of a proposed auditor, provided that the auditor is not a direct competitor of VectorPitch and is subject to appropriate confidentiality obligations.

14.6

The Customer will bear all costs of any audit or inspection under this clause 14, except that where such audit reveals a material breach by VectorPitch of its obligations under this DPA, VectorPitch will bear its own costs of providing reasonable assistance.

14.7

The Customer must not conduct penetration testing, vulnerability scanning or technical testing of the Service without VectorPitch's prior written approval.

14.8

VectorPitch may withhold or redact information where disclosure would compromise security, disclose confidential information of another customer or third party, expose sensitive infrastructure details, or breach legal, contractual or regulatory obligations.

Section 15 — Government and Legal Requests

If a government or law enforcement body demands access, we review the request, tell you where we're permitted to, disclose only what's legally required, and push back on overbroad demands where appropriate.

15.1

If VectorPitch receives a legally binding request from a public authority for access to Customer Personal Data, VectorPitch will, unless prohibited by law:

(a) review the request;
(b) notify the Customer where legally permitted; and
(c) disclose only the Customer Personal Data that VectorPitch is legally required to disclose.

15.2

VectorPitch may challenge or seek to narrow a request where VectorPitch considers it appropriate and commercially reasonable to do so.

Section 16 — Boundary Between Processor Processing and VectorPitch Controller Processing

Where our roles separate. Improving our AI models, we act as an independent controller rather than your processor, relying on legitimate interests — that processing is described in the Privacy Notice and AI Notice, not governed by this DPA.

16.1

This DPA applies to Customer Personal Data processed by VectorPitch as processor on behalf of the Customer.

16.2

The parties acknowledge that certain model evaluation and improvement activities may be carried out by VectorPitch for its own purposes, in which case VectorPitch acts as an independent controller as described in the Terms, Privacy Notice and AI and Model Improvement Notice.

16.3

To the extent VectorPitch acts as an independent controller for model evaluation or improvement activities, VectorPitch acknowledges its obligations as controller under Applicable Data Protection Laws and will maintain appropriate legal bases for that processing as described in the Privacy Notice.

16.4

Where GDPR applies, VectorPitch's anticipated lawful basis for processing personal data for model evaluation and improvement as an independent controller is legitimate interests under Article 6(1)(f) GDPR, as further described in the Privacy Notice.

16.5

VectorPitch has conducted or will conduct a data protection impact assessment under Article 35 GDPR in respect of model evaluation or improvement processing where such processing constitutes high-risk processing within the meaning of Article 35 GDPR. VectorPitch will make a summary of that assessment available to the Customer on reasonable request, subject to appropriate confidentiality, security and redaction requirements.

16.6

Liability for VectorPitch's breach of its obligations as independent controller is governed by the Terms, except to the extent prohibited by Applicable Data Protection Laws.

16.7

Clauses 16.8 to 16.15 describe the intended boundary and safeguards for such processing. They do not convert VectorPitch's independent controller processing into processor processing under this DPA.

16.8

Where Customer Content is used for model improvement, VectorPitch is designed not to retain raw identifiable video in the training corpus.

16.9

Model improvement is intended to use De-identified Training Material, including face-masked frames or crops, derived tracking data, tags, corrections, annotations and related outputs. Audio is removed and match, date and roster metadata is severed using commercially reasonable technical and organisational measures.

16.10

VectorPitch does not use Customer Content to train models to identify named individuals.

16.11

VectorPitch does not permit third-party AI providers to use Customer Content to train their own models.

16.12

Customer Content is not sent to OpenAI, Anthropic or similar third-party AI providers for model training. Where third-party AI providers are used to provide inference, enrichment or other Service functionality, VectorPitch will use commercially reasonable measures to configure those services so that Customer Content is not used to train the provider's models.

16.13

To the extent any De-identified Training Material is determined to be personal data under Applicable Data Protection Laws, VectorPitch will process it in accordance with the Privacy Notice and Applicable Data Protection Laws.

16.14

If there is a disagreement between the parties about whether particular De-identified Training Material constitutes personal data, the parties will act in good faith to resolve the issue within 30 calendar days after written notice of the disagreement. Pending resolution, VectorPitch will apply protective measures to the disputed material where reasonably practicable.

16.15

VectorPitch will periodically review its de-identification measures for model improvement datasets.

Section 17 — Liability

Liability here is limited the same way as under the main Terms, except where data protection law requires otherwise. The caps don't reduce either side's duty to comply with the law.

17.1

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except to the extent prohibited by Applicable Data Protection Laws or expressly stated otherwise in this DPA.

17.2

Nothing in this DPA limits either party's obligation to comply with Applicable Data Protection Laws.

17.3

Any higher liability cap agreed in an order form or separate written agreement applies to this DPA only to the extent expressly stated.

Section 18 — Term and Termination

This DPA runs for as long as we're processing your data — it doesn't end with your subscription.

18.1

This DPA begins on the Effective Date and continues for as long as VectorPitch processes Customer Personal Data.

18.2

Termination or expiry of the Terms does not affect either party's rights or obligations accrued before termination or expiry.

18.3

Clauses that by their nature should survive termination will survive, including clauses relating to confidentiality, deletion, audits, international transfers and liability.

Section 19 — Changes to this DPA

Material changes to how we process your data come with advance notice, and where a change needs a new legal basis or your consent we'll seek it first.

19.1

VectorPitch may update this DPA from time to time.

19.2

Where a change materially affects the processing of Customer Personal Data, VectorPitch will provide notice in accordance with the Terms.

19.3

Where a change requires a new lawful basis, explicit consent, updated contractual terms or other affirmative agreement under Applicable Data Protection Laws, VectorPitch will seek the required agreement or provide the required notice before the change takes effect for existing Customers.

Section 20 — Governing Law

Irish law governs this DPA, with the data protection laws of your own jurisdiction applying where relevant.

20.1

This DPA is governed by the laws of Ireland, except where Applicable Data Protection Laws require otherwise.

20.2

The jurisdiction provisions in the Terms apply to this DPA, except where Applicable Data Protection Laws require otherwise.

Schedule A — Processing Details

The full breakdown of data subjects, data categories and processing purposes. The people covered go well beyond your own staff and players — referees, opposition, parents and bystanders caught in footage all count.

A.1

Subject Matter. The subject matter of processing is the provision of VectorPitch, a sports video analysis platform, including video upload, storage, processing, tagging, tracking, clipping, annotation, reporting, export, sharing, support and related service operations.

A.2

Duration. Customer Personal Data is processed for the duration of the applicable Subscription Plan and thereafter as required or permitted under the Terms, this DPA and applicable retention periods.

A.3

Nature and Purpose of Processing. The nature and purpose of processing include:

(a) creating and managing customer workspaces, organisations, teams, squads and user permissions;
(b) uploading, storing and processing videos;
(c) generating tags, clips, playlists, annotations, comments, reports and exports;
(d) generating player tracking and sports analysis outputs;
(e) enabling collaboration between Authorised Users;
(f) enabling external sharing where configured by the Customer;
(g) providing support and troubleshooting;
(h) securing and monitoring the Service;
(i) investigating misuse, security incidents, rights complaints or legal issues;
(j) maintaining backups and logs;
(k) complying with law; and
(l) other processing reasonably necessary to provide, secure, support and maintain the Service.

A.4

Categories of Data Subjects. Customer Personal Data may relate to: Authorised Users; organisation admins; players; under-18 players; coaches; analysts; referees; opposition players and staff; club, school, academy or university staff; parents or guardians appearing in footage; spectators or other incidental individuals appearing in footage; support contacts; and other individuals whose personal data is included in Customer Content.

A.5

Categories of Personal Data. Customer Personal Data may include: names; email addresses; phone numbers; job titles; organisation names; account identifiers; user roles and permissions; profile photos; player names; squad numbers; positions; team or squad membership; video footage; images, thumbnails and frames; tags, annotations and corrections; comments; clips and playlists; reports, presentations and exports; movement, tracking, speed, distance, acceleration, positioning and sports analysis metrics; IP addresses; device identifiers; browser, session and authentication data; usage logs and audit records; support communications; and technical metadata.

A.6

Special Category Data. VectorPitch does not anticipate processing Special Category Data in the ordinary course of providing the Service. The Service is not intended for health, injury, medical, wellness, biometric identification, biometric categorisation or similar Special Category Data processing. The Customer must not upload Special Category Data unless expressly agreed in writing with VectorPitch and permitted by applicable law. Where the Customer uploads Special Category Data, the Customer warrants that an appropriate Article 9 GDPR condition or equivalent legal basis applies. Incidental appearance of sensitive characteristics in video footage does not mean the Service is intended for Special Category Data processing.

A.7

Children's Data. Customer Personal Data may include children where the Customer uses the Service for academies, schools, youth teams or similar programmes. The Customer is responsible for all required lawful bases, notices, consents, safeguards, access controls and parent or guardian authorisations where required.

A.8

Processing Operations. Processing operations may include collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure and destruction.

A.9

Frequency of Transfer. Customer Personal Data may be transferred on a continuous basis while the Customer uses the Service.

Schedule B — Technical and Organisational Measures

Our security controls in detail: access control, encryption, MFA on admin access, restricted staff access on a legitimate-reason basis, logging, backup and incident response.

B.1

Security Programme. VectorPitch maintains a security programme designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Security controls are reviewed and updated from time to time based on the nature of the Service, operational requirements, risk, available technology and applicable legal requirements.

B.2

Data Minimisation. VectorPitch applies data minimisation measures designed to limit Customer Personal Data processing to what is reasonably necessary to provide, secure, support and maintain the Service.

B.3

Pseudonymisation and De-identification. Where appropriate, VectorPitch uses pseudonymisation, de-identification, aggregation or similar measures designed to reduce identifiability and privacy risk. For model improvement, VectorPitch is designed not to retain raw identifiable video in the training corpus and to use De-identified Training Material as described in this DPA.

B.4

Access Control. VectorPitch implements access controls designed to ensure that Customer Personal Data is accessible only to authorised users, personnel, systems and service providers with an appropriate need for access.

B.5

Role-Based Permissions. The Service supports role-based access controls and organisation-level permissions designed to restrict access to Customer Content and Customer Personal Data.

B.6

Team and Squad Permissions. The Service supports team or squad-level access controls, enabling Customers to restrict access to particular teams, squads or content, including youth or academy content.

B.7

Tenant Separation. VectorPitch maintains logical separation between customer organisations designed to prevent one customer from accessing another customer's Customer Personal Data.

B.8

Authentication. VectorPitch supports account authentication and multi-factor authentication. Multi-factor authentication is required for VectorPitch administrative access to production systems and may be made available or required for customer accounts depending on product configuration, Subscription Plan or security settings.

B.9

Credential Protection. VectorPitch applies appropriate measures designed to protect credentials and authentication secrets.

B.10

Internal Access. Internal access to Customer Content and Customer Personal Data is restricted to authorised personnel with a legitimate need, such as support, troubleshooting, security, abuse investigation, legal compliance or quality investigation.

B.11

Personnel Confidentiality and Training. Personnel authorised to process Customer Personal Data are subject to confidentiality obligations and receive appropriate security and data protection guidance or training based on their role.

B.12

Infrastructure and Network Security. VectorPitch uses cloud infrastructure and network controls designed to segregate environments, restrict unauthorised network access, and protect application traffic, including private networking, security group or firewall rules, web application firewall protections, edge protections, network monitoring and related cloud security controls.

B.13

Web Application Firewall. VectorPitch uses web application firewall controls designed to help protect public-facing application endpoints against common web application threats, abusive traffic patterns and unauthorised access attempts.

B.14

Encryption. VectorPitch uses encryption in transit and encryption at rest where technically supported and appropriate for the relevant system, storage location or data flow. Encryption in transit uses industry-standard transport encryption such as TLS 1.2 or higher. Encryption at rest uses industry-standard encryption such as AES-256 or equivalent cloud-provider managed encryption where supported.

B.15

Storage Security. Customer videos and related files are stored in private cloud storage. Access is controlled through application permissions and controlled access mechanisms.

B.16

Secrets Management. VectorPitch uses secrets management controls designed to protect sensitive configuration values, credentials and operational secrets.

B.17

Logging and Monitoring. VectorPitch maintains security and operational logging designed to support monitoring, troubleshooting, abuse investigation, incident response and auditability.

B.18

Threat Detection. VectorPitch uses threat detection and alerting controls designed to identify and escalate material security risks, suspicious activity and high-severity findings.

B.19

Vulnerability Management. VectorPitch maintains vulnerability management practices designed to identify, assess, prioritise and remediate security vulnerabilities in the Service and supporting systems.

B.20

Security Testing. VectorPitch conducts security testing of its production application and infrastructure no less than annually and following material changes to the infrastructure or application architecture where such changes materially affect the security of Customer Personal Data. VectorPitch will make a summary of material findings and remediation status available to the Customer on reasonable request, subject to reasonable confidentiality, security and redaction requirements. Customer technical testing of the Service is subject to clause 14.7.

B.21

Backup and Recovery. VectorPitch maintains backup and recovery measures appropriate to the Service. Backups are normally deleted or overwritten within 90 days. Specific recovery time objectives or recovery point objectives apply only where expressly stated in a Subscription Plan, Schedule B, service level agreement or separate written agreement.

B.22

Availability and Resilience. VectorPitch uses operational measures designed to support service availability, recovery and continuity, including monitoring and service recovery controls.

B.23

Secure Development and Change Management. VectorPitch applies development, testing and change management practices designed to reduce security and operational risk.

B.24

Youth and Academy Safeguards. Where Customer Personal Data includes children or young players, the Service supports organisation, team and squad-level access controls designed to help Customers restrict access to youth or academy content. VectorPitch personnel may access youth or academy content only where required for support, troubleshooting, security, abuse investigation, legal compliance or quality investigation.

B.25

Sharing Controls. The Service may support private or password-protected links where available. VectorPitch may disable sharing where reasonably necessary for legal, privacy, safeguarding, security, abuse prevention, rights management or operational reasons.

B.26

Incident Response. VectorPitch maintains procedures designed to identify, investigate, contain, remediate and notify relevant customers of Personal Data Breaches where required.

B.27

Model Improvement Safeguards. Where Customer Content is used for model improvement, VectorPitch is designed not to retain raw identifiable video in the training corpus. Model improvement uses De-identified Training Material, including face-masked frames or crops, derived tracking data, tags, corrections, annotations and related outputs. Audio is removed and match, date and roster metadata is severed. Access to model improvement datasets is restricted.

B.28

Sub-processor Controls. VectorPitch uses contractual and operational controls designed to ensure that Sub-processors process Customer Personal Data only for authorised purposes.

B.29

Security Information. VectorPitch may provide additional information about its technical and organisational measures through Schedule B, security documentation, questionnaires, audit materials or other customer-facing security materials. VectorPitch is not required to disclose sensitive security information, infrastructure implementation details, credentials, network configurations, vulnerability details, information about other customers, or information that could reasonably compromise the security of the Service.

Schedule C — Sub-processor Summary

A snapshot of sub-processors expected to be active at the effective date. The live published list is the definitive reference.

C.1

An up-to-date list of Sub-processors is maintained at vectorpitch.com/legal/subprocessors and incorporated into this Schedule by reference. The live Sub-processor List identifies all third parties that process Customer Personal Data as Sub-processors. Providers should be listed as current only when they are actually processing Customer Personal Data for the Service.

Schedule D — International Transfer Details

How transfers are authorised: EU SCCs incorporated with Irish law and the Irish Data Protection Commission as competent authority, the UK Addendum on top for UK transfers, and Transfer Impact Assessments carried out before relying on SCCs.

D.1

EU SCCs. Where the SCCs apply between the Customer and VectorPitch: Module Two applies where the Customer is controller and VectorPitch is processor; Module Three applies where the Customer is processor and VectorPitch is sub-processor; the optional docking clause applies; the governing law is Ireland; the competent supervisory authority is the Irish Data Protection Commission; the data exporter is the Customer; the data importer is VectorPitch; the description of processing is set out in Schedule A; the technical and organisational measures are set out in Schedule B; and the Sub-processors are described in Schedule C and the Sub-processor List.

D.2

Sub-processor SCCs. Where VectorPitch transfers Customer Personal Data to a Sub-processor in reliance on the SCCs, VectorPitch will ensure that the relevant transfer is governed by appropriate SCCs, including Module Three for processor-to-processor or processor-to-sub-processor transfers, unless another valid transfer mechanism applies.

D.3

UK Addendum. Where the UK Addendum applies: the EU SCCs are amended by the UK Addendum; the parties' details are as set out in the Terms and this DPA; the tables and appendix information are populated by the Terms, this DPA and its schedules; the exporter is the Customer; the importer is VectorPitch; and the relevant transfer details are set out in this DPA and the Sub-processor List.

D.4

Transfer Frequency. Restricted Transfers may occur on a continuous basis while the Customer uses the Service.

D.5

Transfer Subject Matter. Restricted Transfers relate to the provision, support, security, maintenance and operation of the Service.

D.6

Transfer Categories. The categories of data subjects, personal data and processing operations are described in Schedule A.

D.7

Transfer Safeguards. Relevant transfer safeguards may include:

(a) encryption in transit;
(b) encryption at rest where technically supported;
(c) access controls;
(d) role-based permissions;
(e) logical tenant separation;
(f) private cloud storage;
(g) web application firewall controls;
(h) logging and monitoring;
(i) contractual Sub-processor controls;
(j) restrictions on third-party AI model training;
(k) de-identification measures for model improvement datasets; and
(l) other measures described in Schedule B.

D.8

Transfer Impact Assessments. Where VectorPitch relies on SCCs as the transfer mechanism for a Restricted Transfer, VectorPitch will carry out and document a TIA in accordance with applicable regulatory guidance before commencing such transfer and will periodically review TIAs where required. On reasonable request, VectorPitch will make available a summary of relevant TIA information reasonably necessary for the Customer to assess Restricted Transfers, subject to appropriate confidentiality, security and redaction requirements.

D.9

EU-US Data Privacy Framework. VectorPitch will rely on the EU-US Data Privacy Framework only where the relevant recipient is certified and the transfer falls within the scope of that certification. Where VectorPitch relies on a Sub-processor's EU-US Data Privacy Framework certification, VectorPitch will take commercially reasonable steps to confirm that the Sub-processor maintains certification. VectorPitch will notify affected Customers if that certification lapses, is withdrawn or is revoked.

D.10

Transfer Risk Information. On reasonable request, VectorPitch will make available information reasonably necessary for the Customer to assess Restricted Transfers relating to the Service, including a summary of relevant transfer risk assessment information where required by Applicable Data Protection Laws and subject to appropriate confidentiality, security and redaction requirements.

D.11

Precedence. If there is a conflict between this DPA and the SCCs or UK Addendum, the SCCs or UK Addendum will prevail to the extent of the conflict in respect of the relevant Restricted Transfer.