Legal

Data Processing Agreement (DPA)

Última actualización: April 24, 2026

This Data Processing Agreement ("DPA") is part of the contract between the academy ("Controller") and NEXTSERVE GESTION DEPORTIVA SL — "Dashboll", CIF B21847785 — ("Processor"). It is signed electronically upon acceptance of the Terms or can be signed as a standalone annex if your legal team requires it. Download a copy of this document at /dpa.pdf.

1. Subject matter

Dashboll processes, on behalf of the academy, the personal data of its members and staff strictly necessary to deliver the management services described in the Terms.

2. Nature and purpose

• Scheduling, attendance tracking, and member progress management.
• Payments, SEPA direct debit, and automated reminders.
• Push notifications and service-related emails.
• Technical support and platform stability.

3. Categories of data subjects

Academy members, directors, coaches, and where applicable, parents/guardians managing profiles for minors. Dashboll does NOT process special categories of data (health, racial origin, etc.) unless the academy enters them voluntarily in free-text fields; in that case, the academy is the controller.

4. Processor obligations

• Process data solely in accordance with the controller's documented instructions.
• Implement appropriate technical and organisational measures (encryption in transit and at rest, JWT and 2FA authentication for operators, access controls, audit logs).
• Not to share data with third parties except the sub-processors listed in §6.
• Notify the controller within 48 hours of any relevant security breach.
• Assist the controller in handling data subject rights requests.
• Upon contract termination: return or delete data according to the controller's choice.

5. Controller obligations

Inform data subjects and obtain the appropriate legal basis before entering their data into the platform, and keep the academy's own privacy policy up to date.

6. Authorised sub-processors

• Hetzner Online GmbH — hosting (Germany, EU).
• Stripe Payments Europe, Ltd. — payments (Ireland, EU).
• Google Firebase — push notifications (EU + USA, Standard Contractual Clauses).
• Mailchimp / Intuit — email marketing (only if the academy enables the integration).

Dashboll will notify the controller of any changes to the sub-processor list at least 14 days in advance. The controller may object in writing, in which case the parties will agree on how to proceed or terminate the contract.

7. International transfers

Transfers to sub-processors outside the EEA are covered by the Standard Contractual Clauses approved by the European Commission, supplemented by reasonable additional safeguards (encryption and data minimisation).

8. Term and termination

This DPA remains in force for as long as Dashboll processes data on the controller's behalf. Upon termination, data is returned or deleted at the controller's request (default: deletion after 30 days), subject to any legal retention obligations.

9. Signature

Acceptance of the Terms by the director constitutes electronic signature of this DPA. If your organisation requires a handwritten or qualified electronic signature, contact us at info@dashboll.com.

¿Dudas? info@dashboll.com · Volver a la landing