Data processing addendum

This Data Processing Addendum ("DPA") describes how ERA Skills processes personal data on behalf of its club and organization customers. It is incorporated into our Terms of Service for organization customers. If your club needs a signed copy for its records, email dane.berman@eraskills.com and we will execute one.

Roles

For the athlete and program data a club enters into the platform — rosters, self-reflections, peer ratings and comments, and coaches' review notes — the club is the controller and ERA Skills is the processor. The club decides why and how this data is used within its program; we process it only to provide the service and on the club's documented instructions, which include the Terms of Service and the club's use of the platform's features. ERA Skills acts as a controller for its own limited data, such as billing records and contact-form submissions, as described in our Privacy Policy.

Scope of processing

Processing covers hosting, storing, displaying, and transmitting the club's program data so that coaches can run assessments, athletes can complete reflections and peer ratings, and parents can view their own child's results. Data subjects are the club's staff, coaches, athletes (minors), and parents. We do not use club program data for advertising and never sell it.

Subprocessors

We use a small set of subprocessors to deliver the service:

• Supabase — hosted database, authentication, and storage, in a United States region.
• Email delivery provider — sending platform notifications and account emails.
• Stripe — payment processing for club subscriptions (billing contact data only; athlete data is not shared with Stripe).

We will inform club administrators before adding or replacing a subprocessor that processes program data, and each subprocessor is bound by data protection obligations consistent with this DPA.

Confidentiality

Personnel with access to club program data are bound by confidentiality obligations and access the data only as needed to operate and support the service.

Security measures

We take reasonable technical and organizational measures to protect program data, including encryption of data in transit, role-based access within the application (players see only their own scores; parents see only their own child's), access limited to authorized personnel, and hosting on managed infrastructure. We keep these measures under review as the service evolves.

Breach notification

If we become aware of a personal data breach affecting a club's program data, we will notify the club's administrators without undue delay, describe what we know about the nature and scope of the breach, and cooperate with the club's reasonable efforts to meet its own notification obligations.

Assistance

Taking into account the nature of the processing, we will reasonably assist the club in responding to requests from parents or other data subjects to access, correct, or delete personal data, and in meeting its other data protection obligations related to the service.

Deletion and return of data

When a club's contract ends, we will, at the club's choice, return the club's program data in a commonly used format or delete it, and then delete remaining copies within a reasonable period — except where limited records must be retained to meet legal or accounting obligations.

Contact

To ask questions about this DPA or to execute a signed copy, contact dane.berman@eraskills.com. ERA Skills is located in Las Vegas, Nevada, USA.