Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between Pro Scout Data ("Processor") and the club, academy or organisation using ProScout ("Controller"). Club owners can record acceptance of this DPA inside the app under Setup → Club details.

1. Subject matter and duration

The Processor processes personal data on behalf of the Controller solely to provide the ProScout Service, for as long as the Controller's account remains active plus any retention window described below.

2. Nature and purpose of processing

Hosting, storing, organising, displaying, exporting and deleting scouting data: player profiles, scouting reports, match logs, shortlists, trial records, injury history and uploaded media.

3. Categories of data subject and data

• Data subjects — club staff and scouts; players (who may be children); parents or guardians; coaches and contacts.
• Personal data — name, date of birth, nationality, position, club, photographs and video, contact details, assessments and ratings.
• Special category data — injury and fitness information, which is health data and needs an additional lawful condition.

4. Controller obligations

• Ensure a lawful basis exists for every player record uploaded, and an appropriate condition for health data.
• Obtain parental or guardian consent where a player is a child and consent is the basis relied on.
• Provide privacy information to players and their families.
• Only enable public share links where sharing is lawful and appropriate.

5. Processor obligations

• Process personal data only on the Controller's documented instructions.
• Ensure personnel with access are bound by confidentiality.
• Implement appropriate technical and organisational measures, described on our Security page.
• Assist the Controller with data subject requests, security incidents and impact assessments.
• Notify the Controller without undue delay after becoming aware of a personal data breach.
• Delete or return personal data at the end of the Service, subject to legal retention requirements.
• Make available information necessary to demonstrate compliance and allow reasonable audits.

6. Subprocessors

The Controller gives general authorisation for the Processor to engage the vendors listed on the Subprocessors page. The Processor will update that page before adding a new subprocessor and remains liable for their performance.

7. International transfers

Transfers outside the UK/EEA are covered by Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision.

8. Retention and deletion

Each club sets its own retention period in Setup. Records that pass that period may be deleted. Club owners can export or permanently erase player records and their own account data from inside the app at any time.

9. Data subject requests

Where a player, parent or staff member contacts the Processor directly, the Processor will refer them to the Controller and assist the Controller in responding within statutory time limits.