Data Processing Agreement
Article 1 — Definitions
The following terms are used in this Data Processing Agreement:
"Data Processing Agreement": this agreement, concluded in accordance with Article 28 GDPR.
"Agreement": the subscription agreement between Refplan and the Club for the use of the Service, including the Trial Period, as further described in the Terms and Conditions.
"Controller": the Club that uses the Service and is thereby responsible for the processing of Personal Data of its End Users.
"Processor" or "Refplan": the provider of the Service, namely CVC consultancy (registered with the Chamber of Commerce (KvK) under number 93483740, trading under the trade name Refplan), which processes Personal Data on behalf of the Controller.
"Subprocessor": a third party engaged by the Processor for the processing of Personal Data.
"Data Subject": the natural person to whom the Personal Data relates — as a rule an official (referee or youth match supervisor), planner or administrator of the Club.
"GDPR": General Data Protection Regulation (EU) 2016/679.
"Security Incident": a breach of security that accidentally or unlawfully leads to the destruction, loss, alteration or unauthorised disclosure of Personal Data.
Article 2 — Subject matter and purposes of the processing
1.The Processor processes Personal Data solely for the purpose of performing the Service, as described in the Agreement.
2.The processing concerns the following categories of Personal Data:
First and last name of End Users;
E-mail address;
Qualification level (for example the referee level);
Availability data (calendar dates and notes);
Preferences, including preferred (age) categories (age categories an official preferably officiates) and language and display preferences;
Roles and permissions within the application;
Notification preferences (push subscriptions, e-mail choices).
3.The processing concerns the following categories of Data Subjects: officials of the Club (referees and youth match supervisors), planners and administrators.
4.The Processor does not process special categories of Personal Data as referred to in Article 9 GDPR.
5.The Data Subjects may include minors, in particular youth referees and youth match supervisors at pupils' matches — for the latter the KNVB applies a minimum age of 12 years. The Club, as Controller, is responsible for obtaining the required consent of a legal representative for the creation of an account on behalf of a minor Data Subject. The Processor limits itself to the processing necessary for the performance of the Service and does not apply profiling or automated decision-making to minor Data Subjects.
6.The Controller warrants that it has a valid legal basis for the processing, that its instructions to the Processor are lawful, and that it has informed its Data Subjects in the required manner about the processing of their Personal Data.
7.The Controller indemnifies the Processor against claims by third parties — including Data Subjects and supervisory authorities — arising from unlawful or incorrect instructions of the Controller, from the Personal Data entered by it, or from the Controller's failure to comply with its own obligations under the GDPR.
Article 3 — Obligations of the Processor
1.The Processor processes Personal Data solely on documented instructions from the Controller, unless a legal obligation requires otherwise. In that case, the Processor informs the Controller in advance, unless this is prohibited by law.
2.The Processor guarantees that persons who have access to the Personal Data have accepted a confidentiality obligation.
3.The Processor takes appropriate technical and organisational measures to secure the Personal Data, including:
Encryption of data in transit (TLS/HTTPS) and, where applicable, at rest;
Access security through authentication (including MFA for administrators);
Row Level Security (RLS) in the database so that data of different clubs is strictly separated;
Regular back-ups by the database provider (Supabase).
4.The Processor informs the Controller without delay and in any event within 48 hours of discovering a Security Incident affecting its Data Subjects. The Processor provides all information reasonably necessary for the Controller to comply with its notification obligation under the GDPR.
5.The Processor assists the Controller in responding to requests from Data Subjects (access, rectification, erasure, portability). The Processor carries out such requests within 10 working days of the Controller's instruction, so that the Controller can meet its statutory response deadline in good time.
Article 4 — Subprocessors
1.The Controller hereby grants general authorisation for engaging Subprocessors. The Processor informs the Controller of intended changes concerning the addition or replacement of Subprocessors, so that the Controller can object.
2.The Processor uses the following Subprocessors:
Supabase (Supabase Inc., USA)Role: database, authentication and file storage. Data is stored in the EU (region eu-west-1 or equivalent). Supabase applies SCCs for any transfer outside the EEA.supabase.com/privacy
Vercel (Vercel Inc., USA)Role: hosting and CDN of the application. Vercel processes request data (IP address, user agent) for the purpose of delivering the Service. Vercel applies SCCs.vercel.com/legal/privacy-policy
Resend (Resend Inc., USA)Role: sending transactional e-mail (invitations, password recovery, notifications). For this purpose, Resend receives the name and e-mail address of Data Subjects. Resend applies SCCs.resend.com/privacy
Apple (Apple Inc., USA)Role: delivery of push notifications to iOS devices via the Apple Push Notification service (APNs). Applicable only if and insofar as the Club uses the iOS app. Apple applies SCCs.apple.com/legal/privacy
Google (Google LLC, USA)Role: delivery of push notifications to Android devices via Firebase Cloud Messaging (FCM). Applicable only if and insofar as the Club uses the Android app. Google applies SCCs.firebase.google.com/support/privacy
3.The Processor concludes a data processing agreement with each Subprocessor that imposes equivalent obligations as set out in this article.
Article 5 — Transfers outside the EEA
1.The Processor does not transfer Personal Data to countries outside the European Economic Area (EEA) without appropriate safeguards, such as Standard Contractual Clauses (SCCs) as adopted by the European Commission.
2.The Subprocessors Supabase, Vercel, Resend, Apple and Google are established in the USA. The transfer of data to these parties is based on the SCCs adopted by the European Commission.
3.At the Controller's request, the Processor provides further information about the transfer mechanisms applied.
Article 6 — Rights of Data Subjects
1.The Controller is primarily responsible for facilitating the exercise of rights by Data Subjects (access, rectification, erasure, portability, objection).
2.If a Data Subject contacts the Processor directly, the Processor informs the Data Subject that the request is handled by the Controller (the Club) and notifies the Controller thereof.
3.The Processor provides, at the written request of the Controller, all cooperation in carrying out an erasure request.
Article 7 — Confidentiality and access
1.The Processor limits access to Personal Data to employees and Subprocessors for whom access is strictly necessary for the performance of the Service.
2.The Processor imposes a written or contractual confidentiality obligation on all persons with access to Personal Data.
3.For the purposes of support, maintenance and troubleshooting, the Processor's platform administrator — secured with mandatory two-factor authentication (MFA) — may temporarily gain access to the Controller's environment by emulating a user session of the Club within the Service ("impersonation"). This access is strictly purpose-bound — solely for the delivery and maintenance of the Service — and is not used for any other purpose.
4.An impersonation session expires automatically after no more than 15 minutes and is recorded in an auditable log (audit trail) stating the administrator involved, the Club and the time. During impersonation, the confidentiality and security obligations under this Data Processing Agreement apply in full. The Controller may request, via support@refplan.app, an overview of impersonation actions relating to its environment.
Article 8 — Security
1.The Processor takes appropriate technical and organisational measures to secure Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope and context of the processing.
2.The security measures include at least:
HTTPS encryption for all communication;
Authentication and session management via Supabase Auth;
Row Level Security in the database per club tenant;
Encryption of sensitive configuration data via AES-256-GCM;
MFA requirement for the Processor's platform administrators.
3.The Processor evaluates the security measures periodically and adjusts them where necessary.
Article 9 — Audit and accountability
1.The Controller has the right to verify compliance with this Data Processing Agreement, or have it verified by an independent third party, subject to a notice period of at least 30 days.
2.The costs of an audit are borne by the Controller, unless the audit reveals that the Processor is seriously in default.
3.The Processor provides, on request, all information reasonably necessary to demonstrate compliance with the GDPR obligations.
Article 10 — Retention periods and erasure
1.The Processor does not retain Personal Data longer than necessary for the performance of the Service.
2.After termination of the Agreement, all Personal Data of the Club, including data of End Users, is erased from the systems of the Processor and Subprocessors within 90 days, unless a statutory retention obligation requires longer retention.
3.The Controller may submit an export request within the 90-day period via support@refplan.app.
4.Back-ups are overwritten in accordance with the back-up policy of the database provider (Supabase).
Article 11 — Term
1.This Data Processing Agreement takes effect on the date on which the Club starts using the Service — including the commencement of the Trial Period — and runs parallel to the Agreement.
2.Upon termination of the Agreement, this Data Processing Agreement also ends, without prejudice to the obligations that by their nature continue (such as erasure of data and confidentiality).
Article 12 — Governing law
1.This Data Processing Agreement is governed by Dutch law.
2.Disputes are submitted to the competent court of the District Court of Oost-Brabant.
Article 13 — Acceptance and amendments
1.This Data Processing Agreement is concluded at the moment the Club accepts Refplan's Terms and Conditions. Acceptance of the Terms and Conditions — upon registration for the Service, including the start of the Trial Period, or by using the Service — also constitutes acceptance of this Data Processing Agreement. A separate signature of the Club is not required for validity.
2.Refplan records the version and the time of acceptance for evidentiary purposes. On request, Refplan provides a signed copy of this Data Processing Agreement for the Club's records.
3.Material amendments to this Data Processing Agreement — for example the addition or replacement of a Subprocessor, expansion of the categories of Personal Data, or amendment of the retention periods — are communicated to the Club by e-mail at least 30 days in advance. In the event of objection to an amendment, the Club may terminate the Agreement as of the effective date of the amendment, without incurring any costs or refund obligations.
4.Interim adjustments that are solely editorial, legal-technical or clarifying in nature may be implemented without prior notice. The version number and the date at the bottom of this document show the currently applicable version at all times.
This Data Processing Agreement is a click-through agreement and takes effect without a separate signature. Clubs that internally require a signed copy can contact us for this via support@refplan.app.
This document is an English translation of the Dutch "Verwerkersovereenkomst". In the event of any discrepancy between the English and Dutch versions, the Dutch version prevails.