Legal

Data Processing Agreement

Template agreement between a club and Bestplay Studio for the personal data Bestplay processes on the club's behalf (GDPR Article 28).

Last updated: 2026-11-03

This Data Processing Agreement (the “DPA”) is a template. A club enters into it with Bestplay Studio by completing and signing the signature fields at the end. It forms part of the agreement under which the club uses Bestplay products (the “Agreement”).

1. Parties

Controller: the club, school, federation or other organization named in the signature fields below (the “Club”).

Processor: the company BESTPLAY STUDIO YAZILIM ANONİM ŞİRKETİ, registered at Maslak Mahallesi, Anka Sokak, Mashattan B4, No: 2 B/4, İç Kapı No: 71, Sarıyer, Istanbul, Türkiye (“Bestplay”). Contact: studio@bestplay.ai.

2. Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meaning given in the EU General Data Protection Regulation 2016/679 (the “GDPR”). “Club Personal Data” means personal data that Bestplay processes on behalf of the Club under the Agreement. “Data Protection Law” means the GDPR and any other data protection law that applies to the Club, including the Turkish Law No. 6698 on the Protection of Personal Data (KVKK), the Serbian Law on Personal Data Protection (ZZPL) and the Law of the Republic of Azerbaijan on Personal Data.

3. Subject matter and duration

Bestplay processes Club Personal Data only to provide the Bestplay products the Club uses under the Agreement. Annex 1 describes the processing. This DPA applies for as long as Bestplay processes Club Personal Data.

4. Roles

The Club is the controller of Club Personal Data and Bestplay is its processor. The Club is responsible for having a lawful basis for the processing, including any consent required from athletes or, for minors, from their parents or guardians, and for giving data subjects the information that Data Protection Law requires.

5. Obligations of Bestplay

Bestplay:

• processes Club Personal Data only on the Club's documented instructions, including with regard to transfers to third countries, unless the law requires otherwise; in that case Bestplay informs the Club before processing unless the law prohibits it. The Agreement, this DPA and the Club's use of product settings are the Club's instructions;
• informs the Club immediately if, in its opinion, an instruction infringes Data Protection Law;
• ensures that the people authorized to process Club Personal Data are bound by confidentiality;
• takes the technical and organizational measures described in Annex 2 (GDPR Article 32);
• engages sub-⁠processors only as set out in Section 6;
• helps the Club, through appropriate technical and organizational measures and as far as possible, to respond to requests from data subjects exercising their rights;
• helps the Club meet its obligations on security, breach notification, data protection impact assessments and prior consultation (GDPR Articles 32 to 36), taking into account the nature of the processing and the information available to Bestplay;
• makes available to the Club the information needed to demonstrate compliance with this DPA, and allows and contributes to audits as set out in Section 9.

6. Sub-processors

The Club gives Bestplay general authorization to engage the sub-⁠processors listed in Annex 3. Bestplay informs the Club by email at least 30 days before it adds or replaces a sub-⁠processor, so that the Club can object. If the Club objects on reasonable data protection grounds and the parties cannot agree on a solution, the Club may terminate the affected services. Bestplay imposes on each sub-⁠processor, by contract, the same data protection obligations as in this DPA and remains liable to the Club for the sub-⁠processor's performance.

7. International transfers

Bestplay is established in Türkiye, and some sub-⁠processors process data in other countries (Annex 3).

Where the Club is established in the European Economic Area (EEA), the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, Module 2 (controller to processor), apply to transfers of Club Personal Data to Bestplay and are incorporated into this DPA by reference. For those clauses, the Club is the data exporter and Bestplay is the data importer; the optional docking clause (Clause 7) applies; option 2 of Clause 9 applies, with the notice period in Section 6; the optional wording in Clause 11 does not apply; the competent supervisory authority under Clause 13 is that of the Member State where the Club is established; Clause 17 (option 2) refers to the law of the Member State where the Club is established and, where that law does not allow for third-⁠party beneficiary rights, to the law of the fallback Member State named in the signature fields; Clause 18 refers to the courts of the Member State where the Club is established; and Annexes 1 to 3 of this DPA complete Annexes I to III of the clauses. If this DPA and the clauses conflict, the clauses prevail.

Where the Club is established in Serbia, transfers rely on Chapter V of the ZZPL, including the standard contractual clauses adopted by the Commissioner for Information of Public Importance and Personal Data Protection where they are required. Where the Club is established in Azerbaijan, transfers follow the cross-⁠border transfer rules of the Law on Personal Data, and the Club obtains any consent of data subjects that those rules require.

Bestplay transfers Club Personal Data to sub-⁠processors outside the EEA only in line with Chapter V of the GDPR and, on request, tells the Club which safeguard applies to each transfer.

8. Personal data breaches

Bestplay notifies the Club without undue delay after becoming aware of a personal data breach affecting Club Personal Data. The notice describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Bestplay provides further information as it becomes available and helps the Club with its own notifications.

9. Audits

On request, Bestplay gives the Club the information needed to show compliance with this DPA. The Club, or an independent auditor bound by confidentiality, may audit compliance once a year, and also after a personal data breach, with at least 30 days' written notice, during business hours and without disrupting Bestplay's operations. Each party bears its own costs of an audit.

10. Return and deletion

When the services end, Bestplay, at the Club's choice, returns Club Personal Data to the Club in a common machine-⁠readable format or deletes it, and deletes existing copies unless the law requires Bestplay to keep them. Copies in backups are deleted when those backups expire.

11. Liability and order of precedence

Liability under this DPA is governed by the Agreement. If this DPA and the Agreement conflict on the processing of Club Personal Data, this DPA prevails.

Annex 1: Description of the processing

• Data subjects: the Club's athletes, including minors; parents and guardians of athletes; the Club's staff, such as coaches, managers and accountants; people who apply to or register with the Club through Bestplay forms.
• Categories of personal data: identity and contact data; membership, branch and group data; attendance, schedules and events; measurements and coach evaluations; fees, instalments and payment records; weekly tasks, goals and daily check-⁠ins (energy, mood, sleep, muscle soreness); chats with AI coaches; photos and files; consent records.
• Special categories of data: health-⁠related data, such as daily check-⁠ins and measurements, and, where the athlete allows it, data read from Apple Health or Health Connect.
• Nature and purpose: storing, organizing, displaying, analyzing and sending Club Personal Data so that the Club can run its activities with the Bestplay products it uses, including AI processing for coach chats, weekly task suggestions and the Buddy club assistant.
• Frequency: continuous, for the term of the Agreement.
• Duration: the term of the Agreement, followed by return or deletion under Section 10.

Annex 2: Technical and organizational measures

• Encryption in transit: the panel, the parent page and the app connect to the API and the database only over https; the iOS app does not allow unencrypted connections.
• Access control: every request that returns personal data is checked against a time-⁠limited session key. Access follows the Club's roles: coaches and coordinators see only the athletes in the branches and groups assigned to them. Staff who work for more than one club state on each request which club they act for, and the request is rejected without an active membership in that club.
• Parent access: setup links work once, expire after 7 days and are stored only as SHA-256 digests. The Club can remove a parent's access at any time.
• Files: photos, registration documents and consent texts are kept in storage that is not public and open only through time-⁠limited links. Photos added to coach chats are deleted automatically after 90 days.
• AI processing: chats with AI coaches are open only to the athlete who owns them. The log of AI calls does not keep message text.
• Abuse protection: endpoints that need no session, such as registration forms, limit how many requests can come from the same address. Admin and scheduled-⁠job endpoints require a secret key.
• Logs: the API does not write database queries to its logs.
• No advertising: the app shows no ads and has no advertising infrastructure.

Annex 3: Sub-processors

Signatures

By signing, the Club and Bestplay agree to this DPA.