01Status, scope and roles
This addendum is a prelaunch proposal, not an executed data processing agreement. Before it becomes effective, the formed operator, club counterparty, provider and location schedule, safeguards and retention arrangements must be confirmed. It will apply when an effective Club Agreement or signed contract incorporates it.
“Club data” means personal information supplied by the club or its authorized users that ClubDojo processes to provide club management on the club’s instructions. The club determines its lawful purposes and is the responsible organization or controller for those uses; ClubDojo acts as its service provider or processor to the extent applicable law recognizes that role.
This addendum does not make a club responsible for ClubDojo’s independent account administration, security, software billing or support purposes, or make ClubDojo the controller of all of a club’s activities. Those purposes and independent payment or identity-provider activities are described in the Privacy Policy.
02Instructions and permitted purposes
The agreement, configured features and documented requests from authorized club representatives provide the club’s instructions. ClubDojo will use club data to supply, maintain, secure and support those services, and for a legal requirement applicable to the processing. It will not sell club data, share it for cross-context behavioral advertising, or use it for an unrelated commercial purpose.
Where applicable service-provider or contractor rules require it, ClubDojo will not retain, use or disclose club data outside the direct business relationship or combine it with unrelated personal information except as permitted by those rules. The club may take reasonable steps to verify compliance and stop or remediate an unauthorized use. ClubDojo will notify the club if it can no longer meet the applicable restrictions.
The club must provide lawful instructions and obtain required notices, consents and authority. ClubDojo will inform the club if it reasonably believes an instruction conflicts with applicable data-protection requirements and may pause that processing while the parties resolve it. Where disclosure is legally required, ClubDojo will notify the club unless the law prohibits notice.
03Processing details
- Purpose
- Manage club membership, activities, reservations, registrations, competitions, operational communications and payment or credit records; provide related support and security.
- People
- Adult club members, administrators, staff, account holders and invitees whose information is lawfully submitted.
- Information
- Identity and contact details, optional profile and eligibility details, club roles, invitations, activity and competition records, posts and media, financial amounts and references, debts, credit and settlement notes, and relevant technical records.
- Operations
- Collection, storage, organization, retrieval, permission-controlled display, transmission, calculation of balances and participation records, correction, restricted retention and deletion.
- Duration
- While providing the service and carrying out lawful return, deletion and retained-record obligations. Category-specific retention must be confirmed before activation.
- Excluded uses
- No child-account or guardian-managed profile service, medical-record repository, full-card-data storage or unrelated advertising database.
04Confidentiality and safeguards
ClubDojo will restrict personnel access to authorized duties and bind persons with access to appropriate confidentiality obligations. It will maintain proportionate technical and organizational safeguards taking account of the information and processing risks.
The service’s safeguards include authenticated sessions, authorization by club and role, password hashing, optional stronger authentication and protected transport. Operating procedures must address access removal, patches, logs, backups, restoration and secure disposal. The launch security schedule must verify those procedures and the providers supporting them; this document is not a claim of certification or a guarantee that no incident can occur.
The club remains responsible for its own devices, administrators, credentials, downloaded copies and independent service providers. It must tell ClubDojo about suspected misuse relevant to the service.
05Providers, locations and transfers
ClubDojo may engage providers necessary for the agreed services, under written obligations appropriate to the processing. The launch schedule must identify each actual provider, service, data involved, processing role, location and applicable transfer safeguard. The current functional inventory is in the Privacy Policy: Cloudflare network/storage/security, Resend email, configured hosting and database services, and Sentry only if enabled. Stripe, Polar and optional Google or Apple features have activity-specific roles; their independent purposes must not be mislabeled as subcontracted club processing.
The club will receive reasonable advance notice of a material new subprocessor affecting its data and an opportunity to raise a substantiated privacy or security objection before the change, except where urgent replacement is needed to protect the service. The parties will seek a reasonable alternative or agree how affected processing will end if they cannot resolve the objection. ClubDojo remains responsible for its providers’ performance of delegated processing obligations.
Information may be processed outside the United States or Canada. The parties must assess the actual destinations, required contracts and applicable Canadian federal or provincial transfer requirements before enabling that processing. This preview does not establish data residency, execute European standard contractual clauses, or authorize a transfer for which additional safeguards are required.
06Requests, incidents and cooperation
Taking account of the processing and available information, ClubDojo will reasonably assist the club with individual privacy requests, required security assessments and its response to a personal-information incident. Requests received directly that concern club data will be directed or coordinated with the club unless ClubDojo must respond under law. Each organization remains responsible for the duties that apply to it.
ClubDojo will notify the club without undue delay after confirming an unauthorized access, disclosure, alteration or loss of club data requiring the club’s response. Notices will include information reasonably available about the incident, affected data, likely consequences and measures taken or proposed, with updates as the investigation develops. Notification is not an admission of fault and may not be delayed solely because every detail is not yet known. Any shorter applicable legal or signed contractual deadline controls.
The club decides and makes notices that belong to it, with reasonable assistance; ClubDojo makes its own required notices. Neither party may prevent the other from satisfying a legal duty. Use [email protected] for coordination and maintain an available club contact.
07Return, deletion and review
On a lawful club instruction or termination, ClubDojo will coordinate return or deletion of club data, subject to required retention and protection of other people’s rights. Available return formats and a practical secure process must be agreed; no complete self-service export is promised. Unresolved money obligations do not by themselves extinguish an applicable individual privacy right.
Necessary retained financial, dispute and security records must have a documented purpose, restricted access and an approved retention criterion. Backup copies follow the verified backup lifecycle and remain protected; deletion instructions must be reapplied if a backup is restored. The club will be told of material retention exceptions relevant to its instruction.
ClubDojo will make available information reasonably necessary to demonstrate its relevant processing obligations and cooperate with a proportionate compliance review. Reviews must protect other customers’ information and service security. The parties may use suitable documentation or independent assessments where adequate; this does not exclude an audit or regulator access required by law.
This addendum controls conflicting general agreement language on club-data processing. Mandatory legal obligations continue to apply. Any changes require an identified new edition and the notice or agreement required for the affected relationship.