Data Processing Addendum

1. Roles and scope

The Customer determines the purposes and means of processing workspace personal information and acts as controller or business, or is authorized to appoint ClubNest for another controller. ClubNest acts as processor or service provider for that processing. Separate information for which ClubNest independently determines the purpose—such as its own account relationship, subscriptions and lawful security or business administration—is governed by the Privacy Policy. A label does not change a party’s statutory role or duties.

2. Documented instructions

The agreement, Customer configuration and authorized use provide the instructions to host, organize, retrieve, display, transmit, export and delete Customer personal information to provide and support the service. ClubNest will process it only on those instructions or as required by law, notify the Customer of a legal requirement where permitted, and inform the Customer if an instruction appears unlawful. We may suspend the affected processing while the parties resolve an unlawful instruction.

3. Processing details

Subject matter and purpose: membership and organization administration, including access, family records, payments, documents and completion evidence, events, communications, governance, reporting and recovery.

Duration: the service relationship and the time needed for instructed return or deletion and lawful retention.

People: members, applicants, parents and children with parent-managed records, administrators, employees, volunteers, donors, sponsors, event participants, contacts and others whose information the Customer lawfully supplies.

Information: identification, contact and account details; age and guardian relationships; memberships, qualifications and activity; payment-related records; documents, photos, signatures and form answers; messages, posts, votes, incidents and audit or support records. The Customer must avoid unnecessary sensitive information and prohibited regulated data.

4. Restrictions on use and disclosure

ClubNest will not sell or share Customer personal information for cross-context behavioral advertising; retain, use or disclose it outside the direct business relationship or for purposes other than the specified services and legally permitted purposes; or combine it with information from other customers or independent sources except as applicable law permits to perform the services. We will not use it to build advertising audiences or train a general-purpose model for unrelated use.

Where California service-provider or contractor requirements apply, ClubNest will comply with applicable obligations, provide the same level of privacy protection required by the CCPA, and certify that it understands and will comply with these restrictions. We will notify the Customer if we determine we can no longer meet them. The Customer may take reasonable and appropriate steps to verify consistent use and, upon notice, stop and remediate unauthorized use.

5. Confidentiality and safeguards

People authorized to process Customer information must be subject to confidentiality duties and access appropriate to their responsibilities. ClubNest will maintain reasonable administrative, technical and physical safeguards appropriate to processing risks, including access authorization, protected transmission, organization isolation and incident response. The Security page describes current measures; it is not a representation of an independent certification.

6. Providers and changes

The Customer authorizes the providers identified on the Subprocessors page for the stated functions. ClubNest will use written obligations requiring applicable confidentiality, security and data-processing protections and remains responsible for performance of its processor obligations when using subprocessors.

Before a material new subprocessor begins processing Customer information, we will notify affected Customers through account email or the service and provide a reasonable opportunity to object on data-protection grounds. When practicable, notice will be at least 30 days in advance; an urgent security or continuity replacement may need shorter notice, with prompt explanation. Contact info@clubnest.tech to object. We will seek a reasonable solution; if none is available, the Customer may end the affected service and receive a refund of unused prepaid fees for it. Customer-selected independent services are governed by their own relationship with the Customer.

7. Requests and compliance assistance

Taking into account the nature of processing and available information, ClubNest will reasonably assist the Customer with individual rights requests, security duties, breach notifications, data-protection assessments and regulator inquiries required by law. We will notify the Customer of requests about information it controls, unless prohibited, and will not make unauthorized substantive responses except where we have our own legal duty. Customers must respond within applicable deadlines and give workable instructions.

8. Personal information breaches

ClubNest will notify an affected Customer without undue delay after becoming aware of a breach involving Customer personal information and within any shorter applicable legal deadline. Notice will describe available details about the incident, affected data and people, likely consequences, mitigation and a response contact. We may provide information in phases as the investigation develops; investigation is not a reason to postpone a notice legally due. We will take reasonable containment and remediation steps and cooperate with the Customer’s lawful response. Each party remains responsible for notices it is legally required to make.

9. Return, deletion and backups

At the Customer’s choice and instruction, ClubNest will return or delete Customer personal information at the end of the services, except where law requires retention. Request an export before ending access. An optional deletion recovery window does not override required rights-request deadlines. Information remaining in restricted backups stays protected, is unavailable for ordinary use, and is deleted when its applicable retention expires. Restoration must reapply intervening deletion and access restrictions. Legally retained information may be used only for that retention purpose and must be deleted when the requirement ends.

10. Information, audits and inspections

ClubNest will make available information reasonably necessary to demonstrate compliance with its applicable processor obligations and allow and contribute to reasonable Customer or independent-auditor assessments and inspections as required by law. The parties will coordinate scope, confidentiality, timing and safeguards for other customers’ information. Existing relevant evidence may be used where sufficient; these arrangements do not prevent a legally required audit, regulator access or urgent investigation.

11. Customer obligations

• Collect and use information lawfully; give clear notices and obtain required permissions, including for youth and sensitive information.
• Provide only necessary information and avoid prohibited regulated records.
• Verify guardian and signer authority and configure permissions, sharing, retention and preservation holds appropriately.
• Maintain accurate instructions, remove obsolete access and handle individual requests within applicable deadlines.
• Review and lawfully authorize connected independent services and international processing requirements.

12. Locations, precedence and survival

ClubNest operates from the United States and providers may use infrastructure in other countries. Before a transfer requiring an additional safeguard, the parties must establish the applicable mechanism. This DPA does not by itself execute European standard contractual clauses, a UK transfer addendum or a HIPAA business associate agreement.

This DPA controls conflicts concerning processing of Customer personal information to the extent needed to comply with applicable law. A separately executed data-protection agreement may supply additional terms. Neither the Terms nor this DPA removes liabilities or rights that cannot lawfully be limited. Confidentiality, protected retention and deletion obligations continue for as long as ClubNest retains Customer personal information.