Data Processing Agreement
Version 1.0 • Last updated 21 September 2026
1. Scope and incorporation
This Data Processing Agreement (“DPA”) applies where HIA – Handball in Analysis processes personal data on behalf of a coach, club, federation, company, school or other customer that determines the purposes and means of that processing and therefore acts as controller. Where applicable, this DPA forms part of the agreement for use of HIA and is intended to satisfy Article 28 of Regulation (EU) 2016/679 (“GDPR”).
2. Parties and roles
The Controller is the HIA customer or organisation that determines why and how relevant player, staff or other third-party personal data is processed. The Processor is Willian Ferrari, responsible for HIA – Handball in Analysis, Portugal, contactable at handballinanalysis@gmail.com, to the extent HIA processes that data on the Controller’s behalf. HIA may separately act as controller for its own account administration, security, billing, legal compliance, support and service-management activities.
3. Subject matter and duration
The processing concerns provision, hosting, operation, security, support and maintenance of HIA functionality, including team management, player information, match-event collection, performance analysis, statistics, charts, timelines and reports. Processing continues while HIA provides the relevant service and for any limited period afterwards required for deletion, return, security or lawful retention.
4. Nature and purpose of processing
Processing may include collection from authorised users, recording, organisation, structuring, storage, retrieval, consultation, calculation, analysis, display, transmission within authorised service functions, backup, security monitoring, troubleshooting and deletion. HIA processes Controller Personal Data only to provide, secure, support and maintain the service, comply with documented lawful instructions, or where required by applicable Union or Member State law.
5. Categories of data subjects
Depending on use, data subjects may include handball players, including young players, coaches, goalkeepers, staff members, authorised club or team personnel and other individuals whose information is lawfully entered into match or team records.
6. Types of personal data
Controller Personal Data may include names, player numbers, positions, team association, match participation, events, timestamps, goals, saves, missed shots, turnovers, goalkeeper information, statistics, performance information, charts, timelines and report content, together with identifiers necessary to associate records with the Controller’s account or team. HIA is not intended as a medical, biometric, financial, government-identity or safeguarding-case management system.
7. Documented instructions
The Controller instructs HIA to process Controller Personal Data as necessary to provide selected service features and as otherwise lawfully documented. HIA will process such data only on documented instructions, including regarding third-country transfers, unless applicable law requires otherwise. Where legally permitted, HIA will inform the Controller of such a requirement. If HIA reasonably considers an instruction unlawful, it may inform the Controller and suspend affected processing while the issue is clarified.
8. Controller obligations
The Controller is responsible for ensuring that its instructions and use of HIA comply with law, that an appropriate lawful basis exists, required privacy information is provided, access is limited to authorised users, and data is adequate, relevant, accurate and limited to what is necessary. For children or young players, the Controller is responsible for applicable legal, parental or guardian, safeguarding, club and federation requirements.
9. Confidentiality
HIA will ensure that persons authorised by HIA to process Controller Personal Data are subject to an appropriate contractual or statutory duty of confidentiality and access personal data only as necessary for authorised functions.
10. Security measures
Taking into account the state of the art, implementation costs and the nature, scope, context and purposes of processing, HIA will maintain technical and organisational measures intended to provide security appropriate to the risk. Measures may include authenticated access, access restrictions, encrypted transmission, provider-managed storage protections, restricted administrative access, logging, backup and recovery capabilities, infrastructure security controls, software updates and incident-response procedures.
11. Subprocessors
The Controller gives HIA general written authorisation to engage subprocessors necessary to provide the service. Depending on features used, these may include Google/Firebase and Google Cloud for authentication, database, hosting and infrastructure; Stripe for payment-related services; and Resend for service communications. HIA will impose applicable Article 28 obligations on subprocessors and will make information about material additions or replacements available through legal documentation or another reasonable communication channel. Where required by law, the Controller will have a reasonable opportunity to object on legitimate data-protection grounds.
12. International transfers
Where Controller Personal Data is transferred outside the European Economic Area and the GDPR requires a transfer mechanism, HIA will use an applicable lawful mechanism, such as an adequacy decision, approved Standard Contractual Clauses or another recognised mechanism, together with supplementary safeguards where appropriate.
13. Assistance with data-subject rights
Taking into account the nature of processing, HIA will provide reasonable assistance through appropriate technical and organisational measures, insofar as possible, to help the Controller respond to applicable data-subject rights. If HIA receives a request directly relating primarily to Controller Personal Data, HIA may direct the individual to the Controller or notify the Controller unless law requires otherwise.
14. Assistance with compliance
Taking into account the nature of processing and information available to HIA, HIA will provide reasonable assistance concerning security, personal data breaches, data protection impact assessments and prior consultation where Articles 32 to 36 GDPR apply. The Controller remains responsible for determining its own compliance obligations.
15. Personal data breaches
HIA will notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller Personal Data processed on its behalf. To the extent reasonably available, HIA will provide information to assist the Controller in assessing the incident and meeting applicable notification obligations.
16. Deletion and return
At the end of relevant processing services, and subject to documented instructions and available service functionality, HIA will delete or return Controller Personal Data and delete remaining copies unless Union or Member State law requires storage. Residual data may remain temporarily in protected backups or provider recovery cycles and will not be used for ordinary service purposes. Effectively anonymised information is not subject to these personal-data obligations.
17. Information and audits
HIA will make available information reasonably necessary to demonstrate compliance with Article 28 processor obligations and cooperate with reasonable compliance enquiries. Where legally required and documentary information is insufficient, the Controller may request a reasonable and proportionate audit subject to confidentiality, security safeguards and reasonable advance notice, unless a supervisory authority or substantiated serious incident requires otherwise. HIA need not disclose information that would compromise another customer’s confidentiality, platform security, trade secrets or protected intellectual property.
18. Records and supervisory authorities
Each party is responsible for maintaining records of processing activities required of it by applicable law. HIA will cooperate with the competent supervisory authority as required by the GDPR in relation to processing covered by this DPA.
19. Liability and mandatory law
Liability arising from processing under this DPA is subject to applicable HIA contractual terms and mandatory data-protection law. Nothing excludes or limits rights, remedies or liabilities that cannot lawfully be excluded or limited.
20. Changes and termination
HIA may update this DPA where necessary to reflect changes in law, regulatory guidance, subprocessors, security practices or the service. Material changes affecting the Controller’s rights or obligations will be communicated through a reasonable channel and, where required, acceptance or another lawful mechanism will be obtained.
21. Governing law and contact
This DPA is governed by applicable Portuguese and European Union law, without prejudice to mandatory rights and jurisdiction rules under the GDPR. Questions concerning this DPA may be sent to handballinanalysis@gmail.com.