Data Processing Agreement
Zelador Football — Effective Date: May 2026
Version 1.0
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Zelador Football ("Processor", "we") and the subscribing club or organization ("Controller", "you") and governs the processing of personal data and club financial data.
1. Definitions
- "Personal Data" means any information relating to an identified or identifiable natural person, including email addresses, names, and user account information.
- "Club Data" means financial data, squad data, contract information, revenue figures, and other club-specific information entered into the platform.
- "Processing" means any operation performed on data, including collection, storage, retrieval, use, and deletion.
- "Applicable Laws" means GDPR (EU), UK Data Protection Act 2018, LGPD (Brazil), Ley 25.326 (Argentina), and any other applicable data protection legislation.
2. Scope & Purpose
The Processor processes data solely for the purpose of providing the Zelador Football platform services as described in the Terms of Service. This includes:
- Storing and processing club financial data to generate health scores, projections, and reports
- Authenticating users and managing access within the club's workspace
- Processing subscription payments through Stripe
- Maintaining audit trails for regulatory compliance (PSR/FFP)
3. Data Categories
| Category | Data Types | Retention |
|---|
| Account Data | Email, name, role, authentication tokens | Active account + 30 days after deletion |
| Club Financial Data | Revenue streams, costs, squad wages, transfer fees, debt, scenarios | Active account + 90 days after deletion |
| Usage Data | Pages visited, features used, session duration (anonymized) | 12 months rolling |
| Payment Data | Subscription plan, billing cycle (card details held by Stripe only) | As required by tax law |
| Audit Trail | Financial change logs with before/after values, user attribution | Up to 5 years (regulatory compliance) |
4. Sub-Processors
| Sub-Processor | Purpose | Location | Certifications |
|---|
| Supabase (AWS) | Database hosting | EU (Frankfurt) | SOC 2 Type II, ISO 27001 |
| Vercel | Application hosting | Global CDN (EU primary) | SOC 2 Type II, ISO 27001 |
| Stripe | Payment processing | USA/EU | PCI-DSS Level 1, SOC 2 Type II |
| Google Analytics | Usage analytics (anonymized) | USA | SOC 2 Type II |
| Sentry | Error monitoring | USA | SOC 2 Type II |
| Resend | Email delivery (alerts) | USA | SOC 2 Type II |
The Controller will be notified of any changes to sub-processors with 30 days' notice.
5. Security Measures
- Encryption: All data encrypted in transit (TLS 1.2+) and at rest (AES-256)
- Access Control: Row-Level Security (RLS) isolates each club's data at the database level. Role-based access control (Owner/Admin/Viewer)
- Audit Logging: Server-side database triggers log all financial data mutations with before/after values and user attribution
- Rate Limiting: API rate limiting prevents brute-force attacks and abuse
- Input Validation: Server-side validation via Supabase Edge Functions prevents malformed data
- Period Locking: Completed financial periods can be locked to prevent retroactive changes
6. Data Subject Rights
The Processor will assist the Controller in responding to data subject requests under Applicable Laws, including:
- Access: Export all data via JSON/CSV (available in-app) within 72 hours of request
- Rectification: Correct inaccurate data within 72 hours
- Erasure: Delete personal data within 30 days of request. Club financial data deleted within 90 days. Audit trail entries may be retained for regulatory compliance (up to 5 years)
- Portability: Data export in JSON and CSV formats available at any time
- Restriction: Limit processing upon request
7. International Data Transfers
Club Data is primarily stored in the EU (AWS Frankfurt via Supabase). Where data is transferred to sub-processors outside the EU/UK/adequate jurisdictions, transfers are protected by:
- Standard Contractual Clauses (SCCs) as approved by the European Commission
- Adequacy decisions where applicable
- The sub-processor's own data protection certifications
8. Data Breach Notification
In the event of a data breach affecting Club Data or Personal Data:
- The Processor will notify the Controller within 72 hours of becoming aware of the breach
- Notification will include: nature of the breach, categories of data affected, approximate number of records, likely consequences, and measures taken
- The Processor will cooperate with the Controller in notifying relevant supervisory authorities and affected individuals as required by Applicable Laws
9. Audit Rights
The Controller may, upon reasonable notice (minimum 30 days), request information about the Processor's data protection practices. The Processor will provide:
- Responses to written security questionnaires
- Copies of relevant certifications and audit reports from sub-processors
- Access to the financial audit trail for the Controller's own club data
10. Term & Termination
- This DPA remains in effect for the duration of the service agreement
- Upon termination, the Controller has 30 days to export all data
- After the export period, all Club Data and Personal Data will be deleted in accordance with Section 6
- Audit trail entries may be retained as specified in Section 3
11. Governing Law
This DPA is governed by the laws applicable to the Controller's jurisdiction. For EU-based clubs: EU law. For UK clubs: UK law. For Argentine clubs: Argentine law (Ley 25.326). For Brazilian clubs: Brazilian law (LGPD).
12. Contact
Data Protection Contact: Dylan Mota, Founder
Email: privacy@zeladorfootball.com
Support: dylan@zeladorfootball.com
Zelador Football (Processor)
Name: ___________________________
Date: ___________________________
Club / Organization (Controller)
Name: ___________________________
Date: ___________________________