Data Processing Addendum

Version 1.0 · Last updated: 14 October 2026

This addendum applies when a club (the "Customer") uses RugbyMetrics and WebNest Creations, Georgia, USA ("RugbyMetrics") processes personal data for the Customer. It forms part of the Terms of Service and applies automatically when the Customer's account owner accepts them. It does not need to be signed.

1. Roles and scope

• The Customer is the controller (in POPIA: the "responsible party") of the personal data it puts into the service about its players, staff and other people. RugbyMetrics is the processor (in POPIA: the "operator").
• Subject matter and duration: running the RugbyMetrics service for the Customer for as long as the Customer has an account, plus the deletion periods in section 9.
• People: the Customer's players (adults only), coaches, medical, strength and conditioning and other staff, administrators.
• Data: the categories in our Privacy Policy, including health-type data (injuries, wellness, readiness, body measurements), which the Customer must only enter with the player's explicit consent.
• Purpose: hosting, storing, displaying, exporting and backing up the data so the Customer can use the service. Nothing else.
• For account and billing data and the website, RugbyMetrics is itself a controller (see the Privacy Policy). This addendum does not apply to that data.

2. What RugbyMetrics does as processor

1. Instructions only. We process the data only on the Customer's documented instructions — these terms and the Customer's use of the service's features (including its export and delete tools) — unless the law requires otherwise, in which case we tell the Customer first where we are allowed to. If we think an instruction breaks data protection law, we will say so.
2. Confidentiality. Only people who need access to run the service can get to the data, and they are bound by confidentiality.
3. Security. We use appropriate technical and organisational measures: encryption in transit; row-level security on every table so each user sees only what their role allows; no service keys in the browser; read-only public demo; owner-only platform functions; private nightly backups kept for 14 days; and logging of account-level actions. These are summarised in the Privacy Policy and may be improved over time but will not be reduced below this level.
4. Subprocessors. The Customer gives general authorisation for the subprocessors below. We bind each to data protection terms no less protective than these, and we remain responsible for them.
5. Helping with rights requests. The service lets players export and delete their own data and lets the owner export and delete the whole organisation. If a person asks us directly about the Customer's data, we pass the request to the Customer and do not answer it ourselves unless the Customer asks us to. We help the Customer respond within the legal time limits.
6. Breach notice. If we become aware of a personal data breach affecting the Customer's data, we tell the Customer's owner without undue delay and give what we know so the Customer can meet its own notification duties.
7. Assistance. We give reasonable help with data protection impact assessments and consultations with regulators, taking into account the nature of the processing.
8. Records and audits. We keep a record of our processing for the Customer. We show compliance through documentation: this addendum, the Privacy Policy and, on reasonable request, written answers about our measures. An on-site audit is not part of the standard service; if a regulator requires one, we will cooperate.

3. Subprocessors

We will tell the Customer's owner in the app, and update this page, before adding or replacing a subprocessor. The Customer may object on reasonable data protection grounds; if we cannot resolve it, the Customer may export its data and end the service.

4. International transfers

The data is processed in the United States. The following apply by reference and are incorporated into this addendum, completed as set out here:

• EU/EEA (including Ireland and France): the Standard Contractual Clauses (EU) 2021/914, Module Two (controller to processor): the Customer is the exporter and RugbyMetrics the importer; clause 7 docking applies; option 1 (general authorisation) in clause 9 with the notice in section 3; the governing law and courts are those of Ireland; the competent supervisory authority is that of the Customer's establishment; Annexes I–III are the information in sections 1–3 of this addendum.
• United Kingdom: the UK Addendum to the EU SCCs issued by the Information Commissioner (version B1.0), with the same details.
• South Africa: section 72 of POPIA: RugbyMetrics is bound by this agreement, which provides an adequate level of protection and the safeguards of POPIA for the data.
• Australia: APP 8: the Customer remains accountable for overseas disclosure and RugbyMetrics takes reasonable steps to handle the data in line with the Australian Privacy Principles.

If a competent authority replaces any of these transfer tools, the replacement applies from the date it takes effect.

5. What the Customer must do

• Have a lawful basis, and where needed the player's explicit consent (especially for health-type data), for everything it enters, and give players the required notices.
• Enter only people aged 18 or over.
• Keep accounts and roles under its control and tell us promptly of any misuse.

6. Backups

We keep a nightly backup of the service for 14 days, then it is overwritten. Data the Customer deletes can remain in a backup until it ages out.

7. Data subject requests

Players can use Settings → My data to download or delete their own data. The Customer's owner can export all the organisation's data and delete the organisation. Requests to [email protected] are answered within 30 days.

8. Breaches

See section 2.6. The notice goes to the owner of the Customer's organisation and says what happened, which data is likely to be affected, and what we are doing about it.

9. Deletion or return at the end

At the end of the service the Customer can export all its data (the organisation export) and delete it. Deleting an organisation makes it read-only for 30 days (the owner can cancel), then all of its data and video files are permanently deleted, and the deletion is logged by counts only. Copies in backups are overwritten within 14 days after that. We keep what the law requires us to keep.

10. Liability and order of precedence

The liability limits in the Terms of Service apply to this addendum, except where data protection law does not allow them. If this addendum conflicts with the Terms about personal data, this addendum prevails; the SCCs and UK Addendum prevail over both for the transfers they cover.

11. Contact

Data protection contact and South African Information Officer: WebNest Creations, Georgia, USA · [email protected]

Questions about this page: [email protected]