01Who we are
Ruckr is the rugby club software service operated as Ruckr Rugby (“Ruckr”, “we”, “us”). Contact [email protected] about the service, these documents or Ruckr’s handling of personal information. Your club is a separate organisation; its name and contact details should appear in its own policies.
02Parties, scope and priority
This agreement is between the club identified in its subscription/account and Ruckr Rugby. It applies where Ruckr processes personal data on that club’s behalf. It supplements the product terms and takes precedence on that subject where they conflict. It does not govern Ruckr’s independent-controller processing or turn an independent payment/social provider into a sub-processor.
The officer accepting must have authority for the club. The acceptance record identifies the document version and its text, the club, accepting person and time. A later web-page edit does not rewrite that record. Any negotiated addition must be expressly agreed by both parties; entering a note alone does not amend this agreement.
03Processing schedule
Subject matter and duration: hosting and operating the club’s selected Ruckr functions during the service and any authorised offboarding or retention period, until relevant data is returned or deleted. Nature of processing: collection, recording, organisation, storage, retrieval, controlled access, transmission, publication when instructed, export, restriction and deletion.
Purposes: the club’s documented membership, team, fixture, coaching, communication, payment administration, welfare, media, event, volunteer and governance activities selected in the service. Categories of people: members, players, children, guardians, staff/volunteers, officers, guests, contacts, payers and people properly named in club records.
Types of data: identity and contact details, family links, roles and qualifications, availability/attendance/selection and development records, messages and files, payment references, images, consents and access records. Where the club uses the relevant functions, data can include health and other special-category information and sensitive allegations; criminal-offence data requires its own lawful authority and safeguards.
04Documented instructions and the club’s duties
Ruckr will process club personal data only on documented instructions, including the agreed service configuration and lawful authorised actions, unless applicable law requires otherwise. Where law requires other processing, Ruckr will inform the club before processing unless the law prohibits that information. Ruckr will tell the club if, in its opinion, an instruction infringes applicable data-protection law and may pause that instruction while it is resolved.
The club determines lawful purposes and bases, provides required notices, obtains valid permissions, verifies the authority of users and recipients, maintains accurate roles and chooses appropriate retention. It must not instruct Ruckr to process unlawfully or disclose more than needed. Ruckr’s own processor obligations remain Ruckr’s responsibility.
05Confidentiality and security
Ruckr will ensure that people authorised to process the data are subject to confidentiality obligations and receive access appropriate to their duties. It will maintain technical and organisational measures appropriate to the nature, scope and risk of the processing, including access controls, secure transmission, protected storage, operational monitoring and relevant audit records.
The design includes additional access controls for medical and welfare workflows and support for guardian, consent and public-display restrictions. Security also depends on the club’s role assignments, devices and recipients. Neither party will materially reduce agreed protection without an appropriate assessment and any required notice.
06Sub-processors
The club gives general authorisation for sub-processors in the provider register that are needed for its selected service functions. Independent-controller services and recipients chosen directly by the club must be distinguished from that authorisation. Ruckr will impose written data-protection obligations on its sub-processors providing the protections required for the processing and remains responsible for their performance of those obligations to the club.
Ruckr will give advance notice of an intended addition or replacement, normally at least 30 days before use, so the club can raise a reasonable data-protection objection. The parties will seek an appropriate resolution, such as an alternative or disabling an optional function; if none is available, the affected service can be ended with return/deletion arrangements. Urgent protective changes must be explained promptly and do not remove required legal safeguards.
07International transfers
Ruckr will not make a restricted transfer of club data without a valid basis and the safeguards required by applicable data-protection law. Depending on the recipient, this may involve applicable adequacy regulations or approved contractual clauses with the necessary UK provisions, risk assessment and supplementary measures.
The register distinguishes the main hosting location from authentication, delivery, payments, support and optional integrations. On reasonable request, Ruckr will provide relevant transfer information and a copy or meaningful summary of safeguards, with necessary protection for confidential information.
08Assisting with individuals’ rights
Taking account of the processing, Ruckr will assist the club with appropriate technical and organisational measures to respond to requests. Tools for access, export, correction, restriction, consent and deletion support that work; the club remains responsible for verifying the requester, considering exceptions and answering within the required period.
If Ruckr receives a request about club-controlled data, it will notify or direct the request to the club without undue delay and will not independently decide the club’s response except as authorised or legally required. Ruckr answers separately for the data for which it is controller.
09Personal-data breaches
Ruckr will notify the club without undue delay after becoming aware of a personal-data breach affecting club data. Its contractual target is an initial notification within 48 hours of awareness; that is not permission to delay an available urgent warning. Information may be supplied in phases as the investigation develops.
The notification will, so far as known, describe the incident, affected categories and approximate scope, likely consequences, mitigation and a contact route. Ruckr will take appropriate containment and remediation steps and assist the club’s assessment. The club decides its regulator and individual notifications for its processing; Ruckr remains responsible for any notification duty applying directly to it.
10Risk assessments and regulatory assistance
Taking into account the processing and information available, Ruckr will assist the club with security obligations, impact assessments and any required consultation with a supervisory authority. The club must provide enough information about its proposed use for meaningful assistance. Neither the product nor the public DPIA summary constitutes a compliance certification.
11Return, deletion and retained copies
At the end of the processing service, the club chooses return or deletion of the club data, subject to applicable law requiring retention. The parties will agree a practical export/deletion timetable and identify any justified retained category, reason, access restriction and end point. A general archive setting is not authority to retain all personal data indefinitely.
Ruckr will delete remaining processor copies after the agreed return/deletion process unless law requires retention, and will make relevant completion information available. Protected backup copies will expire through the applicable backup lifecycle, remain unavailable for ordinary use and be subject to the deletion decision if restored. The club is responsible for its own exports and independent recipients.
Where an earlier erasure or restriction request requires action outside an automated retention setting, the club must instruct Ruckr through the appropriate support route. Product minimum settings are not a substitute for assessing that request.
12Evidence, audit and cooperation
Ruckr will make information available to demonstrate compliance with this agreement and allow and contribute to audits and inspections by the club or an appointed auditor as required by applicable law. Routine reviews should use proportionate evidence and reasonable notice, protect other customers and confidential security information, and avoid unnecessary disruption.
Reasonable coordination of timing, scope and costs must not prevent a required audit or urgent investigation. There is no blanket once-a-year limit where a breach, credible concern or legal requirement makes another review necessary. Each party will cooperate with competent supervisory authorities as required.
13Responsibility, duration and law
Each party retains its statutory responsibilities. The club’s role as controller does not waive Ruckr’s processor duties; the DPA does not restrict an individual’s legal remedies. Commercial liability terms apply only to the extent consistent with mandatory law.
This agreement continues for as long as Ruckr processes the club data covered by it. It is governed by the law of England and Wales, without displacing applicable data-protection requirements. Material amendments require an appropriate new version and acceptance or other valid contractual process; old records remain evidence of the old terms.