1. Reporting a fault

Report faults through the support channels in clause 9. Tell us what you were doing, what happened, and how many people are affected — that is what allows us to prioritise.

2. Response target

We aim to acknowledge a reported fault within 4 working hours.

Working hours means the first line support hours for your territory — 09:00 to 17:00, Monday to Friday, local time. Escalation to second line operates on United Kingdom working hours. A fault reported outside working hours is treated as received at the start of the next working day.

3. Prioritisation and resolution

We prioritise faults by their effect on your ability to operate, taking into account how many users are affected and whether a workaround exists.

We will use reasonable endeavours to resolve faults, and will keep you informed of progress on faults preventing you from operating. We do not commit to a fixed resolution time, because the time required depends on the nature of the fault.

4. Security incidents

Report security concerns to security@clubmanagercentral.com. This address is monitored outside our normal support hours.

We will acknowledge a security report within 1 working day. Where a report concerns a personal data breach we will act on the timescales in Schedule 3, paragraph 8.

On becoming aware of a security threat we will: establish its nature; assess the risk to customer data by likelihood and impact; scope the work needed to mitigate or eliminate it; prioritise accordingly; and, where customer data is affected, notify affected Account Holders under Schedule 3, paragraph 8.

Where a Service requires terms specific to it, those terms are set out in a Product Schedule agreed with the Account Holder. A Product Schedule takes precedence over these terms to the extent of any conflict, and applies only to the Service it names.

1. Scope and roles

1.1 This Schedule applies where we process personal data on behalf of the Account Holder in providing the Services.

1.2 The Account Holder is the controller; we are the processor.

1.3 Nothing here relieves either party of its own direct obligations under data protection law.

1.4 It takes effect with the agreement and requires no separate signature. A Territory Annex modifies this Schedule to the extent stated in it.

2. The controller's obligations

2.1 The Account Holder warrants that it has and will maintain all lawful bases, conditions and notices required to permit lawful transfer of personal data to us for the processing described in Annex A, including any Article 9 condition for special category data and any parental consent for children's data.

2.2 The Account Holder is responsible for the accuracy of the personal data, for the privacy information it gives its Members, and for managing what it retains in its account.

3. Our obligations

We will:

3.1 process personal data only on the Account Holder's documented instructions, including as to international transfers, unless required otherwise by law — in which case we will inform the Account Holder first unless prohibited from doing so. This agreement, the functionality of the Services, and the Account Holder's use of that functionality, together constitute those instructions;

3.2 immediately inform the Account Holder if, in our opinion, an instruction infringes data protection law;

3.3 ensure that people authorised to process the data are under a duty of confidentiality and have received appropriate training;

3.4 implement and maintain the measures described in Annex B ;

3.5 restrict access to personnel who require it;

3.6 assist the Account Holder in responding to data subject rights requests, taking into account the nature of the processing and the information available to us. Where the Account Holder can action a request itself within the Services, it will. We may charge for disproportionate assistance, on advance notice. Telling the Account Holder that a request has been received is never chargeable;

3.7 assist the Account Holder with Articles 32 to 36 UK GDPR — security, breach notification, data protection impact assessments and prior consultation;

3.8 notify the Account Holder without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting the personal data. That period runs in calendar hours and is not limited to working hours. A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to that data, including where it is subsequently recovered. Notification will include, so far as known: the nature of the breach; the categories and approximate numbers of data subjects and records affected; the likely consequences; the measures taken or proposed; and a contact point. We will provide further information as it becomes available, so that the Account Holder can meet its own 72-hour obligation, and will assist with notification to data subjects where required;

3.9 notify the Account Holder promptly on receiving any notice from a supervisory or government body relating to the processing;

3.10 restore personal data from backup at no cost where it is lost, corrupted or rendered unusable while under our control;

3.11 on termination, at the Account Holder's choice, return or delete the personal data and delete existing copies, unless required by law to retain it. That choice must be made within 30 days of termination. If it is not, we delete the personal data six months after the subscription ends, and that period covers live data, backups and previously deleted records;

3.12 maintain records of processing under Article 30(2) UK GDPR.

4. Sub-processors

4.1 The Account Holder gives general written authorisation for us to engage sub-processors.

4.2 Our current sub-processors are published in our sub-processor list, linked from our Privacy Policy.

4.3 We give at least 30 days' notice before adding or replacing a sub-processor.

4.4 The Account Holder may object within that period on reasonable data protection grounds. We will work in good faith to resolve the objection; failing resolution, the Account Holder may terminate the affected Service without penalty and receive a pro rata refund of fees paid in advance.

4.5 We impose obligations equivalent to this Schedule on each sub-processor and remain fully liable for their performance.

5. International transfers

5.1 Personal data is hosted as described in Annex B.

5.2 Where we transfer personal data outside the United Kingdom, we ensure an appropriate Article 46 safeguard is in place — a relevant adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses together with a transfer risk assessment. The mechanism applying to each recipient is stated in our sub-processor list.

5.3 We do not rely on data subject consent as the mechanism for routine transfers.

6. Audit

6.1 We will make available the information reasonably necessary to demonstrate compliance with this Schedule.

6.2 The Account Holder may audit once in any twelve month period, and additionally following a personal data breach affecting its data. Audits are subject to 30 days' notice, take place during business hours, must not cause unreasonable disruption, and are subject to confidentiality. The Account Holder bears its own costs and our reasonable costs of supporting the audit.

6.3 We may satisfy an audit request by providing a completed security questionnaire, our current measures documentation, or an independent third-party report.

7. Intellectual property

Nothing in this Schedule transfers any intellectual property right in the Services. Clause 11 governs ownership.

8. Governing law

English law; exclusive jurisdiction of the English courts, subject to any Territory Annex.

Annex A — Details of processing

Annex B — Technical and organisational measures

Encryption. Data in transit is encrypted using HTTPS. Data at rest is encrypted.

Authentication. Passwords are stored using a one-way hashing function and are never stored in readable form. Multi-factor authentication is available. A security challenge is applied at login to protect against automated attacks and credential stuffing.

Hosting.

• For Account Holders within India, all data is hosted on infrastructure located within India, provided by OVHcloud.
• For Account Holders in all other territories, data is hosted on Hetzner infrastructure in Germany and Finland. Both are EEA member states, and both fall within the scope of Hetzner's ISO/IEC 27001 certification.

Processing outside the hosting location. Our support team in the United Kingdom accesses the infrastructure to provide support and onboarding, including for Indian customers. Messages to Members are delivered through our messaging sub-processors, and support correspondence is held in our support system. Each provider, its location and its transfer mechanism is listed in our sub-processor list.

Payment card data. We do not store card details. For most payment providers, payment pages are hosted by the provider, which is certified to PCI DSS Level 1; card details are entered directly with the provider and we never hold them. Where card information is submitted through a server operated by us, it is passed directly to the payment provider and discarded immediately. It is not retained and is not written to logs.

Network security. Our marketing website is served through Cloudflare, which provides content delivery and protection against denial-of-service attacks. The application is not proxied through Cloudflare; traffic goes directly to our own servers.

Monitoring and resilience.

• Availability monitoring. Server availability is monitored continuously by an independent third-party provider, from multiple geographic locations, independently of our own infrastructure.
• Automated health monitoring. Automated checks run continuously against the live environment and alert on early indicators of degradation, including message-queue processing delays, payment submission failures or delays, background job processing health, application error rates, data integrity checks and backup freshness.
• Backup monitoring. An alert is raised where the most recent database backup is more than two hours old.

Backups. Encrypted backups are taken hourly. No backup is retained beyond six months, so no data outlives the retention periods in clause 14.

Access control. Access to production systems is restricted to personnel who require it for their role.

Personnel. Personnel with access to personal data are bound by confidentiality obligations and receive data protection training.

Annex C — Sub-processors

Our sub-processor list is published on our website and linked from our Privacy Policy. It forms part of this Schedule and is maintained under paragraph 4.

Where the position for a particular country differs from these terms, that difference is set out in a Territory Annex covering: the applicable data protection law and local regulator; governing law and jurisdiction if different; currency and tax treatment; first line support hours; the payment providers available; and any local consumer law provisions.

Support model across all territories. First line support operates 09:00 to 17:00, Monday to Friday, local time. Second line support operates on United Kingdom time. No out-of-hours support is available in any territory.

India. Data is hosted within India. Payments are processed on pages hosted by the payment provider, so card information is not handled by us.