Terms for organisations and data-processing agreement
Effective date: 25 October 2026
These terms are part of the terms of service. They apply to every organisation in drillmate — a coach working on their own (a personal organisation) and a club, on any plan, free or paid. The person who creates the organisation accepts them for it when they create their account, and has the authority to do so. They are also the data-processing agreement required by Article 28 of the GDPR (and the equivalent law of Bosnia and Herzegovina).
1. Who is who
- The organisation is the controller of the personal data it enters about its players, their families and its staff: it decides whom to record and why.
- drillmate (Dino Ramić, an individual based in Bosnia and Herzegovina) is the processor of that data. For accounts, sign-in, subscriptions and the technical operation of the service drillmate is a controller in its own right, as the privacy policy explains.
- A coach on their own is the controller of their players' data.
2. Subject, duration, nature and purpose
drillmate processes the data in Annex 1 to run the service for the organisation — planning trainings, taking attendance, answering availability, informing families, keeping fees and kit — for as long as the organisation has an account.
3. The organisation's instructions
drillmate processes the data only on the organisation's documented instructions, which are its use of the features of the service and these terms, and not for any other purpose. If drillmate believes an instruction breaks the law, it says so.
4. Confidentiality
Everyone who can reach the data on drillmate's side is bound by confidentiality. drillmate staff look up a specific person only with a reason, and the lookup is recorded in an audit log that is only ever added to.
5. Security
drillmate applies the measures in Annex 2.
6. Sub-processors
The organisation agrees to the sub-processors in the table of section 7 of the privacy policy (Annex 3). Each is bound by a data-processing agreement of its own. drillmate announces a new sub-processor, or a replacement, in the app 30 days before it starts processing. The organisation may object in that time; if the parties cannot agree, it may delete its data and close its account.
7. Helping with people's rights
Access, export, correction and deletion are functions of the service. A request that reaches drillmate about data the organisation controls is passed to the organisation, and drillmate helps it answer within the time the law sets.
8. Incidents
drillmate tells the organisation without undue delay, and at the latest within 48 hours of learning of a breach of its data, with what it knows. Where the law requires it, drillmate informs the supervisory authority within 72 hours of learning of a breach for which it is the controller.
9. Deleting and returning data
At any time the organisation can export its data and delete it. When the organisation ends, its data is deleted, except what the law requires drillmate to keep (billing records) and backups, which are replaced within 30 days. A player who left is anonymised after 24 months, as the privacy policy's retention table says; the organisation's attendance history stays without the name.
10. Audit
On request, once a year, drillmate gives the organisation the information needed to show that it follows these terms — a written answer, and where that is not enough a reasonable call. A longer audit is by agreement and at the organisation's cost.
11. Transfers
Transfers outside the EU and the UK rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework (see section 9 of the privacy policy).
12. The organisation's own duties
The organisation:
- has the right to record the people it enters and tells them (their families) that it does, which the enrolment form and the privacy notices help with;
- is responsible for its own rules, and for a data protection impact assessment where the law requires one (children and health data are a reason to consider one);
- gives access only to people who need it, and removes people who leave.
13. Club plan
A Club plan has a seat for each coach, owner and admin; staff and parents are free. The club pays through Paddle, the merchant of record, may cancel at any time and may ask for a refund as set out at drillmate.app/refunds.
14. Changes and law
drillmate changes these terms as it changes the terms of service (section 14 there). The law and courts are those of the terms of service.
Annex 1 — the data
- People: coaches, staff, administrators and owners; players; parents and guardians; an emergency contact named by a family.
- Data: names; email addresses of account holders; years of birth; teams, trainings, attendance and answers about coming (with an optional reason, which can be an illness or an injury — health data); notes and match ratings; enrolment forms (emergency contact; an optional family note that can be health data); a medical check date; requests to pause or leave; fees; kit and sizes; venues; announcements.
- Purpose: to run the club's trainings and to inform families.
Annex 2 — security measures
Access checked on every request against the role; one organisation never reads another's data; encrypted connections; passwords stored only as Argon2id hashes and checked against known breaches; sessions in httpOnly cookies or the device's secure storage; a recent sign-in for export and deletion; a second factor and an audit log for drillmate's own tools; encrypted daily backups kept 30 days; automatic checks of code and dependencies; a documented procedure for incidents.
Annex 3 — sub-processors
See the table in section 7 of the privacy policy.