Data-processing agreement

Outline of what the real agreement will cover: the club is the owner of its members’ personal information and the operator processes it only on the club’s instructions; hosting in Australia under the Australian Privacy Principles; security measures (per-club separation, encrypted credentials, two-factor sign-in for administrators); platform staff access only with the club’s consent, time-limited and recorded in the club’s own audit log; sub-processors (hosting, email delivery, the club’s chosen payment provider); breach notification under the Notifiable Data Breaches scheme; export and deletion when the club leaves.