Data Processing Terms

These terms govern how Wingmen Oy processes personal data on behalf of a club that uses the team features of the service: teams, the event calendar and attendance. They form part of the Terms of Service and fulfil Article 28 of the EU General Data Protection Regulation (GDPR). A club accepts them in the service when it activates the team features. Electronic acceptance is a valid signature. A club that wants a countersigned copy can ask for one at info@wingmen.fi.

1. Parties and roles

Processor: Wingmen Oy, business ID FI25215542, Helsinki, Finland.

Controller: the club named at activation. If the club is a registered association or company, that legal person is the controller. If no registered organisation stands behind the team, the person who accepted these terms is the controller in their own name, because an unregistered group cannot hold rights or obligations of its own.

The person who accepts these terms confirms that they are authorized to do so on behalf of the named club. If the named club does not exist or did not authorize them, that person is bound by these terms personally and answers for the consequences.

Wingmen Oy remains an independent controller for coach accounts, subscriptions, billing, public drill content and the service's own analytics. That processing is described in the Privacy Policy and is outside these terms.

2. What is processed

Subject matter: running a sports team's roster, schedule and attendance.

Purpose: letting the club's coaches invite players, guardians and staff, publish events, collect attendance answers and send reminders.

Data subjects: players, their guardians, coaches and other team staff. Many players are children.

Categories of data: name, email address, phone number, date of birth, jersey number, team and role, guardian relationship, attendance answers, and event details the club enters. The service is not designed for special categories of data (Article 9). The club must not enter health information, injuries, diets, diagnoses or similar details anywhere, including free text fields.

Duration: for as long as the club uses the team features, plus the deletion period in section 9.

3. The club's obligations

The club decides what is entered and why. The club is responsible for

• having a lawful basis for each person's data
• informing players and guardians about the processing, for example with its own privacy notice
• entering only the data its activity needs, and keeping it accurate
• giving each coach access only to the teams they run
• removing people who leave the team
• keeping the data protection contact address up to date

4. Processing on documented instructions

Wingmen Oy processes the data only on the club's documented instructions. These terms, the Terms of Service and the actions the club's users take in the service are those instructions. If Wingmen Oy believes an instruction infringes data protection law, it tells the club before acting on it. Wingmen Oy does not use team data for its own purposes, for marketing, for product analytics beyond aggregate counts, or as input to any AI model. If Union or Member State law requires Wingmen Oy to process the data otherwise, it informs the club beforehand unless the law forbids that.

5. Confidentiality

Only those people at Wingmen Oy whose work requires it can reach production data. Each of them is bound by a confidentiality obligation, by contract or by statute.

6. Security

Wingmen Oy takes the technical and organisational measures required by Article 32, taking into account the state of the art, the cost, and the risk to the people concerned. At the time of writing these include: encryption of data in transit, a firewalled database with access control, passwords stored only in protected form, role-based access inside the service, so that club staff see the club's teams and people and a guardian sees only the team their child is linked to, daily backups held for a limited period, and error monitoring that is stripped of personal data. The measures develop over time. The current description is in the Privacy Policy.

7. Sub-processors

The club gives general authorisation to the sub-processors listed on the Sub-processors page. Each one is bound by a written contract with the same data protection obligations as these terms, and Wingmen Oy remains liable to the club for their work. Wingmen Oy tells the club at least 30 days before adding or replacing a sub-processor that handles team data. The club may object on reasonable grounds within that period. If the objection cannot be resolved, the club may end the team features and have its data deleted or returned. Transfers outside the European Economic Area rely on an adequacy decision or on the standard contractual clauses approved by the European Commission.

8. Helping the club

Rights of the people in the register. If a player or guardian contacts Wingmen Oy directly about their data, Wingmen Oy forwards the request to the club's data protection contact without undue delay and helps the club answer it. The club can correct a person's details and remove the person from its teams in the service, which deletes the contact details and attendance answers the club held about them. Wingmen Oy provides a copy of a person's data, and removes an account that belongs to no other club, on request.

Breaches. Wingmen Oy tells the club's data protection contact about a personal data breach affecting team data without undue delay after becoming aware of it, and no later than 48 hours, with the information the club needs for its own notification under Article 33.

Impact assessments. Wingmen Oy gives the club the information it needs for a data protection impact assessment or a prior consultation, as far as it concerns the service.

9. Deletion and return

The club can remove any person from its teams at any time in the service, which deletes what the club entered and collected about them. Removal works regardless of subscription status. When the club stops using the team features or closes its account, Wingmen Oy deletes the team data within 90 days, unless the club asks for a copy first or the law requires the data to be kept. Deleted data disappears from backups within 24 months.

10. Audits

Wingmen Oy makes available the information needed to show that these terms are followed. The club may audit compliance, itself or through an auditor bound by confidentiality, once per twelve months or after a breach, with 30 days' written notice, during business hours and without disturbing the service for other clubs. Wingmen Oy may first offer a written report or a recognised third-party assessment covering the same points.

11. Incorrect details and suspension

If the club or contact details given at activation are incorrect or invented, Wingmen Oy may restrict the team features until they are corrected. Deletion of data remains available during a restriction.

12. Liability

The limitation of liability in the Terms of Service applies to these terms, except where the GDPR provides otherwise. Each party is liable for administrative fines imposed on it for its own breaches.

13. Term and changes

These terms apply from acceptance for as long as the club uses the team features, and the obligations in sections 5 and 9 survive after that. Wingmen Oy may update these terms to reflect changes in the law or the service. The club is told about significant changes in the service, and continued use after a change means acceptance. Finnish law applies, and disputes are heard by the District Court of Helsinki.

Contact

Data protection questions: info@wingmen.fi.