1. About this Agreement
This Data Processing Agreement (the ‘DPA’) is dated 4 November 2026. It forms part of the agreement between Sportplan Limited, trading as Teamo, a company registered in England and Wales with company number 04002708 and registered office at 4 Grange Close, Bletchingley, Redhill, Surrey RH1 4LW (‘Sportplan’, ‘we’), and each club or organisation that uses Teamo (the ‘Club’).
For the personal data Teamo processes on the Club's behalf, the Club is the controller and Sportplan is the processor. This DPA sets out the terms required by Article 28 of the UK GDPR. It applies alongside our Terms of Use and Privacy Policy; if they conflict on how we process the Club's personal data, this DPA prevails.
2. The processing (Article 28(3))
Subject matter and purpose: providing Teamo to the Club: membership, registration and records; sessions, events, fixtures and bookings; payments; messaging, notifications and email; club websites; documents; qualifications and safeguarding records; and Kit, Teamo's assistant.
Duration: for as long as the Club uses Teamo, and afterwards only as set out in section 3(g).
Nature of the processing: collecting, storing, organising, retrieving, using, sending, disclosing to the sub-processors in section 4, and erasing personal data, by automated means through the Teamo app and websites.
Types of personal data: names and contact details; dates of birth; roles and memberships; family and guardian links; attendance, bookings and event responses; messages and posts; photos and photo consents; payment and invoice records; qualifications and DBS details; emergency contacts; and, where the Club collects it, health and medical information relevant to club activities.
Data subjects: the Club's members, players and athletes (including children), parents and guardians, coaches, volunteers, committee members and staff, and other people the Club adds to Teamo.
3. Sportplan's obligations (Article 28(3)(a)–(h))
(a) Instructions. We process the Club's personal data only on the Club's documented instructions, including about transfers outside the UK, unless the law requires otherwise; if so, we will tell the Club first unless the law prevents it. The Club's use and settings of Teamo, our Terms of Use and this DPA are the Club's instructions. We will tell the Club straight away if we think an instruction breaks data protection law.
(b) Confidentiality. Everyone we authorise to process the Club's personal data is bound by a duty of confidentiality and has access only as far as their role needs.
(c) Security. We take the measures required by Article 32 of the UK GDPR, including: encryption of data in transit (HTTPS); access limited to authorised staff; automated daily and continuous backups, with point-in-time recovery for the last 14 days; hosting in AWS data centres in Ireland and London; and monitoring with alerts to our engineers.
(d) Sub-processors. The Club gives general authorisation for us to use sub-processors. Our current sub-processors are listed in section 4. We will update that list at least 30 days before a new sub-processor starts processing the Club's personal data, and the Club may object in that time. Each sub-processor is bound by a written contract with data protection obligations no less protective than this DPA, and we remain responsible to the Club for its performance.
(e) Data subjects' rights. We help the Club, through Teamo's tools and on request, to respond to people exercising their rights to access, correct, erase, restrict, move or object to the processing of their data. If someone contacts us directly about the Club's data, we pass the request to the Club promptly.
(f) Helping the Club meet its own obligations. We help the Club with security, data protection impact assessments and consulting the Information Commissioner (Articles 32 to 36). If we become aware of a personal data breach affecting the Club's personal data, we will notify the Club without undue delay and in any event within 72 hours, with what we know of its nature, the people and records affected, the likely consequences and what we are doing about it, and keep the Club updated.
(g) When the Club leaves. The Club can download its data at any time with Teamo's Download wizard. When the Club stops using Teamo, we delete or anonymise the Club's personal data within two months, as our Privacy Policy states, unless the law requires us to keep it, in which case we keep it only for that purpose.
(h) Information and audits. We make available the information the Club reasonably needs to show that we meet this DPA, and we allow and contribute to audits, including inspections, by the Club or an auditor it appoints, on 30 days' written notice and no more than once a year (or at any time after a personal data breach). We may first answer a written questionnaire. The Club bears its own audit costs.
4. Sub-processors
As at 4 November 2026, we use these sub-processors for the Club's personal data:
- Amazon Web Services (AWS): Hosting, databases, backups and file storage, in AWS data centres in Ireland and London
- Adyen: Card and payment processing for TeamoPay. Adyen holds card details; Teamo never sees them
- Stripe: Card payment processing for clubs that collect payments through Stripe
- GoCardless: Direct Debit collection for clubs that use it
- Mailgun: Sending the emails Teamo sends on the Club's behalf
- Twilio: Sending text messages (SMS)
- Google: Push notifications to Android devices (Firebase Cloud Messaging); AI models used by Kit; website analytics
- Apple: Push notifications to iPhones and iPads (Apple Push Notification service)
- Anthropic: AI models (Claude) used by Kit, Teamo's assistant
- OpenAI: AI models used by Kit, Teamo's assistant
Where a sub-processor processes personal data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
5. General
This DPA lasts as long as we process personal data for the Club. We may update it to reflect changes in law or in our sub-processors; the date at the top shows the current version. It is governed by the laws of England and Wales. Questions: support@teamo.chat.
Related links:
