Version 1.0 — Effective August 19, 2026. For signed execution copies, contact legal@puckdesk.com
This Data Processing Agreement (“DPA”) supplements and is incorporated into the PuckDesk Terms of Service (“Agreement”) between PuckDesk(processor), a partnership registered in Ontario, Canada, with its principal place of business at 13 Sydenham Wells, Barrie, Ontario, Canada (“Processor”); and the Customer or Organization that has subscribed to the PuckDesk Service (“Controller”).
Where GDPR, UK GDPR, or similar applicable data protection law requires a written processor agreement, this DPA fulfils that requirement once executed by both parties.
Applicable Data Protection Lawmeans the EU General Data Protection Regulation (2016/679) (“GDPR”), the UK GDPR and Data Protection Act 2018, and any equivalent national or regional law that applies to the processing described in this DPA.
Controller Personal Data means personal data that the Controller submits to, stores in, or causes to be processed through the Service, and for which the Controller determines the purposes and means of processing.
Sub-processormeans any third party engaged by PuckDesk to process Controller Personal Data on PuckDesk’s behalf. The current sub-processor list is available at /legal/subprocessors.
PuckDesk stores, retrieves, organizes, transmits, and performs related technical operations on Controller Personal Data solely to provide the Service as described in the Agreement and as instructed by the Controller. PuckDesk processes Controller Personal Data for the duration of the Controller’s active subscription, and for the retention and archival period thereafter as described in section 9 of this DPA.
Data that may be processed includes: staff user accounts (name, email, hashed password, role, login activity); player/roster data (name, position, jersey number, date of birth, contact details); performance and training data; health and medical information (optional, restricted category); technical data (IP addresses, session tokens, access logs).
Data subjects include the Controller’s authorized staff members and players, including minors where permitted by the Controller’s own policies and applicable law.
PuckDesk processes Controller Personal Data only on the Controller’s documented instructions. Personnel authorized to process such data are subject to appropriate confidentiality obligations. PuckDesk does not use Controller Personal Data for its own purposes, including advertising, profiling, or training AI models.
PuckDesk provides reasonable assistance to enable the Controller to fulfil valid data subject rights requests (access, rectification, erasure, restriction, portability, objection) under Applicable Data Protection Law.
The Controller provides general authorization for PuckDesk to engage sub-processors as listed at /legal/subprocessors. PuckDesk will provide advance notice of material changes to that list. PuckDesk imposes data protection obligations on each sub-processor equivalent in substance to those in this DPA and remains liable to the Controller for sub-processor performance.
PuckDesk implements appropriate technical and organizational security measures including: encryption in transit (TLS); authentication and access controls; password hashing; logical segregation of customer data; and incident detection and response procedures. PuckDesk will not materially reduce the overall level of protection.
PuckDesk will notify the Controller without undue delay, and in any event within 72 hours where feasible, after becoming aware of a Security Incident (unauthorized access to or loss of Controller Personal Data). Notification will include, where possible: nature of the incident; categories and approximate number of data subjects and records affected; likely consequences; and measures taken or proposed.
PuckDesk’s infrastructure is currently hosted in the United States. Where Applicable Data Protection Law restricts transfers of personal data, PuckDesk will implement a lawful transfer mechanism, including Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914) or the UK ICO as applicable. Note: the SCC module must be separately executed by both parties before this DPA can be relied upon for GDPR/UK GDPR compliance with EU/UK customers. Contact legal@puckdesk.com to arrange this.
Upon termination or expiry of the Agreement, PuckDesk will at the Controller’s choice either return all Controller Personal Data in machine-readable format or securely delete it. PuckDesk intends to archive Controller Personal Data for up to 12 months after subscription end to allow reactivation; after this period, deletion or irreversible anonymization occurs, subject to legal hold and backup retention constraints.
Upon request, PuckDesk will confirm in writing that deletion has been completed.
PuckDesk will make available to the Controller information reasonably necessary to demonstrate compliance with its processor obligations and will allow for and contribute to audits conducted by the Controller or a third-party auditor, subject to reasonable advance notice and confidentiality obligations. PuckDesk may satisfy an audit request through the provision of a third-party audit report or certification.
This DPA is governed by the same law as the Agreement (Ontario law and federal laws of Canada), except where Applicable Data Protection Law requires otherwise. In the event of a conflict between the Agreement and this DPA in respect of data protection matters, this DPA prevails.
This DPA is entered into by the parties as of the effective date of the Agreement. For a separately signed copy with completed SCC annexes, email legal@puckdesk.com.
See also: Terms of Service — Privacy Policy — Subprocessor List