Data Processing Addendum (v1.0)

Draft template. Have it reviewed by your legal advisor before relying on it commercially.

1. Parties and roles

The bike park, trail area or sports association that uses TrailZone (the “Park”) is the data controller for its riders, parents, coaches and staff. Alessio Somma, Via Giulio Cesare 3, 33020 Zuglio (UD), Italy, VAT IT03109540306, PEC alessiosomma88@pec.it (“TrailZone”), acts as data processor under Art. 28 GDPR. This addendum forms part of the agreement under which the Park uses TrailZone.

2. Subject matter and duration

TrailZone hosts and operates the software the Park uses to publish courses, take bookings, manage participants, coaches, trails, maintenance and notifications, for as long as the Park uses the service.

3. Data and data subjects

• Riders and parents/guardians: identity, contact details, date of birth, bookings, payments status, attendance, skills progress.
• Minors added by a parent or guardian.
• Special category data: medical fitness certificates uploaded by families (Art. 9 GDPR).
• Coaches, office staff and trail crew: account, contact and work data.

4. Processor obligations

• Process data only on the Park’s documented instructions, including this addendum and the settings the Park chooses in the app.
• Ensure everyone with access is bound by confidentiality.
• Apply the security measures in section 6.
• Assist the Park in answering data subject requests (access, export, rectification, erasure).
• Notify the Park without undue delay, and in any case within 48 hours, of any personal data breach.
• Never sell personal data or use it for advertising.
• Make available the information needed to demonstrate compliance.

5. Sub-processors

The Park gives general authorisation to the following sub-processors: Lovable (application hosting, database, storage and authentication, EU-based infrastructure where available) and its email delivery provider; Open-Meteo for weather (no personal data shared). TrailZone will inform the Park of changes so it can object.

6. Security measures

• Encryption in transit (HTTPS) and at rest.
• Strict separation of each Park’s data and role-based access (office, coach, trail crew, rider).
• Coaches see no dates of birth; trail crews see no rider, payment or medical data.
• Medical certificates stored in a private area, visible only to the family and the Park office, via short-lived links.
• Regular backups and audit trails for schedule and pricing changes.

7. International transfers

Where data leaves the EEA, transfers rely on an adequacy decision or the EU Standard Contractual Clauses.

8. End of the service

When the Park stops using TrailZone, it may export its data. Within 90 days TrailZone deletes or anonymises the Park’s personal data, unless the law requires keeping it.

9. Acceptance

The Park accepts this addendum electronically from Office → Park Settings & Admin. TrailZone records who accepted, on behalf of which organisation, the version and the time.