This Data Processing Agreement (“DPA”) forms part of the agreement between:

• Club Supporter Ltd, 15 Front Street, Sherburn Hill, DH6 1PA(“Processor”)
• The club, charity, or organisation using the charity lottery platform (“Controller”)

1. Definitions

Terms such as personal data, processing, controller, processor and UK GDPR have the meanings given in the UK GDPR.

2. Subject Matter

The Controller may upload supporter contact information to the charity lottery platform to invite individuals to participate in lotteries and to send service-related communications.

The Processor will process such data only on documented instructions from the Controller.

3. Duration

Processing will continue for as long as the Controller uses the platform, unless otherwise agreed or required by law.

4. Nature and Purpose of Processing

Processing activities include:

• Storing uploaded contact details securely
• Sending invitation emails and SMS on behalf of the Controller
• Maintaining delivery logs and compliance records
• Providing reporting tools to the Controller

5. Categories of Data Subjects

Supporters, members, donors, or contacts of the Controller.

6. Categories of Personal Data

Uploaded data may include:

• Name
• Email address
• Phone number
• Supporter reference details
• Communication history

7. Controller Obligations

The Controller confirms that:

• It has a lawful basis to upload and use supporter data
• It has provided appropriate privacy information to supporters
• It is responsible for handling opt-outs and marketing preferences

8. Processor Obligations

Club Supporter Limited shall:

• Process data only on the Controller’s instructions
• Ensure staff are bound by confidentiality
• Implement appropriate technical and organisational security measures
• Assist with data subject rights requests where applicable
• Notify the Controller of any personal data breach without undue delay

9. Sub-Processors

The Controller authorises the use of the following sub-processors:

• Microsoft Azure (UK hosting) – cloud hosting infrastructure
• SendGrid, Brevo – email delivery
• Freshdesk – support services
• Brevo – SMS delivery (if applicable)

The Processor will ensure sub-processors are bound by equivalent data protection obligations.

10. International Transfers

Where processing involves transfers outside the UK, appropriate safeguards will be used, including the UK IDTA, SCCs, or adequacy decisions where applicable.

11. Deletion or Return of Data

Upon termination of services, the Processor will delete or return uploaded supporter data within a reasonable period, unless retention is required by law.

12. Audit Rights

The Controller may request reasonable information to confirm compliance with this DPA. Any audit requests must be proportionate and subject to confidentiality and security requirements.

Annex: Processing Details (UK GDPR Article 28)