Club Data Processing Addendum

Your club is the Responsible Party for the personal information of your players, coaches and officials that is submitted to Shadow Stats. You decide what is collected, for what purpose, and you are responsible for having a lawful basis to collect and share it with us.

Shadow Stats is the Operator. We process that data only on your instruction, to provide the analytics platform described in our Terms of Service, and for no other purpose of our own.

We do not collect health, medical, or fitness information about players. Workload figures (overs bowled per match) are derived from the scorecard record itself, not from any medical source, and are presented as a scheduling and selection aid, not a medical or fitness assessment. See Terms of Service §6.

Shadow Stats does not independently verify parental consent for each player; we rely on your club's confirmation, given when your club's authorised representative accepts this Addendum, that the necessary authorisation is in place. If we become aware that junior player data has been submitted without appropriate authorisation, we will work with your club to remove it promptly.

As Responsible Party, your club agrees to:

• Have a lawful basis to collect and share player, coach, and official data with us, including parental authorisation for junior players as described above
• Only submit data through authorised coaching/admin logins, restricted to people your club has approved
• Notify players (or, for minors, their parent/guardian) that performance data is processed through Shadow Stats, in whatever way is appropriate for your club, for example as part of existing registration or membership communications
• Tell us promptly if a login is compromised or an authorised user leaves the club

As Operator, Shadow Stats agrees to:

• Process your club's data only to provide the platform, and only on your club's instruction, not for our own separate purposes, marketing, or resale
• Keep your club's data confidential and scope access so that one club cannot see another club's matches, players, or reports
• Use appropriate technical and organisational security measures, as described in §8
• Only engage the sub-processors listed in §6, and notify your club of any material change to that list
• Assist your club in responding to data subject requests, as described in §9
• Notify your club without undue delay if we become aware of a security compromise affecting your data, as described in §10
• Delete or return your club's data on request or on termination, as described in §11

We use the following sub-processors to provide the platform. Each is bound by confidentiality and data protection obligations consistent with this Addendum:

We will give your club reasonable notice of any new sub-processor with access to your data, and a reasonable opportunity to object on data protection grounds before it is engaged.

Match and player data is stored in the European Union (Supabase, Render), with edge delivery from South Africa (Vercel). In accordance with section 72 of POPIA, we rely on the EU's data protection framework, generally recognised as providing a level of protection at least equivalent to POPIA, as the basis for these transfers, and require our providers to maintain security measures consistent with that standard.

• Access to club data is scoped by account, so no club can view another club's matches, players, or reports
• Administrative and database-level privileges are restricted to what is operationally necessary
• Data in transit is encrypted
• We monitor for and patch known vulnerabilities in the platform's infrastructure on an ongoing basis

No system is completely secure, and we cannot guarantee against every possible compromise, but we take these measures seriously and review them on an ongoing basis.

If a player, parent/guardian, coach, or official contacts Shadow Stats directly to access, correct, or delete their personal information, we will refer them to your club as the Responsible Party, and reasonably assist your club in fulfilling that request using the tools available on the platform, including data export, described in §11.

If we become aware of unauthorised access to, or loss of, your club's data, we will notify your club without undue delay and provide the information reasonably available to us to help your club assess and respond to the incident, including meeting any notification obligations your club may have under POPIA.

• While your club's subscription is active, your data (matches, player reports, and leaderboards) is available on request as an export, at any time, without needing to ask our permission.
• If your club moves to the off-season vault, your data remains live and readable; nothing is deleted.
• If your club's subscription lapses entirely, we retain your data for a reasonable period to allow you to request an export, after which it is securely deleted, unless we are required by law to retain it for longer.
• Your club may request deletion of its data at any time, subject to any legal or accounting retention obligations we may have.

Each party is responsible for its own compliance with POPIA in the role it holds under this Addendum. Nothing in this Addendum overrides the limitation of liability set out in our Terms of Service §9, except to the extent that liability cannot lawfully be limited or excluded.

This Addendum applies for as long as your club has an active subscription or off-season vault with Shadow Stats, and its data-handling obligations (§8–§11) survive termination until your club's data has been exported or deleted as described in §11.