CoachLine — Data Processing Agreement (DPA)

Last updated: October 2026

This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the CoachLine Terms of Service between Feeko Oy ("CoachLine," "Processor," "we," "us") and the Customer identified in the applicable Order ("Customer," "Controller," "you"). It applies whenever CoachLine processes personal data on the Customer's behalf in connection with the Service, as described in Section 5 of the Terms of Service.

Capitalized terms not defined here have the meaning given in the Terms of Service.

1. Subject Matter and Duration

CoachLine processes personal data on the Customer's behalf solely to provide the Service as described in the Terms of Service and the applicable Order. This DPA applies for the duration of the Customer's subscription and continues to apply to any personal data retained by CoachLine after termination, for as long as CoachLine processes that data (e.g., during the post-termination retrieval period described in Section 9 of the Terms of Service, or as required by law).

2. Nature and Purpose of Processing

CoachLine processes personal data to:

• Host, store, and display roster, player profile, and team/club data entered by the Customer;
• Store and display coaching notes, test results, practice plans, season plans, and related content;
• Process voluntary Pulse wellbeing check-in data submitted by invited Players;
• Support AI-assisted features (e.g., practice and season plan generation, task and meeting-note parsing, game statistics extraction and summaries, weekly digest summaries) that may process personal data as described in Section 6 of the Terms of Service;
• Provide account authentication, invitations, and role-based access;
• Provide customer support and maintain the security, integrity, and availability of the Service.

3. Categories of Data Subjects

• Coaches and club administrators using the Service under the Customer's account;
• Players, including minors, whose data is entered by a Coach or who hold an invited Player account;
• Other individuals whose data a Customer may enter as part of ordinary use (e.g., contacts listed in sponsor or budget records under the Club plan).

4. Categories of Personal Data

• Contact and identity data (name, email, role);
• Roster and player profile data (team, position, birth date where entered);
• Coaching notes, test results, and performance data;
• Pulse check-in responses: 0–10 ratings and an optional free-text answer to questions the Customer configures (by default, how the player is feeling, how they performed and how they rate their training), which may constitute health data under Article 9 GDPR depending on the questions the Customer chooses and what players write;
• Free-text fields (player notes, task descriptions) that may incidentally contain special category data (e.g., references to injuries), depending on what the Customer chooses to enter;
• Usage and account data (login activity, invitation status).

CoachLine does not intentionally collect special category data beyond what Customers voluntarily enter, and the Service is designed to avoid unnecessarily prompting for it (see Section 6 of the Terms of Service). The default Pulse questions are deliberately general. Because the Customer can edit them, the Customer is responsible for ensuring that any question it adds is necessary for coaching purposes and, where it could elicit health information, that it has a valid legal basis for asking it.

5. Processor Obligations

CoachLine shall:

a. Process personal data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by EU or Member State law, in which case CoachLine will inform the Customer of that legal requirement before processing (unless prohibited from doing so);

b. Ensure that persons authorized to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality;

c. Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR (see Section 9 below);

d. Respect the conditions for engaging another processor (subprocessor) as set out in Section 7 below;

e. Taking into account the nature of the processing, assist the Customer by appropriate technical and organizational measures, insofar as reasonably possible, for the fulfilment of the Customer's obligation to respond to requests for exercising data subjects' rights under GDPR Chapter III;

f. Assist the Customer in ensuring compliance with the obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation), taking into account the nature of processing and the information available to CoachLine;

g. At the Customer's choice, delete or return all personal data to the Customer after the end of the provision of services, and delete existing copies unless EU or Member State law requires storage, as further described in Section 11 below, Section 9 of the Terms of Service and Annex 1 (where applicable);

h. Make available to the Customer all information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to reasonable advance notice, confidentiality, and no more than once per year, except where triggered by a suspected breach.

6. Customer (Controller) Obligations

The Customer is responsible for:

• Determining the purposes and means of processing personal data entered into the Service;
• Ensuring it has a valid legal basis for all personal data it enters into the Service, including any special category data, and for informing data subjects as required by applicable law;
• Ensuring, where a Player is a minor, that any required parental or guardian consent or authorization has been obtained in accordance with applicable law before the minor's data is processed or before the minor uses the Service, as described in Section 2 of the Terms of Service, and confirming this in the player invite form for Players under 13 (CoachLine records the time of the confirmation but does not verify age or consent);
• Issuing documented instructions to CoachLine regarding the processing of personal data, which the Terms of Service and this DPA are deemed to constitute for ordinary use of the Service;
• Responding to data subject requests, with CoachLine's assistance as described in Section 5(e).

7. Subprocessors

General authorization. In accordance with Article 28(2) GDPR, the Customer gives CoachLine general written authorization to engage the subprocessors listed in this Section, and to engage additional or replacement subprocessors to provide the Service in accordance with the procedure below.

Subprocessor list. The list in this Section, as published at https://coachlineapp.io/dpa, is CoachLine's up-to-date list of subprocessors. It identifies each subprocessor, the purpose of its processing, its processing location and, where applicable, the transfer mechanism used.

Notification of changes. CoachLine will inform the Customer of any intended addition or replacement of a subprocessor by email to the Customer's account email address at least 30 days before the new subprocessor begins processing Customer personal data. The notice identifies the subprocessor, the purpose of its processing, its processing location and any transfer mechanism.

Right to object. The Customer may object to the change on reasonable data protection grounds by email during the notice period. The parties will discuss the objection in good faith. If it cannot be resolved, CoachLine will either not use the new subprocessor for the Customer's personal data or the Customer may terminate the affected part of the Service before the change takes effect, without penalty and with a refund of any prepaid fees for the unused remainder.

Subprocessor obligations. In accordance with Article 28(4) GDPR, CoachLine will impose on each subprocessor, by written contract, the same data protection obligations as set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures. Where a subprocessor transfers personal data outside the EEA, CoachLine ensures that an appropriate transfer mechanism under Section 8 is in place. CoachLine remains fully liable to the Customer for the performance of a subprocessor's obligations.

Subprocessor chain. CoachLine's subprocessors may engage their own subprocessors, such as cloud infrastructure providers (for example, Vercel's hosting infrastructure runs on providers such as AWS, Microsoft Azure and Google Cloud Platform). These further subprocessors are bound by the obligations required under Article 28(4) GDPR through the contract with the relevant subprocessor and are not listed individually in this DPA. Each subprocessor's current list of its own subprocessors is available through the link to its data processing agreement in the table below, and CoachLine will provide further information on request.

Current subprocessors:

Stripe as an independent controller. Stripe also processes some payment-related personal data as an independent controller, for example for fraud prevention and to meet its own legal obligations. That processing is governed by Stripe's own terms and privacy practices, not this DPA.

Providers that are not subprocessors. The following provider receives personal data in connection with the Service but does not process Customer personal data on CoachLine's behalf, so it is not a subprocessor under this DPA:

• Google (Sign in with Google): when a user chooses to sign in with a Google account, Google shares that user's name, email address and profile picture with CoachLine. Google acts as an independent controller under the Google Controller-Controller Data Protection Terms, through Google Ireland Limited for the EEA.

8. International Transfers

Where personal data is transferred outside the EEA by CoachLine or a subprocessor, CoachLine will ensure that the transfer is covered by a valid transfer mechanism under Chapter V GDPR. The transfer mechanism used for each subprocessor is set out in the subprocessor list in Section 7.

Adequacy decisions. Where a transfer is covered by an adequacy decision, including the EU–U.S. Data Privacy Framework for a recipient certified under it, the transfer relies on that decision and separate Standard Contractual Clauses are not required for that transfer.

Standard Contractual Clauses and transfer impact assessments. Where a transfer relies on the Standard Contractual Clauses, CoachLine assesses the circumstances of the transfer, including the laws and practices of the destination country (a transfer impact assessment), and implements supplementary safeguards where necessary. In doing so, CoachLine may rely on transfer impact assessments or equivalent assessments made available by the relevant subprocessor. CoachLine will make a summary of its assessment available to the Customer on request.

EU/EEA processing. Where a subprocessor offers processing within the EU/EEA for the service CoachLine uses and this is technically available, CoachLine uses it. Customer data held in the core database (Supabase) is stored and processed in the EU. Some personal data is nevertheless transferred outside the EEA in the ordinary course of providing the Service, in particular through application hosting (Vercel), AI-assisted features (Anthropic), transactional email (Resend) and payment processing (Stripe).

AI-assisted features. Content a Coach submits to an AI feature, which may include player names, notes, statistics or wellbeing trends (which include the wording of the Customer's Pulse questions), is sent to Anthropic and may be processed outside the EEA. No EU-only processing option is currently available for the Anthropic service CoachLine uses. These transfers rely on Anthropic's current data processing addendum and the transfer arrangements it provides for. CoachLine limits the player personal data included in AI requests to what is necessary for the feature, and the Customer should ensure that its users do not include unnecessary personal data, in particular special category data, in AI inputs.

UK and Swiss data. For transfers of UK or Swiss personal data, the relevant UK and Swiss transfer instruments are used.

9. Security Measures

CoachLine implements technical and organizational measures appropriate to the risk, including:

• Encryption of personal data in transit and at rest, provided by our hosting and database providers;
• Database-level access controls (row-level security), so that each Customer can access only its own data;
• Access to personal data by CoachLine personnel limited to what is necessary to operate and support the Service.

10. Personal Data Breach Notification

CoachLine will notify the Customer without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting the Customer's data, providing information reasonably available to CoachLine to assist the Customer in meeting its own notification obligations under Articles 33 and 34 GDPR.

11. Deletion and Return of Data

Deletion during the subscription. When the Customer deletes an individual player profile, or a user account holding Customer personal data is deleted, the relevant personal data may be retained for a 30-day recovery and deletion period, after which CoachLine deletes it from active systems.

Deletion at the end of the Service. Upon termination of the Service, CoachLine will make personal data available for export as described in Section 9 of the Terms of Service (and Annex 1, where applicable). At the Customer's choice, CoachLine will return the remaining personal data or delete it from active systems at the end of the 30-day retrieval period, or earlier if the Customer so instructs.

Pulse check-ins. Pulse check-in responses are automatically deleted from active systems 12 months after the practice, game or period they relate to, even while the player profile and subscription remain active.

Backups. After deletion from active systems, personal data may remain in backup copies for up to 90 days in accordance with CoachLine's backup retention and rotation procedures. During that period, CoachLine will not restore deleted personal data to active use except where strictly necessary for disaster recovery or similar legitimate technical purposes, and the data is permanently overwritten or otherwise removed through the normal backup rotation process. Where Annex 1 of the Terms of Service applies, its erasure deadlines prevail.

Legal retention. The above applies unless EU or Member State law requires continued storage of the personal data, in which case CoachLine retains it only to the extent and for the period required, and restricts its processing to that purpose.

12. Audit Rights

See Section 5(h) above. The Customer may request evidence of compliance (e.g., subprocessor DPAs, security documentation) in lieu of a full audit, which CoachLine will provide within a reasonable time.

13. Liability

Liability under this DPA is governed by the liability provisions of the Terms of Service, except that the limitations described there do not apply to the extent they would be unlawful under Article 82 GDPR or other mandatory data protection law.

14. Precedence

In the event of a conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA prevails, except where Annex 1 (EU Data Act) expressly prevails within its own scope as described in Section 5 of the Terms of Service.