Translation for convenience; the Dutch version prevails. Nederlandse versie
Data processing agreement (Art. 28 GDPR)
Effective from 1 November 2026
Between the club using AllTennisDrills Coach ("controller") and Gwen Rijkx, trading as Health and Beauty (sole proprietorship), J. Vanzeerstraat 70, 3290 Diest, company number 0561.942.477, also trading as AllTennisDrills, email coachplaybook.info@gmail.com ("processor").
1. Subject
The processor processes personal data exclusively on behalf of and in accordance with the written instructions of the controller, in order to provide the AllTennisDrills Coach service.
2. Data and data subjects
- Data subjects: coaches and head coaches of the club, players and members (or their parents), people who book a lesson.
- Data: name, username, email, phone number, hourly rate, profile photo, lesson schedule, attendance in groups, bookings.
- Publicly visible: on the club's online booking page, players see a coach's name, profile photo, bio and private hourly rate (if the coach fills these in).
- Purpose: scheduling, hours overview, online booking and notifications. Duration: for as long as the agreement runs.
The service is not intended for special categories of personal data (Art. 9 GDPR), e.g. medical information.
3. Obligations of the processor
- Processes only in accordance with instructions and reports it if, in its opinion, an instruction infringes the GDPR.
- Ensures that everyone with access to the data is bound by confidentiality.
- Takes appropriate technical and organisational measures (Art. 32 GDPR): HTTPS, hashed passwords, logical separation per club, daily encrypted backups, restricted server access, updates.
- Assists the controller with requests from data subjects and with a data protection impact assessment, insofar as reasonable.
- Reports a personal data breach without undue delay, and where possible within 48 hours of discovery.
- Makes available all information necessary to demonstrate compliance and allows reasonable audits (at the controller's expense, with prior notice).
4. Sub-processors
The controller gives general authorisation for the following sub-processors:
| Sub-processor | Service | Location |
|---|---|---|
| Hetzner Online GmbH, Gunzenhausen (DE) | Hosting and storage (server + backups) | EU (Germany/Finland) |
| Sendinblue SAS (Brevo), Paris (FR) | Sending transactional emails | EU |
New or different sub-processors are announced by email at least 30 days in advance; the controller may object and in that case cancel free of charge. The processor imposes the same obligations on sub-processors.
5. Transfers
Data is not processed outside the EEA.
6. Termination
After the end of the agreement, the processor provides an export on request and deletes the data within 30 days; backups are overwritten within 30 days after that, unless retention is required by law.
7. Liability and law
The liability provisions of the general terms and conditions apply. Belgian law applies.