Data Processing Addendum

• The club is the controller. It gives the processing instructions and warrants it has a lawful basis, including any parental permissions, for the member records it puts here.
• Swimo.fit is the processor. We process roster, performance, and communication data strictly to deliver the service and on the club’s documented instructions.

• Security and confidentiality. Appropriate technical and organisational controls, and confidentiality obligations on everyone we authorise to process club data.
• Assistance. Tools that let the club answer its members’ access, correction, and erasure requests.
• Breach notification. We tell the club without undue delay, and in any case within 72 hours of becoming aware of a breach affecting its personal data.
• Deletion. On termination we delete or return the club’s data, subject to any legal retention obligation.
• Audits. Documentation on request, and an audit by the club or its appointed auditor at reasonable written notice, no more than once a year, at the club’s expense.

The club authorises the sub-processors listed at /subprocessors. We notify clubs by email before that list changes, and a club may object.

Processing happens in the United States. We do not currently offer a transfer mechanism for clubs outside the US, so this addendum is offered to US clubs; a club elsewhere should talk to us first. Texas law governs. Questions: info@swimo.fit.