Effective from the date of account registration
1. Parties
Data Controller: The club, organisation, or individual registering for the SponsorStack Club Portal, or the athlete, creator, or their parent/guardian registering for the SponsorStack Brand Portal (the “Club” or “User” as applicable).
Data Processor: SponsorStack Ltd (SC883405), registered in Scotland. Contact: ben@sponsorstack.co.uk (the “Processor”).
2. Purpose and Scope
This Agreement sets out the terms under which the Processor will process personal data on behalf of the Club or User in connection with the SponsorStack Club Portal and/or the SponsorStack Brand Portal, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
3. Personal Data Processed
The Processor processes the following categories of personal data on behalf of the Club or User:
Club Portal:
- Club administrator names, email addresses, and contact details
- Sponsor contact names, email addresses, phone numbers, and business addresses
- Sponsorship financial data (values, payment status, invoices)
- Documents uploaded by the Club to the portal
Brand Portal:
- Athlete/creator names, email addresses, and profile details (bio, sport or niche, social media follower counts)
- Bank account details (sort code, account number) provided by the User for the purpose of generating sponsorship invoices
- Sponsor contact names, email addresses, phone numbers, and business addresses
- Sponsorship financial data (values, payment status, invoices)
- Documents, media, and gallery content uploaded by the User to the portal
Age restriction: The Brand Portal is intended for use by individuals aged 18 or over. Where the individual an account relates to is under 18, the account must be registered and operated by a parent or legal guardian on that individual’s behalf. The Processor does not knowingly collect or process personal data directly from a person under 18. No player data, youth member data, or safeguarding records are collected by either portal.
4. Lawful Basis
The Club, as Data Controller, is responsible for ensuring a lawful basis exists for processing personal data entered into the portal. The Processor processes data solely on the documented instructions of the Club, as necessary for the performance of the service contract (Article 6(1)(b) UK GDPR).
5. Processor Obligations
The Processor shall:
- Process personal data only on documented instructions from the Club, unless required by law
- Ensure that persons authorised to process personal data are subject to confidentiality obligations
- Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption of data in transit and at rest
- Not engage another processor without prior written authorisation from the Club (see Section 6)
- Assist the Club in responding to data subject access requests where reasonably practicable
- Notify the Club without undue delay (and within 72 hours) upon becoming aware of a personal data breach
6. Sub-Processors
The Club authorises the Processor to engage the following sub-processors to deliver the service:
- Supabase Inc. — database hosting and authentication (data stored in EU region)
- Vercel Inc. — application hosting and deployment
- Stripe Inc. — payment processing (PCI DSS compliant)
- Resend Inc. — transactional email delivery
The Processor will notify the Club of any intended changes to sub-processors, giving the Club the opportunity to object.
7. Data Retention and Deletion
Personal data is retained for the duration of the Club’s active subscription. Upon termination of the service or account closure, the Processor will delete all personal data within 90 days, unless retention is required by law.
The Club may request deletion of specific data at any time by contacting ben@sponsorstack.co.uk.
8. Data Subject Rights
The Club remains responsible for responding to data subject requests (access, rectification, erasure, portability, restriction, objection). The Processor will assist the Club in fulfilling these obligations where the request relates to data held within the portal.
9. International Data Transfers
Where personal data is transferred outside the UK, the Processor ensures appropriate safeguards are in place, including Standard Contractual Clauses or UK adequacy decisions, as required by Chapter V of the UK GDPR.
10. Security Measures
The Processor implements the following security measures:
- Row Level Security (RLS) ensuring clubs can only access their own data
- Encryption in transit (TLS/HTTPS) and at rest
- Secure authentication — Club Portal uses one-time code (OTP) login with no stored passwords; Brand Portal uses password-based authentication with encrypted password storage
- Document upload validation and file type restrictions
- Regular review of access controls and security practices
11. Audit Rights
The Club may request information necessary to demonstrate compliance with this Agreement. The Processor will make available all information necessary and allow for and contribute to audits conducted by the Club or an appointed auditor, subject to reasonable notice.
12. Term and Termination
This Agreement is effective from the date the Club registers an account on the SponsorStack Club Portal and remains in effect for the duration of the service. It terminates automatically upon closure of the Club’s account.
Clauses 7 (Data Retention), 8 (Data Subject Rights), and 11 (Audit Rights) survive termination.
13. Governing Law
This Agreement is governed by and construed in accordance with the laws of Scotland. Any disputes shall be subject to the exclusive jurisdiction of the Scottish courts.
SponsorStack Ltd (SC883405)
ICO Registration: ZC114185