Data processing agreement

Data processing agreement version: 2026-10-19

Agreement between each club, as controller, and TrainPlanner, as processor, under Article 28 GDPR and Article 33 of Spanish Organic Law 3/2018. The club accepts it when signing up.

Basic information on data protection

Controller: Pau Haro Acín (TrainPlanner). Tax ID: 20857705V. Contact: trainplanner@trainplanner.es.
Purposes: Providing the app and the club panel, managing your account and your guardian’s approval if you are under 14, the level test, answering your enquiries and invoicing clubs.
Legal basis: Performance of a contract; your consent for the level-test photos and videos and for the contact form; legal obligations; legitimate interest in security.
Recipients: The clubs you join and the providers that serve us. Some process data in the United States, with GDPR safeguards. We do not sell data.
Rights: Access and download your data, rectify it, erase it, object, restrict its processing, port it and withdraw your consent. You can complain to the Spanish Data Protection Agency.
Further information: In the full privacy policy: /en/privacy.

Parties

Controller: the club that signs up, as identified in its registration. Processor: Pau Haro Acín, tax ID (NIF) 20857705V, with address at C/ Sant Dídac 41, 1.º C, 46712 Piles (Valencia), España, providing the service under the trade name TrainPlanner. Processor’s privacy contact: trainplanner@trainplanner.es.

Subject matter, nature and purpose

TrainPlanner processes the personal data the club enters into the platform for the sole purpose of providing its academy management service: students, coaches and staff; schedules, classes and bookings; attendance; class passes, fees, payments and refunds; messages and campaigns; class ratings.

Duration

As long as the club’s subscription lasts. When it ends, the section "End of the service" applies.

Data and data subjects

Categories of data: identification and contact data, date of birth, guardian details for minors, playing level, attendance, purchases, payments and debts, internal notes and photo. Data subjects: students (including minors), their guardians, and the club’s coaches and staff.

What this agreement does not cover

The student account in the app belongs to TrainPlanner as controller: sign-up, guardian approval, the platform level test and deleting the account across all clubs. When a student with an account joins the club, what they do in the club is processed by the club as controller and by TrainPlanner as its processor. The privacy policy explains both roles.

The club’s obligations

The club undertakes to:

Have a legal basis for each item of data it enters and inform the data subjects.
Obtain, for each child under 14 it registers, the consent of whoever holds parental responsibility or guardianship, and keep proof of it. By accepting this agreement the club declares that it does so; TrainPlanner cannot verify it.
Give lawful instructions and not enter data it does not need for the service.
Send its campaigns only to people who have consented. The club is the advertiser and appears as the sender.

TrainPlanner’s obligations

TrainPlanner undertakes to:

Process the data only on the club’s documented instructions, which are this agreement and the club’s use of the platform, and tell the club if an instruction appears to infringe the law.
Not use the data for its own purposes or disclose it to third parties, except to authorised subprocessors or where the law requires it.
Ensure that the people with access to the data have committed to confidentiality.
Apply the security measures in the next section.
Help the club respond to data subjects’ requests, with the panel’s tools or on request, and meet its obligations on security, breach notification and impact assessment.
Make available to the club the information needed to demonstrate compliance with this agreement and allow reasonable audits, with prior notice.

Security measures

Among others, TrainPlanner applies these measures:

Encryption of data in transit.
Separation of each club’s data in the database, so that no club can see another’s.
Passwords stored with an algorithm that does not allow them to be recovered, and two-factor authentication for the TrainPlanner team.
A log of sensitive actions that cannot be altered.
Daily and monthly backups in private storage.
Access to photos, videos and screenshots only through links that expire within minutes.

Subprocessors

The club gives TrainPlanner general authorisation to use the subprocessors on the list published on this website. TrainPlanner imposes on them the same data protection obligations it takes on in this agreement. Before adding or replacing a subprocessor, TrainPlanner will notify the club in advance, and the club may object; if the objection prevents the service from being provided, the club may terminate it.

Google Cloud: hosting, database, file storage and backups. Belgium (European Union).
Resend: email delivery. United States.
Apple Push Notification service: delivery of notifications on iPhone. United States.
Firebase Cloud Messaging: delivery of notifications on Android (Google). United States.
Stripe: collection of each club's subscription and, in the club's own Stripe account, of its students' payments. United States.
Verifacti: registration of TrainPlanner’s invoices to clubs with the Spanish Tax Agency (Verifactu). European Economic Area.
Instituto Geográfico Nacional: maps in the club panel and geocoding of venue addresses. Spain.

International transfers

Some subprocessors may process data outside the European Economic Area: Resend, Apple Push Notification service, Firebase Cloud Messaging, and Stripe (United States). Each transfer relies on a European Commission adequacy decision (Article 45 GDPR) or on the standard contractual clauses approved by the Commission (Article 46 GDPR). The club can ask for a copy of the applicable safeguard at trainplanner@trainplanner.es.

Security breaches

TrainPlanner will notify the club without undue delay of any security breach affecting its data, with the information available so that the club can meet its 72-hour deadline before the Spanish Data Protection Agency, and will complete it as it becomes available.

Retention during the service

While the service lasts, TrainPlanner applies these periods on the club’s behalf: a former student’s data is erased once they have had 24 months with no activity and nothing outstanding in the club; a student’s payments, debts and refunds are kept while they remain an active member of the club, and lose everything that identifies them when their member record is erased, 24 months after leaving the club with no activity and nothing pending. TrainPlanner’s invoices to the club are kept for 6 years, counted in full from the end of the year in which they were issued; after that their PDF links are removed.

End of the service

When the service ends, the club can export its data from the panel. TrainPlanner erases it 30 days later, and it disappears from the backups as they expire, within 12 months at most. Whatever the law requires to be kept, such as payment records, is kept blocked until its legal period ends.