Team Bonus Ball is operated by SWJ Power Engineering Limited. These terms are intended to apply where SWJ Power Engineering Limited provides Team Bonus Ball services to a club.
1. Parties and roles
The Club is the controller for participant and fundraiser personal data it decides to enter into the service. SWJ Power Engineering Limited, trading as Team Bonus Ball, acts as processor for that data, except where it independently acts as controller for its own account, security, billing, support or legal records.
2. Processing details
| Subject matter | Hosting and administration of club bonus-ball fundraiser records. |
|---|---|
| Duration | For the subscription/service period and up to 90 days afterwards for orderly return, export, anonymisation or deletion, unless law requires longer retention. |
| Nature and purpose | Storage, organisation, retrieval, calculation, display, backup, support and deletion of fundraiser data. |
| Data subjects | Club administrators, adult participants, parents/contacts where relevant, winners and other people whose details the club lawfully enters. |
| Personal data types | Names/display names, optional contact name, optional mobile number, optional email/notes where used, entry numbers, payment-tracking records, reminder history, draw/match records and club account data. |
| Special-category data | Not required by the service and should not be entered unless separately agreed and lawfully justified. |
3. Documented instructions
SWJ Power Engineering Limited, trading as Team Bonus Ball, will process club-controlled personal data only on documented instructions from the Club, including instructions inherent in the Club's use of the service, unless UK law requires otherwise.
4. Confidentiality
Anyone authorised by SWJ Power Engineering Limited / Team Bonus Ball to process the data must be subject to an appropriate duty of confidentiality.
5. Security
SWJ Power Engineering Limited / Team Bonus Ball will maintain appropriate technical and organisational measures proportionate to the risk, including authentication, role-based access, Row Level Security, club isolation, public-data minimisation, security headers, restricted administrator access and incident procedures.
6. Sub-processors
The Club authorises the use of service providers reasonably necessary to provide the service. Current core providers include:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and storage. |
| Cloudflare | Hosting, content delivery and security. |
SWJ Power Engineering Limited / Team Bonus Ball will ensure appropriate contractual protections are in place with sub-processors where required and will update material sub-processor information when the service changes.
7. Individual rights
Taking account of the nature of processing, SWJ Power Engineering Limited / Team Bonus Ball will reasonably assist the Club with access, correction, erasure, restriction, objection and portability requests where required. The app includes participant export, anonymisation and deletion tools for authorised club administrators.
8. Security incidents and breaches
SWJ Power Engineering Limited / Team Bonus Ball will notify the Club without undue delay after becoming aware of a personal data breach affecting Club data and will provide reasonably available information needed for the Club's own assessment and reporting obligations.
9. DPIAs and regulatory assistance
Taking account of the nature of processing and information available, SWJ Power Engineering Limited / Team Bonus Ball will provide reasonable assistance with data protection impact assessments and regulator consultations where legally required and proportionate.
10. Return and deletion
At the end of the service, the Club may request export, return, deletion or anonymisation of Club personal data. Unless otherwise agreed, data is intended to be removed or anonymised within 90 days after termination, subject to lawful retention requirements and normal backup lifecycle constraints.
11. Audits and compliance information
SWJ Power Engineering Limited / Team Bonus Ball will make available reasonable information necessary to demonstrate compliance with applicable processor obligations and will cooperate with proportionate audits or inspections, subject to confidentiality, security and reasonable notice requirements.
12. International transfers
Where a restricted international transfer occurs, appropriate lawful safeguards will be used where required. Relevant provider DPAs and transfer terms may apply.
13. Club obligations
The Club must ensure its instructions are lawful, provide appropriate privacy information, identify a lawful basis, minimise data, keep records accurate, control public display names, manage administrator access and notify Team Bonus Ball promptly of security incidents or rights requests requiring assistance.
14. Priority
If these data-processing terms conflict with general service terms about the processing of personal data, these data-processing terms take priority for that subject.
15. Contact
Data protection contact: [email protected].