Legal
Data Processing Agreement
Last updated: July 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between TactictFlow Ltd (“Processor”) and the Club (“Controller”). It applies specifically to Club accounts, where TactictFlow processes coach and player data on behalf of the club.
1. Definitions
- Controller: the club that signs up for a TactictFlow Club account
- Processor: TactictFlow Ltd
- Personal Data: coach names, email addresses, player names, and fitness data entered into the platform
2. Processing details
- Subject matter: delivery of TactictFlow coaching platform services
- Duration: for the term of the subscription
- Nature: storage, organisation, and retrieval of coaching and squad data
- Purpose: providing tactical intelligence and coaching management tools
- Data subjects: coaches and players whose data is entered by the Controller
- Categories of data: names, positions, fitness scores, tactical plans, match notes
3. Processor obligations
TactictFlow will:
- •Process data only on the Controller's instructions
- •Ensure staff are bound by confidentiality
- •Implement appropriate technical security measures
- •Delete or return data on contract termination
- •Notify the Controller of any data breaches within 72 hours of becoming aware
4. Sub-processors
TactictFlow uses these sub-processors:
- •Supabase Inc: database storage, EU servers
- •Anthropic PBC: AI processing
- •Resend Inc: transactional email
- •Vercel Inc: hosting
5. International transfers
Data is stored on Supabase EU servers. AI processing by Anthropic may involve transfer to US servers under appropriate safeguards.
6. Controller rights
The Controller may audit TactictFlow's processing on 30 days' written notice.
Contact
Questions about this DPA? Email tolu@tactictflow.co.uk.