Data Processing Agreement

1. Definitions

In this Agreement the following terms shall have the meanings set out below:

• "Agreement" means these terms together with any applicable order form or Terms of Service.
• "Controller Personal Data" means personal data that RoxRace processes on behalf of the Controller in connection with the Services.
• "Data Protection Laws" means all applicable laws relating to the processing of personal data, including GDPR and national implementing legislation.
• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
• "Services" means the race registration, timing, results, and event management services provided by RoxRace.
• "Sub-processor" means any third party appointed by RoxRace to process personal data on behalf of the Controller.

2. Processing of Personal Data

RoxRace shall, in relation to Controller Personal Data:

• Process Controller Personal Data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country, unless required to do so by EU or Member State law; RoxRace shall inform the Controller of that legal requirement before processing, unless prohibited by law on important grounds of public interest.
• Ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Take all measures required pursuant to Article 32 of the GDPR (security of processing).
• Respect the conditions for engaging Sub-processors referred to in this Agreement.
• Assist the Controller in ensuring compliance with obligations pursuant to Articles 32–36 of the GDPR, taking into account the nature of the processing and the information available to RoxRace.
• At the choice of the Controller, delete or return all personal data to the Controller after the end of the provision of Services, and delete existing copies unless EU or Member State law requires storage.
• Make available to the Controller all information necessary to demonstrate compliance with this Agreement and allow for and contribute to audits and inspections conducted by the Controller or a mandated auditor.

3. Confidentiality

RoxRace shall ensure that access to Controller Personal Data is limited to those employees and contractors who have a genuine need to access the data for the purpose of providing the Services, and that all such persons are bound by appropriate confidentiality obligations.

4. Security

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, RoxRace shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Pseudonymisation and encryption of personal data where appropriate.
• Ensuring ongoing confidentiality, integrity, availability, and resilience of processing systems and services.
• Restoring availability and access to personal data in a timely manner in the event of a physical or technical incident.
• A process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

5. Sub-processors

The Controller provides general written authorisation for RoxRace to appoint Sub-processors. RoxRace shall notify the Controller of any intended changes concerning the addition or replacement of Sub-processors, giving the Controller the opportunity to object. RoxRace shall impose the same data protection obligations as set out in this Agreement on any Sub-processor by way of contract.

RoxRace currently uses the following categories of Sub-processors:

• Stripe, Inc. — payment processing (EEA data transfers covered by Standard Contractual Clauses)
• Cloud hosting provider — infrastructure and data storage within the EEA
• Transactional email provider — delivery of registration confirmations and event communications

6. Data Subject Rights

RoxRace shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests from data subjects exercising their rights under GDPR (Articles 15–22). RoxRace shall promptly notify the Controller if it receives a request from a data subject in respect of Controller Personal Data.

7. Personal Data Breach Notification

RoxRace shall notify the Controller without undue delay after becoming aware of a personal data breach affecting Controller Personal Data. Such notification shall contain at minimum: a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach. Where notification cannot be provided simultaneously, information may be provided in phases without further undue delay.

8. Data Protection Impact Assessments

RoxRace shall provide reasonable assistance to the Controller with any data protection impact assessments, and with prior consultations with supervisory authorities, which the Controller reasonably considers to be required pursuant to Articles 35 and 36 of the GDPR, in each case solely in relation to the processing of Controller Personal Data by RoxRace and taking into account the nature of the processing and the information available to RoxRace.

9. Deletion and Return of Data

Upon termination or expiry of the Agreement, RoxRace shall, at the choice of the Controller and within 30 calendar days, either delete or return all Controller Personal Data to the Controller. RoxRace shall also delete all existing copies of Controller Personal Data, unless EU or Member State law requires storage of the personal data beyond the end of the Services.

10. Audit Rights

RoxRace shall make available to the Controller all information necessary to demonstrate compliance with this Agreement and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. RoxRace shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other applicable Data Protection Laws.

11. International Data Transfers

RoxRace shall not transfer Controller Personal Data to a country outside the European Economic Area (EEA) without ensuring that appropriate safeguards are in place as required by GDPR Chapter V, such as Standard Contractual Clauses adopted by the European Commission, adequacy decisions, or Binding Corporate Rules.

12. Governing Law and Jurisdiction

This Agreement and any dispute or claim arising out of or in connection with it shall be governed by and construed in accordance with the laws of Sweden. The parties irrevocably agree that the courts of Stockholm, Sweden shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Agreement.

13. Acceptance

By creating an organization on RoxRace or by continuing to use the Services, the Controller agrees to be bound by this Data Processing Agreement. The acceptance is recorded with a timestamp and IP address at the time of organization creation.