Data Processing Addendum

benchli Data Processing Addendum

Effective date: 1 October 2026 Version: 1.0.1

This Data Processing Addendum ("DPA") forms part of the benchli Terms and Conditions between Mitbolas GmbH ("benchli", "we") and the team, club, league, or organization that uses benchli to manage its members (the "Club", "you"). It applies whenever the Club's team data is processed through benchli. It is accepted once per team, when the team is created (Section 12).

Where this DPA and the Terms and Conditions conflict on the processing of personal data, this DPA applies.

---

1. Definitions

• Personal data, processing, controller, processor, data subject, and personal data breach have the meanings given in the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
• Team data means the personal data the Club enters or causes to be entered into benchli about its members, guests, and contacts: rosters, invitations, RSVPs and availability, games and events, statistics, team feed content, and team finance records.
• Account data means the personal data benchli holds about an individual user in their own right: their account, sign-in details, consent records, player card, billing details where they pay benchli, and the security and audit records of their own activity.
• Sub-processor means a third party engaged by benchli to process team data on the Club's behalf.

---

2. Roles

For team data, the Club is the controller and benchli is the processor. The Club decides which people to invite, what information to enter about them, how to use RSVP and participation data, and how long to keep the team.

For account data, benchli is the controller in its own right, as described in the benchli Privacy Policy. This includes each member's own account, their player card, and their consent records. benchli does not act as the Club's processor for account data, and the Club does not act as a controller of it.

Where the same information appears in both places (for example, a member's name on the roster and on their own player card), each party is responsible for its own processing of it.

---

3. The Club's responsibilities

The Club will:

1. only enter personal data into benchli that it is entitled to process, and only for managing its team;
2. tell the people it adds to a team that it uses benchli, and where they can read the benchli Privacy Policy (benchli also gives every invited person this notice in the invitation itself);
3. respond to requests from its members about the team data it controls, using the tools benchli provides (Section 6);
4. keep its team's roster accurate and remove people who are no longer part of the team;
5. not add anyone under the minimum age stated in the Terms and Conditions.

---

4. benchli's obligations as processor

benchli will:

1. Process on instructions only. benchli processes team data only to provide the Service as described in the Terms and Conditions, as configured by the Club through the Service, and as required by law. The Club's use of the Service is its documented instruction. benchli will tell the Club if, in its opinion, an instruction breaks data protection law.
2. Keep it confidential. Everyone benchli allows to access team data is bound by confidentiality.
3. Keep it secure. benchli maintains the technical and organizational measures described in Annex 2 and in Section 18 of the Privacy Policy.
4. Help with requests and obligations. benchli helps the Club respond to data subject requests and meet its own obligations on security, breach notification, and data protection impact assessments, to the extent the Club cannot do so through the Service itself.
5. Report breaches. benchli notifies the Club of a personal data breach affecting its team data without undue delay after becoming aware of it, and gives the Club the information it needs for its own notifications.
6. Delete or return data at the end. When a team is closed or the Club's use of benchli ends, team data is deleted according to the retention schedule in Section 12 of the Privacy Policy, unless law requires benchli to keep it. The Club can export its team data through the Service before closing a team.
7. Show its work. benchli makes available the information reasonably needed to show that it meets this DPA, and allows audits as described in Section 8.

---

5. Sub-processors

The Club authorizes benchli to use the sub-processors listed in Appendix A of the Privacy Policy. Each sub-processor is bound by data protection obligations at least as protective as this DPA.

benchli will give the Club at least 30 days' notice before adding or replacing a sub-processor, by updating Appendix A and notifying team owners as described in Section 22 of the Privacy Policy. If the Club has a reasonable objection on data protection grounds, it may close its team and end its use of benchli before the change takes effect. The refund rules in Section 11 of the Terms and Conditions apply.

benchli remains responsible for its sub-processors.

---

6. Data subject requests

Members and other data subjects can exercise their rights directly with benchli for account data, and with the Club for team data, as described in Section 13 of the Privacy Policy.

If benchli receives a request about team data, it will pass it to the Club without undue delay and will not respond on the Club's behalf unless the Club asks it to or the law requires it. benchli provides the Club with tools to export team data, correct roster information, and remove members. Where a request needs more than those tools, benchli assists the Club on request.

---

7. International transfers

benchli processes team data in the European Union. It is stored in Frankfurt, Germany; requests to the AI-assisted features described in Section 7 of the Privacy Policy may be processed in another Amazon Web Services region in the European Union (Stockholm, Ireland, Paris, Milan or Spain), which is not a transfer outside the European Union. Where a sub-processor transfers personal data outside Switzerland or the European Economic Area, the transfer is covered by an adequacy decision or by standard contractual clauses, as stated for each sub-processor in Appendix A of the Privacy Policy.

---

8. Audit

The Club may ask benchli, once in any 12-month period or after a personal data breach affecting its team data, for the information reasonably necessary to confirm that benchli meets this DPA. benchli answers in writing within 30 days. Where that is not enough to meet a legal requirement of the Club, the Club may arrange an audit at its own cost, on reasonable notice, during business hours, by an auditor bound by confidentiality, and without disrupting the Service or exposing other clubs' data.

---

9. Liability

Each party's liability under this DPA is subject to Section 23 of the Terms and Conditions, except that nothing limits a party's liability to data subjects where the law does not allow it to be limited.

---

10. Duration

This DPA applies from the moment a team is created and lasts until all of that team's team data has been deleted or returned under Section 4.6.

---

11. Changes

benchli may update this DPA to reflect changes in law, in the Service, or in its sub-processors. Material changes are notified to team owners as described in Section 26 of the Terms and Conditions, and a new version is accepted the next time a team owner creates a team or is asked to confirm it in the Service. Earlier versions remain available.

---

12. Acceptance, authority, and who the controller is

This DPA is accepted electronically when a team is created, by the person creating it ticking the acceptance and creating the team. benchli records the version accepted, who accepted it, and when. You can see this record in your team's settings.

By accepting, the person creating the team confirms that they are authorized to accept this DPA for the Club, and names the Club.

If the Club is not a legal person (for example, a group of friends who play together without a registered association), the person who creates the team is the controller of the team data for the purposes of this DPA, until the team's owner changes or the team names an organization in its settings.

---

13. Governing law

This DPA is governed by the laws of Switzerland, as stated in Section 27 of the Terms and Conditions.

---

Annex 1: Details of the processing

---

Annex 2: Technical and organizational measures

• Infrastructure in the European Union (Amazon Web Services, Frankfurt; AI requests may be processed in other Amazon Web Services EU regions), with encryption in transit and at rest.
• Access to production systems limited to named staff with multi-factor authentication; administrative access to team data is logged.
• Role-based access within the Service: only a team's own members and managers see its team data, according to the roles described in Section 4 of the Terms and Conditions.
• Audit records of administrative actions.
• Bot and abuse protection on sign-in and team creation.
• Backups with a defined lifecycle; deletion requests propagated to backups within the backup cycle.
• Secure development practice: automated tests and independent review before every release.
• Incident response: a defined breach process with notification to affected clubs (Section 4.5).

---

Annex 3: Sub-processors

The current list is Appendix A of the benchli Privacy Policy, which forms part of this DPA.

---

Mitbolas GmbH Asylstrasse 26, 8800 Thalwil, Switzerland benchli_operations@benchli.com