Game Mode — Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") is part of the Game Mode Organization Terms of Service between Adalou LLC d/b/a Game Mode ("Game Mode," "Processor") and the organization that accepted those Terms ("Organization," "Controller"). It applies whenever Game Mode processes Personal Information on the Organization's behalf. If this DPA conflicts with the Terms, this DPA controls for that processing.

1. Definitions

"Personal Information" means information relating to an identified or identifiable individual that Game Mode processes on the Organization's behalf under the Terms.

"Applicable Privacy Law" means U.S. state privacy laws that apply to the parties, including those of California, Colorado, Connecticut, Oregon, Texas, Utah, Virginia, and other states with comparable laws, and COPPA where it applies.

"Controller," "Processor," "Business," "Service Provider," and "Consumer" have the meanings given in Applicable Privacy Law. The Organization is the Controller or Business. Game Mode is the Processor or Service Provider for the processing described here.

"Subprocessor" means a third party engaged by Game Mode to process Personal Information.

2. Roles and scope

The Organization determines the purposes and means of processing Personal Information it submits to the Service. Game Mode processes it only on the Organization's documented instructions.

The Terms, this DPA, the Organization's use and configuration of the Service, and instructions given through the Service or in writing are the Organization's complete instructions. Game Mode will tell the Organization if, in its reasonable opinion, an instruction violates Applicable Privacy Law.

Where Game Mode determines the purposes of processing — account administration, authentication and security, fraud prevention, subscription billing, support, product telemetry, and legal compliance — it acts as a Controller or Business in its own right, as described in the Privacy Policy, and this DPA does not apply to that processing.

3. Details of processing

Subject matter: providing the Service under the Terms.

Duration: for the term of the Terms, plus the post-termination period in Section 9, after which Personal Information is deleted.

Nature and purpose: hosting, storing, transmitting, displaying, reformatting, backing up, securing, and otherwise processing Personal Information to operate the Service; sending communications the Organization initiates; processing payments through Stripe; and AI-assisted drafting, summarizing, and document reading at the Organization's direction.

Categories of individuals: participants (typically minors), parents and guardians, coaches, staff, volunteers, and other individuals whose information the Organization submits.

Categories of Personal Information: names; dates of birth; contact details including email addresses and phone numbers; team, roster, and registration information; evaluation scores and notes; payment records and payment identifiers (not card numbers); messages and their delivery status; uploaded documents, photos, and video; and account and usage records associated with the above.

Sensitive information: the Service is not designed for comprehensive medical records, Social Security numbers, government identification numbers, or financial account numbers. Organizations may submit limited health or safety information reasonably necessary for sports participation, such as allergies, medical restrictions, emergency information, or similar registration information, only where they are legally permitted to collect and process that information.

4. Game Mode's obligations

Game Mode will:

• process Personal Information only for the purposes in Section 3 and on the Organization's instructions;
• not sell or share Personal Information, and not retain, use, or disclose it for any purpose other than performing the Service, including not for its own commercial purposes, except as permitted by Applicable Privacy Law;
• not combine Personal Information with information from other sources, except as permitted by Applicable Privacy Law;
• ensure personnel with access are bound by confidentiality obligations and receive appropriate training;
• limit access to those who need it to provide the Service;
• comply with its obligations as a Processor or Service Provider under Applicable Privacy Law;
• notify the Organization if it can no longer meet these obligations.

Game Mode may create and use aggregated or deidentified information derived from the Service where permitted by Applicable Privacy Law, provided it cannot reasonably be used to identify any individual or the Organization, and will not attempt to reidentify it.

5. Security

Game Mode maintains technical and organizational measures appropriate to the risk, including: encryption of Personal Information in transit and at rest; logical separation of each Organization's data; role-based access controls; authentication controls for administrative access; logging and monitoring; regular patching of infrastructure components; and restricted staff access to production data.

Game Mode reviews these measures periodically and may update them, provided protection is not materially reduced.

6. Subprocessors

The Organization authorizes Game Mode to engage Subprocessors. Current Subprocessors:

Game Mode will: impose data protection obligations on each Subprocessor no less protective than this DPA; remain responsible for their performance; and give the Organization at least 30 days' notice before adding or replacing a Subprocessor, by email to Organization Admins or notice in the Service. If the Organization reasonably objects on data protection grounds within that period, the parties will discuss in good faith; if no resolution is reached, the Organization may terminate the affected Service without penalty and receive a refund of prepaid, unused fees.

7. Assistance with individual rights

Game Mode will provide functionality or reasonable assistance enabling the Organization to access, correct, export, and delete Personal Information in its account.

If an individual contacts Game Mode directly about Personal Information held on the Organization's behalf, Game Mode will not respond substantively, will refer the individual to the Organization, and will notify the Organization without undue delay. Game Mode will provide reasonable assistance, at the Organization's expense where the assistance requires material effort beyond the Service's features.

8. Security incidents

Game Mode will notify the Organization without undue delay, and in any event within 72 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Information processed on the Organization's behalf.

The notice will describe, to the extent known: the nature of the incident, the categories and approximate number of individuals and records affected, likely consequences, and the measures taken or proposed. Game Mode will provide further information as it becomes available and will reasonably assist the Organization with its own notification obligations. Notification is not an acknowledgment of fault.

9. Return and deletion

During the term, the Organization may export Personal Information at any time using the Service.

After termination, Personal Information remains available for export for 30 days. Game Mode deletes Personal Information 90 days after termination, except copies retained temporarily in routine backups, which are deleted on the normal backup cycle, and records Game Mode is required by law to retain, which stay subject to this DPA.

The Organization may request deletion sooner, at any time during or after the term, and Game Mode will complete deletion within 30 days of the request.

10. Demonstrating compliance

On the Organization's written request, no more than once per 12 months, Game Mode will provide information reasonably necessary to demonstrate compliance with this DPA, including a description of its security measures and available third-party reports of its infrastructure providers.

Where Applicable Privacy Law entitles the Organization to conduct or arrange an assessment, the parties will agree on scope and timing in advance. Any on-site assessment is at the Organization's expense, during business hours, subject to confidentiality, and conducted so as not to disrupt the Service.

11. Children's information

The Organization is responsible for obtaining verifiable parental consent where required by COPPA or comparable law, and for its own compliance with those laws.

Game Mode will process children's information only as instructed by the Organization; will not use identifiable children's information for advertising, unrelated profiling, or training machine learning models; will retain it only as long as necessary for the purpose it was collected; and will assist the Organization in responding to parental access and deletion requests.

12. Liability

Each party's liability under this DPA is subject to the limitations in the Terms.

13. Changes

Game Mode may update this DPA to reflect changes in law, Subprocessors, or the Service, with at least 30 days' notice for material changes, provided the changes do not materially reduce protection of Personal Information.