Data Processing Addendum

benchli Data Processing Addendum

Effective date: 19 October 2026 Version: 1.0.3

This Data Processing Addendum ("DPA") forms part of the benchli Terms and Conditions between Mitbolas GmbH ("benchli", "we") and the team, club, league, or organization that uses benchli to manage its members (the "Club", "you"). It applies whenever the Club's team data is processed through benchli. It is accepted once per team, when the team is created (Section 12).

Where this DPA and the Terms and Conditions conflict on the processing of personal data, this DPA applies.

---

1. Definitions

• Personal data, processing, controller, processor, data subject, and personal data breach have the meanings given in the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
• Team data means the personal data the Club enters or causes to be entered into benchli about its members, guests, and contacts: rosters, invitations, RSVPs and availability, games and events, statistics, team feed content, and team finance records, together with the personal data benchli generates from them when providing the Service to the Club, such as statistics and the outputs of the AI-assisted features the Club uses.
• Account data means the personal data benchli holds about an individual user in their own right: their account, sign-in details, consent records, player card, billing details where they pay benchli, and the security and audit records of their own activity, and the indicator, described in Section 10.1 of the Privacy Policy, that shows managers of a player's other teams how many active suspensions that player has.
• Sub-processor means a third party engaged by benchli to process team data on the Club's behalf.

---

2. Roles

For team data, the Club is the controller and benchli is the processor. The Club decides which people to invite, what information to enter about them, how to use RSVP and participation data, and how long to keep the team.

For account data, benchli is the controller in its own right, as described in the benchli Privacy Policy. This includes each member's own account, their player card, and their consent records. benchli does not act as the Club's processor for account data, and the Club does not act as a controller of it.

Where the same information appears in both places (for example, a member's name on the roster and on their own player card), each party is responsible for its own processing of it.

---

3. The Club's responsibilities

The Club will:

1. only enter personal data into benchli that it is entitled to process, and only for managing its team;
2. give the people it adds to a team the information that data protection law requires for its own use of their data, including who the Club is and how to contact it, why it uses their data, on what legal basis, who receives it, how long it keeps it, and their rights; linking to the benchli Privacy Policy covers benchli's own processing and does not replace the Club's notice (benchli also gives every invited person a notice in the invitation itself);
3. respond to requests from its members about the team data it controls, using the tools benchli provides (Section 6);
4. keep its team's roster accurate and remove people who are no longer part of the team;
5. not add anyone under the minimum age stated in the Terms and Conditions, including a person who does not yet have an account, and remove at once anyone it learns is under that age;
6. only record a person's injury or other health information in its team's attendance records where it has a lawful basis and, where the GDPR applies, an Article 9 condition for it, normally that person's explicit consent, which the Club asks for, keeps a record of and honours if the person withdraws it; consent a person gives to benchli for their own status does not cover the Club's record.

---

4. benchli's obligations as processor

benchli will:

1. Process on instructions only. benchli processes team data only on the Club's documented instructions: this DPA and the Club's use and configuration of the Service, and, where the law requires other processing, as the law requires. The content licence in Section 16 of the Terms and Conditions does not widen these instructions. If the law requires benchli to process team data in another way, benchli tells the Club first unless the law forbids it. benchli will tell the Club if, in its opinion, an instruction breaks data protection law.
2. Keep it confidential. Everyone benchli allows to access team data is bound by confidentiality.
3. Keep it secure. benchli maintains the technical and organizational measures described in Annex 2 and in Section 18 of the Privacy Policy.
4. Help with requests and obligations. Taking into account the nature of the processing and the information it has, benchli helps the Club respond to data subject requests and meet its own obligations on security, breach notification, data protection impact assessments, and prior consultation with a supervisory authority, including where the Club cannot do so through the Service itself.
5. Report breaches. benchli notifies the Club of a personal data breach affecting its team data without undue delay after becoming aware of it, and gives the Club the information it needs for its own notifications.
6. Delete or return data at the end. When a team is closed or the Club's use of benchli ends, team data is deleted according to the retention schedule in Section 12 of the Privacy Policy (12 months after closure), unless the law requires benchli to keep it. At the Club's written request, benchli deletes it earlier, or first returns it to the Club in the export format and then deletes it, within 30 days of the request. The Club can also export its team data through the Service before closing a team. Data that benchli must keep by law is kept apart and used only for that purpose.
7. Show its work. benchli makes available the information reasonably needed to show that it meets this DPA, and allows audits as described in Section 8.

---

5. Sub-processors

The Club authorizes benchli to use the sub-processors listed in Appendix A of the Privacy Policy. Each sub-processor is bound by data protection obligations at least as protective as this DPA.

benchli will give the Club at least 30 days' notice before adding or replacing a sub-processor, by updating Appendix A and notifying team owners as described in Section 22 of the Privacy Policy. The Club may object in writing, on reasonable data protection grounds, within the notice period. benchli considers the objection in good faith and tells the Club what it can do about it. If there is no workable alternative, the Club may close its team and end its use of benchli before the change takes effect, with its team data returned or deleted under Section 4.6.

benchli remains responsible for its sub-processors.

---

6. Data subject requests

Members and other data subjects can exercise their rights directly with benchli for account data, and with the Club for team data, as described in Section 13 of the Privacy Policy.

If benchli receives a request about team data, it will pass it to the Club without undue delay and will not respond on the Club's behalf unless the Club asks it to or the law requires it. benchli provides the Club with tools to export team data, correct roster information, and remove members. Where a request needs more than those tools, benchli assists the Club on request.

---

7. International transfers

Apart from the exceptions below, benchli processes team data in the European Union. It is stored in Frankfurt, Germany; requests to the AI-assisted features described in Section 7 of the Privacy Policy may be processed in another Amazon Web Services region in the European Union (Stockholm, Ireland, Paris, Milan or Spain), which is not a transfer outside the European Union. A small number of sub-processors (Stripe for payments, Cloudflare for bot protection) may process some personal data outside Switzerland and the European Economic Area. For each of them, Appendix A of the Privacy Policy names the destination and the transfer basis: an adequacy decision or the Data Privacy Framework where the recipient is covered by it for Switzerland or the EU as applicable, and otherwise standard contractual clauses with the adaptations Swiss law requires. benchli does not rely on a framework for a recipient it does not cover.

---

8. Audit

The Club may ask benchli, once in any 12-month period, and also after a personal data breach affecting its team data, after a request from a data protection authority, or where it has reasonable grounds to suspect that benchli does not meet this DPA, for the information reasonably necessary to confirm that benchli meets this DPA. benchli answers in writing within 30 days, or sooner where a legal deadline of the Club or an urgent risk reasonably requires. Where that is not enough to meet a legal requirement of the Club, or where a data protection authority requires it, the Club may arrange an audit, including an inspection, at its own cost, on reasonable notice, during business hours, by an auditor bound by confidentiality, and without unreasonably disrupting the Service or exposing other clubs' data. The parties agree the arrangements in good faith; they do not prevent or unduly delay an audit that the law requires.

---

9. Liability

benchli's liability under this DPA is subject to the exclusions and limits in Section 23 of the Terms and Conditions, with all the exceptions stated there. This DPA does not add a limit on the Club's liability. Nothing in this DPA limits a party's liability to data subjects, or any other liability, where the law does not allow it to be limited.

---

10. Duration

This DPA applies from the moment a team is created and lasts until benchli has deleted all of that team's team data under Section 4.6, including any copies that remain after the data has been returned and the copies in backups, which leave within the backup period in Section 12 of the Privacy Policy. Return alone does not end this DPA. For data that the law requires benchli to keep, the confidentiality, security and use limits of this DPA continue until it is deleted.

---

11. Changes

benchli may update this DPA to reflect changes in law, in the Service, or in its sub-processors. Material changes are notified to team owners as described in Section 26 of the Terms and Conditions. Each team stays under the version of the DPA recorded for it until a person authorized to act for that team and Club accepts a newer version for that team in the Service; accepting a version when creating one team does not change another team's DPA. A notice of an amendment that needs acceptance states what changes and when it takes effect, and continued use alone is not acceptance. Changes to sub-processors follow Section 5, and changes the law requires apply whether or not they are accepted. Earlier versions remain available. Where this DPA refers to a section of the Privacy Policy for team data, such as retention, security measures or sub-processors, it means the version in force when the Club accepted this DPA for that team; a later Privacy Policy update does not reduce the Club's protections for that team unless the Club accepts a newer DPA version, apart from sub-processor changes under Section 5 and changes the law requires.

---

12. Acceptance, authority, and who the controller is

This DPA is accepted electronically when a team is created, by the person creating it ticking the acceptance and creating the team. benchli records the version accepted, who accepted it, and when. You can see this record in your team's settings.

By accepting, the person creating the team confirms that they are authorized to accept this DPA for the Club, and names the Club.

If the Club is not a legal person (for example, a group of friends who play together informally, without an association or company of their own), the person who creates the team is the controller of the team data for the purposes of this DPA, until the team's owner changes or the team names an organization in its settings.

An association that has legal personality, with or without a commercial-register entry, is itself the Club and the contracting party.

---

13. Governing law

This DPA is governed by the laws of Switzerland, as stated in Section 27 of the Terms and Conditions.

---

Annex 1: Details of the processing

---

Annex 2: Technical and organizational measures

• Infrastructure in the European Union (Amazon Web Services, Frankfurt; AI requests may be processed in other Amazon Web Services EU regions), with encryption in transit and at rest.
• Access to production systems limited to named staff with multi-factor authentication; administrative access to team data is logged.
• Role-based access within the Service: a team's data is seen by its own members and managers, according to the roles described in Section 4 of the Terms and Conditions, except in the cases the Club switches on or that the Privacy Policy describes: the team name and home association where team discoverability is on (Section 3.3), the number of active suspensions shown to managers of a player's other teams (Section 10.1), games and results shared with an opposing team, and sharing with the organizers of a league or competition the team has joined (Section 10.2).
• Audit records of administrative actions.
• Bot and abuse protection on sign-in and team creation.
• Backups kept for the maximum period stated in Section 12 of the Privacy Policy; data deleted in the live service leaves the backups within that period.
• Measures appropriate to the risk for the confidentiality, integrity, availability and resilience of the systems that hold team data, including backups so that team data can be restored after a physical or technical incident.
• Secure development practice: automated tests and independent review before every release.
• Incident response: a defined breach process with notification to affected clubs (Section 4.5).

---

Annex 3: Sub-processors

The current list is Appendix A of the benchli Privacy Policy, which forms part of this DPA.

---

Mitbolas GmbH Asylstrasse 26, 8800 Thalwil, Switzerland benchli_operations@benchli.com