Privacy Policy

benchli Privacy Policy

Effective date: 19 October 2026 Last updated: 19 October 2026 Product: benchli (mobile apps + web) Data controller: Mitbolas GmbH Registered address: Asylstrasse 26, 8800 Thalwil, Switzerland Privacy contact: benchli_operations@benchli.com

This Privacy Policy explains how benchli collects, uses, stores, shares, and protects personal data when you use the benchli apps, websites, APIs, support tools, and related services (together, the "Service").

benchli is a sports team operations platform for players, team managers, clubs, leagues, and organizers.

This Privacy Policy applies to personal data processed through the Service about users and about other people whose details are entered into it, such as people a team has invited who have not created an account. Our role differs between account data and team data, as Section 1 explains.

---

1. Who is responsible for your personal data

The data controller responsible for your personal data is:

Mitbolas GmbH Address: Asylstrasse 26, 8800 Thalwil, Switzerland Email: benchli_operations@benchli.com

Team data is different. When a team, club, league, or organization (a "Club") uses benchli to manage its members, the Club decides which people to invite, what information to enter about them, how to use RSVP and participation data, and how long to keep the team. For that team data the Club is the controller and benchli is its processor, under the benchli Data Processing Addendum (the "DPA"), which the Club accepts when it creates a team. If a Club is not a legal person (for example, a group of friends who play together informally, without an association or company of their own), the person who created the team is the controller of its team data until the team's owner changes or the team names an organization in its settings, as the DPA provides.

For everything else described in this Privacy Policy, including your own account, your player card, your consent records, your billing details where you pay benchli, and the security records of your own activity, Mitbolas GmbH is the controller.

Questions about how a Club uses your team data go to that Club first; benchli helps the Club answer them and passes on any request it receives about team data.

---

2. Summary

benchli collects personal data to provide team sports management functionality.

This may include account information, profile information, team membership, RSVP status, availability, event participation, team communications, support messages, payment-related information, uploaded photos, app usage data, and optional notes or feedback.

We use this data to:

• provide the app;
• manage accounts and authentication;
• support team and player workflows;
• process invitations and RSVPs;
• enable team communications;
• support payments and subscriptions;
• improve security;
• provide support;
• generate analytics and insights;
• power optional AI-assisted features;
• comply with legal obligations.

We do not sell your personal data.

---

3. Personal data we collect

3.1 Account and identity data

We may collect:

• first name;
• last name;
• email address;
• phone number, if supported;
• authentication identifiers;
• login verification status;
• preferred language;
• account status;
• user ID;
• device or session identifiers;
• role information.

3.2 Player profile data

We may collect:

• profile photo;
• date of birth, which you must give: we use it to check that you meet the minimum age, to apply the rules for your age and country, and to derive the age range below. We keep it while your account exists, because your age, and so the rules and the age range that apply to you, change over time;
• gender, only if you choose to give it: it is optional, and we use it on the basis of your choice to give it. If you give it, the managers of your teams can see it, including in a team roster export. You can leave it blank, or remove it at any time, which withdraws that choice;
• an age range derived from your date of birth (never the date itself), shown to managers searching for guest players;
• preferred jersey number or numbers;
• team membership;
• player status;
• jersey size;
• position or role, if supported;
• player preferences;
• self-managed profile fields.

Injury. If you choose to record that you are injured, we store that status and the expected return date, with no note and no medical detail. This is information about your health, so we ask for your explicit consent before you save it. We show it to you and to the managers of your team. When you clear the status, your managers stop seeing it; a record of the dates stays in your own status history, which managers do not see, until you delete your account. You can withdraw your consent at any time by contacting us at benchli_operations@benchli.com, and we then delete that record. A manager of your team can also record that you were injured when marking attendance; that is the team's record under the DPA, and the team needs your explicit consent for it. To have that record corrected or removed, ask the team, or contact us and we will pass your request on.

3.3 Team and organization data

We may collect:

• team name;
• sport type;
• team logo;
• team settings;
• team roles;
• team membership records;
• manager and owner information;
• league, club, or organization relationships;
• team subscription status;
• team configuration data.

Team discoverability. Team names and their home association (for example the club or league they belong to) are discoverable by other benchli teams so that opposing teams can find each other to schedule games. Discoverability is on by default; the person who creates a team can switch it off during team creation, and owners can change it at any time in team settings. If a team name contains a personal name, switching discoverability off removes it from search. If a team is named after you and you did not choose that, you can ask the team to change the name or switch discoverability off, or contact us at benchli_operations@benchli.com and we will help.

3.4 Game, event, and participation data

We may collect:

• games;
• events;
• tournaments;
• fixtures;
• locations;
• schedules;
• RSVP status;
• availability;
• attendance;
• participation history;
• statistics;
• game notes;
• event notes;
• team feedback;
• poll responses;
• task activity;
• team feed activity.

3.5 Communications data

We may collect:

• support messages;
• feedback submissions;
• team messages;
• announcements;
• comments;
• replies;
• notification preferences;
• email delivery metadata;
• push notification tokens;
• in-app communication records.

3.6 Photos, media, and uploaded content

We may collect:

• profile images;
• team logos;
• uploaded documents;
• written notes;
• voice notes;
• audio recordings, if supported;
• transcriptions;
• translations;
• generated summaries;
• image validation metadata.

Where a profile photo is uploaded, we run a basic check that it appears to be a suitable headshot (see Section 8). This is not facial recognition and does not create biometric data.

3.7 Payment and billing data

Where paid features are used, we may collect:

• subscription status;
• plan type;
• billing contact details;
• transaction IDs;
• invoice references;
• payment provider references;
• currency;
• amount;
• payment status;
• refund status;
• platform fee metadata;
• tax-related metadata where required.

We do not receive or store your full card number. You enter card details with Stripe (or with the app store, if you buy through one), which processes them under its own terms.

3.8 Device, technical, and usage data

We may collect:

• device type;
• operating system;
• app version;
• browser or webview data;
• IP address;
• approximate location derived from IP address;
• language settings;
• crash logs;
• diagnostic logs;
• API request metadata;
• authentication events;
• security logs;
• feature usage;
• performance metrics.

3.9 Data we do not collect

benchli does not collect or process:

• biometric data, facial-recognition templates, or other special-category biometric identifiers;
• medical records, physiological or heart-rate data, or health data other than the injury status described in Section 3.2;
• sensor, wearable, or edge-device measurements.

benchli is not a medical service. We do not ask for health information beyond that, and you should not put diagnoses, treatment details or medical certificates in notes, messages or uploads. If something like that is submitted anyway, we hold it as part of the submission; contact us and we will remove it. Profile-photo handling is limited to confirming that an uploaded image appears to be a headshot (see Section 8) and does not involve facial recognition, biometric matching, or identity verification.

---

4. How we collect data

We collect data when:

• you create or update an account;
• you verify your email or login;
• you join or create a team;
• a team manager invites you;
• you RSVP to a game or event;
• you submit availability;
• you upload a profile photo;
• you post notes, feedback, or support messages;
• you use polls, tasks, feeds, or team tools;
• you interact with notifications;
• you make or manage payments;
• you contact support;
• you use the app or website;
• third-party services provide data necessary for integrations.

Some information may be entered by team managers, owners, league organizers, or other authorized users.

If someone adds you to a team. A team manager may enter your name and e-mail address to invite you before you have an account. The invitation you receive names the person and the team that invited you, so you know who supplied your details, tells you who benchli is, and links to this Privacy Policy. The team is responsible for the information about its own use of your details; benchli gives you the information about benchli's own processing. If you never accept the invitation, the invitation record is deleted or anonymized as described in Section 12.

---

5. Why we use personal data

We use personal data for the following purposes.

5.1 To provide the Service

This includes:

• account creation;
• authentication;
• team membership;
• player profiles;
• game and event management;
• RSVP tracking;
• availability tracking;
• team communications;
• statistics;
• player history;
• team feeds;
• polls;
• tasks;
• marketplace functionality;
• mobile app functionality.

5.2 To manage teams, leagues, and organizations

This includes:

• team setup;
• role management;
• manager permissions;
• league or club administration;
• roster management;
• team settings;
• participation records;
• team-level analytics.

5.3 To provide payments and subscriptions

This includes:

• subscription management;
• payment confirmation;
• invoicing;
• refunds;
• fraud prevention;
• account status management;
• tax and accounting support;
• payment provider integration.

5.4 To provide support and handle feedback

This includes:

• responding to support requests;
• investigating issues;
• managing incidents;
• triaging requests;
• improving knowledge base content;
• analyzing product feedback;
• prioritizing fixes and enhancements.

The ideas board. When you submit an idea, it stays private until a member of the benchli team has reviewed it. If we publish it, its title, description, category, sport, tags, status, vote count, the dates it was submitted and last updated, any note we add about its progress, and links to similar ideas it was combined with can be seen and voted on by every signed-in benchli user, not only your team. We do not show your name, your teams, your country or your contact details with a published idea, and before we publish an idea we remove any personal details about anyone that appear in what you wrote. We record who voted on each idea so that everyone gets one vote, and we let you know in the app when an idea you submitted or voted on is planned, built, released, declined or combined with a similar idea. You can ask us to take a published idea down at any time through support.

5.5 To provide AI-assisted features

benchli may use AI or automated processing to support:

• support triage;
• feedback classification;
• knowledge base recommendations;
• game retrospectives;
• translation;
• transcription;
• summarization.

This includes the optional "propose a lineup" suggestion: a manager can ask for a suggested team lineup. The suggestion is decision support only; the manager reviews it and decides.

AI outputs may be reviewed, logged, corrected, or improved for quality, safety, and auditability.

5.6 To keep the Service secure

This includes:

• fraud detection;
• abuse prevention;
• audit logging;
• access control;
• rate limiting;
• incident response;
• identity verification;
• suspicious activity detection;
• account protection.

5.7 To improve the Service

This includes:

• product analytics;
• performance monitoring;
• crash analysis;
• usability improvements;
• feature planning;
• quality control;
• testing;
• debugging.

These purposes do not let benchli reuse a Club's team data for its own ends: we process identifiable team data only on the Club's instructions under the DPA, or as the law requires. Information that has been anonymized so that it no longer identifies anyone is not personal data.

5.8 To comply with legal obligations

This includes:

• tax and accounting obligations;
• regulatory requirements;
• law enforcement requests where valid;
• data protection obligations;
• consumer protection obligations.

We also use personal data to establish, exercise or defend legal claims and to investigate fraud and security incidents. Those are our own purposes, not legal obligations: where the GDPR applies, they rest on our legitimate interests (Section 6).

---

6. Legal basis for processing

Where Swiss data protection law applies, we process personal data in accordance with the Swiss Federal Act on Data Protection.

Where the GDPR applies, we rely on one or more of the following legal bases:

The table below describes processing for which Mitbolas GmbH is the controller. For team data, such as rosters and RSVP records, the Club decides the legal basis and benchli processes the data on the Club's instructions under the DPA.

Contract necessity applies only where the processing is needed for our agreement with you, or to take steps you ask for before you sign up. Our legitimate interests are keeping the Service secure and preventing fraud, resolving support requests, and improving the Service's reliability and ease of use, always balanced against your rights and reasonable expectations. Where we rely on consent, you can withdraw it at any time; this does not affect processing before the withdrawal.

Where we rely on legitimate interests, we balance our interests against your rights and freedoms.

---

7. AI, automated processing, and profiling

benchli uses a third-party AI service — Amazon Web Services (AWS) Bedrock, currently running the Amazon Nova Lite and Amazon Nova 2 Lite models, in the EU — to power a small set of automated, assistive features. Requests start in Frankfurt (eu-central-1), and AWS may process them in another of its EU regions (Stockholm, Ireland, Paris, Milan or Spain) to balance load. AWS processes this data on benchli's behalf under our instructions and contractual data-protection terms; the data stays within the EU and is not used to train third-party foundation models.

Today these uses are mostly operational and assistive, for example:

• support-request triage and feedback classification (including duplicate detection);
• knowledge-base and help suggestions;
• moderation assistance.

The main user-facing use is the optional "propose a lineup" suggestion, which a manager can trigger to receive a suggested team lineup. Any such output is advisory — a manager reviews it and decides. To suggest a lineup, benchli sends the AI service the opponent, whether the game is at home or away, the style you chose, and, for each player who has said yes or maybe, an internal player ID with basic game counts. It does not send names, photos, contact details, or notes, and the suggestion is not an assessment of any person.

No solely-automated decisions with legal or similarly significant effect. benchli does not use AI to make decisions that produce legal effects concerning you, or similarly significantly affect you, without human involvement (in GDPR terms, Article 22). We do not use AI for credit, eligibility, safeguarding, or disciplinary decisions, and we do not use AI to rate people or to infer special-category information about them.

AI-generated outputs may be inaccurate or incomplete and should be reviewed before being relied upon. Content you submit to an AI-assisted feature is processed to provide that feature. We also keep a record of AI requests (see Section 12) for reliability, security, quality, and audit purposes. For team data, this follows the Club's instructions under the DPA.

---

8. Profile photos (headshot check)

benchli allows users to upload a profile photo, which should be a headshot so teammates can recognise each other.

To keep photos appropriate, benchli runs a basic automated check (using AWS Rekognition, EU region) on whether an uploaded image appears to be a headshot (face-presence and image quality) and screens it for inappropriate content; it may generate technical metadata such as a validation status, a generated thumbnail, image-quality indicators, and a moderation status. Only the pass/fail result is kept — the analysis itself is transient.

This is not facial recognition or biometric processing. benchli does not:

• create, store, or compare facial-recognition templates or biometric identifiers;
• identify or verify a person's identity from their photo;
• match faces across teams, accounts, or other services;
• sell your photo, or use it for anything except this check and showing it to the people described in Section 10.1. AWS runs the check on our behalf; it does not identify or verify you or match your face against other images.

The check only assesses whether the picture looks like a suitable headshot — nothing more. (Any device-level face unlock, such as Face ID, is performed by your device's operating system, not by benchli.) Where local law nonetheless requires consent for this kind of image handling, benchli will seek consent or offer an alternative.

---

9. Children and younger users

benchli is intended for users aged 18 and above, unless a higher minimum age applies in a particular country or feature.

We do not knowingly allow children below the applicable minimum age to create accounts.

The minimum age also applies to people added to a team by someone else, including people who do not have an account: a team must not add anyone below it (see the DPA), and a guardian's consent does not change that. If you believe an account or a team record concerns someone below that age, contact us at benchli_operations@benchli.com.

Teams, clubs, leagues, and organizers are responsible for ensuring that their use of benchli complies with applicable child protection, safeguarding, consent, and sports governance rules.

---

10. Sharing personal data

We may share personal data with the following categories of recipients.

10.1 Team members and team managers

Depending on your role and team settings, some data may be visible to other users, such as:

• name;
• profile photo;
• team role;
• RSVP status;
• availability;
• player status;
• jersey number;
• statistics;
• comments or notes you choose to share;
• team feed activity.

Team managers may have broader access to team-related information.

If a team suspends you, managers of your other teams can see that you have an active suspension elsewhere and how many — never which team suspended you, why, or for how long. You can always see the same indicator about yourself in your own profile. We record every time this indicator is accessed. A suspension is recorded by the team that issued it. If you think one is wrong, ask that team to correct it, and the indicator changes with it. You can also contact us at benchli_operations@benchli.com to ask about the indicator or to object to it.

Team discoverability (see §3.3) also affects what other teams can see: a discoverable team's name and home association can be found by other benchli teams.

Ideas you submit to the ideas board can be seen by every signed-in benchli user once we publish them, without your name (see §5.4).

10.2 Clubs, leagues, and organizations

Where your team joins a club, league, tournament, or organization, the team data its organizers need for that competition (for example fixtures, results, and participation) may be shared with its authorized organizers. For team data this follows the Club's instructions and settings under the DPA; belonging to a competition does not by itself give its organizers access to everything a team holds.

10.3 Service providers

We may share data with service providers that help us operate the Service, including providers of:

• cloud hosting;
• databases;
• authentication;
• email delivery;
• push notifications;
• payment processing;
• analytics;
• crash reporting;
• customer support;
• AI processing;
• transcription;
• translation;
• image processing;
• security;
• logging;
• monitoring.

These providers may process data only as necessary to provide services to us, subject to contractual obligations.

10.4 Payment providers and app stores

If you make payments, relevant transaction data may be shared with:

• payment processors;
• card networks;
• banks;
• Apple App Store;
• Google Play;
• tax or accounting service providers;
• refund or dispute handling providers.

10.5 Integration partners

If you or your team use optional integrations, we may share data with integration partners as needed to provide the selected functionality.

Calendar subscriptions that you set up are one such integration. Other integrations are off by default and are switched on, and disclosed, only when a team or you turn them on.

AI assistants you connect. If you connect an AI assistant you use, such as ChatGPT, Claude or Grok, benchli gives that assistant your own information that you approved, for the teams you picked, when it asks and until you disconnect it; benchli does not choose the assistant and sends it nothing on its own. That information is about you: your games and training, your RSVP answers, your stats and what you owe. It can include a team name, an event title or the purpose of a payment, which someone in your team may have typed and which can contain another person's name; benchli gives the assistant no team roster and no other information about the people in your teams. What the assistant's provider receives is handled under that provider's own terms and privacy policy and may be stored outside Switzerland and the EU; disconnecting stops further access but does not delete what the provider already holds. Before we offer an assistant, we check where its provider handles data and which transfer safeguards it relies on, and the screen where you approve it names the provider and says that its own terms apply and that it may keep data outside Switzerland and the EU. You can see and disconnect your assistants under Account & preferences › Connected assistants.

We will only share data necessary for the relevant integration.

10.6 Legal, safety, and compliance recipients

We may share data where necessary to:

• comply with law;
• respond to valid legal requests;
• protect users;
• prevent fraud or abuse;
• enforce our Terms;
• investigate security incidents;
• protect the rights, property, or safety of benchli, users, or others.

10.7 Business transfers

If benchli is involved in a merger, acquisition, financing, reorganization, or sale of assets, we use anonymized or aggregated information wherever that is enough, and share identifiable personal data only where necessary and lawful, under confidentiality and access limits. Team data stays subject to the DPA and the Club's instructions. If the controller or the purposes of processing change, we give you the information the law requires.

---

11. International data transfers

benchli is based in Switzerland. Core processing and storage take place in the EU — Amazon Web Services, Frankfurt (eu-central-1) — covering authentication, databases, file storage, email, image checks, and the AI features described in Section 7. Requests to the AI features described in Section 7 may be processed in another AWS EU region (Stockholm, Ireland, Paris, Milan or Spain); this stays within the EU and is not a transfer outside it.

A limited number of providers may process some personal data outside Switzerland/the EU — for example Stripe (payments, a sub-processor) may involve transfers to the United States, and if you choose to add your digital player card to Google Wallet, Google receives the pass details under its own terms and may process them in the United States. The named sub-processors and their regions are listed in Appendix A.

For transfers to a country without recognised adequate protection, we use a valid transfer mechanism, ordinarily standard contractual clauses with the adaptations Swiss law requires, and add measures where needed. We rely on the Swiss-US or EU-US Data Privacy Framework only for a recipient and processing that the framework covers. Data processing agreements, security measures, and transfer assessments support, but do not replace, that mechanism. Appendix A names the destinations and mechanisms, and you can ask for a copy of the relevant safeguards at benchli_operations@benchli.com, with commercial terms redacted.

---

12. Data retention

We keep personal data only as long as needed for the purposes described in this Privacy Policy, and then delete or anonymize it. The periods below apply unless the law requires a longer period, or specific records are needed for an ongoing investigation, safeguarding matter, or legal claim. In that case we keep only the records concerned, limit who can use them, review the need regularly, and delete or anonymize them when the need ends. For team data that we process on a Club's behalf, retention and deletion follow the Club's instructions and Section 4.6 of the DPA; these exceptions do not let us keep that data against those instructions unless the law requires it.

When a period ends, we delete the data or anonymize it so that it no longer identifies you. Anonymized team history (for example, a game result without player names) may be kept.

---

13. Your rights

Depending on your location and applicable law, you may have rights to:

• access your personal data;
• correct inaccurate data;
• delete your data;
• restrict processing;
• object to processing;
• withdraw consent;
• receive a copy of your data;
• request data portability;
• object to direct marketing;
• challenge certain automated decisions;
• lodge a complaint with a data protection authority.

Withdrawing consent does not affect processing carried out before the withdrawal.

Your right to object. You can object at any time, on grounds relating to your particular situation, to processing that rests on our legitimate interests, including related profiling. We will stop unless we show compelling legitimate grounds that override your interests, rights and freedoms, or we need the processing for legal claims. You can also object to direct marketing at any time without giving a reason, and we will then stop using your data for it. To object, contact us at benchli_operations@benchli.com.

To exercise your rights, contact us at benchli_operations@benchli.com.

We may need to verify your identity before responding. We respond without undue delay and within 30 days of receiving your request (within one calendar month where the GDPR sets that limit). If a request is complex or we receive many requests, the GDPR allows us to take up to two further months; we tell you within the first month and explain why.

For team data controlled by a Club (Section 1), we pass your request to the Club and help it respond.

We keep data despite a deletion request only where the law permits or requires it, for example payment records we must keep (Section 12). We tell you what we kept and why, and that you can complain to a data protection authority (Section 23).

---

14. Account deletion

You may request account deletion through the app, where available, or by contacting us at benchli_operations@benchli.com.

When your account is deleted:

• your login is disabled straight away and you appear in your teams as "Deleted member";
• for 30 days after your request we can restore your account if you ask; after that, our next daily clean-up deletes or irreversibly anonymizes your personal data, including your profile photo;
• records we must or may keep stay, limited to the purposes and periods in Section 12, for example payment and audit records;
• team records keep your past participation without your name, photo or contact details: you appear as “Deleted member”. Posts you wrote in a team feed can stay with the team under that name; contact us if you want one removed.

If you are the only owner of a team that has other members, transfer ownership to another member before you delete your account. If you cannot, contact us: we will settle the team with you, for example by passing it to a manager you name or closing it after telling its members, so that your request is handled within the time the law gives us.

---

15. Marketing communications

We may send marketing communications where permitted by law.

You can opt out of marketing emails by using the unsubscribe link or contacting us.

Even if you opt out of marketing, we may still send service-related communications, such as security notices, login codes, billing notices, team invitations, and important account updates.

---

16. Push notifications

With your permission, benchli may send push notifications to your device.

These may include:

• game reminders;
• RSVP reminders;
• team updates;
• support messages;
• event changes;
• invitations;
• task updates;
• payment or subscription notices;
• security alerts.

You can manage push notification permissions in your device settings or in the app where available.

---

17. Cookies, analytics, and similar technologies

The websites and the app use only the storage they need to sign you in, keep your session, remember your preferences, and keep the Service secure, including the bot-protection challenge from Cloudflare at sign-in and team creation (Appendix A). We do not use advertising or analytics cookies, and we do not use third-party tracking SDKs. If we ever add anything that is not strictly necessary, we will ask for your consent first where the law requires it.

---

18. Security

We use technical and organizational measures designed to protect personal data.

These include:

• access controls;
• authentication;
• encryption in transit;
• encryption at rest;
• audit logging;
• security monitoring;
• role-based permissions;
• least-privilege access;
• secure cloud infrastructure;
• backup controls;
• incident response procedures.

For team data we maintain the measures in Annex 2 of the DPA.

No system is completely secure. You are responsible for keeping your device, email account, and login methods secure.

If you believe your account or data has been compromised, contact us immediately at benchli_operations@benchli.com.

---

19. Data breaches

If a personal data breach affects team data that we process for a Club, we tell the Club without undue delay and help it with its own notifications, as the DPA provides. For data we control, we notify the Federal Data Protection and Information Commissioner as soon as possible where the breach is likely to result in a high risk to the people concerned and, where the GDPR applies, the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to people's rights. If we take longer, we say why. We tell the people affected where the law requires it.

---

20. App store privacy disclosures

If benchli is distributed through Apple App Store or Google Play, we may be required to provide privacy and data safety disclosures to those platforms.

Apple requires developers to identify data collected by the app and third-party partners and keep app privacy responses accurate and up to date. Google Play requires developers to explain what user data is collected, transmitted, used, and shared. The app store privacy labels or data safety sections are summaries. This Privacy Policy provides the fuller explanation.

---

21. Third-party links

The Service may contain links to third-party websites, services, payment pages, app stores, support tools, partner services, or integrations.

We are not responsible for the privacy practices of independent third parties. This does not limit our responsibility for our own processing and disclosures of personal data, or for providers that process personal data on our behalf.

You should review their privacy policies before using their services.

---

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

If changes are material, we will take reasonable steps to notify users, such as through the app, email, or website.

The updated version applies from the effective date stated in it. We tell you about material changes before they take effect, for example in the app or by e-mail. Updating this Privacy Policy, or your continued use of the Service, is not consent to new processing that needs your consent; where consent is needed we ask for it. Processing of team data stays under the Club's instructions in the DPA, and we give team owners at least 30 days' notice of a new or replaced sub-processor, as Appendix A says.

---

23. Complaints

You can contact us about privacy at benchli_operations@benchli.com, but you do not have to before you contact a data protection authority. You can complain to the Swiss Federal Data Protection and Information Commissioner. Where the GDPR applies, you have the right to complain to a supervisory authority, in particular in the country where you live or work or where the problem arose.

---

24. Contact

For privacy questions, data rights requests, or complaints, contact:

Mitbolas GmbH Email: benchli_operations@benchli.com Address: Asylstrasse 26, 8800 Thalwil, Switzerland Website: https://benchli.com/

---

Appendix A — Sub-processors

benchli uses the three providers below to process personal data for the Service, each under a data-processing agreement. AWS and Cloudflare process on our behalf. Stripe processes on our behalf for the services we configure, and also acts as an independent controller for payment processing, fraud prevention, and its own legal obligations, under its own terms and privacy policy. Core infrastructure runs on Amazon Web Services in Frankfurt (eu-central-1, EU). This list is maintained and may change; we give team owners at least 30 days' notice of a new or replaced sub-processor, as described in Section 22 and in the Data Processing Addendum.

You can ask for information about, or a copy of, the safeguards for a transfer at benchli_operations@benchli.com, with commercial terms redacted.

Other services and optional third-party features.

The table describes what these services receive. Some receive personal data under their own terms and privacy policies; they are not sub-processors acting on our behalf. App stores receive your app-store account data. If you add your digital player card to a wallet, the pass holds the name, team, sport, and statistics shown on it, on your device for Apple Wallet or in your Google account for Google Wallet.

Region-specific or optional integrations that are off by default are switched on only by the person they concern or, for a team, by someone authorized to act for the team, and are disclosed at that point. Adding a digital player card to a wallet, or connecting an AI assistant to your own account, is your own choice. We do not use advertising networks or third-party behavioural-tracking SDKs.