Data processing addendum

This Data Processing Addendum ("DPA") forms part of the Terms of service between ArenOS and each Organizer. It applies whenever ArenOS processes personal data of Players on an Organizer's behalf.

1. Roles

The Organizer is the Data Fiduciary for its Players' personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). ArenOS is the Data Processor, processing that data only on the Organizer's documented instructions, which are the settings and features of the Service.

2. Scope of processing

Player identity and contact details, registration answers, waivers and signatures, payments and receipts, bookings, attendance, messages, and usage data, for the purpose of running the Organizer's programmes.

3. ArenOS obligations

• Process personal data only as needed to provide the Service and as instructed by the Organizer.
• Keep personal data confidential and ensure staff are bound by confidentiality.
• Apply appropriate technical and organisational security measures: encryption in transit and at rest, access controls, audit logs, and backups.
• Assist the Organizer in responding to Players' requests to access, correct, or erase data.
• Notify the Organizer without undue delay, and within 72 hours, of a personal data breach affecting its Players.
• Delete or return personal data when the Organizer deletes its organization, except records we must keep by law.

4. Sub-processors

ArenOS uses the following sub-processors: hosting and database providers in India, Razorpay (payments), MSG91 (SMS and WhatsApp), Resend (email), and Amazon Web Services (file storage). We will notify Organizers of changes with 30 days' notice; an Organizer may object on reasonable grounds.

5. Organizer obligations

Collect only the data your programme needs, obtain valid consent (including a parent or guardian's consent for minors), publish a privacy notice to your Players, and respond to their rights requests.

6. Data location

Personal data is stored and processed in India. Transfers outside India happen only through the sub-processors above and in accordance with the DPDP Act.

7. Audit

On request, no more than once a year, ArenOS will provide a summary of its security measures and any independent assessments.

Contact: privacy@arenosai.com.