Data processing agreement

Data processing agreement under Art. 28 GDPR · Version of 1 October 2026. This is a courtesy translation. The German version is legally binding.

1. Parties, conclusion and term

This agreement is between the club that uses Schatu and is listed there under its name ("club"), as controller, and

as processor ("we"). It is concluded when a person authorised to represent the club accepts it in Schatu on the club's page, or confirms it to us in text form, for example by email. It thereby exists in electronic form (Art. 28(9) GDPR). We record which version was accepted for the club, when and by whom.

The agreement runs for as long as the club uses Schatu. The club may end its use and this agreement at any time by telling us in text form. We may end it with four weeks' notice in text form if we stop providing Schatu to the club. Either party's right to terminate without notice for good cause is unaffected. Good cause exists in particular if a party seriously breaches this agreement or data protection law.

2. Subject, nature and purpose of processing

We provide the club with Schatu, an application for managing club members, roles and chess tournaments. In doing so we store data, show it to authorised users, generate pairings, calculate standings and delete data on the club's instructions. Member lists and the club's tournaments, including player names, ratings and results, are visible only to the club's members, unless the club publishes them on its public club page. In addition, Schatu's platform administrators (currently the operator alone) can view all clubs with their member lists and tournaments, but only for the purposes set out in section 5.

Public club page

On the club's instructions we provide a public club page that anyone can view on the internet without an account. The club admins decide in Schatu whether it exists and what it shows: the club's description, contact details and website, DSB club number, number of members, the club admins' display names, and tournaments the club selects, optionally with player names, pairings, results and standings and additionally with players' ratings and affiliations. We never publish DSB member numbers. Unless the club allows it, we ask search engines not to index the page. Once public, data can be copied by third parties; we cannot retrieve such copies.

Data subjects

• members of the club with a Schatu account,
• players in the club's tournaments, including people without an account,
• people the club names in the description or contact details of its public club page.

Types of data

• for members: display name, role in the club, time of joining in Schatu, linked DSB member number,
• for tournament players: name, rating, club or affiliation, where applicable DSB member number, starting rank and withdrawal,
• tournament data: name, format, dates, pairings, results and standings,
• public club page details: the description, contact details and website the club enters for it.

Special categories of personal data (Art. 9 GDPR) are not processed. The club does not enter such data in Schatu.

This agreement does not cover the user accounts themselves (email address, password, sessions), the sign-in emails, or retrieving DWZ data from the German Chess Federation's rating portal. We are the controller for those, as described in our privacy policy. Schatu keeps no copy of the DWZ data.

To show the current rating of linked members and players, we send the DSB member number the club linked and, for the member list, the club's DSB club number to the rating portal. We send no other club data, such as display names, roles or tournament data. The rating portal does not process data on our behalf and is therefore not a subprocessor.

Place of processing

The data is stored and processed in data centres in the European Union. Transfers to a third country, including access from one, only take place under section 7.

3. The club's obligations

The club is responsible for the lawfulness of the processing, in particular the legal basis, informing data subjects under Art. 13 and 14 GDPR, and answering their requests. It assigns roles in Schatu only to people who should see or edit the data concerned. If the club notices errors or irregularities in the processing, it tells us without delay.

Whether the club runs a public club page and which data it shows is the club's decision alone. Before each publication, the club checks that it is lawful: that there is a legal basis, such as consent or the club's overriding legitimate interest, that the data subjects have been informed beforehand, that it honours objections and does not keep data public longer than necessary, and that it gives minors special protection. It complies with third-party requirements, such as the German Chess Federation's rules on publishing ratings, and is responsible for the details it publishes on the page itself, including any mandatory information such as a legal notice. A club admin confirms this responsibility in Schatu every time they save the page switched on. We store who confirmed it and when.

4. Instructions

We process the data only on the club's documented instructions (Art. 28(3)(a) GDPR), including with regard to transfers to third countries. Instructions are the entries and settings that people with the relevant rights in the club make in Schatu. Further instructions are given in text form by the club admins or the club's authorised representatives to mail@schatu.com. We keep instructions given in text form for the term of this agreement and three years after.

We may only deviate where EU or German law requires us to. In that case we inform the club beforehand, unless the law prohibits this. If we consider an instruction unlawful, we tell the club without delay (Art. 28(3), third sentence, GDPR). We may suspend carrying it out until the club confirms or changes it. This also applies to the public club page: platform administrators can switch it, or individual tournaments on it, off and inform the club; they cannot switch it on or change it.

5. Our obligations

• We process the data only to perform this agreement and not for our own purposes. We make copies only where operation requires them, such as the backups under Annex 1.
• Platform administrators access data of a club in which their own role does not allow that access only where this is necessary to provide, maintain, support or secure Schatu, to carry out the club's instructions or to meet legal obligations. These read accesses are logged (Annex 1). Where a platform administrator is a member of a club, their access within the scope of their role there counts as ordinary access by a member.
• Only people who have committed themselves to confidentiality or are under a statutory obligation of confidentiality have access to the data (Art. 28(3)(b) GDPR). Currently this is the operator alone. The duty of confidentiality continues after this agreement ends.
• We keep a record of the processing activities we carry out on behalf of clubs (Art. 30(2) GDPR).
• We are not required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG). The contact for data protection is the operator at mail@schatu.com.
• If a supervisory authority inspects our processing of the club's data or takes measures concerning it, we inform the club without delay, unless the law prohibits this.

6. Security of processing

We take the technical and organisational measures under Art. 32 GDPR described in Annex 1. We may adapt them to the state of the art as long as the level of protection does not decrease. We document significant changes and include them in a new version of Annex 1.

7. Subprocessors

The club authorises the subprocessors listed in Annex 2. We announce additional or different subprocessors at least four weeks in advance by email to the club admins. Within that period the club may object for an important data protection reason. If we cannot resolve the objection, the club may stop using Schatu and end this agreement without notice.

The club also authorises the further subprocessors that Railway engages under its data processing agreement. Railway announces changes at shorter notice. We pass them on to the club admins without delay, and the club may object as above.

We bind every subprocessor contractually to data protection obligations equivalent to those in this agreement (Art. 28(4) GDPR). If a subprocessor fails to meet its obligations, we are liable to the club as for our own conduct. Transfers to third countries only take place under the conditions of Art. 44 et seq. GDPR. Ancillary services without access to the club's data, such as telecommunications or domain name resolution (DNS), are not subprocessing.

8. Assisting the club

If data subjects contact us about the club's data, we forward their requests to the club without delay and do not answer them ourselves unless the club instructs us to. We assist the club with appropriate measures in providing access, correcting, restricting or deleting data and fulfilling the other rights under Chapter III GDPR. The club can do much of this itself in Schatu, for example editing and deleting players, tournaments or memberships.

We also assist the club with its obligations under Art. 32 to 36 GDPR insofar as they concern our processing: security of processing, breach notifications, data protection impact assessments and prior consultation of the supervisory authority.

9. Personal data breaches

If we become aware of a breach affecting the club's data, we inform the club without undue delay, where possible within 24 hours, by email to the club admins. As far as known, the notice contains the information under Art. 33(3) GDPR: the nature of the breach, the people and data concerned, the likely consequences and the measures taken. We provide missing information as soon as it is available. We take the necessary measures without delay to secure the data and mitigate possible adverse effects. Notifying the supervisory authority and the data subjects is the club's responsibility. We assist it in doing so.

10. Deletion during the term

When the club deletes data in Schatu or instructs us to, we remove it from the live database immediately. It remains in the backups under Annex 1 until they are deleted automatically after at most 90 days. Until then we use backups only to restore operation after an outage or error. If we restore a backup, we delete any data in it that had already been deleted.

11. Deletion and return after the agreement ends

When this agreement ends, we delete the club's data from the live database within 30 days unless a statutory retention obligation applies. On request, we first give the club a copy in a common machine-readable format (CSV or JSON). The data disappears from the backups as described in section 10. Security log entries are deleted after 90 days regardless. On request, we confirm the deletion in text form.

We may keep evidence that this agreement was concluded, and documents showing that we processed the data properly, beyond the end of the agreement for as long as we need them to meet statutory obligations or defend against claims.

12. Evidence and audits

We give the club all the information it needs to demonstrate compliance with this agreement and Art. 28 GDPR. We allow and contribute to audits, including inspections, by the club or an auditor it appoints who is bound to confidentiality (Art. 28(3)(h) GDPR). Written information and documents are usually sufficient. The club announces any further audits with reasonable notice. They must not disrupt operation disproportionately or disclose other clubs' data.

13. Liability

Liability towards data subjects is governed by Art. 82 GDPR. Between the club and us, each party bears the damage for which it is responsible under Art. 82(2) to (5) GDPR.

14. Final provisions

Changes to this agreement require text form. We present a new version to the club in Schatu for acceptance. Until it is accepted, the previously accepted version continues to apply. Where this agreement conflicts with other agreements, it prevails in matters of data protection. German law applies. If a provision is invalid, the rest of the agreement remains in force, and the invalid provision is replaced by one that meets the requirements of Art. 28 GDPR and comes closest to what was intended.

Annex 1: Technical and organisational measures

Confidentiality

• Physical access: servers and database run in data centres of the hosting provider Railway in the EU. The provider secures them physically under its data processing agreement. We do not operate servers of our own.
• System access: passwords of at least 12 characters, stored only as salted Argon2id hashes. Sign-in and password links work once, expire after 15 or 30 minutes and are stored only as hashes. Sessions end after 12 hours and can be revoked individually or all at once. Sign-in attempts are rate-limited per IP address and email address. The accounts with the hosting provider and code host are protected with two-factor authentication, and only the operator has access to them.
• Data access: rights depend on the role in each club and are checked against the database on every request. Only club members see member lists and tournaments, unless the club releases them on its public club page; the club assigns roles and rights. The public club page shows only what a club admin switched on there item by item; everything about people starts switched off. Only the platform administrators (currently the operator alone) have full rights, for the purposes in section 5.
• Separation: each club's data is assigned to that club and only reachable through its rights check.
• Pseudonymisation and encryption: outgoing emails are encrypted in the database until sent. Abuse-prevention counters store IP and email addresses only as hashes with a secret key.

Integrity

• Transfer: all connections are encrypted with TLS (with HSTS). Write requests are only accepted from our own website (Origin and Fetch Metadata checks). Session cookies are signed, HttpOnly, Secure and SameSite.
• Input: security-relevant events, including sign-ins, changes to memberships and roles, tournament administration, changes to the public club page and to published tournaments, and platform administrators reading member lists or tournaments of a club in which their own role does not allow it, are logged with time, user and IP address and deleted after 90 days.

Availability and resilience

• The database is backed up automatically on a fixed schedule at the hosting provider. Backups are deleted automatically after at most 90 days. The database can be restored from a backup.
• Database schema changes run as versioned migrations. Overloaded operations are limited rather than blocking the service.

Review and control of subprocessors

• Every code change passes automated tests, including tests of the rights checks. The measures are reviewed on significant changes and at least once a year.
• We only use subprocessors under an agreement complying with Art. 28 GDPR. We do not collect data Schatu does not need.

Annex 2: Subprocessors

• Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA: hosting of the application, database and backups in the Europe region. Third-country transfers based on the EU-US Data Privacy Framework where Railway is certified under it, otherwise on the EU Standard Contractual Clauses included in Railway's data processing agreement. This includes the further subprocessors Railway names in that agreement (section 7).
• Tutao GmbH, Deisterstraße 17a, 30449 Hannover, Germany: email mailbox for communication with the club, insofar as club data is sent that way.