This Agreement is made between Nexlane (Paul Berry) of 6 Dew Way, Calne, SN11 8HD (the "Processor") and the club that accepts it (the "Controller"), and takes effect on the date the Club accepts it.
It sets out how Nexlane processes personal data on the Club's behalf when providing PBTable, as required by Article 28 of the UK GDPR. The Club decides what member data is collected and why; Nexlane only acts on the Club's instructions. Where Nexlane processes its own administrator and billing data, it does so as a separate controller under its own privacy notice.
The Club is the controller and Nexlane is the processor for the personal data described below. Nexlane will process that data only on the Club's documented instructions — including this Agreement and the Club's normal use of PBTable — unless the law requires otherwise, in which case Nexlane will tell the Club first where it is allowed to.
Nexlane will: keep the data confidential and ensure anyone with access is bound by confidentiality; apply appropriate technical and organisational security measures (see clause 4); not engage a new sub-processor without the Club's prior agreement (clause 5); assist the Club, so far as it reasonably can, in responding to member requests to access, correct or delete their data and in meeting its breach, DPIA and consultation duties; and make available the information the Club reasonably needs to show compliance with this Agreement.
Access to Club data is restricted to authorised administrators through passwordless email sign-in; each Club's data is isolated at database level (row-level security); data is encrypted in transit and at rest; and hosting is with reputable, independently certified providers (clause 5) — Supabase (SOC 2 Type II, ISO 27001), Netlify (SOC 2 Type II, ISO 27001, ISO 27018, PCI DSS v4), Brevo (ISO 27001:2022) and, where enabled, Stripe (PCI DSS Level 1). Members have no logins. Nexlane will provide evidence of these certifications, or of its own compliance, on reasonable request. Nexlane reviews these measures from time to time and may improve them, but not weaken them.
The Club authorises Nexlane to use the following sub-processors, each under a written contract with equivalent data-protection obligations:
Nexlane will give the Club reasonable notice of any intended change and the chance to object. Nexlane remains responsible to the Club for its sub-processors.
Club data is hosted in the EU — Supabase's database in Ireland and Brevo's email service across France, Germany and Belgium — not the UK. No additional safeguards are required for this: the UK and EU each recognise the other as offering an adequate level of data protection. Where a sub-processor transfers personal data outside the UK/EEA — for example Stripe's payment processing, where enabled — Nexlane ensures an appropriate safeguard is in place (such as the UK International Data Transfer Addendum or Standard Contractual Clauses).
If Nexlane becomes aware of a personal data breach affecting the Club's data, it will notify the Club without undue delay and in any event within 48 hours, with the information the Club needs to meet its own reporting duties, and will help the Club respond.
On termination, or on the Club's written request, Nexlane will delete or return the Club's personal data within 30 days and delete existing copies, unless the law requires it to keep them. Routine backups are retained only briefly for disaster recovery, are never used to restore data that has been deleted, and are automatically purged once that period ends. The Club can export its data at any time from the Admin panel.
The Club instructs Nexlane to publish member names and ratings on the Club's public leaderboard where the Club chooses to make it public. The Club is responsible for having a lawful basis for this and for telling its members how their data is used.
This Agreement forms part of, and is subject to, the PBTable Terms of Service between the parties. It is governed by the laws of England and Wales. If any term conflicts with the UK GDPR, the UK GDPR prevails.
Processor: Paul Berry, trading as Nexlane · 6 Dew Way, Calne, SN11 8HD. This web version mirrors the signed PDF available on request.
