Data Processing Addendum

1. Roles of the parties

1.1 For the personal data of the League's players (including children and dependent adults), parents, coaches, and referees ("League Personal Data"), the League is the controller and ProElite is the processor, acting only on the League's documented instructions as set out in the Terms of Service, this DPA, and the League's own configuration of the Service (including any custom registration fields the League creates).

1.2 For its own data — league-administrator account records, billing and subscription records, product analytics, and security logs — ProElite is an independent controller, and this DPA does not apply to that data.

2. Subject matter and categories of data

2.1 Subject matter. ProElite processes League Personal Data solely to provide the Service described in the Terms of Service, for the duration of the Terms of Service.

2.2 Categories of data subjects. Players (including children and dependent adults), parents and guardians, coaches, referees, and league administrators.

2.3 Categories of data. Identity and contact information; date of birth; grade level; disability-routing information (the special-needs flag described in the Privacy Policy); free-text notes and medical/allergy information supplied at registration; emergency-contact information; payment and transaction metadata (no card data); waiver signature records; photographic images of participants, where the League submits one as a reference image for AI-assisted marketing or image generation (Section 13); and usage/audit-log data. The Privacy Policy has the full inventory.

3. ProElite's obligations as processor

ProElite will:

3.1 Process League Personal Data only on the League's documented instructions, including instructions reflected in the League's own configuration of the Service, unless required to do otherwise by law (in which case ProElite will inform the League beforehand, unless prohibited from doing so).

3.2 Ensure personnel who process League Personal Data are subject to confidentiality obligations.

3.3 Implement the security measures described in Section 5.

3.4 Engage subprocessors only as disclosed in Section 4, and flow down confidentiality and security obligations to them.

3.5 Provide the League reasonable assistance responding to a data subject's request, to the extent the Service does not already give the League or the data subject a direct, self-service way to do so (see Section 7).

3.6 Notify the League of a confirmed personal-data breach as described in Section 6.

3.7 On termination, handle League Personal Data as described in Section 9.

4. Subprocessors

4.1 Currently engaged subprocessors. ProElite engages the subprocessors listed below to process League Personal Data. This list is provided so that the League, as controller, can carry out its own transparency and vendor-disclosure obligations, and so that the League's authorization under Section 4.3 is given with knowledge of who is involved. ProElite maintains this list and will keep it current.

4.2 Not currently live. Twilio (SMS) and Mailgun (an alternate email provider) are configured but not used to process League Personal Data as of this version. If either is activated, it will be added to this list and the League notified first.

4.3 General authorization; objection. The League generally authorizes ProElite's use of the subprocessors listed in Section 4.1. ProElite will give the League at least thirty (30) days' notice, by email to the League's primary administrator, before engaging a new subprocessor to process League Personal Data. During that period the League may object in writing on reasonable data-protection grounds; if the parties cannot resolve the objection, the League's remedy is to terminate the affected part of the Service.

4.3.1 Emergency replacement. Where a subprocessor becomes unavailable, insecure, or terminates its service, ProElite may engage a replacement performing the same function with less than 30 days' notice, and will notify the League as soon as reasonably practicable and in any event within seven (7) days. The League's right to object under Section 4.3 then applies from the date of that notice.

4.4 Location of processing. ProElite's own application and database are hosted in the United States. Certain subprocessors listed in Section 4.1 are established outside the United States or operate global infrastructure, and League Personal Data may therefore be processed outside the United States. In particular, ProElite's email provider is established in the European Union, and ProElite's DNS and bot-protection provider operates a global network through which traffic may be routed.

4.4.1 No data-residency commitment. ProElite does not offer, and this DPA does not provide, a guarantee that League Personal Data will be stored or processed only within the United States. A League that requires United States data residency should raise it before signing, as ProElite cannot meet that requirement on its current infrastructure.

4.4.2 Transfers. Where a subprocessor processes League Personal Data outside the jurisdiction in which it was collected, ProElite relies on the transfer terms in that subprocessor's own data processing agreement, including standard contractual clauses where the subprocessor provides them.

5. Security measures

ProElite maintains the following measures, and represents no others:

• Encryption in transit (TLS/HTTPS) for all traffic to the Service.
• Password hashing (bcrypt); passwords require 10+ characters with mixed case, a number, and a symbol.
• JWT access tokens expiring in 15 minutes, with a 7-day sliding refresh and an absolute session cap (30 days for parents and coaches, 12 hours for administrators).
• Mandatory TOTP multi-factor authentication for platform and league administrator accounts, with single-use hashed recovery codes.
• Account lockout after repeated failed login attempts, and rate limiting.
• An audit log of administrative and financial actions (timestamp, user, IP address).
• Encrypted storage (AES-256-GCM) for third-party credentials the platform holds on a League's behalf.
• Encrypted (AES-256), off-site database backups, retained on the schedule in Section 8.

ProElite does not represent, and this DPA does not state, that League Personal Data is encrypted at rest. Participant data (names, dates of birth, emergency contacts, medical notes) is stored in plain text in the database; there is no database-level or disk-level encryption at rest on the current shared-hosting infrastructure. ProElite does not hold SOC 2, ISO 27001, HIPAA, or PCI-DSS certification and has not completed a third-party penetration test.

6. Data breach cooperation

If ProElite confirms a personal-data breach affecting League Personal Data, ProElite will notify the League without undue delay and no later than 72 hours after confirming the breach, describing (to the extent then known) the nature of the breach, the categories and approximate number of data subjects affected, and the measures taken or proposed. ProElite will reasonably cooperate with the League's own investigation and its notification obligations. The League, as controller, is responsible for notifying affected individuals and any regulator; ProElite does not assume that duty under this DPA.

7. Data subject requests

7.1 Self-service first. A parent or guardian can directly view, edit, or request removal of their player's profile information through their own account. This is the primary mechanism for correction and deletion requests involving a child or dependent adult.

7.2 Requests ProElite receives directly. If ProElite receives a request from an individual rather than the League (for example, from a referee, who has no account under Section 2.9 of the Privacy Policy), ProElite will direct the individual to the relevant League where practical, and will otherwise provide the League reasonable assistance in responding.

7.3 Verification. ProElite will take reasonable steps to verify a requester's identity, including confirming that a parent controls the relevant account, before acting on a request involving a child's or dependent adult's information.

8. Data retention

League Personal Data is retained on the schedule stated in the Privacy Policy (account and profile data, player records, registrations and payments, signed waivers, audit logs, and backups). ProElite does not purge payment, invoice, or signed-waiver records on the League's deletion request, because they are financial and consent records the League and ProElite are entitled or required to keep; a deletion request anonymizes and closes the relevant account instead.

9. Return and deletion on termination

9.1 On termination of the Terms of Service, the League may request an export of its League Personal Data before the effective date of termination, in a format the Service then supports.

9.2 Following termination, ProElite will delete or anonymize League Personal Data in its systems consistent with the retention schedule in Section 8, except for records ProElite or the League is required or entitled to retain (including payment, invoice, and signed-waiver records).

9.3 Deletion under this Section does not reach records retained in routine, time-limited backups (Section 8) until those backups themselves age out under the ordinary retention schedule.

10. Audit

10. Audit. On reasonable written request, and no more than once in any twelve-month period, ProElite will provide the League with a written summary of the security measures described in Section 5, together with a completed response to a reasonable security questionnaire of the League's choosing. This is provided in lieu of an on-site audit or a third-party audit report, which ProElite does not offer at its current scale.

10.1 Where more is required. ProElite does not hold SOC 2, ISO 27001, HIPAA, or PCI-DSS certification and has not completed a third-party penetration test. A League whose own obligations require any of these should raise it before signing.

11. Liability

Liability arising from this DPA is subject to the limitation of liability and indemnification provisions of the Terms of Service; this DPA does not create a separate or additional cap.

12. Term

This DPA remains in effect for as long as the Terms of Service is in effect, and survives termination to the extent Section 9 (Return and deletion) requires.

13. AI-specific processing

13.1 Participant photographs. Where the League submits a photograph of an identifiable participant — including a child or dependent adult — as a reference image for the AI image-generation feature, that photograph is transmitted to OpenAI as described in Section 4. The League is responsible for having the consent or authority required under applicable law before submitting such a photograph; ProElite does not independently verify this before transmission.

13.2 Subprocessor retention. ProElite has not separately negotiated a data-retention commitment with its AI providers beyond those providers' own published API terms, and relies on those published terms as they apply from time to time. Those terms govern how long prompt content and submitted images are retained and for what purposes they may be used. ProElite will make the applicable terms available to the League on request.

13.3 No automated decision-making without review. ProElite does not use an AI feature to make a final decision about a data subject's eligibility, team placement, or discipline without a human administrator reviewing and confirming it, consistent with the propose-then-confirm design described in the Terms of Service.