Club Portal LogoClub Portal/Data Processing Agreement
Sign In
Contractual Addendum5 Min ReadRA 10173 Aligned

Data Processing Agreement

Contractual terms governing the processing, security, and subprocessor delegation of personal data between club workspaces (Data Controller) and Club Portal (Data Processor).

Effective Date: September 2026

Platform: clubportal.org

Version: 2.4

Related Agreements:Terms of UsePrivacy PolicyData Processing Agreement (DPA)
Contractual Scope Notice

This Data Processing Agreement (“DPA”) supplements the Club Portal Terms of Use and governs personal data operations performed on behalf of registered clubs and independent organizations. By creating an organization workspace or maintaining active officer credentials, you enter into this agreement as the authorized representative of your organization.

Agreement Sections

7 Clauses
01Roles and Responsibilities02Scope & Details of Processing03Technical Security Safeguards04Authorized Subprocessor Registry05Data Subject Requests & Incidents06Data Deletion, Return & Purge07Contractual Inquiries & DPO
DPA Inquiries

Need an executed copy of this agreement or have institutional audit questions?

[email protected]

Response window: 1 to 2 business days.

01

Roles and Responsibilities

For the purposes of the Philippine Data Privacy Act of 2012 (RA 10173), the registered club or organization operating the workspace is the Data Controller. Club Portal, operated by The Club Portal Engineering Team, acts strictly as the Data Processor.

Data Controller Duties

The Data Controller is solely accountable for establishing a lawful basis for collecting member records, securing necessary consents, ensuring uploaded CSV rosters are accurate, and authorizing dues assessments.

Data Processor Duties

Club Portal processes personal data solely in accordance with documented instructions from the Controller, maintaining platform uptime, encryption, role access segregation, and automated clearance ledger calculations.

02

Scope & Details of Processing

The subject matter, duration, nature, and purpose of personal data processing under this agreement are defined as follows:

Subject Matter & Duration

The provision of club and organization governance software. Processing endures for the active operational lifespan of the organization workspace, plus any retention grace period prior to formal data purge.

Categories of Data Subjects

Organization officers (Administrators, Managers, Operators), advisers or moderators, and active members enrolled in the organization roster.

Types of Personal Data Processed

Member Identification Numbers, Full Names, Department or Standing Level, Officer Email Addresses, Event Check-In/Check-Out Timestamps, and Financial Dues Transaction Ledgers.

03

Technical Security Safeguards

Club Portal implements technical and organizational controls to protect against unauthorized access, destruction, loss, or alteration of personal data:

Encryption StandardsTLS 1.3 enforced across all web endpoints; bcrypt cryptographic hashing for passwords.
Logical Multi-TenancyServer-side workspace scoping ensuring zero cross-tenant data leakage between organizations.
Offline Queue ProtectionLocal browser storage segregation for gate scanning stations during intermittent connectivity.
Audit LoggingImmutable administrative change logs for fee deployment, officer permissions, and data purges.
04

Authorized Subprocessor Registry

The Data Controller grants general authorization for Club Portal to engage the following subprocessors to host, deliver, and maintain the service:

SubprocessorPurpose / ServiceData ScopeHosting Region
ResendTransactional EmailOfficer Emails & Invite LinksUnited States
CloudinaryMedia & Asset CDNOrganization Logos & ReceiptsGlobal Edge CDN
SentryCrash & Error TelemetryDiagnostic Stack TracesUnited States
Cloud InfrastructureDatabase & ComputeEncrypted Application DatabaseOracle Cloud / Supabase

Club Portal binds all subprocessors to contractual data protection terms at least as protective as those set forth in this DPA.

05

Data Subject Requests & Incident Notification

Data Subject Requests

As Data Processor, Club Portal will promptly forward any requests for access, rectification, or erasure received directly from members to the designated workspace Administrator. The platform provides built-in tools (e.g., clearance lookup, record editor, account deletion) enabling Controllers to fulfill their legal obligations under RA 10173.

Security Incident Notification

In the event of a confirmed security incident or data breach affecting personal data, Club Portal will notify affected workspace Administrators without undue delay upon confirmation. Club Portal will provide technical incident details, scope of impacted records, and recommended remediation steps to assist Controllers in regulatory compliance.

06

Data Deletion, Return & Workspace Purge

Upon conclusion of subscription services, organization dissolution, or upon administrative request:

  • •Controller-Initiated Purge: Authorized Administrators possess self-service capabilities to permanently destroy all organization records via the Purge Organization Data tool. Purge actions are irreversible.
  • •Archival Option: Prior to turnover or semester completion, Controllers can invoke Archive Semester to lock attendance and financial ledgers into read-only historical verification mode.
  • •Account Deletion: Officers may permanently delete their personal profiles via Account Settings, severing all authentication associations.
07

Contractual Inquiries & DPO Contact

Questions regarding data processing or compliance?

Direct inquiries regarding this DPA or subprocessor verification to our legal contact.

[email protected]

© 2026 Club Portal SaaS Platform. All rights reserved.

Terms of Use•Privacy Policy•DPA•Portal Login