This addendum forms part of the West 110 Platform Agreement. It describes how W110 handles personal information on your club's behalf. Your club accepts it when it accepts the Platform Agreement; there is no separate signature.
1. Who is responsible for what
Your club is the controller. It decides what information to collect about its families and athletes, who at the club sees it, and how long to keep it.
W110 is the processor. We process that information only to provide the service, and only on your club's instructions.
W110 is a controller for a narrow set of its own data: club administrator account records, subscription and billing records, and security and usage logs. That is our own business record, not your club's.
2. What we process, and why
Purpose: operating registration, scheduling, groups, volunteering, communication, payments and reporting for your club.
Duration: for as long as your club uses W110, plus the retention periods in §7.
Categories of people: parents and guardians; athletes, who are usually children; coaches; club administrators; and volunteers, who may not have an account.
Categories of information:
- Contact and account details — name, email, phone
- Athlete records — name, date of birth, gender, grade, school, preferred discipline, federation membership numbers (such as USSA and FIS), photo-release consent, household, group and programme
- Any medical or emergency contact information your club chooses to collect
- Registration, payment and refund records
- Volunteer shifts, attendance and deposits
- Waiver signatures: the name typed and the time of signing
- Messages sent through the platform
- Usage and error logs
3. Children's information
Athletes are usually minors. W110 does not collect information from children. Athlete records are created by a parent, a guardian, or club staff acting for the club, and children do not have accounts and cannot sign in.
We do not use children's information for advertising, we do not sell it, and we do not disclose it except as set out here.
4. Our obligations
- Process personal information only on your club's documented instructions, and tell you if we believe an instruction breaks the law.
- Keep it confidential, and make sure anyone with access is under a duty of confidence.
- Apply the security measures in §5.
- Help your club respond to a person exercising their rights (§8).
- Tell you about a breach (§6).
- Return or delete the information when your club leaves (§7).
5. Security
- Encryption in transit (TLS) and at rest.
- Row-level security is enabled on the database's tables, and the tables that hold club data are scoped to a club. Much of W110's server-side work runs with elevated database privileges and enforces club scope in application code, which an automated tenancy audit checks.
- Role-based access: an administrator sees their club and a parent sees their own household. Coaches can read athlete records across their club, and the application narrows what it shows them to their assigned groups.
- Card numbers never reach W110's systems. Stripe handles them and holds PCI compliance.
- Your club can disconnect QuickBooks, and revoke W110's access to it, from the club's settings while its plan includes QuickBooks. Google Sheets exports are created in W110's own Google account and shared with the administrator who exported them; there is no connection to revoke.
- W110 staff access club data for support and to fix problems, sometimes by signing in as a user; each such sign-in is logged. W110 staff also receive an email naming the parent and the athletes on each new registration.
6. If there is a breach
If we become aware of a breach affecting your club's personal information, we will notify your club without undue delay and in any case within 72 hours of becoming aware, with what we know: what happened, who is affected, what information was involved, what we are doing, and what we suggest your club does.
We will help your club meet its own notification obligations.
7. Retention, return and deletion
W110 does not yet delete personal information on a fixed schedule. Your club's records are kept while it uses W110, and after it leaves, until your club asks us to delete them. AI request data is kept by Anthropic for up to 30 days (§9). Server and error logs are kept by our hosting and monitoring providers under their own retention settings.
Deleting removes the records attached. Deleting your club's data, or a parent's account, removes the registrations, payments and waiver signatures attached to it. Records of who accepted W110's agreements are kept. Spreadsheets exported to Google Sheets are not removed automatically.
Export before you delete. Your club may need some records for years: registration and payment records for tax and accounting, and waiver signatures for much longer, because the time limit for a claim brought by a child does not begin until they reach adulthood. When your club leaves W110 it can export its data, and we delete it when your club asks us to.
8. Helping with individual rights
If someone asks your club for access to their information, or to correct, delete or export it, W110 will help your club respond. Most of it your club can do itself in the platform. We respond to a club's request for help within 45 days, usually far sooner.
If a person contacts W110 directly about information your club controls, we will pass the request to your club rather than act on it ourselves.
9. Sub-processors
W110 uses these providers. Each may use the information only to provide its service to us.
| Provider | Purpose | Location | |---|---|---| | Supabase | database, authentication | United States | | Stripe | payments, payouts | United States | | Vercel | hosting | United States | | Resend | email delivery | United States | | Twilio | SMS delivery | United States | | Sentry | error monitoring | United States | | Anthropic | AI features for club staff | United States | | Intuit (QuickBooks Online) | accounting sync, only if your club connects it | United States | | Google | spreadsheet export, only at an administrator's request | United States |
Anthropic and AI features. What is sent depends on the feature. Summaries and insights send counts and totals, not names. AI-drafted emails are written with placeholders such as {{parent_first_name}}, filled in on W110's own systems after the model returns. The AI assistant does send personal data — when a club's staff ask it a question about their own families, the records that answer the question, which may include athlete and guardian names, contact details and dates of birth, are sent to Anthropic so it can respond. The assistant is scoped to the club it belongs to. Anthropic does not use any of it to train its models and retains API data for up to 30 days for abuse monitoring only. AI features are off by default. Turning them on is your club's instruction to W110 to send the information described above to Anthropic, and an administrator can turn them off again in the club's settings.
Adding a sub-processor. We give clubs at least 30 days' notice before adding one that handles personal information, or before materially expanding the categories of personal information an existing one receives. Notice is given as set out in §12 of the Platform Agreement. A club may object in writing within 15 days of the notice, and if we cannot resolve the objection the club may terminate without penalty for that reason.
10. Where information is processed
The United States. If your club or its families are outside the United States, using W110 involves transferring information there.
11. Audit
W110 will provide the information a club reasonably needs to confirm we are meeting this addendum. At our size we do not offer on-site audits; we answer security questionnaires and provide documentation.
12. Order of precedence
If this addendum conflicts with the Platform Agreement on the handling of personal information, this addendum prevails.
13. Contact
privacy@w110.io · West 110
Permanent link: /legal/dpa/v/2 · sha256 b8aa8cd53efe4e5b745cdf2d3befb8076bf32ad0f83fde2633329ef670cf4722