Data Processing Addendum

Effective date

This Data Processing Addendum (“DPA”) forms an integral part of the LHM Terms of Service (“Main Agreement”) entered into by and between:

  1. The User - the entity or individual subscribing to and using the LHM Service, acting as the Data Controller under Applicable Data Protection Law (“Controller” or “User”), and
  2. Michał Majka, conducting business under the business name Michał Majka Neurogrine, with its registered office at ul. Armii Krajowej 7/14, 30-150 Kraków, Poland, VAT Identification Number (NIP): 6772308416, REGON: 369467404, acting as the Data Processor under Applicable Data Protection Law (“Processor” or “Service Provider”).

The Controller and the Processor shall individually be referred to as a “Party” and collectively as the “Parties”.

1. Definitions and Interpretation

  1. “Applicable Data Protection Law” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation - “GDPR”), as well as any applicable national data protection legislation supplementary to the GDPR in Poland.
  2. “Personal Data”, “Data Subject”, “Processing”, “Controller”, “Processor”, and “Personal Data Breach” shall have the meanings ascribed to them in Article 4 of the GDPR.
  3. Terms not defined herein shall have the meanings assigned to them in the Main Agreement.

2. Subject Matter, Scope, and Instructions

  1. Scope: This DPA applies to the Processing of Personal Data submitted, uploaded, or otherwise made available by or on behalf of the Controller through the LHM Software-as-a-Service (SaaS) platform.
  2. Role of the Parties: The Parties acknowledge and agree that with respect to the Personal Data processed within the LHM system (including information regarding players, athletes, coaches, and event personnel), the User acts as the Controller and the Service Provider acts as the Processor.
  3. Instructions: The Processor shall process Personal Data exclusively on behalf of and in accordance with the documented instructions of the Controller. The execution of the Main Agreement, including configuration and operation of the LHM platform by the User, constitutes the Controller’s complete and final instructions to the Processor.

3. Details of Processing

  1. Nature and Purpose of Processing: Digital processing within the LHM cloud environment to enable the Controller to prepare, organize, manage, and produce broadcast graphics, overlays, and administrative tools for sports, esports, and entertainment events.
  2. Categories of Data Subjects:
    • Players, athletes, and competitors participating in events managed by the Controller;
    • Coaches, team managers, referees, and technical staff;
    • Authorized users and representatives of the Controller accessing the LHM account.
  3. Categories of Personal Data:
    • Full name, display name, game ID and nickname/alias;
    • Image and visual likeness (profile photos, avatars, headshots);
    • Team/club affiliation, position, jersey number, and performance statistics;
    • Any other personal data voluntarily uploaded by the Controller into the LHM platform for broadcast production purposes.
  4. Duration of Processing: For the duration of the Main Agreement, plus the period required for data deletion or return following agreement termination, unless applicable legal requirements dictate longer retention.

4. Obligations of the Controller

  1. The Controller warrants that it has established an appropriate legal basis (e.g., explicit consent, legitimate interest, or performance of a contract) under Applicable Data Protection Law to collect, process, and transfer Personal Data to the Processor via the LHM platform.
  2. The Controller shall have sole responsibility for the accuracy, quality, legality, and lawfulness of all Personal Data provided to the Processor.
  3. The Controller acknowledges that any public distribution or broadcasting of data processed via LHM (e.g., display on stadium screens, live streams, or broadcasts) is driven exclusively by the Controller's setup and instructions.

5. Obligations of the Processor

The Processor undertakes to:

  1. Process Personal Data solely on documented instructions from the Controller, unless required to do so by European Union or Member State law to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
  2. Ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  3. The current technical and organizational measures (TOMS) implemented and maintained by the Processor, including details on security controls, encryption, access management, and infrastructure resilience, are publicly accessible at the following URL: https://lhm.gg/toms (“TOMS List”). The Controller explicitly acknowledges and accepts the technical and organizational measures identified on this list as of the date of accepting the Main Agreement.
  4. The Processor shall inform the Controller of any intended changes or updates concerning the technical and organizational measures at least 14 days in advance by updating the online list at https://lhm.gg/toms and providing notice via email or within the LHM platform user dashboard.
  5. The Controller may object to the engagement of a new TOMS List on reasonable data protection grounds within 7 days of receiving notification. If no objection is received, the change shall be deemed approved. If the Controller objects on valid data protection grounds and the Processor cannot accommodate the objection, either Party may terminate the Main Agreement upon notice without penalty.
  6. Assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests for exercising Data Subjects' rights under Chapter III of the GDPR.
  7. Assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to the Processor.
  8. Notify the Controller without undue delay, and no later than 48 hours after becoming aware of a confirmed or suspected Personal Data Breach affecting the Controller's data.
  9. Upon termination of the Main Agreement or completion of services, at the choice of the Controller, delete or return all Personal Data to the Controller and delete existing copies, unless applicable law requires storage of the Personal Data.
  10. Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

6. Sub-processors

  1. The Controller provides a general written authorization to the Processor to engage third-party sub-processors (“Sub-processors”) to perform specific processing activities on behalf of the Controller.
  2. The current list of authorized Sub-processors, including their identity, location, and role, is publicly accessible at the following URL: https://lhm.gg/subprocessors.
  3. (“Sub-processor List”). The Controller explicitly acknowledges and accepts the Sub-processors identified on this list as of the date of accepting the Main Agreement.
  4. The Processor shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors at least 14 days in advance by updating the online list and providing notice via email or within the LHM platform user dashboard.
  5. The Controller may object to the engagement of a new Sub-processor on reasonable data protection grounds within 7 days of receiving notification. If no objection is received, the change shall be deemed approved. If the Controller objects on valid data protection grounds and the Processor cannot accommodate the objection, either Party may terminate the Main Agreement upon notice without penalty.
  6. The Processor shall impose data protection obligations on any engaged Sub-processor that are no less protective than those set out in this DPA.

7. International Data Transfers

  1. Personal Data shall primarily be stored and processed within the European Economic Area (EEA).
  2. Any transfer of Personal Data to a third country outside the EEA shall only take place in compliance with Chapter V of the GDPR (e.g., on the basis of an Adequacy Decision by the European Commission, Standard Contractual Clauses (SCCs), or the EU-U.S. Data Privacy Framework).

8. Liability and Indemnity

  1. The Processor’s total aggregate liability arising out of or related to this DPA shall be subject to the exclusions and limitations of liability set forth in the Main Agreement, except where prohibited by mandatory provisions of the GDPR.
  2. The Processor shall be liable for damages caused by Processing only where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to lawful instructions of the Controller.

9. Final Provisions

  1. In the event of any conflict between the terms of this DPA and the Main Agreement, the provisions of this DPA shall prevail with respect to data protection obligations.
  2. This DPA shall automatically terminate upon termination or expiration of the Main Agreement.
  3. This DPA is governed by Polish law, and any disputes shall be submitted to the exclusive jurisdiction of the competent courts in Poland.