Data Processing Agreement
TeamStride — Solidini
Version 1.0
Effective date: 7 October 2026
This Data Processing Agreement is made under Article 28 of the General Data Protection Regulation. It forms part of the Agreement between Solidini and the Customer under the Terms of Service of TeamStride.
1. Parties, conclusion and relation to the Terms
1.1 This DPA is between:
(a) Solidini, established in the Netherlands, registered with the Chamber of Commerce (KvK) under number 97133981, with its registered address as stated in the Legal notice on teamstride.app ("Solidini"); and
(b) the sports club, association, foundation, school or other organisation that has accepted the Terms ("Customer").
1.2 The Owner accepts this DPA on behalf of the Customer when the Owner accepts the Terms. The Owner warrants that the Owner has authority to bind the Customer.
1.3 This DPA takes effect at the same moment as the Agreement. It ends when Solidini no longer processes any Customer Personal Data. Clause 17 sets out which clauses continue after that.
1.4 Solidini makes this DPA available electronically, before or at the conclusion of the Agreement, in a form that the Customer can store and reproduce.
1.5 This DPA forms part of the Agreement. Where this DPA and any other part of the Agreement, including an Order, conflict on the processing or protection of personal data, this DPA prevails.
1.6 The English version of this DPA is authoritative. Translations into Dutch, French and German are for convenience only. If a translation conflicts with the English version, the English version prevails.
2. Definitions and interpretation
2.1 The terms "personal data", "processing", "controller", "processor", "data subject", "supervisory authority", "special categories of personal data" and "personal data breach" have the meaning given to them in the GDPR.
2.2 Terms defined in the Terms of Service have the same meaning in this DPA. These include "Agreement", "Authorised User", "Customer", "Customer Data", "Fees", "Order", "Organisation", "Output", "Own Drill", "Owner", "Period", "Player Data", "Privacy Statement", "Prohibited Data", "Read-only", "Service", "Special-Category Data", "Terms" and "Working Day".
2.3 In this DPA:
(a) DPA means this Data Processing Agreement, including its Annexes.
(b) GDPR means Regulation (EU) 2016/679.
(c) Data Protection Law means the GDPR, the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming) and any other EU or Member State law on the protection of personal data that applies to the processing under this DPA.
(d) Customer Personal Data means the personal data contained in the Customer Data.
(e) Personal Data Breach means a personal data breach, as defined in Article 4(12) GDPR, that affects Customer Personal Data.
(f) Sub-processor means a processor that Solidini engages to carry out processing activities on Customer Personal Data on behalf of the Customer.
(g) Sub-processor List means the list of Sub-processors published at the sub-processor page of the Service, as replicated in Annex 3.
(h) Standard Contractual Clauses means the standard contractual clauses for the transfer of personal data to third countries adopted by Commission Implementing Decision (EU) 2021/914.
(i) Model Provider means a Sub-processor that provides a large language model, as named in Annex 3.
2.4 "In writing" includes email. Solidini sends notices under this DPA to the email address of the Owner, unless the Customer has named another contact for data protection matters in the Service or by email to privacy@getteamstride.com.
3. Subject, nature, purpose and duration
3.1 Solidini processes Customer Personal Data on behalf of the Customer, to provide the Service under the Agreement.
3.2 Annex 1 describes the subject, nature and purpose of the processing, the types of personal data, the categories of data subjects and the duration of the processing.
3.3 The Customer is the controller of the Customer Personal Data. Solidini is the processor.
3.4 Solidini is a controller, and not a processor, for the following processing. This DPA does not apply to it. The Privacy Statement describes it. Article 9.3 of the Terms records the Customer's agreement that Solidini uses parts of the Customer Data for (a), (b), (f) and (h).
(a) Account administration for sign-in, security, fraud and abuse prevention.
(b) The internal access log of reads by Solidini staff, which records which staff member read which training document.
(c) Billing, invoicing and tax records.
(d) Website analytics and the contact form.
(e) Sales contact with clubs.
(f) Reading post-session drill feedback to improve the drill library. The Service tells the Authorised User about it.
(g) The record of consent when an Authorised User marks an Own Drill so that Solidini may use the ideas in it (Article 8.7 of the Terms). Solidini uses such an idea without the name of the Authorised User or the Customer.
(h) Product improvement based on aggregated, de-identified usage statistics.
3.5 Solidini does not use Customer Personal Data to train or fine-tune any artificial intelligence model. Clause 13 applies.
4. Obligations of the Customer
4.1 The Customer is responsible for the lawfulness of the processing of Customer Personal Data. The Customer ensures that it has a lawful basis for each processing activity that it instructs.
4.2 The Customer informs its Authorised Users about the processing of their personal data in the Service, as Articles 13 and 14 GDPR require.
4.3 The Customer ensures that each Authorised User is 16 years or older, and that the Owner is 18 years or older.
4.4 The Customer ensures that no Authorised User enters Prohibited Data into the Service. This applies to every field, including the assistant conversation, the weekly check-in, team memory, Own Drills and drill feedback. Article 6 of the Terms contains the same prohibition. A restriction recorded without identity, such as "2 players: no jumping", is not Player Data as long as no player can be identified from it.
4.5 The Service is designed so that it does not ask for Prohibited Data and does not need it. Solidini does not process Prohibited Data as part of the Service.
4.6 If Prohibited Data is entered into the Service:
(a) the Customer breaches the Agreement, including this DPA;
(b) the Customer remains the controller of that data and is responsible for it;
(c) the Customer instructs Solidini to delete that data, or the record that contains it if the data cannot be separated, when Solidini finds it, without prior notice. Solidini informs the Owner by email after the deletion;
(d) Solidini has no obligation to search for Prohibited Data.
4.7 The Customer gives its instructions in accordance with Data Protection Law.
5. Processing on documented instructions
5.1 Solidini processes Customer Personal Data only on documented instructions from the Customer. This includes transfers to a third country.
5.2 The complete instructions of the Customer are:
(a) the Agreement, including this DPA; and
(b) the use of the functions of the Service by the Customer and its Authorised Users.
5.3 The Customer may give an additional instruction in writing. Solidini follows it if it is consistent with the Agreement and the functions of the Service. If it is not, the parties discuss it in good faith. Solidini may charge reasonable costs for an additional instruction that requires work outside the normal Service, if it tells the Customer the cost before it does the work.
5.4 If EU or Member State law requires Solidini to process Customer Personal Data other than on instructions, Solidini informs the Customer before it processes. This does not apply if that law prohibits such information on important grounds of public interest.
5.5 Solidini informs the Customer immediately if, in its opinion, an instruction infringes Data Protection Law. Solidini may suspend the execution of that instruction until the Customer confirms or changes it.
6. Confidentiality
6.1 Solidini gives access to Customer Personal Data only to persons who need it to provide, support or secure the Service.
6.2 Solidini ensures that each such person is bound by a written obligation of confidentiality or by a statutory obligation of confidentiality.
6.3 This obligation continues after the work of that person for Solidini ends.
7. Security
7.1 Solidini implements the technical and organisational measures in Annex 2. These measures ensure a level of security appropriate to the risk, as Article 32 GDPR requires.
7.2 The Customer has assessed Annex 2 and agrees that the measures are appropriate for the processing described in Annex 1. This assessment takes into account that Prohibited Data must not be entered.
7.3 Solidini may change the measures in Annex 2 to follow technical developments. A change must not reduce the overall level of security.
7.4 The Customer is responsible for the security of its own devices and email accounts, and for the access it gives to Authorised Users. The Customer removes an Authorised User from the Organisation in the Service when that person no longer acts for the Customer.
8. Assistance with data subject rights
8.1 Solidini assists the Customer, by appropriate technical and organisational measures, to respond to requests from data subjects under Chapter III GDPR.
8.2 Where possible, the Service provides this assistance as self-service functions. These include:
(a) the team memory page, where an Authorised User reads and deletes what the assistant remembers about a team;
(b) the function by which an Authorised User deletes their own conversations, check-ins, personal memory notes and drill feedback;
(c) the function by which an Authorised User deletes their own account;
(d) the functions by which a Coordinator or the Owner removes an Authorised User and by which the Owner closes the Organisation;
(e) the display, printing and editing of plans and sessions in the Service.
8.3 The Service has no self-service export. Clause 15.1 applies to a copy of the Customer Data.
8.4 If the self-service functions are not sufficient, the Customer may ask Solidini for assistance in writing at privacy@getteamstride.com. Solidini provides the assistance within 10 Working Days after it receives the request.
8.5 If a data subject sends a request about Customer Personal Data directly to Solidini, Solidini forwards it to the Customer without undue delay. Solidini does not respond to the request itself, except to confirm receipt, to refer the data subject to the Customer, or to refer the data subject to a self-service function. This does not affect requests about processing for which Solidini is a controller under clause 3.4.
8.6 Assistance under this clause is part of the Service and has no additional charge.
9. Impact assessments, prior consultation and records
9.1 Solidini assists the Customer with a data protection impact assessment under Article 35 GDPR and with a prior consultation of the supervisory authority under Article 36 GDPR, as far as the assessment or consultation relates to the Service. Solidini provides the information available to it, taking into account the nature of the processing.
9.2 Solidini may charge reasonable costs for substantial work under clause 9.1. Solidini tells the Customer the estimated cost before it does the work.
9.3 Solidini keeps a record of all categories of processing activities that it carries out on behalf of the Customer, as Article 30(2) GDPR requires. Solidini makes this record available to the supervisory authority on request.
10. Personal Data Breach
10.1 Solidini notifies the Customer of a Personal Data Breach without undue delay, and no later than 48 hours after Solidini becomes aware of it. This also applies to a Personal Data Breach at a Sub-processor.
10.2 The notification contains, as far as available:
(a) the nature of the Personal Data Breach, including, where possible, the categories and the approximate number of data subjects and of personal data records concerned;
(b) the name and contact details of the contact point at Solidini, which is privacy@getteamstride.com;
(c) the likely consequences of the Personal Data Breach;
(d) the measures that Solidini has taken or proposes to take to address the Personal Data Breach, including measures to reduce its possible adverse effects.
10.3 If Solidini cannot provide all information at the same time, it provides the information in phases without further undue delay.
10.4 Solidini takes the reasonable measures available to it to contain the Personal Data Breach and to reduce its consequences. Solidini keeps the Customer informed of material developments.
10.5 The Customer decides whether to notify the supervisory authority and the data subjects under Articles 33 and 34 GDPR. Solidini assists the Customer with these notifications on request.
10.6 Solidini does not notify the supervisory authority or data subjects on behalf of the Customer, unless the Customer instructs Solidini in writing to do so. This does not limit any obligation that Solidini has as a controller for its own processing under clause 3.4.
10.7 Solidini keeps a log of every Personal Data Breach. The log records the facts, the effects and the remedial action taken. Solidini makes the log entries that relate to the Customer available to the Customer on request.
10.8 A notification under this article is not an admission of fault or liability by Solidini.
11. Sub-processors
11.1 The Customer gives Solidini a general written authorisation to engage Sub-processors. On the effective date of this DPA, the Customer authorises the Sub-processors on the Sub-processor List.
11.2 The Sub-processor List at the sub-processor page of the Service is the authoritative list. Annex 3 replicates it on the effective date of this DPA.
11.3 Solidini engages a Sub-processor only under a written contract that imposes on the Sub-processor the same data protection obligations as this DPA, as Article 28(4) GDPR requires. The contract must give sufficient guarantees for appropriate technical and organisational measures.
11.4 Solidini remains fully liable to the Customer for the performance of the obligations of each Sub-processor. Clause 16.5 applies.
11.5 Solidini gives notice of an intended addition or replacement of a Sub-processor at least 30 days before the change takes effect. Solidini gives this notice by email to the Owner and on the sub-processor page of the Service. The notice states the name of the Sub-processor, the purpose, the location of processing and the transfer mechanism.
11.6 The Customer may object to the change in writing within the notice period. The objection must be based on reasonable grounds relating to data protection. The Customer sends the objection to privacy@getteamstride.com.
11.7 If the Customer objects, the parties discuss the objection in good faith. Solidini may propose a reasonable alternative, such as a change to the configuration of the Service.
11.8 If the parties do not find a solution within the notice period, the Customer may terminate the Agreement by written notice before the change takes effect. Solidini then refunds the prepaid Fees for the part of the Period after the termination date, pro rata. To keep its Customer Data away from the new Sub-processor, the Owner can ask for a copy under clause 15.1 and close the Organisation before the change takes effect.
11.9 If the Customer does not object within the notice period, the Customer authorises the change.
11.10 Solidini may replace a Sub-processor without the notice period of clause 11.5 if this is necessary in an emergency, such as a security risk, a breach of law or a sudden termination of service by the Sub-processor. Solidini then gives notice as soon as possible. Clauses 11.6 to 11.8 apply, and the objection period starts on the date of that notice.
12. International transfers
12.1 Solidini transfers Customer Personal Data to a country outside the European Economic Area only if the conditions of Chapter V GDPR are met.
12.2 Solidini uses one of the following safeguards for each transfer:
(a) an adequacy decision of the European Commission, including the adequacy decision for the EU-US Data Privacy Framework for a recipient that is certified under it, and the adequacy decision for the United Kingdom; or
(b) the Standard Contractual Clauses, module three (processor to processor), between Solidini and the Sub-processor, or between the Sub-processor and its own processor, together with supplementary measures where necessary.
12.3 Solidini documents a transfer impact assessment for each transfer that relies on the Standard Contractual Clauses, before the transfer starts. Solidini makes a summary available to the Customer on request.
12.4 The Customer authorises the transfers listed in Annex 3, with the safeguards listed there.
12.5 If a safeguard becomes invalid, Solidini informs the Customer without undue delay. Solidini then takes the steps necessary to make the transfer lawful again, or stops the transfer. Clause 11.10 applies to a replacement Sub-processor.
13. Language models and artificial intelligence
13.1 The Service uses a Model Provider to generate Output. Solidini sends Customer Personal Data to a Model Provider only to generate Output for the Customer.
13.2 Solidini sends to a Model Provider only the content that is necessary to generate the Output. This content is the aggregate team data, the plan, team memory and the text that an Authorised User writes in the Service.
13.3 Solidini ensures that each Model Provider is bound by contract not to use Customer Personal Data to train or improve its models.
13.4 A Model Provider may retain Customer Personal Data for a limited period to monitor abuse of its service. Annex 3 states this period for each Model Provider. After this period, the Model Provider deletes the data.
13.5 Solidini does not use Customer Personal Data to train or fine-tune any model, its own or a third party's.
13.6 Output is generated by a language model and can be wrong. The Terms set out the responsibilities of the parties for Output.
14. Information and audits
14.1 Solidini makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR and this DPA. This information includes:
(a) this DPA and Annex 2;
(b) the Sub-processor List;
(c) on request, the audit reports or certifications that a Sub-processor makes available to Solidini, as far as the Sub-processor permits disclosure;
(d) on request, written answers to reasonable questions about the processing.
14.2 If the information under clause 14.1 is not sufficient to demonstrate compliance, the Customer may have an audit carried out. The following conditions apply:
(a) an independent auditor carries out the audit;
(b) the auditor is bound by a written obligation of confidentiality and is not a competitor of Solidini;
(c) the Customer gives at least 30 days' written notice and a proposed scope;
(d) an audit takes place no more than once in each period of twelve months;
(e) the audit takes place during business hours on Working Days and does not unreasonably disrupt the operations of Solidini;
(f) the auditor has no access to data of other customers of Solidini, or to information that would breach the confidentiality obligations of Solidini to third parties;
(g) the audit does not include an inspection of the premises of a Sub-processor; for a Sub-processor, the information under clause 14.1(c) applies;
(h) the Customer bears the costs of the audit, including the costs of the auditor.
14.3 In addition to clause 14.2(d), the Customer may have an audit carried out after a Personal Data Breach that affects its Customer Personal Data. That audit is limited to the Personal Data Breach and the measures related to it. The other conditions of clause 14.2 apply.
14.4 The Customer gives Solidini a copy of the audit report free of charge. The report is confidential information of Solidini. The Customer may share it with a supervisory authority. If the audit shows that Solidini does not comply with this DPA, Solidini remedies the non-compliance without undue delay.
14.5 Solidini always permits an audit or inspection by a competent supervisory authority and cooperates with it.
15. Return and deletion
15.1 During the Agreement, including the Read-only state, the Owner may ask Solidini by email to support@getteamstride.com for a copy of the Customer Data. Solidini delivers the copy in a machine-readable format (JSON or CSV) within 10 Working Days after the request, free of charge. Authorised Users can also view and print Customer Data with the functions of the Service during that time.
15.2 If the Owner closes the Organisation, in the Service or by email to support@getteamstride.com, Solidini deletes the Customer Data of that Organisation at once. Before closure, the Service warns the Owner that closure deletes all Customer Data and cannot be undone. The Owner should ask for the copy under clause 15.1 before closure.
15.3 If the Organisation becomes Read-only under the Terms, Solidini keeps the Customer Data for 12 months. Solidini sends an email to the Owner 30 days before the deletion. At the end of the 12 months, Solidini deletes the Customer Data. The Owner may close the Organisation before that date. Clause 15.2 then applies.
15.4 With clauses 15.1 to 15.3, the Customer chooses between return and deletion of the Customer Personal Data at the end of the processing, as Article 28(3)(g) GDPR requires.
15.5 Deleted Customer Data remains in backups for up to 7 days. Backups roll over within 7 days after the deletion, and the deleted data is then overwritten. During this period, Solidini does not restore the deleted data, except to recover the Service after an incident. In that case, Solidini deletes the restored Customer Data again.
15.6 Clauses 15.2, 15.3 and 15.5 do not apply as far as EU or Member State law requires Solidini to store the data.
15.7 Invoices and billing records are not Customer Data. Solidini keeps them as a controller for 7 years, as Dutch tax law requires (Article 52 of the General State Taxes Act, AWR).
15.8 Retention periods for specific Customer Data during the Agreement are in Annex 1. These periods apply in addition to this clause.
15.9 On request of the Customer, Solidini confirms the deletion in writing.
16. Liability and fines
16.1 Solidini's liability under this DPA is subject to Article 15 of the Terms.
16.2 That limitation does not apply to damage caused by intent or deliberate recklessness (opzet of bewuste roekeloosheid) of Solidini or its management.
16.3 This DPA does not limit the rights of data subjects under Article 82 GDPR.
16.4 Each party bears the administrative fines that a supervisory authority imposes on it. A party cannot recover such a fine from the other party. If a party has paid full compensation to a data subject, it may claim back from the other party the part of the compensation that corresponds to the other party's part of the responsibility for the damage, as Article 82(5) GDPR provides. Clause 16.1 applies to such a claim against Solidini.
16.5 Solidini's liability to the Customer for its Sub-processors under Article 28(4) GDPR and clause 11.4 is not excluded. It remains subject to Article 15 of the Terms, except for damage caused by intent or deliberate recklessness of Solidini or its management.
17. Term, termination and survival
17.1 This DPA cannot be terminated separately from the Agreement.
17.2 This DPA applies as long as Solidini processes Customer Personal Data, until deletion under clause 15 is complete.
17.3 Clauses 6, 10, 14, 15, 16 and 18 continue after this DPA ends, as far as necessary for their purpose.
18. Governing law, forum and amendments
18.1 Dutch law governs this DPA. The United Nations Convention on Contracts for the International Sale of Goods (CISG) does not apply.
18.2 The competent court of the district where Solidini has its registered office has exclusive jurisdiction over all disputes about this DPA, unless mandatory law provides otherwise.
18.3 Solidini may change this DPA under Article 18 of the Terms. Solidini may change this DPA without that procedure if a change in Data Protection Law, a decision of a supervisory authority or a court decision requires it. A change does not reduce the protection of Customer Personal Data, unless the law requires it.
18.4 If a clause of this DPA is invalid, the other clauses remain in force. The parties replace the invalid clause with a valid clause that comes as close as possible to its purpose.
18.5 Solidini sends notices under this DPA to the Owner as clause 2.4 sets out. The Customer sends notices to legal@getteamstride.com, and matters about personal data and Personal Data Breaches to privacy@getteamstride.com.
Annex 1: Description of the processing
A1.1 Subject and nature
Solidini hosts, stores, structures, retrieves, displays, transmits, generates content from, and deletes Customer Personal Data, to provide the Service.
A1.2 Purposes
| # | Purpose |
|---|---|
| 1 | Give Authorised Users access to the Organisation, its teams and their plans |
| 2 | Generate season plans, weekly plans and training sessions, and answer Authorised Users through the assistant |
| 3 | Keep team memory, so that the assistant takes earlier information about the team into account |
| 4 | Store the content that Authorised Users write: conversations, check-ins, memory notes, Own Drills and drill feedback |
| 5 | Send invitations and other service emails that relate to the Organisation |
| 6 | Support, maintain and secure the Service, including diagnosis of errors |
| 7 | Provide a copy of, and delete, Customer Personal Data under this DPA and on instruction |
A1.3 Categories of data subjects
| Category | Notes |
|---|---|
| Authorised Users of the Customer | Owner, Coordinators and Coaches. The Owner is 18 or older; Coordinators and Coaches are 16 or older |
| Persons invited to the Organisation | Email address only, until the invitation is accepted or expires |
| Any person named in free text | Only incidentally, and contrary to the Agreement. Clause 4.6 applies |
A1.4 Types of personal data
| Type | Examples |
|---|---|
| Identity and contact | Email address, optional display name |
| Sign-in | Single-use sign-in links (magic-link tokens), sessions |
| Organisation and role | Memberships, roles, team assignments, invitations (email address invited) |
| Content written by Authorised Users | Assistant conversations, weekly check-ins, team memory notes, Own Drills, post-session drill feedback |
| Usage and technical data | Usage logs, IP address in technical logs |
Team data is aggregate: team name, sport, age category, number of players, skill level, training slots, fixtures and goals. It is not personal data of players. A restriction recorded without identity, such as "2 players: no jumping", is not personal data as long as no player can be identified from it.
A1.5 Special categories of personal data
None. Special categories of personal data and other Prohibited Data are prohibited (clause 4.4).
A1.6 Frequency and duration
Processing is continuous during the Agreement. It ends when Solidini has deleted the Customer Data under clause 15.
A1.7 Retention
| Data | Retention |
|---|---|
| Assistant conversation | 90 days |
| Weekly check-in incl. free text | 90 days |
| Post-session drill feedback | 180 days |
| Half-finished onboarding | 30 days |
| Internal access log (who at Solidini looked at which training document) | 730 days |
| Acceptance records (who accepted the Terms and the DPA, and when) | as long as the Organisation exists, then 7 years |
| Team memory | as long as the team exists |
| Account, organisation, teams, plans | until the Owner closes the Organisation (deleted at once); otherwise deleted 12 months after the Organisation becomes Read-only, with 30 days' warning by email |
| Invoices and billing records | 7 years (Dutch tax law, art. 52 AWR) |
| Technical logs (Axiom) | 30 days |
| Backups (Supabase) | up to 7 days rolling; deletion propagates when backups roll over |
The internal access log, the acceptance records, and invoices and billing records are data for which Solidini is a controller (clause 3.4). They are in this table for completeness.
Annex 2: Technical and organisational measures
A2.1 Access control for users
- Solidini stores no passwords. An Authorised User signs in only with a single-use link sent by email (magic link).
- A sign-in link expires and can be used once.
- Sessions are stored server-side and can be ended.
- Invitation tokens are random, single-use, and stored only as a cryptographic hash.
- Access is role-based. The roles are Owner, Coordinator and Coach. Only the Owner manages the subscription and closes the Organisation.
- A conversation with the assistant, a coach's personal memory notes and post-session feedback are not visible to other Authorised Users. Team memory is visible to the coaches of that team.
- The Service limits the number of sign-in requests per email address and per source, and the number of assistant messages per Authorised User, to prevent abuse.
A2.2 Tenant isolation
- Each Customer is a separate Organisation in the data model. Every query on Customer Data is scoped by organisation, and by team where the role requires it.
- Every identifier that arrives in a request is resolved to its organisation and checked against the access rights of the Authorised User before data is read.
- The Service gives the same answer for "not yours" and "does not exist", so that it does not disclose which records exist.
- Automated tests guard the tenant isolation rules.
A2.3 Encryption
- All traffic between the browser and the Service uses TLS. The Service sends HTTP Strict Transport Security headers.
- Traffic between the Service and its Sub-processors uses TLS.
- The database provider encrypts the database and its backups at rest.
A2.4 Application security
- All database queries use bound parameters.
- The Service renders model output as text, not as code.
- The Service sets security headers, including a content security policy and a policy that denies framing.
- Secrets are held in the environment configuration of the hosting provider and are not stored in the source code.
- Scheduled internal endpoints require a secret that is compared in constant time.
A2.5 Logging and monitoring
- Technical logs are kept for 30 days in the EU.
- Every log line passes a redaction step before it leaves the Service. The redaction removes email addresses, IP addresses, credentials, tokens, cookies and database connection strings.
- Free text written by Authorised Users is not logged in production.
- Each read by Solidini staff of training documents across organisations, and of drill feedback, is recorded in an internal access log. The log records who read what and how many records, not the content. It is kept for 730 days.
A2.6 Availability and backup
- The database provider makes daily backups and keeps them for up to 7 days.
- The Service runs on the infrastructure of the hosting provider and the database provider, as listed in Annex 3.
A2.7 Development and change management
- Test and production use separate databases.
- Changes to the database structure go through version-controlled migrations only.
- Production is deployed from one defined release process only.
- A test sign-in function exists only outside production. It cannot be switched on in production.
- Solidini checks software dependencies for known vulnerabilities.
- Solidini reviews the security of the Service when it adds a new externally reachable function.
A2.8 Staff and internal access
- Access to production systems is limited to named staff of Solidini who need it, on the principle of least privilege.
- Staff use multi-factor authentication on the administration consoles of the providers in Annex 3.
- Staff are bound by confidentiality obligations (clause 6).
- Access rights are removed when a staff member no longer needs them.
A2.9 Incident response
- Solidini has a procedure to detect, assess, contain and report a Personal Data Breach.
- Solidini notifies the Customer under clause 10 and keeps a breach log.
- Reports to Solidini go to
privacy@getteamstride.com.
A2.10 Data minimisation by design
- The Service does not ask for Player Data. Team data is aggregate.
- The Service sends to a Model Provider only the content necessary to generate Output (clause 13).
- Records with a retention period carry a deletion date that the database sets when the record is created. A scheduled job deletes records when that date has passed.
- Authorised Users can delete their own content and team memory with self-service functions (clause 8.2).
Annex 3: Sub-processors
The Sub-processor List at the sub-processor page of the Service is the authoritative and current list (clause 11.2). This table replicates it on the effective date of this DPA. "SCCs" means the Standard Contractual Clauses. "EU-US DPF" means the EU-US Data Privacy Framework.
| Sub-processor | Purpose | Location of processing | Transfer mechanism |
|---|---|---|---|
| Vercel Inc. (US) | Hosting of the web application, serverless functions, CDN, cookieless web analytics | Global edge network; functions in Frankfurt, Germany (fra1) | EU-US Data Privacy Framework (Vercel is certified) + SCCs in Vercel DPA |
| Supabase Inc. (US) | Database (PostgreSQL) hosting, backups | London, United Kingdom (AWS eu-west-2) | UK adequacy decision (EU 2021, renewed 19 December 2025); SCCs for any access from US |
| OpenAI, L.L.C. / OpenAI Ireland Ltd | Large language model that generates plans and assistant answers. API data not used for training; retained by OpenAI up to 30 days for abuse monitoring, then deleted | United States | SCCs (Module 3) in the OpenAI DPA |
| Resend (Plus Five Five Inc.) | Transactional email: sign-in links, invitations, billing notices | United States | EU-US DPF (Resend is certified) + SCCs in Resend DPA |
| Axiom Inc. | Application logs and error diagnostics (redacted: no email addresses, no free text) | EU (eu-central-1, Frankfurt) | EU processing; SCCs for any support access from US |
The Model Provider for clause 13 is OpenAI.
Stripe Payments Europe Ltd (Ireland) processes payment data. Stripe acts as an independent controller for payment data under its own terms. Payment data is not Customer Data. The sub-processor page lists Stripe for transparency.