CourtBeam Data Processing Addendum

1. Scope, roles and precedence

"Applicable Data Protection Law" means privacy and data-protection law applicable to the processing, including the GDPR, UK GDPR and US state privacy laws where applicable. "Controller", "processor", "business", "service provider" and "personal data" have their corresponding legal meanings. A "Personal Data Breach" is a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data. An unsuccessful attack without a data compromise is not itself a Personal Data Breach.

Customer acts as controller or business for club operations, and CourtBeam as processor or service provider. If Customer acts for another controller, Customer must have authority to instruct CourtBeam as a subprocessor. Annex A describes the processing. CourtBeam's independent business-account, billing, marketing and platform-security processing is described in its Privacy Notice; that distinction does not permit repurposing Customer Personal Data outside this Addendum.

This Addendum prevails over conflicting agreement terms about Customer Personal Data. Mandatory law and an applicable executed international-transfer instrument prevail over inconsistent provisions here. Contractual liability limits cannot restrict non-waivable individual rights or rights under an applicable transfer instrument.

2. Instructions and Customer responsibilities

CourtBeam will process Customer Personal Data only on Customer's documented instructions, including the agreement, this Addendum, enabled settings and authorized support requests, to provide and secure the contracted service. Processing includes collection, storage, retrieval, organization, communication, reporting, correction, export and deletion. Additional work outside the service requires a written scope and any agreed charges; charges must not prevent legally required assistance.

If law requires processing beyond those instructions, CourtBeam will inform Customer beforehand unless prohibited by law. CourtBeam will promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law and may pause that instruction while the parties resolve it.

Customer is responsible for lawful collection, notices, permissions and a valid basis for instructions; accuracy; personnel access; its own device security; and responses to players. Customer must not upload full card data, government identity documents, medical records, credentials or unnecessary sensitive data into free-form fields. The service is not approved for protected health information under HIPAA or an independent children's-account program. Restricted data or youth programs need a separately approved lawful process.

3. Confidentiality and security

CourtBeam will bind authorized personnel to confidentiality obligations, limit access to their duties and maintain the technical and organizational measures in Annex B. Measures may evolve but will not materially reduce overall protection during the agreement.

The parties will cooperate on security appropriate to the nature, scope, purposes and risks of processing. Neither party's responsibility for its own controls removes the other's obligations.

4. Subprocessors

Customer generally authorizes subprocessors disclosed for enabled services in the Service Providers and Subprocessors list. CourtBeam will enter written contracts imposing substantively no less protective obligations for the processing concerned and remains responsible for its subcontracted obligations.

Before adding or replacing a subprocessor handling Customer Personal Data, CourtBeam will give Customer's designated contact at least 15 days' written notice, including the provider's identity, function and relevant locations. Updating a website alone does not replace that notice. Customer may object within that period on reasonable data-protection grounds. The parties will seek a resolution, such as avoiding the affected processing or providing an alternative. If no reasonable solution is available, Customer may terminate the affected service on written notice and receive a prorated refund of prepaid fees for its unused affected period. A new subprocessor may not receive restricted data without any authorization required by law or the applicable transfer instrument.

5. Personal Data Breaches

CourtBeam will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice is not delayed until an investigation is complete. To the extent known, it will describe the breach, affected data and people, likely consequences, mitigation taken or proposed and a contact for further information. CourtBeam may provide information in stages and will cooperate with investigations and required notifications.

Customer is responsible for its regulator and individual notices; CourtBeam remains responsible for its own statutory duties. Consultation must not delay a legally required notice. Incident notice does not itself admit liability. Customer must promptly report suspected unauthorized access to support@courtbeam.com.

6. Requests, assessments and regulatory assistance

Taking account of the processing and available information, CourtBeam will provide reasonable technical and organizational assistance with applicable individual rights; security obligations; breach reporting; data-protection impact assessments; and prior consultation with regulators.

If CourtBeam receives a request about Customer-controlled data, it will promptly notify Customer where lawful and assist under Customer's instructions, unless law requires a direct response. Requests about CourtBeam's own controller processing are handled separately. Neither party may direct the other to conceal a request or miss a statutory deadline.

7. Information and audits

CourtBeam will make available information reasonably necessary to demonstrate compliance and allow and contribute to audits, including inspections, by Customer or its independent auditor. The parties will agree reasonable scope, timing, confidentiality and security arrangements that protect other customers and do not obstruct legally required oversight.

Existing relevant evidence may satisfy a routine request where sufficient. Further inspection remains available where evidence is inadequate, a material incident warrants it or law or a regulator requires it. This Addendum does not claim SOC 2, ISO certification or an independent report CourtBeam has not obtained. Agreed audit costs must be reasonable and must not prevent mandatory rights.

8. Return, deletion and continuing protection

At service termination, Customer may elect secure return or deletion of Customer Personal Data. The Platform Terms provide a 30-day export window, unless longer is agreed or legally required. CourtBeam will then delete or anonymize remaining data and copies within a reasonable period, except where retention is legally required. Retained data remains protected, restricted to that legal purpose and deleted when the requirement ends.

Backups that cannot immediately be individually erased will be isolated from ordinary use and deleted through the applicable backup cycle. Restoration must not undo an applicable deletion instruction. CourtBeam will provide deletion confirmation on request and identify continuing legal-retention exceptions. Inconvenience does not justify indefinite retention.

9. US state service-provider terms

Where applicable US state law treats CourtBeam as a service provider, contractor or processor, Customer discloses data only for the limited, specified purposes in Annex A. CourtBeam will comply with applicable obligations and provide the legally required level of protection.

CourtBeam will not sell or share Customer Personal Data; retain, use or disclose it outside the direct business relationship or for purposes other than the specified services, except as permitted by law; or combine it with personal information from other customers or CourtBeam's own interactions except as permitted by law to provide the service. CourtBeam certifies it understands and will comply with these restrictions.

Customer may take reasonable and appropriate steps to verify compliance and, on notice, stop and remediate unauthorized use. CourtBeam will notify Customer if it determines it can no longer meet its obligations. The subprocessor, assistance, deletion and audit provisions also apply to these obligations.

10. International transfers

Customer's instructions authorize processing in disclosed locations only where lawful. Before a restricted transfer, including remote access, the parties must document an applicable adequacy basis or execute the appropriate transfer instrument and any required supplementary measures. CourtBeam will provide information reasonably needed for transfer assessment and downstream safeguards.

For EEA data, the parties may use the European Commission's standard contractual clauses under Decision (EU) 2021/914, using Module Two for controller-to-processor or Module Three for processor-to-processor transfers where applicable. UK transfers require a UK-approved instrument, such as the UK Addendum to those clauses; Swiss transfers require applicable Swiss adaptations. Other jurisdictions may require additional arrangements.

The parties must complete exporter/importer identities, binding acceptance, roles, contacts, data and processing details, locations, competent authority, governing-law and forum selections, security measures and required subprocessor details. Annexes A and B support that work. This Addendum does not execute incomplete SCCs or authorize a transfer merely by naming them. If a lawful mechanism is unavailable, the affected transfer must not begin or must be suspended. CourtBeam will notify Customer if it can no longer comply with an applicable mechanism.

11. Analytics and automated processing

Club reports and associated account-linked measurements are Customer Personal Data while identifiable and remain subject to lawful instructions. CourtBeam will not use Customer Personal Data to train a general-purpose AI model or authorize a provider to do so without Customer's express written instructions and a lawful basis. A content license or feedback clause grants no such right.

Before a feature involving automated decisions with legal or similarly significant effects, the parties must document its scope, notices, lawful basis and safeguards. Ordinary booking rules, payment processing and aggregate reports do not authorize unrelated profiling.

Annex A. Processing details

• Subject matter and purpose: providing Customer's club-management software, portals and apps, bookings, events, memberships, club credit, communications, support, operational reporting and security under documented instructions.
• Duration and frequency: ongoing during the service, followed by return/deletion and legally required retention; collection and transfers occur as users interact and operations run.
• Individuals: players, guests, staff, organizers and business contacts whose records Customer controls. Youth participation requires the separately approved process above.
• Data: identifiers and contact details; roles and profiles; booking, membership, attendance and payment references; credit transactions; waivers and acceptance records; content and support; account-linked usage, installation and notification identifiers; security and audit records. Payment providers handle full payment credentials.
• Customer contact: legal name, address and designated administrator or privacy contact recorded in the order or account. Customer must keep these current.
• CourtBeam contact: PicklePro Tech LLC, 1021 E Lincolnway STE 7756, Cheyenne, WY 82001, United States; support@courtbeam.com.
• Providers and locations: the Service Providers and Subprocessors list and applicable order or transfer schedule. Headquarters do not imply exclusive storage in that country.

Annex B. Technical and organizational measures

• Access: authenticated accounts, permission checks, tenant scoping, least-privilege service access, confidentiality and removal of unneeded access.
• Data protection: encryption in transit and provider-managed encryption at rest, restricted credentials, separation of payment credentials from CourtBeam records, controlled export and deletion.
• Application safeguards: input validation, request-forgery protection for applicable sessions, rate limits, authorization checks, signed payment-webhook verification and controls against duplicate financial actions.
• Monitoring and response: security and audit events, restricted diagnostics, incident investigation, breach escalation and Customer cooperation.
• Resilience and maintenance: provider infrastructure safeguards, backup and recovery arrangements, security maintenance, controlled changes and restoration procedures preserving deletion restrictions.
• Assurance: relevant evidence and review through Section 7. These are service commitments, not a guarantee of uninterrupted availability or a certification.