Annex A: X-Skills data processing agreement
Version: October 2025
This data processing agreement forms an integral part of the X-Skills License and is deemed to have been entered into at the moment the club digitally accepts these terms.
This data processing agreement (“Data Processing Agreement”) forms an integral part of the X-Skills License Agreement and is concluded between:
- Controller: the Organisation that purchases an X-Skills license (name, address and Chamber of Commerce number to be specified separately)
- Processor: X-Skills B.V., Spaarne 64, 2011 CK Haarlem, Chamber of Commerce 91287227
Hereinafter jointly referred to as: “the Parties”.
Article 1 – Purpose and scope
X-Skills processes personal data solely on the instructions of and for the benefit of the Organisation, in the context of the use of the X-Skills software, app, hardware and methodology. The purpose of the processing is to facilitate: training sessions and events; performance measurement and analysis; internal club administration; leaderboards and reporting.
Article 2 – Categories of personal data and data subjects
Data subjects
- players (youth and seniors);
- trainers and coaches;
- club administrators.
Personal data
- name or nickname;
- e-mail address (optional);
- age category or date of birth;
- team or club details;
- performance and measurement data;
- account and login details;
- SkillTag/Tag IDs.
Article 3 – Processing phases
- Anonymous phase: processing of performance data without any link to personal data (Tag IDs).
- Personal phase: linking to personal data after a user voluntarily:
- creates an account;
- and links a SkillTag.
The Organisation determines whether and when this linking takes place.
Article 4 – Duration of the processing
- The processing continues for as long as the License Agreement is in force.
- Following termination, personal data is deleted or anonymised within 30 days, unless statutory retention obligations require otherwise.
Article 5 – Obligations of X-Skills (Processor)
X-Skills:
- processes personal data solely on the written instructions of the Organisation;
- processes data exclusively within the European Economic Area;
- takes appropriate technical and organisational measures, including:
- encrypted connections (TLS);
- encrypted storage;
- role-based access rights;
- logging, monitoring and back-ups;
- safeguards the confidentiality of its personnel;
- reports data breaches to the Organisation without delay and within 48 hours at the latest.
Article 6 – Obligations of the Organisation
The Organisation:
- is the controller under the GDPR;
- ensures that players and parents are properly informed;
- obtains parental consent for players under the age of 16;
- is responsible for the leaderboard settings and the visibility of names.
Article 7 – Sub-processors
- X-Skills makes use of sub-processors, including:
- Google Firebase (EU);
- Amazon Web Services (EU);
- payment processors (where applicable).
- Changes of sub-processors are notified; objection is possible within 14 days.
Article 8 – Rights of data subjects
- X-Skills supports the Organisation with requests for:
- access;
- rectification;
- erasure;
- data portability.
- Requests addressed directly to X-Skills are forwarded to the Organisation.
Article 9 – Liability
- The liability of X-Skills is limited in accordance with the License Agreement.
- X-Skills is not liable for errors caused by incorrect instructions from the Organisation.