Data processing agreement

Parties and purpose

This agreement binds the club (the association, the company or, for a crew with no legal entity, the person who created it), the controller, and Robin Clerc, a private individual not registered as a business, the processor. It is an annex to the terms of use, accepted when the club is created; the accepted version is recorded.

It is built on the European Commission’s standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915) and carries over the obligations of GDPR article 28. [To be completed: annex those clauses in full, or confirm the current wording (question L1)]

Description of the processing

• Purpose: running the club, its runs, its pace groups, sign-ups, roll call, waivers and messages to participants.

• Data subjects: the club’s members, guests and run leaders.

• Data: first and last name, email address, membership details, sign-ups and attendance, proof of waiver acceptance, a keyed hash of returning guests’ email (13 months).

• Sensitive data: none; for a club whose purpose reveals sensitive data, membership rests on the member’s explicit consent. No health data is processed.

• Duration: as long as the club uses Kilomeet, with the retention periods of the privacy policy.

Instructions

Kilomeet processes the data only on the club’s documented instructions: the terms of use and the club’s settings, including for any transfer. If an instruction seems unlawful to us, we tell you.

Confidentiality

Everyone with access to the data is bound to confidentiality: the founder, and the holder of the emergency access, by a written undertaking.

Security (annex)

• Hosting in France; encrypted connections (HTTPS).

• Each club’s data partitioned in the database, by rules the database itself enforces.

• Separate least-privilege database roles; an audit log of sensitive actions kept 12 months.

• Password-free sign-in with one-time codes; time-limited sessions.

• Backups encrypted before upload, with the decryption keys kept off the server.

• Access to production data reserved to the founder; no artificial-intelligence tool can reach it.

Sub-processors

The club gives a general authorisation to use the sub-processors listed on the sub-processors page. Any addition or replacement is announced by email 30 days ahead; the club may object and, if no solution is found, leave the service. Kilomeet imposes the same obligations on each sub-processor and remains liable for their compliance.

Data subject requests

Standing instruction: Kilomeet honours, on the club’s behalf, requests made with the service’s tools (export and erasure of a guest’s data, account deletion, consent withdrawal). Any other request we receive is forwarded to the club within 5 working days.

Assistance and data breaches

Kilomeet helps the club ensure security, carry out an impact assessment where needed and consult the CNIL. In case of a data breach, Kilomeet notifies the club without undue delay, within 48 hours at most (target: 24 hours), with the necessary information and a pre-filled CNIL notification the club can file or ask us to file. Members are informed on the club’s instruction.

End of processing

When the service ends, the club exports its data, then Kilomeet erases it within 30 days, copies included as backups cycle out. Waiver proofs are kept only on the club’s instruction or when a legal proceeding requires it.

Information and audits

Kilomeet makes available the information needed to demonstrate compliance with this agreement. The club may first send a questionnaire, then, at most once a year and with 30 days’ notice, carry out or commission an audit, on site or remotely, at its own cost.

What Kilomeet does on its own account

So that we never go beyond your instructions, we state what we process as a controller: account and security data, anonymous aggregate statistics (never an identifiable person), abuse logs and the identification data a hosting provider must keep. These are described in the privacy policy.