Data Processing Agreement

"GNG" means Magnus Golf Coaching LLC, a Wyoming company, acting as processor. "Coach" means the customer using the Service, acting as controller of their Players' personal data. "Player", "Parent", "Content" and "Video" have the meanings given in the Coach Terms. "Sub-processor" means a third party engaged by GNG to process personal data. "Data protection law" means the laws applicable to the processing, including the EU GDPR and UK GDPR where they apply.

For personal data the Coach enters or generates about their Players, the Coach is the controller and GNG is the processor. For the Coach's own account data — name, email, login and billing records once billing exists — GNG is the controller and the privacy notice applies.

Subject matter: the provision of the GNG practice-planning, results and video service. Duration: for as long as the Coach's account is open, and afterwards only for the short period needed to complete deletion or return under clause 9.

Storage, hosting, organisation, retrieval, transmission and deletion of Player data, for the purposes of: maintaining the Coach's roster; delivering practice plans and assignments to Players; recording practice results; storing, transcoding and delivering Video and coach analyses; sending the transactional emails the Service provides (invitations, an analysis notice to the Player, and a weekly digest to the Coach); and providing support and security.

Data subjects: the Coach's Players, including Players who are minors, and the Parents who consent on their behalf.

• Identity and contact: name, email address.
• Golf profile: handicap index, coaching notes entered by the Coach.
• Practice data: every attempt logged — completion, skips, planned and actual time, scores, attempts and Player notes, with a snapshot of how the drill was measured.
• Video: swing recordings uploaded by the Coach or the Player.
• Coach analyses: recordings that combine the Video, on-screen drawings and the Coach's voice.
• Account and preference data: role, notification preferences, timezone.
• Technical data: server logs and error reports.

No special-category data is requested by the Service. The Coach must not enter health, medical or other special-category data into free-text notes.

• Instructions. Process Player data only on the Coach's documented instructions, which include use of the Service's features, unless required otherwise by law — in which case we tell the Coach first, where lawful.
• Confidentiality. Ensure everyone authorised to process the data is bound by confidentiality.
• Security. Access to Player data is enforced in the database itself through row-level security, not only in the interface: a Coach can reach only their own Players, a Player only their own records, and administrators cannot browse coaching content, rosters or results. Data is encrypted in transit; Video is delivered only through short-lived signed links; passwords are stored hashed.
• Assistance. Assist the Coach, taking account of the nature of processing, in responding to requests from Players or Parents, and with security, breach notification and impact assessments. We notify the Coach without undue delay after becoming aware of a personal data breach affecting their Players.
• Minors. The Service provides a parental consent mechanism. Obtaining and maintaining that consent remains the Coach's obligation as controller.

The Coach authorises the following sub-processors:

• Lovable Cloud (Supabase) — database, authentication and application hosting.
• Lovable — delivery of transactional email.
• Bunny Stream — storage, transcoding and delivery of Video and coach analyses.
• Zoho Mail — hosting of the hello@gng.golf and privacy@gng.golf mailboxes, which receive correspondence including privacy requests.

Each sub-processor is engaged under terms no less protective than this agreement. We will give the Coach at least 30 days' notice by email before adding or replacing a sub-processor. If the Coach reasonably objects on data protection grounds, they may terminate the Coach Terms before the change takes effect.

GNG's entity is in the United States, its owner is resident in Qatar, sub-processors operate infrastructure in the United States and the European Union, and Coaches and Players are worldwide. Personal data will therefore be transferred across borders, including out of the EEA and the UK.

[Legal review: confirm the transfer mechanism. Candidates are the EU Standard Contractual Clauses (with the UK International Data Transfer Addendum) between the Coach as data exporter and GNG as importer, plus a transfer impact assessment; confirm the position for a US entity with a Qatar-resident controller of the business and whether hosting region can be pinned to the EU.]

On termination of the Coach Terms, and at the Coach's choice, GNG deletes or returns the Player data and deletes existing copies within 30 days, unless law requires retention. There is no self-service export tool today: to request a return of data, email privacy@gng.golf and we will produce it. Content that other Coaches have adopted is retired rather than deleted so their historical results remain readable; that Content contains no Player personal data.

GNG makes available the information reasonably needed to demonstrate compliance with this agreement and cooperates with audits by the Coach or their auditor, no more than once a year unless required by a supervisory authority, on reasonable notice, during business hours, and subject to confidentiality. GNG is a small operation: we will answer written questionnaires and provide documentation rather than host on-site inspections.

Liability under this agreement is governed by, and counts towards, the limitation of liability in section 10 of the Coach Terms of Service.

[Legal review: confirm that a single aggregate cap across the Coach Terms and this DPA is enforceable in the chosen governing law, and whether data protection claims must sit outside the cap.]