Article 1
GDPR definitions and roles
Identification of the data controller (your federation/club), the data processor (PickleDeck) and its subprocessors.
Security
Courtesy translation: only the French version is legally binding.
GDPR compliance
Data Processing Agreement.
Version 1.0, revised on 30 March 2026 · Available in French
In accordance with article 28 of the GDPR, we provide a DPA (Data Processing Agreement) to all our professional and institutional clients. The standard document is sent on request within 24 working hours by our DPO. A customised version is available for sports federations.
Reply within 24 working hours from the DPO · See the subprocessors
Structure of the document
The standard DPA covers the 8 articles required by the GDPR to govern the data controller / data processor relationship. For institutions, specific clauses (commitment not to reuse data for commercial purposes, enhanced audit right, contractual SLA) can be added in the customised version.
Article 2
Description of the processing
Purposes, categories of data, categories of data subjects, duration of the processing, types of operations performed.
Article 3
Processor's obligations
Documentation of instructions, confidentiality of staff, security measures, management of subprocessors (prior consultation).
Article 4
Rights of data subjects
Assistance procedure for responding to requests for access, rectification, erasure, portability, objection, restriction.
Article 5
Breach notification (two-way)
Two-way commitment: our subprocessors notify us of any breach within 48h of becoming aware of it. PickleDeck notifies its institutional clients (federations, leagues, committees) within 24h of becoming aware of it ourselves. Details and corrective measures, in accordance with the public procedure /securite/violation.
Article 6
Audits and inspections
Provision of the information needed for audits. Possibility of an audit by an independent third party chosen jointly.
Article 7
Transfers outside the EU
Governed by Standard Contractual Clauses (SCC) for subprocessors outside the EU (Stripe, DUPR, etc.). Exhaustive list on the subprocessors page.
Article 8
Duration and end of the contract
Return or deletion of all personal data at the end of the contract, at the option of the data controller.
Our concrete commitments
Breach notification < 24 h
Detection, qualification and notification to the data controller, with corrective measures under way.
Security questionnaire reply < 10 days
Commitment to answer standard security questionnaires (ANSSI, MIPS, ISO 27001 light).
Governed subprocessors
6 technical subprocessors listed publicly, all under a DPA or SCC for transfers outside the EU.
Documents provided on request
Art. 30 record, DPIA, recovery plan, architecture diagram: available at dpo@pickledeck.com.
A question?
Our DPO replies within 1 working month.
In accordance with article 12 of the GDPR. For federal institutions, a dedicated contact can be assigned.