DATA PROCESSING AGREEMENT

5.1  The Fundamental Structure: iSportz Is a Tool, Organizations Are Operators

iSportz is a sports management technology platform. It does not independently determine what data to collect about child athletes. It does not solicit information from children or their families. It does not set data collection policies. It stores, displays, and processes only the data that Organizations enter and configure. The Organization — the sports club, league, team, or federation using iSportz — is the entity with its own data governance policies, its own direct relationship with child athletes and families, and its own legal responsibilities under applicable law.

✔ COPPA STRUCTURE UNDER THIS DPA:  ORGANIZATION = COPPA Operator. Has its own data collection policies. Has the direct relationship with child athletes and families. Is responsible for parental notice, verifiable parental consent, and all COPPA operator obligations. iSportz = Sports Management Tool / Service Provider. Processes child data only as the Organization instructs and configures. Does not direct its services to children. Does not collect data directly from children. Does not set the Organization’s data collection policies.

COPPA (15 U.S.C. §§ 6501–6506) applies to operators of online services directed to children under 13, or operators with actual knowledge they are collecting personal information directly from children under 13. iSportz is neither. iSportz is directed to adult sports administrators. Because iSportz processes child data only as a service provider acting on Organizations’ instructions, and because the FTC recognizes the operator / service provider distinction, the COPPA compliance obligations in this Section 5 are allocated accordingly.

5.2  Organization’s Representations and Warranties as COPPA Operator

⚠ DPA CONDITION:  iSportz processes child data under this DPA only because and to the extent the Organization has satisfied its own COPPA obligations. The following are the Organization’s representations and warranties to iSportz — not the other way around. Breach of any of these warranties by the Organization constitutes a material breach of this DPA and the MSA.

By accepting this DPA and submitting child athlete data to iSportz, the Organization represents and warrants that:

• Own Privacy Policy. The Organization has and maintains its own COPPA-compliant privacy policy covering its data collection practices, including disclosure of iSportz as a service provider that processes child data on its behalf. The Organization’s privacy policy — not iSportz’s Children’s Privacy Policy — is the Organization’s primary COPPA operator notice. iSportz’s Children’s Privacy Policy at https://isportz.co/legal-COPPA may be referenced as a supplement describing the service provider’s handling.
• Own Consent Process. The Organization has established its own process for obtaining verifiable parental consent — independent of iSportz — before any child athlete’s personal information is entered into the iSportz Platform. This consent process is the Organization’s responsibility. iSportz does not and cannot obtain parental consent on the Organization’s behalf.
• Own Parental Notice. The Organization has provided direct notice to parents of child athletes describing what personal information is collected, how it is used, that iSportz processes it as a service provider, and how parents can exercise their rights by contacting the Organization.
• Consent Records. The Organization maintains records of all verifiable parental consents obtained, including the method, date, and identity of the consenting parent or guardian, and will make those records available upon request from iSportz or a regulatory authority.
• Data Minimization. The Organization will submit to iSportz only personal information about child athletes that is necessary for sports management purposes and for which it has parental consent. The Organization will not submit sensitive personal data about children (health records, government IDs, biometric data) without specific parental consent for that data category.
• Adult-Controlled Entry. The Organization controls its own registration systems and access to iSportz. It ensures that all child athlete data entered into iSportz is entered by an authorized adult — a parent, guardian, or adult Administrator — not by the child directly. The Organization configures its own registration portal and access controls to enforce this; iSportz implements the access structure the Organization creates.
• Parent Rights Handling. The Organization handles all parental rights requests (review, correction, deletion, consent withdrawal) as the first point of contact. Parents contact the Organization. Where a request requires action within the iSportz Platform, the Organization’s Administrator acts directly using the Platform’s tools, or forwards the request to iSportz at support@iSportz.co (subject: “COPPA — Child Data Request”) and iSportz will process it within thirty (30) days.
• Regulatory Notification. The Organization will notify iSportz within five (5) business days of any FTC, State AG, or other regulatory inquiry, investigation, or enforcement action relating to child athlete data processed through the iSportz Platform.

5.3  iSportz Platform-Level Commitments for Child Data

iSportz is a tool — it processes what Organizations configure and enter, nothing more. The following commitments apply at the platform level to all child athlete data processed through iSportz, regardless of which Organization submitted it. These commitments reflect iSportz’s tool role and protect against iSportz ever being characterized as a COPPA co-operator by the FTC:

• No Direct Collection. iSportz does not and will not present registration, data entry, or profile creation screens directly to children under 13. The Platform is designed for adult administrators. All child athlete data is entered by parents, guardians, or adult Administrators.
• No Advertising Use. iSportz will not use child athlete data for advertising, behavioral profiling, interest-based advertising, or any commercial purpose unrelated to providing the iSportz Services to the Organization that submitted the data.
• No Sale or Sharing. iSportz will not sell or share child athlete data with any third party for monetary consideration or for behavioral advertising purposes.
• Purpose Limitation. iSportz processes child data only for sports management purposes within the iSportz Services, as directed by the Organization. iSportz does not use child data for any purpose the Organization has not authorized.
• No Independent Public Disclosure. iSportz will not make child athlete data publicly accessible without the Organization’s explicit authorization.
• Deletion on Instruction. Upon receiving a forwarded parental deletion request from the Organization at support@iSportz.co, iSportz will delete the specified child’s Personal Data from active systems within thirty (30) days and from backup systems within ninety (90) days, and provide written deletion confirmation.
• Sub-Processor Restrictions. iSportz will contractually prohibit all sub-processors from using child athlete data for advertising or any purpose beyond providing the iSportz Services.
• iSportz maintains security measures appropriate to child data sensitivity, including encryption in transit and at rest consistent with its AWS infrastructure configuration.
• Breach Notification. iSportz will notify the Organization within forty-eight (48) hours of becoming aware of any breach involving child athlete data so the Organization can fulfill its notification obligations to parents and regulatory authorities.

5.4  iSportz’s No-Knowledge Protection

Under the COPPA Rule, a service provider that receives actual knowledge that a first-party operator’s service is directed to children may itself become a co-operator subject to direct COPPA obligations. iSportz manages this risk through the following structural features of the Platform and this DPA:

• iSportz’s Platform is directed to adult sports administrators. The Platform’s interface, marketing materials, and terms of service are aimed at Organizations and adult users.
• iSportz does not present data collection interfaces to children. Children do not interact directly with iSportz’s Platform to enter their own information.
• The Organization, by accepting this DPA, represents that it has obtained parental consent through its own processes before submitting child data. iSportz relies on this representation.
• iSportz maintains the platform-level restrictions in Section 5.3, ensuring that even if an Organization were to submit child data without adequate consent, iSportz would not use that data for advertising or other prohibited purposes.

FTC STANDARD:  A third-party service provider acquires “actual knowledge” — and becomes subject to direct COPPA obligations — when the child-directed operator directly communicates the child-directed nature of its service to the service provider (FTC COPPA Rule FAQ 39). The structure of this DPA and the Platform is designed to ensure iSportz remains a neutral tool, not a co-operator.

5.5  Organization Indemnification for COPPA Compliance Failures

The Organization agrees to defend, indemnify, and hold harmless iSportz and the iSportz Parties from and against any claims, demands, actions, fines, penalties, losses, liabilities, damages, costs, and expenses (including attorneys’ fees) arising from: (a) the Organization’s failure to maintain its own COPPA-compliant privacy policy; (b) the Organization’s failure to establish and run its own verifiable parental consent process before entering child data into iSportz; (c) the Organization’s failure to provide required direct parental notice; (d) the Organization’s failure to maintain consent records; (e) the Organization’s failure to respond to parental rights requests; (f) the Organization’s misconfiguration of the iSportz Platform or its own registration systems in a manner that results in unauthorized collection or processing of child data; (g) any FTC or State enforcement action arising from the Organization’s own data collection policies, practices, or consent failures; or (h) any claim by a parent arising from the Organization’s role as COPPA operator.

⚠ CLEAR ALLOCATION:  iSportz is a tool. The Organization sets the data collection policies, runs the consent process, and owns the parent relationship. If the Organization’s COPPA compliance fails — wrong consent method, missing privacy notice, inadequate parental rights procedure — that is the Organization’s liability. iSportz’s liability under this DPA is limited to its own platform-level commitments in Section 5.3.

5.6  Categories of Child Data iSportz May Process (As Submitted by Organization)

For transparency, the following categories of child athlete data may be stored in iSportz depending on what the Organization enters and configures. iSportz processes only what the Organization submits:

Name, date of birth, gender: Entered by parent/guardian or adult Administrator for roster and eligibility purposes.

Team assignment, jersey number: Entered by adult Administrator for team management.

Athletic performance data, statistics, attendance: Entered by coach or adult Administrator for coaching and reporting.

Parent/guardian contact information (not child’s): Entered by parent/guardian for communications about the child’s participation.

Competition results, scheduling: Entered by adult Administrator for event management.

Profile photo (if uploaded): Uploaded by parent/guardian or adult Administrator for roster identification. Deleted on parental request.

Device/IP data: Collected automatically from the adult device used to access the Platform. Not collected from the child’s device.

NOTE:  iSportz does NOT collect device identifiers, IP addresses, or any persistent identifiers directly from the child’s device. Any session or device data is collected from the adult’s device when they access the Platform to manage the child’s account.