MASTER SERVICE AGREEMENT

7.1  Who Is Responsible Under COPPA — The Legal Structure

iSportz is a sports management technology platform — a tool. It does not create data about athletes. It does not collect data from children. It stores and processes only the data that Organizations choose to enter. The Organization, not iSportz, determines: what data to collect; how to collect it; what consents to obtain; and what policies govern its use. COPPA (15 U.S.C. §§ 6501–6506) applies to operators of websites or online services directed to children under 13, or that have actual knowledge they are collecting personal information directly from children. iSportz is neither. iSportz is directed to adult sports administrators and is a downstream service provider that processes only what Organizations submit. The COPPA operator responsible for parental notice, verifiable parental consent, and data governance is the Organization — the sports club, league, team, or federation with a direct relationship with child athletes and their families.

✔ THE CORRECT LEGAL STRUCTURE:  ORGANIZATION = COPPA Operator and Data Owner. The Organization sets its own data collection policies, decides what information to gather from athletes and their families, runs its own consent processes, and bears full COPPA operator responsibility. iSportz = Sports Management Tool and Service Provider. iSportz stores and processes only what the Organization enters and configures. The Organization’s data governance decisions are implemented by the iSportz tool — those decisions and their legal consequences belong entirely to the Organization.

This legal structure is not a limitation on iSportz’s protections for children — iSportz maintains strict data use restrictions with respect to all child data it processes (see Section 7.3). It is, however, an accurate allocation of legal responsibility under COPPA: the FTC holds the Organization — as the entity with a direct relationship with the child and their family — responsible for COPPA compliance.

7.2  Organization’s COPPA Obligations

⚠ REQUIRED OF EVERY ORGANIZATION USING iSPORTZ WITH CHILD ATHLETES:  iSportz is a tool that executes the Organization’s data management instructions. Because the Organization is the entity with its own data collection policies, its own direct relationship with child athletes and families, and its own operator responsibility, all COPPA compliance obligations belong to the Organization. By accepting this Agreement, the Organization represents and warrants that it has and will maintain throughout the term its own COPPA-compliant privacy policy, data collection practices, and parental consent procedures — all independent of iSportz.

7.2.1  Post a COPPA-Compliant Privacy Notice

The Organization must have and maintain its own COPPA-compliant privacy policy covering its data collection practices. iSportz is a downstream processing tool — the Organization’s policy must disclose its use of iSportz as a service provider. The policy must describe: (a) what personal information about child athletes the Organization collects and how; (b) how the Organization uses that information; (c) that iSportz processes the data as a sports management platform on the Organization’s behalf; (d) how parents contact the Organization to exercise their rights; and (e) the Organization’s data retention practices. iSportz’s Children’s Privacy Policy at https://isportz.co/legal-COPPA describes iSportz’s handling as a service provider and may be referenced as a supplement — not a substitute — for the Organization’s own required COPPA notice.

7.2.2  Provide Direct Notice to Parents

Before any child athlete’s personal information is collected or submitted to iSportz, the Organization must provide the child’s parent or legal guardian with direct notice of: (a) the fact that the Organization intends to collect personal information about the child through the iSportz Platform; (b) the types of personal information to be collected; (c) how the information will be used; (d) that the information will be processed by iSportz as a service provider; and (e) the parent’s rights to review, correct, and delete their child’s information. Direct notice may be provided by email, in a registration packet, or through the Organization’s own website, provided it is conspicuous and provided before data collection begins.

7.2.3  Obtain Verifiable Parental Consent

The Organization must establish and implement its own process for obtaining verifiable parental consent — this is a function of the Organization’s operations, not of the iSportz Platform. iSportz does not and cannot obtain parental consent on the Organization’s behalf. The Organization’s consent process must occur before any child athlete’s data is entered into iSportz. Under COPPA § 312.5, acceptable consent methods include:

• Providing a consent form to be signed and returned by the parent (by mail, fax, or electronic scan);
• Requiring a parent to use a credit card, debit card, or other online payment method in connection with a transaction (such as a registration fee), provided the Organization sends a notification of each transaction to the parent;
• Having the parent call a toll-free number or connect via video conference with trained Organization staff;
• Verifying a parent’s identity by checking a government-issued ID against a database, provided the ID is promptly deleted after verification; or
• Obtaining the parent’s consent through email combined with a confirmation step (email-plus method), where the Organization sends a follow-up communication to the parent after consent is received.

By accepting this Agreement, the Organization represents and warrants that: (a) it has established a COPPA-compliant consent process independent of iSportz; (b) it has obtained verifiable parental consent for each child athlete whose data is submitted to iSportz; (c) such consent was obtained using one of the FTC-approved methods above or another FTC-approved method; and (d) it will maintain records of all such consents. The Organization acknowledges that iSportz’s role is limited to storing and processing the data the Organization submits — iSportz does not verify, facilitate, or take responsibility for the Organization’s consent process.

7.2.4  Maintain Records of Parental Consent

The Organization must maintain records of all parental consents obtained, including the method of consent, the date obtained, and the identity of the consenting parent or guardian. These records must be retained for the duration of the child’s participation in the Organization’s programs and for a reasonable period thereafter. Records must be made available to iSportz or to regulatory authorities upon request.

7.2.5  Only Submit Necessary Child Data

The Organization shall submit to the iSportz Platform only the personal information about child athletes that is necessary for sports management purposes. The Organization shall not submit sensitive personal information about child athletes (health data, government IDs, biometric data) without specific parental consent for that category of information and a documented legitimate sports management need. Under COPPA § 312.7, the Organization shall not condition a child athlete’s participation in any sports activity on the disclosure of more personal information than is reasonably necessary.

7.2.6  Ensure Adult Data Entry — No Direct Child Access

The iSportz Platform is designed for use by adult sports administrators. The Organization is responsible for controlling access to the Platform and for ensuring that child athletes do not directly enter their own personal data. If the Organization operates a member-facing portal or registration process that feeds into iSportz, that portal is the Organization’s system — the Organization must implement age verification and access controls in its own registration process to ensure children cannot self-register or directly input their own personal information. iSportz implements whatever user access structure the Organization configures — the Organization’s configuration choices are the Organization’s responsibility.

7.2.7  Honor Parental Rights

Because the Organization owns the data and has the direct parent relationship, parental rights requests flow through the Organization — not through iSportz. Parents contact the Organization to review, correct, or delete their child’s data or withdraw consent. The Organization is responsible for providing parents with clear, accessible instructions on how to exercise their rights. Where fulfilling a request requires a Platform action (such as deleting a record), the Organization’s Administrator can act directly in the Platform, or may forward the request to iSportz at support@iSportz.co (subject: “COPPA — Child Data Request”) and iSportz will process it within thirty (30) days.

7.2.8  Notify iSportz of COPPA Investigations

The Organization shall notify iSportz within five (5) business days of receiving any inquiry, investigation, complaint, or enforcement action from the FTC, a State Attorney General, or any other regulatory authority relating to the Organization’s collection or use of child athlete data through the iSportz Platform.

7.3  iSportz Commitments with Respect to Child Data

iSportz is a sports management tool. It processes what Organizations configure and submit, nothing more. The following platform-level commitments apply to all child athlete data that passes through iSportz — regardless of which Organization submitted it. These commitments ensure iSportz maintains its clean tool role and is never characterized as a COPPA co-operator by the FTC:

FTC STANDARD:  A third-party service provider acquires actual knowledge — and becomes a co-operator subject to direct COPPA obligations — when the child-directed operator directly communicates the child-directed nature of its service to the third party (FTC COPPA Rule FAQ). iSportz addresses this risk through the commitments below.

• No Direct Collection. iSportz does not and will not present account registration, data entry, or profile creation screens directly to children under 13. All child athlete data is entered into the Platform exclusively by parents, guardians, or adult Administrators.
• No Advertising Use. iSportz will not use child athlete Personal Data for advertising, behavioral profiling, interest-based advertising, or any commercial purpose unrelated to providing the iSportz Services to the Organization.
• No Sale or Sharing. iSportz will not sell, share, or disclose child athlete Personal Data to any third party for monetary consideration or for any purpose other than providing the iSportz Services.
• Purpose Limitation. iSportz will process child athlete data only for sports management purposes within the iSportz Services as directed by the Organization.
• No Public Disclosure. iSportz will not make child athlete Personal Data publicly available without the Organization’s explicit authorization.
• Data Minimization. iSportz will not collect, store, or process child athlete data beyond what is submitted by the Organization and necessary to provide the iSportz Services.
• Deletion Support. Upon the Organization’s written instruction forwarded from a parent’s verified request, iSportz will delete the specified child athlete’s Personal Data from active systems within thirty (30) days and from backup systems within ninety (90) days.
• Sub-Processor Restrictions. iSportz will contractually prohibit all sub-processors from using child athlete data for advertising or any purpose beyond providing the iSportz Services.
• iSportz will maintain security measures appropriate to the sensitivity of child data, including encryption in transit and at rest consistent with its AWS infrastructure configuration.
• Breach Notification. iSportz will notify the Organization within forty-eight (48) hours of becoming aware of any breach involving child athlete data, to allow the Organization to fulfill its obligations to notify parents and regulatory authorities.

7.4  Organization Indemnification for COPPA Violations

The Organization agrees to defend, indemnify, and hold harmless iSportz and the iSportz Parties from and against any claims, demands, actions, fines, penalties, losses, liabilities, damages, costs, and expenses (including attorneys’ fees) arising from: (a) the Organization’s failure to maintain its own COPPA-compliant privacy policy; (b) the Organization’s failure to establish and run its own verifiable parental consent process before entering child data into iSportz; (c) the Organization’s failure to provide required direct parental notice; (d) the Organization’s failure to maintain records of parental consents; (e) the Organization’s failure to respond to parental rights requests directed to it; (f) the Organization’s misconfiguration of the iSportz Platform or its own registration systems resulting in unauthorized child data collection; (g) any FTC or State enforcement action arising from the Organization’s own data collection policies or practices; or (h) any claim by a parent arising from the Organization’s role as COPPA operator.

⚠ IMPORTANT:  iSportz is a tool. It implements what Organizations configure. The Organization’s data collection policies, consent procedures, privacy notices, and parent relationships are the Organization’s responsibility. If an Organization’s policies or practices fail to meet COPPA requirements, the resulting liability belongs to that Organization. iSportz’s role is to faithfully implement the Organization’s instructions, maintain platform-level data use restrictions, and provide the deletion and notification support described in Section 7.3.

7.5  FTC Safe Harbor and Industry Programs

Organizations that are members of an FTC-approved COPPA Safe Harbor program (such as CARU, the Children’s Advertising Review Unit) may satisfy their COPPA notice and consent obligations through the Safe Harbor program’s guidelines. Organizations participating in an FTC-approved Safe Harbor program should notify iSportz of their participation and provide documentation of their Safe Harbor status upon request. iSportz will cooperate with Safe Harbor program requirements applicable to its role as a service provider.

7.6  General Child User Protections

7.6.1  No Unauthorized Child Data. No Organization or Authorized User may upload, store, process, or transmit on the Platform any data about children under 13 unless the Organization has obtained verifiable parental consent as required by Section 7.2.3 above.

7.6.2  No Behavioral Advertising to Children. iSportz shall not use the Personal Data of child athletes for behavioral advertising, interest-based profiling, or any commercial purpose. This commitment is absolute and applies regardless of any other provision of this Agreement.

7.6.3  Deletion Upon Request. Upon receipt of a forwarded verified parental request from the Organization, iSportz shall promptly delete the Personal Data of the specified child athlete in accordance with Section 7.3.

7.6.4  Minimum Age Enforcement. Each Organization shall implement age verification measures in its own registration processes to prevent children under 13 from self-registering or directly entering their own information into the iSportz Platform without adult supervision and parental consent.