Data Processing Agreement (DPA)

Last Updated:

  • Scope

  • Roles

  • Processing of Personal Data

  • Confidentiality

  • Security Measures

  • Subprocessors

  • International Transfers

  • Data Subject Rights

  • Data Breach

  • Deletion and Return of Data

  • Audits

  • Contact

1. Scope

This Data Processing Agreement (“DPA”) forms part of the Terms of Service. It applies when TheZealot processes personal data on behalf of an organizer, meaning an event host or a team: for example, the team lists and athlete details an organizer gives us.

2. Roles

  • For what an organizer gives us, the organizer is the data controller and NovaSage, Inc. is the data processor

  • For a family’s own uploads and purchases, NovaSage, Inc. is the controller, and our Privacy Policy applies

Draft wording · final text pending

The final split of controller and processor roles between organizers, teams and TheZealot.

3. Processing of Personal Data

We will process personal data:

  • Only on documented instructions from the organizer

  • Only as needed to run the organizer’s events on TheZealot

  • In accordance with applicable data protection laws

Setting up an event, adding its teams and giving us a team list are documented instructions to process that information to run the event. A team does not have to give us a team list; families can add their own wrestler instead.

4. Confidentiality

Everyone we authorize to process personal data is bound by confidentiality obligations.

5. Security Measures

We implement appropriate technical and organizational measures, including:

  • Encryption in transit and at rest

  • Access controls

  • Monitoring and logging

6. Subprocessors

We use other companies to run parts of the service, such as hosting, storage and payments. A current list of subprocessors is available upon request. Every subprocessor is bound by appropriate data protection obligations.

7. International Transfers

Where personal data is transferred across borders, we implement appropriate safeguards as required by applicable law.

8. Data Subject Rights

We will help the organizer, where reasonably possible, respond to requests from the people whose data it gave us, including parents and guardians acting for a child.

9. Data Breach

We will notify the organizer without undue delay after becoming aware of a personal data breach affecting the data it gave us.

10. Deletion and Return of Data

When an organizer stops using TheZealot, we will delete or return the personal data it gave us, unless the law requires us to keep it.

11. Audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA.

12. Contact

For data protection inquiries: privacy@thezealot.ai