This schedule supplements the instructions and supplier information in Appendices A, B, C and F of the existing DPA for the management portal. It does not replace the DPA or reduce its core protections. The existing WhatsApp, AI, media, moderation and publishing arrangements continue as documented there.

The club instructs KlubAmp to provide secure club administration, including its designated administrator’s access, coach names and authorised numbers, prompts, settings, branding, social connection metadata and necessary billing references. Coaches remain WhatsApp-only. Club administrators have MFA and access only to their assigned clubs; platform-wide supplier administration remains restricted to KlubAmp’s authorised personnel.

For a new club’s order, the initial authorised portal suppliers also include Render for the application and SQLite data on a persistent disk in Frankfurt; Supabase for account authentication and mandatory MFA in Frankfurt; Microsoft 365 for encrypted off-site administration backups (current OneDrive storage Denmark, committed geography EU/EFTA) and ordinary service correspondence; and Brevo for verification, recovery and onboarding emails. They receive only the information needed for those functions. The operative contracting entity and further processors are those in the relevant provider agreement and maintained supplier schedule. These hosting choices do not promise exclusively European processing by all suppliers or support teams. Existing supplier DPAs and lawful onward-transfer safeguards apply. No WhatsApp conversations or media are imported into the portal backup merely by club migration.

Stripe securely handles subscriptions and payment credentials. Its account, payment and legal-compliance processing has the controller/processor roles specified in its agreement. KlubAmp stores necessary customer/subscription/invoice references and tax evidence, not full payment credentials. Cloudflare continues to host the website and enquiry data; it is not the portal database. Billing, account security and statutory records handled by KlubAmp as controller remain distinguished from club-controlled content.

Portal processing, encrypted backups, relevant access controls and manual erasure are covered by the Privacy Policy. Restricted portal backup archives rotate over approximately eight weeks; restored data must have current revocations and deletion instructions reapplied before use. Original WhatsApp/media supplier retention is unchanged. Routine audit retention cannot override the DPA’s shorter offboarding instructions for ordinary club data.

For new customers these suppliers and instructions are part of the initial order. For an existing customer already bound by a DPA, its notice, objection and location-change provisions remain intact, including the existing 30-day prior-notice procedure where applicable. This schedule does not retrospectively deem that notice to have been sent or create authority to change existing club arrangements.

The original DPA C.4.11 requires disconnection within seven days of notice and normally coach/club configuration deletion within the same period. A billing-only instruction not to renew does not itself require immediate offboarding: the customer expressly requests continued service until the confirmed end date. At that end date, KlubAmp records and confirms the separate offboarding notice under the customer's scheduled instruction. An actual offboarding, earlier termination, restriction or deletion notice received before then is acted on under the DPA from receipt; its deadline is not postponed or restarted by the billing end date. If an instruction is unclear, KlubAmp promptly seeks clarification without treating that as permission to delay an applicable deadline. Any short written export/configuration extension must satisfy C.4.11 and never extend its disconnection deadline or suspend automatic message/media retention.

Before new-club operational provisioning, the authorised Club Administrator electronically signs in the existing MFA-protected club-registration step, using an initially unticked affirmative acknowledgement. The order records their name, account/email, authority to act for the identified club, club address, UTC signature time and the exact DPA, Terms and section 11 schedule versions and fingerprints. Payment is authorised separately before Stripe Checkout; later subscription acceptance does not postpone the original agreement's effective date.

Subject to the proprietor's express approval of this standing execution method, KlubAmp countersigns the same electronic order as the club signs, before operational provisioning. The record identifies Edward James de Renzy-Martin as KlubAmp's proprietor, his authorisation reference/date, the explicit countersignature statement and UTC countersignature time. Both parties adopt the attached unchanged KlubAmp DPA v1.7 dated 19 October 2026 as binding through this electronic order, despite the source heading "proposed update" and blank signature fields. The completed order supplies the parties, signatures and effective date for Clause 14.1; it does not backdate or rewrite the original. This is an ordinary electronic signature process, not a qualified-signature or qualified-timestamp service.

The customer can download and retain the completed agreement from the existing subscription record: a readable execution record identifying both signatures, the acceptance data, the exact Terms including this schedule, the Privacy Policy and the unchanged original DPA. The signed acceptance record and its exact document versions are archived independently of changeable billing settings and linked to the audit trail by a content fingerprint. The portal cannot edit or overwrite an accepted record; a correction requires a new record with the original retained. Both parties retain access through KlubAmp’s existing controlled records and the customer download. Existing encrypted backups protect those records. The customer should retain the downloaded copy; if portal access ends, an authorised club representative can request it from admin@klubamp.com subject to lawful retention. These new-order arrangements do not replace any existing pilot's executed DPA or retrospectively satisfy its notice/objection requirements.