### Who is responsible

KlubAmp, proprietor Edward James de Renzy-Martin, CVR 33005679, Skovkrogen 15, 2920 Charlottenlund, Denmark, admin@klubamp.com, is controller for enquiries, customer/account administration, billing, security, support and legal records. The club is normally controller for its coaches and submitted club content; KlubAmp acts as processor for that content under the existing DPA. Existing website enquiry and club-photo guidance continues alongside these additions.

### Information, purposes and legal bases

We process administrator identity/contact information, authorised club memberships, club details, branding, business/VAT evidence, subscription/invoice references, selected social accounts/Pages, coach names and WhatsApp numbers, JOIN/STOP/opt-in records, submitted content, prompts, drafts and necessary operational/security records. One administrator account may have several explicitly authorised club memberships. Coaches do not have portal accounts. Stripe receives payment credentials directly; we do not store full card numbers/security codes.

We use necessary information to enter and perform club agreements, meet accounting/tax obligations, secure the service and handle support. Where the contracting customer is a club rather than the individual, legitimate interests support necessary staff/volunteer account administration, balanced against their rights. Content processing follows the club's documented instructions and lawful basis. Service-message opt-in is separate from marketing consent. We do not add coaches or administrators to a marketing list as a condition of using the service.

### Website enquiries and visit counts

Website enquiries collect your name, club, email, country and optional message so we can respond. They are held in the existing restricted Cloudflare database. Ordinary identifiable enquiry records are reviewed and deleted or minimised after 180 days unless needed for an active customer relationship or documented legal purpose. Do not put sensitive member information or photographs in an enquiry.

The website records aggregate page-view counts by day, page, referring hostname and device type. This feature saves no cookies, visitor IDs, IP addresses or full referrer URLs and respects Do Not Track and Global Privacy Control. It is separate from security logs needed to operate the service.

### Service providers and international processing

We use Cloudflare for the existing website and enquiry database, Render for portal hosting, Supabase for identity/MFA, Microsoft365 for normal business mail and encrypted backups, Brevo for transactional email, Stripe for billing/tax/payment services, Make for workflow execution, UploadPost for social connections/submission, Twilio/WhatsApp(Meta) for messaging, and OpenAI/Cloudinary for the existing AI/media workflow. Social networks process content and authorisations under their own terms. A provider may also act as an independent controller for its payment, compliance or account purposes.

The portal and authentication are configured in Frankfurt; current Microsoft OneDrive storage geography is Denmark with an EU/EFTA commitment. These choices do not promise exclusively EU processing by every provider or its support/subprocessors. Applicable DPAs and transfer safeguards, such as adequacy decisions or standard contractual clauses where appropriate, apply. Current supplier details and safeguards are available from admin@klubamp.com. The existing portal privacy supplier table is the maintained disclosure schedule; Cloudinary uses the United States primary-storage arrangement described in the existing DPA C.5; that agreement records the applicable support, CDN and transfer arrangements.

Brevo receives the necessary recipient and signup, recovery or onboarding message, including short-lived verification links. Message previews are not retained in its transactional logs; delivery metadata is configured for one month, with anonymous engagement statistics where enabled. These service emails do not use a duplicate marketing-contact system. Microsoft365 continues to handle incoming and ordinary business email.

### Retention, security and your rights

We retain operational records while needed for the service. Ordinary club personal data is returned or deleted from active systems within 30 days following termination, subject to lawful exceptions. Identifiable operational and audit records are generally retained for 180 days and then erased or minimised through our documented manual review. Shorter DPA offboarding periods still apply to ordinary club content, coach details and club configuration; a general audit period does not authorise retaining those data after their required deletion. The same request process is available from the start of the service; deletion is not deferred until an automated system is built. Danish bookkeeping records and the necessary invoice/tax-treatment evidence are normally retained for five years after the end of the relevant financial year, with longer retention only where another applicable duty or documented legal hold requires it. Rejected applications do not justify indefinite evidence retention; the review-and-delete interval is 180 days unless needed for an active dispute or another documented legal basis. Encrypted backups rotate over approximately eight weeks. Removed off-site backup files can remain in provider recovery/recycle windows. Backups and unavoidable supplier residual copies remain restricted, are not used for ordinary service processing and expire under the applicable provider schedule. Twilio’s configured seven-day message-access period can be followed by up to 30 days of supplier-side message/media residual retention (approximately 37 days from creation). We do not promise that every supplier backup is physically erased within the active-system 30-day period. Any longer legally required retention is limited to the applicable purpose. A restoration must reapply current revocations and deletion instructions before service resumes.

Portal access requires MFA, server-side membership checks and secure sessions. WhatsApp identity confirmation is a separate boundary; portal MFA does not authenticate a coach's WhatsApp message. We use encrypted backups, restricted provider credentials and audit logging. No security measure is an absolute guarantee.

For eligibility we use club/billing data, VAT validation results and limited publicly available website evidence. Processing supports steps requested before entering a contract, contractual administration, fraud prevention and legal tax-record obligations, as applicable. A Club Admin can ask for review/correction of an eligibility hold at admin@klubamp.com. No third-party tax-verification supplier or document-upload requirement is added.

Contact admin@klubamp.com to request access, correction, erasure, restriction, objection or portability where applicable, or to ask about an international transfer. Where we process club-controlled content, contact your club first; we will assist the club with its responsibilities. You may complain to [Datatilsynet](https://www.datatilsynet.dk/english) or another competent supervisory authority. AI-assisted drafting does not make a solely automated decision about an individual's legal or similarly significant rights; human publication approval remains required.