Data Processing Agreement

This agreement is between the Club (see clause 1) and Freeboard LTD, which runs Training Den. It sets out how we handle the personal data the Club keeps in Training Den, as UK data protection law requires (Article 28 of the UK GDPR). The Club decides what data it keeps and why. We use that data only to run Training Den for the Club.

1. The parties

The Club is the club set up in Training Den for which this agreement is accepted under clause 2. It may be a swimming club, or a coach working on their own. The Club is identified by its name as recorded in Training Den, and also by its legal name and postal address if those have been recorded. The Club's data protection contact is the one recorded for it, if any; otherwise the person who accepted this agreement for the Club while they remain one of its administrators; otherwise the Club's administrators. An administrator can record the Club's legal name, postal address and data protection contact in Club settings. The Club is the controller of the Club Data.

Training Den ("we", "us") is Freeboard LTD, a company registered in Scotland (company number SC897840). Our registered office is 8 Duntreath Place, Edinburgh EH16 4ZA. We are registered with the Information Commission (the ICO), registration reference ZC262248. Our contact for this agreement is admin@trainingden.app. We are the processor of the Club Data.

2. How this agreement is made

2.1 The person who creates the Club in Training Den accepts this agreement by ticking the box when they create it. An administrator of the Club can also accept it later: while the Club has not accepted the current version, its administrators are asked to accept it when they next open the Club in Training Den, and they can also accept it in Club settings. By accepting, they confirm that they may accept it for the Club: for themselves, if they coach on their own, or for the organisation they set the Club up for. This electronic acceptance takes the place of a signature.

2.2 When they accept, we record the version of this agreement, the date and time, who accepted it (their account and the email address they signed in with), and the Club's name. The record also includes the Club's legal name, postal address and data protection contact, where those have been recorded, and when they were recorded. That record is the evidence of this agreement. The Club's administrators can see it in Club settings.

2.3 This agreement takes effect at the date and time recorded under 2.2 (the "Effective Date"). It also covers any Club Data we processed for the Club before the Effective Date.

2.4 If the Club's details change, an administrator can accept again with the new details. The latest record applies.

2.5 This is version 2026-10-11. If we change this agreement, we will publish a new version with a new version identifier and ask the Club's administrators to accept it. Until the Club accepts a new version, the version it last accepted continues to apply, and we keep every version a club has accepted published with this agreement.

3. What this agreement covers

3.1 "Club Data" means the personal data that the Club, its staff, its swimmers and their families put into Training Den for the Club, and that we process on the Club's behalf. Schedule 1 describes it: what we do with it, whose data it is, what kinds of data, and how long it is kept.

3.2 We are a controller in our own right, not the Club's processor, for: sign-in and account data, including the emails we send about accounts; complaints and support requests about Training Den itself; billing and payments for coach subscriptions; referrals; and running, supporting and administering the platform across clubs and keeping it secure. Our privacy notice covers that data. This agreement does not.

3.3 Words such as "personal data", "processing", "controller", "processor", "personal data breach" and "special category data" mean what they mean in the UK GDPR. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time, including by the Data (Use and Access) Act 2025.

4. The Club's responsibilities

4.1 The Club decides what Club Data to put into Training Den, and why. It is responsible for having a lawful basis for that, and for telling its members and families how their data is used.

4.2 If the Club records illness or injury as a reason for absence, that is health data, which is special category data. Before it can, the Club must record in Club settings how it meets Article 9 of the UK GDPR. There are two choices:

• explicit consent, which most clubs should use: a parent or guardian confirms their consent each time illness or injury is recorded, and Training Den stores that confirmation with the notice; or
• a condition in Schedule 1 to the Data Protection Act 2018 that the Club identifies and documents itself. A club should choose this only after taking advice, and must then also keep an appropriate policy document.

Until the Club records its choice, Training Den does not let anyone record illness or injury as a reason. Which choice fits the Club is the Club's decision. We cannot make it for the Club.

4.3 The Club decides who gets a login. We recommend that swimmers under 13 use Training Den through a parent's or guardian's account rather than their own.

4.4 The Club's instructions to us must comply with Data Protection Law. The Club keeps its administrators' details in Training Den up to date, so that notices under this agreement reach it.

5. How we process Club Data

5.1 Only on the Club's instructions. We process Club Data only on the Club's documented instructions, including about transfers outside the UK, unless the law requires us to do otherwise. If it does, we will tell the Club before we process the data, unless the law forbids that. The Club's instructions are this agreement, the settings the Club chooses in Training Den, and any other instructions it gives us in writing. We will tell the Club straight away if we think an instruction breaks Data Protection Law.

5.2 No other use. We do not use Club Data for our own purposes, except for the limited platform administration in clause 3.2. For example, our staff screens show each club's staff list and how the club uses Training Den, so that we can support and bill the service; for that use we are a controller in our own right. We do not sell Club Data, use it for advertising, combine it with another club's data, or use it to train AI models.

5.3 AI features. When a coach uses an AI feature, some Club Data is sent to an AI provider listed as a sub-processor (clause 6). Before typed text is sent, we replace the names of the Club's swimmers and coaches with labels, and put the names back in the reply. This does not cover voice audio or photos, which the provider receives as recorded, or the names of squads. On the session page, the AI can also read a line while a coach is writing it, with its heading and the few lines around it, or a round's count line with its heading and up to twenty of that round's lines, without the coach asking each time; the same replacement applies, except that a swimmer or coach added to the Club, or renamed, in the last minute may not yet be replaced. Distances, totals and other figures are always worked out by our own code, never by the AI. Sessions and dashboards the AI drafts are not saved until a coach has checked them. Conversations with the coach assistant are saved, with real names, for the period set out in Schedule 1. A Club administrator can limit what the coach assistant may look up with the Assistant privacy setting. New clubs start on the strict setting.

5.4 Confidentiality. Everyone we allow to process Club Data is bound by a duty of confidentiality and has only the access their work needs.

5.5 Security. We take the technical and organisational measures that Article 32 of the UK GDPR requires. Schedule 2 describes them, including what is not yet in place.

6. Sub-processors

6.1 The Club gives us general authorisation to use other companies (sub-processors) to process Club Data. The current list, with what each one does and where it processes data, is published in our privacy notice.

6.2 Before a new sub-processor starts processing Club Data, we will update the published list and email each of the Club's administrators at least 30 days before it starts. The email says who the sub-processor is, what it will do and where it will process the data. The same applies if we replace a sub-processor. We keep a record of each notice we send.

6.3 The Club may object to a new sub-processor on reasonable data protection grounds by emailing admin@trainingden.app within those 30 days. We will discuss the objection with the Club in good faith. If we cannot resolve it and still go ahead, the Club may end this agreement by deleting the Club in Training Den, without any charge.

6.4 Each sub-processor is bound by a written contract that gives Club Data the same protection as this agreement does. For the sub-processors we use today (Supabase, Vercel, Resend, OpenAI and Anthropic), that contract is the provider's standard data processing agreement, which forms part of its terms of service. We will have such a contract in place before a new sub-processor processes Club Data. We remain responsible to the Club for how each sub-processor meets its obligations.

7. Helping the Club with people's rights

7.1 People have rights over their personal data: to see it, correct it, have it deleted, restrict or object to its use, and take a copy. The Club answers requests about Club Data. We help, as far as the nature of the processing allows, with the tools in 7.2 and in the ways set out below.

7.2 These tools are in Training Den:

• A Club administrator can download the Club's records as a ZIP file of spreadsheet (CSV) and data (JSON) files.
• A Club administrator can download the data Training Den holds about one swimmer, to help answer a request from that swimmer or their family.
• Anyone with a Training Den login can download the data held about them from their account ("download my data").
• A Club administrator can correct swimmer records, and can erase one swimmer's record. The erasure screen explains what it removes and what it does not, such as text written about a whole session, and AI conversation history, which is deleted after the period set out in Schedule 1.
• Anyone with a login can delete their own account.

7.3 If we receive a request about Club Data directly, we pass it to the Club without undue delay. We do not answer it ourselves unless the Club asks us to.

7.4 If the Club needs Club Data that the tools in 7.2 do not provide, we will provide it on request, quickly enough for the Club to meet its deadlines under Data Protection Law.

7.5 Training Den provides an online complaints form and a place in Club settings to acknowledge complaints and record the response. The Club remains responsible for handling complaints about how it uses Club Data, including acknowledging each one within 30 days and replying without undue delay. These tools help the Club do that. They do not do it for the Club.

8. Security incidents and impact assessments

8.1 We will tell the Club without undue delay, and in any event within 24 hours, after we become aware of a personal data breach affecting Club Data. We will email the Club's administrators and its data protection contact. We will give the Club the information it needs to decide whether to report the breach to the ICO and whether to tell the people affected, as far as we have it at the time, and send the rest as we learn it. We will take reasonable steps to contain the breach and limit its effects.

8.2 We will help the Club with any data protection impact assessment, and any consultation with the ICO, that concerns our processing. On request we will give the Club our own impact assessment of Training Den, which the Club can adapt for its own.

9. Transfers outside the UK

9.1 We will transfer Club Data outside the UK, or let a sub-processor do so, only where the transfer meets the UK GDPR's rules for international transfers. That means the destination is covered by UK regulations (for example, a US company certified under the UK Extension to the EU–US Data Privacy Framework), or appropriate safeguards are in place (such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses) and the protection is not materially lower than in the UK.

9.2 The published sub-processor list (clause 6.1) says which sub-processors process data outside the UK. We keep a written assessment of each such transfer, and will give it to the Club on request.

10. How long this agreement lasts, and what happens at the end

10.1 This agreement lasts while we process Club Data for the Club. It ends when the Club is deleted in Training Den, or when the Club's use of Training Den otherwise ends.

10.2 The Club can download its data at any time (clause 7.2). Deleting the Club in Training Den deletes the Club Data from our live database straight away, apart from the records in 10.5.

10.3 If this agreement ends another way, then within 30 days of the end we will, as the Club chooses, either return the Club Data to the Club (in the format of the download in clause 7.2, or another format we agree) and then delete it, or just delete it. If the Club has not told us its choice within those 30 days, we will delete it.

10.4 We keep Club Data after that only where the law requires us to, or as clause 10.5 says. If so, we will tell the Club what we keep and why, and this agreement continues to protect it. Deleted data can remain in our database host's backups until those backups expire. We do not restore it from backups except to recover the service.

10.5 When the Club is deleted, we keep two records. We keep them as a controller in our own right, not as the Club's processor, because we have a legitimate interest in being able to show how complaints were handled and that this agreement existed, and in defending legal claims:

• records of data protection complaints about the Club, and how each was handled. A complaint that was answered is deleted three years after the answer. A complaint that was never answered is deleted three years after the Club was deleted.
• the record of the Club's acceptance of this agreement (clause 2.2), deleted six years after the Club was deleted.

11. Information and audits

11.1 On reasonable request, we will give the Club all the information it needs to show that we meet this agreement and Article 28 of the UK GDPR. This includes our record of processing, our impact assessment, our breach procedure, our sub-processor list and our transfer assessments.

11.2 We will allow for and contribute to audits, including inspections, by the Club or by an auditor the Club appoints who is bound by a duty of confidentiality. The Club will give us at least 30 days' written notice of an audit, and no more than one audit in any 12 months, unless there has been a personal data breach affecting Club Data or a regulator requires it.

12. Liability

12.1 Nothing in this agreement limits or excludes liability that cannot be limited or excluded by law, the right of anyone whose personal data is Club Data to compensation under Article 82 of the UK GDPR, or a party's responsibility for any fine a regulator imposes on it.

12.2 Subject to 12.1, each party's total liability to the other, under this agreement and the club agreement in our terms of use together, is limited to the greater of £100 and the fees the Club paid us for Training Den in the 12 months before the claim. That is one limit, shared with section 6 of our terms of use, not a second one.

12.3 Neither party is liable to the other for indirect or consequential loss.

13. Notices

13.1 Notices to us go by email to admin@trainingden.app, or by post to our registered office (clause 1).

13.2 Notices to the Club go by email to the Club's data protection contact and its administrators as recorded in Training Den. If a postal address for the Club has been recorded, notices can also go by post to the address last recorded under clause 2.

14. Law and courts

This agreement, and any dispute about it, is governed by the law of Scotland. The Scottish courts can hear any dispute about it, but this does not stop a claim being brought in another court that has jurisdiction.

15. General

15.1 If this agreement conflicts with our terms of use, or with anything else agreed between the Club and us about Club Data, this agreement wins.

15.2 If any part of this agreement is found to be invalid, the rest of it still applies.

Schedule 1: Details of the processing

Subject matter. Hosting and running Training Den for the Club: planning swim, land and other training, recording attendance, absences and results, and the other features of Training Den.

Duration. The life of this agreement, and afterwards only as clause 10 allows.

What we do with Club Data (nature and purposes):

• store and show swimmer, parent, guardian and coach records for the Club;
• plan swim, land and general activity sessions (such as running or cycling), including drafting sessions with AI from what a coach types, says or photographs (clause 5.3);
• let the Club's coaches comment on sessions and ask each other for changes, and edit a saved session together, each seeing who else has it open;
• record attendance, and notice of absence given in advance by swimmers or families, including illness and injury (clause 4.2);
• record what swimmers or their families report about sessions: done or skipped, effort from 1 to 10, time spent, and notes;
• record changes to sets for individual swimmers, competition results, and swimmers' season goals (target times with an optional note);
• tell a coach by email when another coach asks for a change to a session they wrote: who asked, the session's date and squads, how many change requests on it are open, and a link to it (never the session's title or what was asked);
• work out training-load and attendance flags for coaches, by fixed rules rather than AI. The Club can switch these off, or leave one swimmer out;
• answer coaches' questions through the coach assistant, which can look up the Club's data;
• turn a coach's speech into text, without keeping a word-for-word transcript of the call;
• build coaches' dashboards and analyses from the Club's data;
• handle data protection complaints about the Club, including sending emails about them;
• provide the downloads, corrections, erasure and deletion in clauses 7 and 10;
• keep a log of who changed what, measure AI use against limits, and keep Training Den working and secure.

Whose data (categories of data subjects):

• swimmers, most of them children under 18;
• parents and guardians;
• coaches, club administrators and other club staff;
• people who complain about how the Club uses personal data.

What data (types of personal data):

• Swimmers: first and last name and, optionally, date of birth; squads; attendance; notice of absence (a reason and an optional note); what they or their family report about sessions (done or skipped, effort, minutes, notes); changes to sets; competition results; season goals; training-load and attendance flags; and an email address if they have their own login.
• Parents and guardians: name and email address if they have a login, and which swimmer they are linked to.
• Coaches and staff: name, email address and role; the session plans, notes and comments they write (a coach's session notes, and comments that are not requests for a change, are private to them unless they share them); when they open a saved session to edit its text, their edits as they type them and which part of the page they are on; their conversations with Training Den's AI features, such as the coach assistant, kept with real names for the period below; and any voice transcripts kept under the Club's earlier setting, until they are deleted (below).
• People who complain: name, email address, what they wrote, and how the complaint was handled.
• Everyone who signs in: a log of the changes they make, and counts of AI use (not what was said).

Special category data. Illness and injury as reasons for absence are health data (clause 4.2). Notes written by swimmers, families or coaches, and the text of complaints, may also contain health or other sensitive details, although Training Den does not ask for them. Training Den does not ask for swimmers' addresses, photographs, medical records or emergency contacts.

How long it is kept. For as long as the Club uses Training Den, unless the Club deletes it sooner, except that:

• a notice of absence (the whole notice, with its reason and note) is deleted 365 days after the date of the session it is for, or after the notice was given if the session has no date;
• a conversation with an AI feature, such as the coach assistant, is deleted 365 days after it was last used or updated;
• the working copy of a saved session open for editing is normally cleared when a coach saves the session and leaves the page; otherwise it is deleted by a nightly job once nobody has written to it for 14 days;
• voice transcripts (word-for-word records of a voice call) are not kept.

The two 365-day periods apply from 14 days after the Club first accepts this version, or any earlier version dated 4 October 2026 or later, to data already in Training Den as well as new data. Until then, any period the Club set in Club settings applies, and a new club starts with notice of absence kept for 365 days. After that, a shorter period the Club set in Club settings for notice of absence or conversations still applies. A period the Club set in Club settings for coaches' session notes always applies; without one, they are kept with their session. Voice transcripts kept under the Club's earlier setting are deleted at the latest when the period the Club set for them ends.

Schedule 2: Security measures

• Where data is kept. Club Data is stored by Supabase in London, and our website and our API, which handles most requests, run on Vercel in London. While a coach has a saved session open for editing, the browsers of the coaches on it learn that it has changed, and who else has it open, through Supabase's Realtime service, which runs on servers in several countries. Those messages hold account and page identifiers, never the session's words; to check that a coach may join, Realtime also receives their sign-in token, which carries their email address and the name they signed up with (clause 9).
• In transit. Every connection to Training Den uses HTTPS.
• Who can see what. Every request is checked, so a person sees only the clubs they belong to, and only what their role allows. Where the app reads data straight from the database, the database itself keeps each club's data separate. Only the Club's staff can join a session page's live updates. A coach's session notes are private to them by default.
• Passwords. Sign-in is handled by Supabase. We never see or store passwords.
• Our own accounts. Training Den's staff screens, which can see across clubs, open only after multi-factor sign-in.
• AI. Names are replaced with labels before typed text reaches an AI provider (clause 5.3), and the app refuses to send the text at all if it cannot load the names to replace.
• Keeping only what is needed. A swimmer's record holds their name and, optionally, their date of birth.
• Records and limits. A log of who changed what, request logs that do not contain what people wrote, and limits on how often AI features can be used.

Limits the Club should know about. We will update this list if either changes.

• Backups. Our database plan does not include point-in-time recovery, and we have not tested restoring from a backup, so we cannot promise how quickly lost data could be restored, or exactly how long our database host keeps backups. The Club can download its data at any time (clause 7.2).
• One database connection. Our API reaches the database through one service connection, so on that path club separation is enforced by our own code rather than by the database as well.

This agreement is between the Club (see clause 1) and Freeboard LTD, which runs Training Den. It sets out how we handle the personal data the Club keeps in Training Den, as UK data protection law requires (Article 28 of the UK GDPR). The Club decides what data it keeps and why. We use that data only to run Training Den for the Club.

1. The parties

The Club is the club set up in Training Den for which this agreement is accepted under clause 2. It may be a swimming club, or a coach working on their own. The Club is identified by its name as recorded in Training Den, and also by its legal name and postal address if those have been recorded. The Club's data protection contact is the one recorded for it, if any; otherwise the person who accepted this agreement for the Club while they remain one of its administrators; otherwise the Club's administrators. An administrator can record the Club's legal name, postal address and data protection contact in Club settings. The Club is the controller of the Club Data.

Training Den ("we", "us") is Freeboard LTD, a company registered in Scotland (company number SC897840). Our registered office is 8 Duntreath Place, Edinburgh EH16 4ZA. We are registered with the Information Commission (the ICO), registration reference ZC262248. Our contact for this agreement is admin@trainingden.app. We are the processor of the Club Data.

2. How this agreement is made

2.1 The person who creates the Club in Training Den accepts this agreement by ticking the box when they create it. An administrator of the Club can also accept it later: while the Club has not accepted the current version, its administrators are asked to accept it when they next open the Club in Training Den, and they can also accept it in Club settings. By accepting, they confirm that they may accept it for the Club: for themselves, if they coach on their own, or for the organisation they set the Club up for. This electronic acceptance takes the place of a signature.

2.2 When they accept, we record the version of this agreement, the date and time, who accepted it (their account and the email address they signed in with), and the Club's name. The record also includes the Club's legal name, postal address and data protection contact, where those have been recorded, and when they were recorded. That record is the evidence of this agreement. The Club's administrators can see it in Club settings.

2.3 This agreement takes effect at the date and time recorded under 2.2 (the "Effective Date"). It also covers any Club Data we processed for the Club before the Effective Date.

2.4 If the Club's details change, an administrator can accept again with the new details. The latest record applies.

2.5 This is version 2026-10-10. If we change this agreement, we will publish a new version with a new version identifier and ask the Club's administrators to accept it. Until the Club accepts a new version, the version it last accepted continues to apply, and we keep every version a club has accepted published with this agreement.

3. What this agreement covers

3.1 "Club Data" means the personal data that the Club, its staff, its swimmers and their families put into Training Den for the Club, and that we process on the Club's behalf. Schedule 1 describes it: what we do with it, whose data it is, what kinds of data, and how long it is kept.

3.2 We are a controller in our own right, not the Club's processor, for: sign-in and account data, including the emails we send about accounts; complaints and support requests about Training Den itself; billing and payments for coach subscriptions; referrals; and running, supporting and administering the platform across clubs and keeping it secure. Our privacy notice covers that data. This agreement does not.

3.3 Words such as "personal data", "processing", "controller", "processor", "personal data breach" and "special category data" mean what they mean in the UK GDPR. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time, including by the Data (Use and Access) Act 2025.

4. The Club's responsibilities

4.1 The Club decides what Club Data to put into Training Den, and why. It is responsible for having a lawful basis for that, and for telling its members and families how their data is used.

4.2 If the Club records illness or injury as a reason for absence, that is health data, which is special category data. Before it can, the Club must record in Club settings how it meets Article 9 of the UK GDPR. There are two choices:

• explicit consent, which most clubs should use: a parent or guardian confirms their consent each time illness or injury is recorded, and Training Den stores that confirmation with the notice; or
• a condition in Schedule 1 to the Data Protection Act 2018 that the Club identifies and documents itself. A club should choose this only after taking advice, and must then also keep an appropriate policy document.

Until the Club records its choice, Training Den does not let anyone record illness or injury as a reason. Which choice fits the Club is the Club's decision. We cannot make it for the Club.

4.3 The Club decides who gets a login. We recommend that swimmers under 13 use Training Den through a parent's or guardian's account rather than their own.

4.4 The Club's instructions to us must comply with Data Protection Law. The Club keeps its administrators' details in Training Den up to date, so that notices under this agreement reach it.

5. How we process Club Data

5.1 Only on the Club's instructions. We process Club Data only on the Club's documented instructions, including about transfers outside the UK, unless the law requires us to do otherwise. If it does, we will tell the Club before we process the data, unless the law forbids that. The Club's instructions are this agreement, the settings the Club chooses in Training Den, and any other instructions it gives us in writing. We will tell the Club straight away if we think an instruction breaks Data Protection Law.

5.2 No other use. We do not use Club Data for our own purposes, except for the limited platform administration in clause 3.2. For example, our staff screens show each club's staff list and how the club uses Training Den, so that we can support and bill the service; for that use we are a controller in our own right. We do not sell Club Data, use it for advertising, combine it with another club's data, or use it to train AI models.

5.3 AI features. When a coach uses an AI feature, some Club Data is sent to an AI provider listed as a sub-processor (clause 6). Before typed text is sent, we replace the names of the Club's swimmers and coaches with labels, and put the names back in the reply. This does not cover voice audio or photos, which the provider receives as recorded, or the names of squads. On the session page, the AI can also read a line while a coach is writing it, with its heading and the few lines above it, without the coach asking each time; the same replacement applies, except that a swimmer or coach added to the Club, or renamed, in the last minute may not yet be replaced. Distances, totals and other figures are always worked out by our own code, never by the AI. Sessions and dashboards the AI drafts are not saved until a coach has checked them. Conversations with the coach assistant are saved, with real names, for the period set out in Schedule 1. A Club administrator can limit what the coach assistant may look up with the Assistant privacy setting. New clubs start on the strict setting.

5.4 Confidentiality. Everyone we allow to process Club Data is bound by a duty of confidentiality and has only the access their work needs.

5.5 Security. We take the technical and organisational measures that Article 32 of the UK GDPR requires. Schedule 2 describes them, including what is not yet in place.

6. Sub-processors

6.1 The Club gives us general authorisation to use other companies (sub-processors) to process Club Data. The current list, with what each one does and where it processes data, is published in our privacy notice.

6.2 Before a new sub-processor starts processing Club Data, we will update the published list and email each of the Club's administrators at least 30 days before it starts. The email says who the sub-processor is, what it will do and where it will process the data. The same applies if we replace a sub-processor. We keep a record of each notice we send.

6.3 The Club may object to a new sub-processor on reasonable data protection grounds by emailing admin@trainingden.app within those 30 days. We will discuss the objection with the Club in good faith. If we cannot resolve it and still go ahead, the Club may end this agreement by deleting the Club in Training Den, without any charge.

6.4 Each sub-processor is bound by a written contract that gives Club Data the same protection as this agreement does. For the sub-processors we use today (Supabase, Vercel, Resend, OpenAI and Anthropic), that contract is the provider's standard data processing agreement, which forms part of its terms of service. We will have such a contract in place before a new sub-processor processes Club Data. We remain responsible to the Club for how each sub-processor meets its obligations.

7. Helping the Club with people's rights

7.1 People have rights over their personal data: to see it, correct it, have it deleted, restrict or object to its use, and take a copy. The Club answers requests about Club Data. We help, as far as the nature of the processing allows, with the tools in 7.2 and in the ways set out below.

7.2 These tools are in Training Den:

• A Club administrator can download the Club's records as a ZIP file of spreadsheet (CSV) and data (JSON) files.
• A Club administrator can download the data Training Den holds about one swimmer, to help answer a request from that swimmer or their family.
• Anyone with a Training Den login can download the data held about them from their account ("download my data").
• A Club administrator can correct swimmer records, and can erase one swimmer's record. The erasure screen explains what it removes and what it does not, such as text written about a whole session, and AI conversation history, which is deleted after the period set out in Schedule 1.
• Anyone with a login can delete their own account.

7.3 If we receive a request about Club Data directly, we pass it to the Club without undue delay. We do not answer it ourselves unless the Club asks us to.

7.4 If the Club needs Club Data that the tools in 7.2 do not provide, we will provide it on request, quickly enough for the Club to meet its deadlines under Data Protection Law.

7.5 Training Den provides an online complaints form and a place in Club settings to acknowledge complaints and record the response. The Club remains responsible for handling complaints about how it uses Club Data, including acknowledging each one within 30 days and replying without undue delay. These tools help the Club do that. They do not do it for the Club.

8. Security incidents and impact assessments

8.1 We will tell the Club without undue delay, and in any event within 24 hours, after we become aware of a personal data breach affecting Club Data. We will email the Club's administrators and its data protection contact. We will give the Club the information it needs to decide whether to report the breach to the ICO and whether to tell the people affected, as far as we have it at the time, and send the rest as we learn it. We will take reasonable steps to contain the breach and limit its effects.

8.2 We will help the Club with any data protection impact assessment, and any consultation with the ICO, that concerns our processing. On request we will give the Club our own impact assessment of Training Den, which the Club can adapt for its own.

9. Transfers outside the UK

9.1 We will transfer Club Data outside the UK, or let a sub-processor do so, only where the transfer meets the UK GDPR's rules for international transfers. That means the destination is covered by UK regulations (for example, a US company certified under the UK Extension to the EU–US Data Privacy Framework), or appropriate safeguards are in place (such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses) and the protection is not materially lower than in the UK.

9.2 The published sub-processor list (clause 6.1) says which sub-processors process data outside the UK. We keep a written assessment of each such transfer, and will give it to the Club on request.

10. How long this agreement lasts, and what happens at the end

10.1 This agreement lasts while we process Club Data for the Club. It ends when the Club is deleted in Training Den, or when the Club's use of Training Den otherwise ends.

10.2 The Club can download its data at any time (clause 7.2). Deleting the Club in Training Den deletes the Club Data from our live database straight away, apart from the records in 10.5.

10.3 If this agreement ends another way, then within 30 days of the end we will, as the Club chooses, either return the Club Data to the Club (in the format of the download in clause 7.2, or another format we agree) and then delete it, or just delete it. If the Club has not told us its choice within those 30 days, we will delete it.

10.4 We keep Club Data after that only where the law requires us to, or as clause 10.5 says. If so, we will tell the Club what we keep and why, and this agreement continues to protect it. Deleted data can remain in our database host's backups until those backups expire. We do not restore it from backups except to recover the service.

10.5 When the Club is deleted, we keep two records. We keep them as a controller in our own right, not as the Club's processor, because we have a legitimate interest in being able to show how complaints were handled and that this agreement existed, and in defending legal claims:

• records of data protection complaints about the Club, and how each was handled. A complaint that was answered is deleted three years after the answer. A complaint that was never answered is deleted three years after the Club was deleted.
• the record of the Club's acceptance of this agreement (clause 2.2), deleted six years after the Club was deleted.

11. Information and audits

11.1 On reasonable request, we will give the Club all the information it needs to show that we meet this agreement and Article 28 of the UK GDPR. This includes our record of processing, our impact assessment, our breach procedure, our sub-processor list and our transfer assessments.

11.2 We will allow for and contribute to audits, including inspections, by the Club or by an auditor the Club appoints who is bound by a duty of confidentiality. The Club will give us at least 30 days' written notice of an audit, and no more than one audit in any 12 months, unless there has been a personal data breach affecting Club Data or a regulator requires it.

12. Liability

12.1 Nothing in this agreement limits or excludes liability that cannot be limited or excluded by law, the right of anyone whose personal data is Club Data to compensation under Article 82 of the UK GDPR, or a party's responsibility for any fine a regulator imposes on it.

12.2 Subject to 12.1, each party's total liability to the other, under this agreement and the club agreement in our terms of use together, is limited to the greater of £100 and the fees the Club paid us for Training Den in the 12 months before the claim. That is one limit, shared with section 6 of our terms of use, not a second one.

12.3 Neither party is liable to the other for indirect or consequential loss.

13. Notices

13.1 Notices to us go by email to admin@trainingden.app, or by post to our registered office (clause 1).

13.2 Notices to the Club go by email to the Club's data protection contact and its administrators as recorded in Training Den. If a postal address for the Club has been recorded, notices can also go by post to the address last recorded under clause 2.

14. Law and courts

This agreement, and any dispute about it, is governed by the law of Scotland. The Scottish courts can hear any dispute about it, but this does not stop a claim being brought in another court that has jurisdiction.

15. General

15.1 If this agreement conflicts with our terms of use, or with anything else agreed between the Club and us about Club Data, this agreement wins.

15.2 If any part of this agreement is found to be invalid, the rest of it still applies.

Schedule 1: Details of the processing

Subject matter. Hosting and running Training Den for the Club: planning swim, land and other training, recording attendance, absences and results, and the other features of Training Den.

Duration. The life of this agreement, and afterwards only as clause 10 allows.

What we do with Club Data (nature and purposes):

• store and show swimmer, parent, guardian and coach records for the Club;
• plan swim, land and general activity sessions (such as running or cycling), including drafting sessions with AI from what a coach types, says or photographs (clause 5.3);
• let the Club's coaches comment on sessions and ask each other for changes, and edit a saved session together, each seeing who else has it open;
• record attendance, and notice of absence given in advance by swimmers or families, including illness and injury (clause 4.2);
• record what swimmers or their families report about sessions: done or skipped, effort from 1 to 10, time spent, and notes;
• record changes to sets for individual swimmers, competition results, and swimmers' season goals (target times with an optional note);
• tell a coach by email when another coach asks for a change to a session they wrote: who asked, the session's date and squads, how many change requests on it are open, and a link to it (never the session's title or what was asked);
• work out training-load and attendance flags for coaches, by fixed rules rather than AI. The Club can switch these off, or leave one swimmer out;
• answer coaches' questions through the coach assistant, which can look up the Club's data;
• turn a coach's speech into text, without keeping a word-for-word transcript of the call;
• build coaches' dashboards and analyses from the Club's data;
• handle data protection complaints about the Club, including sending emails about them;
• provide the downloads, corrections, erasure and deletion in clauses 7 and 10;
• keep a log of who changed what, measure AI use against limits, and keep Training Den working and secure.

Whose data (categories of data subjects):

• swimmers, most of them children under 18;
• parents and guardians;
• coaches, club administrators and other club staff;
• people who complain about how the Club uses personal data.

What data (types of personal data):

• Swimmers: first and last name and, optionally, date of birth; squads; attendance; notice of absence (a reason and an optional note); what they or their family report about sessions (done or skipped, effort, minutes, notes); changes to sets; competition results; season goals; training-load and attendance flags; and an email address if they have their own login.
• Parents and guardians: name and email address if they have a login, and which swimmer they are linked to.
• Coaches and staff: name, email address and role; the session plans, notes and comments they write (a coach's session notes, and comments that are not requests for a change, are private to them unless they share them); when they open a saved session to edit its text, their edits as they type them and which part of the page they are on; their conversations with Training Den's AI features, such as the coach assistant, kept with real names for the period below; and any voice transcripts kept under the Club's earlier setting, until they are deleted (below).
• People who complain: name, email address, what they wrote, and how the complaint was handled.
• Everyone who signs in: a log of the changes they make, and counts of AI use (not what was said).

Special category data. Illness and injury as reasons for absence are health data (clause 4.2). Notes written by swimmers, families or coaches, and the text of complaints, may also contain health or other sensitive details, although Training Den does not ask for them. Training Den does not ask for swimmers' addresses, photographs, medical records or emergency contacts.

How long it is kept. For as long as the Club uses Training Den, unless the Club deletes it sooner, except that:

• a notice of absence (the whole notice, with its reason and note) is deleted 365 days after the date of the session it is for, or after the notice was given if the session has no date;
• a conversation with an AI feature, such as the coach assistant, is deleted 365 days after it was last used or updated;
• the working copy of a saved session open for editing is normally cleared when a coach saves the session and leaves the page; otherwise it is deleted by a nightly job once nobody has written to it for 14 days;
• voice transcripts (word-for-word records of a voice call) are not kept.

The two 365-day periods apply from 14 days after the Club first accepts this version, or any earlier version dated 4 October 2026 or later, to data already in Training Den as well as new data. Until then, any period the Club set in Club settings applies, and a new club starts with notice of absence kept for 365 days. After that, a shorter period the Club set in Club settings for notice of absence or conversations still applies. A period the Club set in Club settings for coaches' session notes always applies; without one, they are kept with their session. Voice transcripts kept under the Club's earlier setting are deleted at the latest when the period the Club set for them ends.

Schedule 2: Security measures

• Where data is kept. Club Data is stored by Supabase in London, and our website and our API, which handles most requests, run on Vercel in London. While a coach has a saved session open for editing, the browsers of the coaches on it learn that it has changed, and who else has it open, through Supabase's Realtime service, which runs on servers in several countries. Those messages hold account and page identifiers, never the session's words; to check that a coach may join, Realtime also receives their sign-in token, which carries their email address and the name they signed up with (clause 9).
• In transit. Every connection to Training Den uses HTTPS.
• Who can see what. Every request is checked, so a person sees only the clubs they belong to, and only what their role allows. Where the app reads data straight from the database, the database itself keeps each club's data separate. Only the Club's staff can join a session page's live updates. A coach's session notes are private to them by default.
• Passwords. Sign-in is handled by Supabase. We never see or store passwords.
• Our own accounts. Training Den's staff screens, which can see across clubs, open only after multi-factor sign-in.
• AI. Names are replaced with labels before typed text reaches an AI provider (clause 5.3), and the app refuses to send the text at all if it cannot load the names to replace.
• Keeping only what is needed. A swimmer's record holds their name and, optionally, their date of birth.
• Records and limits. A log of who changed what, request logs that do not contain what people wrote, and limits on how often AI features can be used.

Limits the Club should know about. We will update this list if either changes.

• Backups. Our database plan does not include point-in-time recovery, and we have not tested restoring from a backup, so we cannot promise how quickly lost data could be restored, or exactly how long our database host keeps backups. The Club can download its data at any time (clause 7.2).
• One database connection. Our API reaches the database through one service connection, so on that path club separation is enforced by our own code rather than by the database as well.

This agreement is between the Club (see clause 1) and Freeboard LTD, which runs Training Den. It sets out how we handle the personal data the Club keeps in Training Den, as UK data protection law requires (Article 28 of the UK GDPR). The Club decides what data it keeps and why. We use that data only to run Training Den for the Club.

1. The parties

The Club is the club set up in Training Den for which this agreement is accepted under clause 2. It may be a swimming club, or a coach working on their own. The Club is identified by its name as recorded in Training Den, and also by its legal name and postal address if those have been recorded. The Club's data protection contact is the one recorded for it, if any; otherwise the person who accepted this agreement for the Club while they remain one of its administrators; otherwise the Club's administrators. An administrator can record the Club's legal name, postal address and data protection contact in Club settings. The Club is the controller of the Club Data.

Training Den ("we", "us") is Freeboard LTD, a company registered in Scotland (company number SC897840). Our registered office is 8 Duntreath Place, Edinburgh EH16 4ZA. We are registered with the Information Commission (the ICO), registration reference ZC262248. Our contact for this agreement is admin@trainingden.app. We are the processor of the Club Data.

2. How this agreement is made

2.1 The person who creates the Club in Training Den accepts this agreement by ticking the box when they create it. An administrator of the Club can also accept it later: while the Club has not accepted the current version, its administrators are asked to accept it when they next open the Club in Training Den, and they can also accept it in Club settings. By accepting, they confirm that they may accept it for the Club: for themselves, if they coach on their own, or for the organisation they set the Club up for. This electronic acceptance takes the place of a signature.

2.2 When they accept, we record the version of this agreement, the date and time, who accepted it (their account and the email address they signed in with), and the Club's name. The record also includes the Club's legal name, postal address and data protection contact, where those have been recorded, and when they were recorded. That record is the evidence of this agreement. The Club's administrators can see it in Club settings.

2.3 This agreement takes effect at the date and time recorded under 2.2 (the "Effective Date"). It also covers any Club Data we processed for the Club before the Effective Date.

2.4 If the Club's details change, an administrator can accept again with the new details. The latest record applies.

2.5 This is version 2026-10-04. If we change this agreement, we will publish a new version with a new version identifier and ask the Club's administrators to accept it. Until the Club accepts a new version, the version it last accepted continues to apply, and we keep every version a club has accepted published with this agreement.

3. What this agreement covers

3.1 "Club Data" means the personal data that the Club, its staff, its swimmers and their families put into Training Den for the Club, and that we process on the Club's behalf. Schedule 1 describes it: what we do with it, whose data it is, what kinds of data, and how long it is kept.

3.2 We are a controller in our own right, not the Club's processor, for: sign-in and account data, including the emails we send about accounts; complaints and support requests about Training Den itself; billing and payments for coach subscriptions; referrals; and running, supporting and administering the platform across clubs and keeping it secure. Our privacy notice covers that data. This agreement does not.

3.3 Words such as "personal data", "processing", "controller", "processor", "personal data breach" and "special category data" mean what they mean in the UK GDPR. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time, including by the Data (Use and Access) Act 2025.

4. The Club's responsibilities

4.1 The Club decides what Club Data to put into Training Den, and why. It is responsible for having a lawful basis for that, and for telling its members and families how their data is used.

4.2 If the Club records illness or injury as a reason for absence, that is health data, which is special category data. Before it can, the Club must record in Club settings how it meets Article 9 of the UK GDPR. There are two choices:

• explicit consent, which most clubs should use: a parent or guardian confirms their consent each time illness or injury is recorded, and Training Den stores that confirmation with the notice; or
• a condition in Schedule 1 to the Data Protection Act 2018 that the Club identifies and documents itself. A club should choose this only after taking advice, and must then also keep an appropriate policy document.

Until the Club records its choice, Training Den does not let anyone record illness or injury as a reason. Which choice fits the Club is the Club's decision. We cannot make it for the Club.

4.3 The Club decides who gets a login. We recommend that swimmers under 13 use Training Den through a parent's or guardian's account rather than their own.

4.4 The Club's instructions to us must comply with Data Protection Law. The Club keeps its administrators' details in Training Den up to date, so that notices under this agreement reach it.

5. How we process Club Data

5.1 Only on the Club's instructions. We process Club Data only on the Club's documented instructions, including about transfers outside the UK, unless the law requires us to do otherwise. If it does, we will tell the Club before we process the data, unless the law forbids that. The Club's instructions are this agreement, the settings the Club chooses in Training Den, and any other instructions it gives us in writing. We will tell the Club straight away if we think an instruction breaks Data Protection Law.

5.2 No other use. We do not use Club Data for our own purposes, except for the limited platform administration in clause 3.2. For example, our staff screens show each club's staff list and how the club uses Training Den, so that we can support and bill the service; for that use we are a controller in our own right. We do not sell Club Data, use it for advertising, combine it with another club's data, or use it to train AI models.

5.3 AI features. When a coach uses an AI feature, some Club Data is sent to an AI provider listed as a sub-processor (clause 6). Before typed text is sent, we replace the names of the Club's swimmers and coaches with labels, and put the names back in the reply. This does not cover voice audio or photos, which the provider receives as recorded, or the names of squads. Distances, totals and other figures are always worked out by our own code, never by the AI. Sessions and dashboards the AI drafts are not saved until a coach has checked them. Conversations with the coach assistant are saved, with real names, for the period set out in Schedule 1. A Club administrator can limit what the coach assistant may look up with the Assistant privacy setting. New clubs start on the strict setting.

5.4 Confidentiality. Everyone we allow to process Club Data is bound by a duty of confidentiality and has only the access their work needs.

5.5 Security. We take the technical and organisational measures that Article 32 of the UK GDPR requires. Schedule 2 describes them, including what is not yet in place.

6. Sub-processors

6.1 The Club gives us general authorisation to use other companies (sub-processors) to process Club Data. The current list, with what each one does and where it processes data, is published in our privacy notice.

6.2 Before a new sub-processor starts processing Club Data, we will update the published list and email each of the Club's administrators at least 30 days before it starts. The email says who the sub-processor is, what it will do and where it will process the data. The same applies if we replace a sub-processor. We keep a record of each notice we send.

6.3 The Club may object to a new sub-processor on reasonable data protection grounds by emailing admin@trainingden.app within those 30 days. We will discuss the objection with the Club in good faith. If we cannot resolve it and still go ahead, the Club may end this agreement by deleting the Club in Training Den, without any charge.

6.4 Each sub-processor is bound by a written contract that gives Club Data the same protection as this agreement does. For the sub-processors we use today (Supabase, Vercel, Resend, OpenAI and Anthropic), that contract is the provider's standard data processing agreement, which forms part of its terms of service. We will have such a contract in place before a new sub-processor processes Club Data. We remain responsible to the Club for how each sub-processor meets its obligations.

7. Helping the Club with people's rights

7.1 People have rights over their personal data: to see it, correct it, have it deleted, restrict or object to its use, and take a copy. The Club answers requests about Club Data. We help, as far as the nature of the processing allows, with the tools in 7.2 and in the ways set out below.

7.2 These tools are in Training Den:

• A Club administrator can download the Club's records as a ZIP file of spreadsheet (CSV) and data (JSON) files.
• A Club administrator can download the data Training Den holds about one swimmer, to help answer a request from that swimmer or their family.
• Anyone with a Training Den login can download the data held about them from their account ("download my data").
• A Club administrator can correct swimmer records, and can erase one swimmer's record. The erasure screen explains what it removes and what it does not, such as text written about a whole session, and AI conversation history, which is deleted after the period set out in Schedule 1.
• Anyone with a login can delete their own account.

7.3 If we receive a request about Club Data directly, we pass it to the Club without undue delay. We do not answer it ourselves unless the Club asks us to.

7.4 If the Club needs Club Data that the tools in 7.2 do not provide, we will provide it on request, quickly enough for the Club to meet its deadlines under Data Protection Law.

7.5 Training Den provides an online complaints form and a place in Club settings to acknowledge complaints and record the response. The Club remains responsible for handling complaints about how it uses Club Data, including acknowledging each one within 30 days and replying without undue delay. These tools help the Club do that. They do not do it for the Club.

8. Security incidents and impact assessments

8.1 We will tell the Club without undue delay, and in any event within 24 hours, after we become aware of a personal data breach affecting Club Data. We will email the Club's administrators and its data protection contact. We will give the Club the information it needs to decide whether to report the breach to the ICO and whether to tell the people affected, as far as we have it at the time, and send the rest as we learn it. We will take reasonable steps to contain the breach and limit its effects.

8.2 We will help the Club with any data protection impact assessment, and any consultation with the ICO, that concerns our processing. On request we will give the Club our own impact assessment of Training Den, which the Club can adapt for its own.

9. Transfers outside the UK

9.1 We will transfer Club Data outside the UK, or let a sub-processor do so, only where the transfer meets the UK GDPR's rules for international transfers. That means the destination is covered by UK regulations (for example, a US company certified under the UK Extension to the EU–US Data Privacy Framework), or appropriate safeguards are in place (such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses) and the protection is not materially lower than in the UK.

9.2 The published sub-processor list (clause 6.1) says which sub-processors process data outside the UK. We keep a written assessment of each such transfer, and will give it to the Club on request.

10. How long this agreement lasts, and what happens at the end

10.1 This agreement lasts while we process Club Data for the Club. It ends when the Club is deleted in Training Den, or when the Club's use of Training Den otherwise ends.

10.2 The Club can download its data at any time (clause 7.2). Deleting the Club in Training Den deletes the Club Data from our live database straight away, apart from the records in 10.5.

10.3 If this agreement ends another way, then within 30 days of the end we will, as the Club chooses, either return the Club Data to the Club (in the format of the download in clause 7.2, or another format we agree) and then delete it, or just delete it. If the Club has not told us its choice within those 30 days, we will delete it.

10.4 We keep Club Data after that only where the law requires us to, or as clause 10.5 says. If so, we will tell the Club what we keep and why, and this agreement continues to protect it. Deleted data can remain in our database host's backups until those backups expire. We do not restore it from backups except to recover the service.

10.5 When the Club is deleted, we keep two records. We keep them as a controller in our own right, not as the Club's processor, because we have a legitimate interest in being able to show how complaints were handled and that this agreement existed, and in defending legal claims:

• records of data protection complaints about the Club, and how each was handled. A complaint that was answered is deleted three years after the answer. A complaint that was never answered is deleted three years after the Club was deleted.
• the record of the Club's acceptance of this agreement (clause 2.2), deleted six years after the Club was deleted.

11. Information and audits

11.1 On reasonable request, we will give the Club all the information it needs to show that we meet this agreement and Article 28 of the UK GDPR. This includes our record of processing, our impact assessment, our breach procedure, our sub-processor list and our transfer assessments.

11.2 We will allow for and contribute to audits, including inspections, by the Club or by an auditor the Club appoints who is bound by a duty of confidentiality. The Club will give us at least 30 days' written notice of an audit, and no more than one audit in any 12 months, unless there has been a personal data breach affecting Club Data or a regulator requires it.

12. Liability

12.1 Nothing in this agreement limits or excludes liability that cannot be limited or excluded by law, the right of anyone whose personal data is Club Data to compensation under Article 82 of the UK GDPR, or a party's responsibility for any fine a regulator imposes on it.

12.2 Subject to 12.1, each party's total liability to the other, under this agreement and the club agreement in our terms of use together, is limited to the greater of £100 and the fees the Club paid us for Training Den in the 12 months before the claim. That is one limit, shared with section 6 of our terms of use, not a second one.

12.3 Neither party is liable to the other for indirect or consequential loss.

13. Notices

13.1 Notices to us go by email to admin@trainingden.app, or by post to our registered office (clause 1).

13.2 Notices to the Club go by email to the Club's data protection contact and its administrators as recorded in Training Den. If a postal address for the Club has been recorded, notices can also go by post to the address last recorded under clause 2.

14. Law and courts

This agreement, and any dispute about it, is governed by the law of Scotland. The Scottish courts can hear any dispute about it, but this does not stop a claim being brought in another court that has jurisdiction.

15. General

15.1 If this agreement conflicts with our terms of use, or with anything else agreed between the Club and us about Club Data, this agreement wins.

15.2 If any part of this agreement is found to be invalid, the rest of it still applies.

Schedule 1: Details of the processing

Subject matter. Hosting and running Training Den for the Club: planning swim, land and other training, recording attendance, absences and results, and the other features of Training Den.

Duration. The life of this agreement, and afterwards only as clause 10 allows.

What we do with Club Data (nature and purposes):

• store and show swimmer, parent, guardian and coach records for the Club;
• plan swim, land and general activity sessions (such as running or cycling), including drafting sessions with AI from what a coach types, says or photographs (clause 5.3);
• record attendance, and notice of absence given in advance by swimmers or families, including illness and injury (clause 4.2);
• record what swimmers or their families report about sessions: done or skipped, effort from 1 to 10, time spent, and notes;
• record changes to sets for individual swimmers, competition results, and swimmers' season goals (target times with an optional note);
• work out training-load and attendance flags for coaches, by fixed rules rather than AI. The Club can switch these off, or leave one swimmer out;
• answer coaches' questions through the coach assistant, which can look up the Club's data;
• turn a coach's speech into text, without keeping a word-for-word transcript of the call;
• build coaches' dashboards and analyses from the Club's data;
• handle data protection complaints about the Club, including sending emails about them;
• provide the downloads, corrections, erasure and deletion in clauses 7 and 10;
• keep a log of who changed what, measure AI use against limits, and keep Training Den working and secure.

Whose data (categories of data subjects):

• swimmers, most of them children under 18;
• parents and guardians;
• coaches, club administrators and other club staff;
• people who complain about how the Club uses personal data.

What data (types of personal data):

• Swimmers: first and last name and, optionally, date of birth; squads; attendance; notice of absence (a reason and an optional note); what they or their family report about sessions (done or skipped, effort, minutes, notes); changes to sets; competition results; season goals; training-load and attendance flags; and an email address if they have their own login.
• Parents and guardians: name and email address if they have a login, and which swimmer they are linked to.
• Coaches and staff: name, email address and role; the session plans and notes they write (a coach's session notes are private to them unless they share them); their conversations with Training Den's AI features, such as the coach assistant, kept with real names for the period below; and any voice transcripts kept under the Club's earlier setting, until they are deleted (below).
• People who complain: name, email address, what they wrote, and how the complaint was handled.
• Everyone who signs in: a log of the changes they make, and counts of AI use (not what was said).

Special category data. Illness and injury as reasons for absence are health data (clause 4.2). Notes written by swimmers, families or coaches, and the text of complaints, may also contain health or other sensitive details, although Training Den does not ask for them. Training Den does not ask for swimmers' addresses, photographs, medical records or emergency contacts.

How long it is kept. For as long as the Club uses Training Den, unless the Club deletes it sooner, except that:

• a notice of absence (the whole notice, with its reason and note) is deleted 365 days after the date of the session it is for, or after the notice was given if the session has no date;
• a conversation with an AI feature, such as the coach assistant, is deleted 365 days after it was last used or updated;
• voice transcripts (word-for-word records of a voice call) are not kept.

The two 365-day periods apply from 14 days after the Club first accepts this version, or any earlier version dated 4 October 2026 or later, to data already in Training Den as well as new data. Until then, any period the Club set in Club settings applies, and a new club starts with notice of absence kept for 365 days. After that, a shorter period the Club set in Club settings for notice of absence or conversations still applies. A period the Club set in Club settings for coaches' session notes always applies; without one, they are kept with their session. Voice transcripts kept under the Club's earlier setting are deleted at the latest when the period the Club set for them ends.

Schedule 2: Security measures

• Where data is kept. Club Data is stored by Supabase in London, and our website and our API, which handles most requests, run on Vercel in London.
• In transit. Every connection to Training Den uses HTTPS.
• Who can see what. Every request is checked, so a person sees only the clubs they belong to, and only what their role allows. Where the app reads data straight from the database, the database itself keeps each club's data separate. A coach's session notes are private to them by default.
• Passwords. Sign-in is handled by Supabase. We never see or store passwords.
• Our own accounts. Training Den's staff screens, which can see across clubs, open only after multi-factor sign-in.
• AI. Names are replaced with labels before typed text reaches an AI provider (clause 5.3), and the app refuses to send the text at all if it cannot load the names to replace.
• Keeping only what is needed. A swimmer's record holds their name and, optionally, their date of birth.
• Records and limits. A log of who changed what, request logs that do not contain what people wrote, and limits on how often AI features can be used.

Limits the Club should know about. We will update this list if either changes.

• Backups. Our database plan does not include point-in-time recovery, and we have not tested restoring from a backup, so we cannot promise how quickly lost data could be restored, or exactly how long our database host keeps backups. The Club can download its data at any time (clause 7.2).
• One database connection. Our API reaches the database through one service connection, so on that path club separation is enforced by our own code rather than by the database as well.

This agreement is between the Club (see clause 1) and Freeboard LTD, which runs Training Den. It sets out how we handle the personal data the Club keeps in Training Den, as UK data protection law requires (Article 28 of the UK GDPR). The Club decides what data it keeps and why. We use that data only to run Training Den for the Club.

1. The parties

The Club is the club set up in Training Den for which this agreement is accepted under clause 2. It may be a swimming club, or a coach working on their own. The Club is identified by its name as recorded in Training Den, and also by its legal name and postal address if those have been recorded. The Club's data protection contact is the one recorded for it, if any; otherwise the person who accepted this agreement for the Club while they remain one of its administrators; otherwise the Club's administrators. An administrator can record the Club's legal name, postal address and data protection contact in Club settings. The Club is the controller of the Club Data.

Training Den ("we", "us") is Freeboard LTD, a company registered in Scotland (company number SC897840). Our registered office is 8 Duntreath Place, Edinburgh EH16 4ZA. We are registered with the Information Commission (the ICO), registration reference ZC262248. Our contact for this agreement is admin@trainingden.app. We are the processor of the Club Data.

2. How this agreement is made

2.1 The person who creates the Club in Training Den accepts this agreement by ticking the box when they create it. An administrator of the Club can also accept it later in Club settings. By accepting, they confirm that they may accept it for the Club: for themselves, if they coach on their own, or for the organisation they set the Club up for. This electronic acceptance takes the place of a signature.

2.2 When they accept, we record the version of this agreement, the date and time, who accepted it (their account and the email address they signed in with), and the Club's name. The record also includes the Club's legal name, postal address and data protection contact, where those have been recorded, and when they were recorded. That record is the evidence of this agreement. The Club's administrators can see it in Club settings.

2.3 This agreement takes effect at the date and time recorded under 2.2 (the "Effective Date"). It also covers any Club Data we processed for the Club before the Effective Date.

2.4 If the Club's details change, an administrator can accept again with the new details. The latest record applies.

2.5 This is version 2026-10-03. If we change this agreement, we will publish a new version with a new version identifier and ask the Club's administrators to accept it. Until the Club accepts a new version, the version it last accepted continues to apply, and we keep every version a club has accepted published with this agreement.

3. What this agreement covers

3.1 "Club Data" means the personal data that the Club, its staff, its swimmers and their families put into Training Den for the Club, and that we process on the Club's behalf. Schedule 1 describes it: what we do with it, whose data it is, what kinds of data, and how long it is kept.

3.2 We are a controller in our own right, not the Club's processor, for: sign-in and account data, including the emails we send about accounts; complaints and support requests about Training Den itself; billing and payments for coach subscriptions; referrals; and running, supporting and administering the platform across clubs and keeping it secure. Our privacy notice covers that data. This agreement does not.

3.3 Words such as "personal data", "processing", "controller", "processor", "personal data breach" and "special category data" mean what they mean in the UK GDPR. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time, including by the Data (Use and Access) Act 2025.

4. The Club's responsibilities

4.1 The Club decides what Club Data to put into Training Den, and why. It is responsible for having a lawful basis for that, and for telling its members and families how their data is used.

4.2 If the Club records illness or injury as a reason for absence, that is health data, which is special category data. Before it can, the Club must record in Club settings how it meets Article 9 of the UK GDPR. There are two choices:

• explicit consent, which most clubs should use: a parent or guardian confirms their consent each time illness or injury is recorded, and Training Den stores that confirmation with the notice; or
• a condition in Schedule 1 to the Data Protection Act 2018 that the Club identifies and documents itself. A club should choose this only after taking advice, and must then also keep an appropriate policy document.

Until the Club records its choice, Training Den does not let anyone record illness or injury as a reason. Which choice fits the Club is the Club's decision. We cannot make it for the Club.

4.3 The Club decides who gets a login. We recommend that swimmers under 13 use Training Den through a parent's or guardian's account rather than their own.

4.4 The Club's instructions to us must comply with Data Protection Law. The Club keeps its administrators' details in Training Den up to date, so that notices under this agreement reach it.

5. How we process Club Data

5.1 Only on the Club's instructions. We process Club Data only on the Club's documented instructions, including about transfers outside the UK, unless the law requires us to do otherwise. If it does, we will tell the Club before we process the data, unless the law forbids that. The Club's instructions are this agreement, the settings the Club chooses in Training Den, and any other instructions it gives us in writing. We will tell the Club straight away if we think an instruction breaks Data Protection Law.

5.2 No other use. We do not use Club Data for our own purposes, except for the limited platform administration in clause 3.2. For example, our staff screens show each club's staff list and how the club uses Training Den, so that we can support and bill the service; for that use we are a controller in our own right. We do not sell Club Data, use it for advertising, combine it with another club's data, or use it to train AI models.

5.3 AI features. When a coach uses an AI feature, some Club Data is sent to an AI provider listed as a sub-processor (clause 6). Before typed text is sent, we replace the names of the Club's swimmers and coaches with labels, and put the names back in the reply. This does not cover voice audio or photos, which the provider receives as recorded, or the names of squads. Distances, totals and other figures are always worked out by our own code, never by the AI. Sessions and dashboards the AI drafts are not saved until a coach has checked them. Conversations with the coach assistant are saved, with real names, for as long as the Club's settings allow (Schedule 1). A Club administrator can limit what the coach assistant may look up with the Assistant privacy setting. New clubs start on the strict setting.

5.4 Confidentiality. Everyone we allow to process Club Data is bound by a duty of confidentiality and has only the access their work needs.

5.5 Security. We take the technical and organisational measures that Article 32 of the UK GDPR requires. Schedule 2 describes them, including what is not yet in place.

6. Sub-processors

6.1 The Club gives us general authorisation to use other companies (sub-processors) to process Club Data. The current list, with what each one does and where it processes data, is published in our privacy notice.

6.2 Before a new sub-processor starts processing Club Data, we will update the published list and email each of the Club's administrators at least 30 days before it starts. The email says who the sub-processor is, what it will do and where it will process the data. The same applies if we replace a sub-processor. We keep a record of each notice we send.

6.3 The Club may object to a new sub-processor on reasonable data protection grounds by emailing admin@trainingden.app within those 30 days. We will discuss the objection with the Club in good faith. If we cannot resolve it and still go ahead, the Club may end this agreement by deleting the Club in Training Den, without any charge.

6.4 Each sub-processor is bound by a written contract that gives Club Data the same protection as this agreement does. For the sub-processors we use today (Supabase, Vercel, Resend, OpenAI and Anthropic), that contract is the provider's standard data processing agreement, which forms part of its terms of service. We will have such a contract in place before a new sub-processor processes Club Data. We remain responsible to the Club for how each sub-processor meets its obligations.

7. Helping the Club with people's rights

7.1 People have rights over their personal data: to see it, correct it, have it deleted, restrict or object to its use, and take a copy. The Club answers requests about Club Data. We help, as far as the nature of the processing allows, with the tools in 7.2 and in the ways set out below.

7.2 These tools are in Training Den:

• A Club administrator can download the Club's records as a ZIP file of spreadsheet (CSV) and data (JSON) files.
• A Club administrator can download the data Training Den holds about one swimmer, to help answer a request from that swimmer or their family.
• Anyone with a Training Den login can download the data held about them from their account ("download my data").
• A Club administrator can correct swimmer records, and can erase one swimmer's record. The erasure screen explains what it removes and what it does not, such as text written about a whole session, and AI conversation history, which the Club's retention settings control.
• Anyone with a login can delete their own account.

7.3 If we receive a request about Club Data directly, we pass it to the Club without undue delay. We do not answer it ourselves unless the Club asks us to.

7.4 If the Club needs Club Data that the tools in 7.2 do not provide, we will provide it on request, quickly enough for the Club to meet its deadlines under Data Protection Law.

7.5 Training Den provides an online complaints form and a place in Club settings to acknowledge complaints and record the response. The Club remains responsible for handling complaints about how it uses Club Data, including acknowledging each one within 30 days and replying without undue delay. These tools help the Club do that. They do not do it for the Club.

8. Security incidents and impact assessments

8.1 We will tell the Club without undue delay, and in any event within 24 hours, after we become aware of a personal data breach affecting Club Data. We will email the Club's administrators and its data protection contact. We will give the Club the information it needs to decide whether to report the breach to the ICO and whether to tell the people affected, as far as we have it at the time, and send the rest as we learn it. We will take reasonable steps to contain the breach and limit its effects.

8.2 We will help the Club with any data protection impact assessment, and any consultation with the ICO, that concerns our processing. On request we will give the Club our own impact assessment of Training Den, which the Club can adapt for its own.

9. Transfers outside the UK

9.1 We will transfer Club Data outside the UK, or let a sub-processor do so, only where the transfer meets the UK GDPR's rules for international transfers. That means the destination is covered by UK regulations (for example, a US company certified under the UK Extension to the EU–US Data Privacy Framework), or appropriate safeguards are in place (such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses) and the protection is not materially lower than in the UK.

9.2 The published sub-processor list (clause 6.1) says which sub-processors process data outside the UK. We keep a written assessment of each such transfer, and will give it to the Club on request.

10. How long this agreement lasts, and what happens at the end

10.1 This agreement lasts while we process Club Data for the Club. It ends when the Club is deleted in Training Den, or when the Club's use of Training Den otherwise ends.

10.2 The Club can download its data at any time (clause 7.2). Deleting the Club in Training Den deletes the Club Data from our live database straight away, apart from the records in 10.5.

10.3 If this agreement ends another way, then within 30 days of the end we will, as the Club chooses, either return the Club Data to the Club (in the format of the download in clause 7.2, or another format we agree) and then delete it, or just delete it. If the Club has not told us its choice within those 30 days, we will delete it.

10.4 We keep Club Data after that only where the law requires us to, or as clause 10.5 says. If so, we will tell the Club what we keep and why, and this agreement continues to protect it. Deleted data can remain in our database host's backups until those backups expire. We do not restore it from backups except to recover the service.

10.5 When the Club is deleted, we keep two records. We keep them as a controller in our own right, not as the Club's processor, because we have a legitimate interest in being able to show how complaints were handled and that this agreement existed, and in defending legal claims:

• records of data protection complaints about the Club, and how each was handled. A complaint that was answered is deleted three years after the answer. A complaint that was never answered is deleted three years after the Club was deleted.
• the record of the Club's acceptance of this agreement (clause 2.2), deleted six years after the Club was deleted.

11. Information and audits

11.1 On reasonable request, we will give the Club all the information it needs to show that we meet this agreement and Article 28 of the UK GDPR. This includes our record of processing, our impact assessment, our breach procedure, our sub-processor list and our transfer assessments.

11.2 We will allow for and contribute to audits, including inspections, by the Club or by an auditor the Club appoints who is bound by a duty of confidentiality. The Club will give us at least 30 days' written notice of an audit, and no more than one audit in any 12 months, unless there has been a personal data breach affecting Club Data or a regulator requires it.

12. Liability

12.1 Nothing in this agreement limits or excludes liability that cannot be limited or excluded by law, the right of anyone whose personal data is Club Data to compensation under Article 82 of the UK GDPR, or a party's responsibility for any fine a regulator imposes on it.

12.2 Subject to 12.1, each party's total liability to the other, under this agreement and the club agreement in our terms of use together, is limited to the greater of £100 and the fees the Club paid us for Training Den in the 12 months before the claim. That is one limit, shared with section 6 of our terms of use, not a second one.

12.3 Neither party is liable to the other for indirect or consequential loss.

13. Notices

13.1 Notices to us go by email to admin@trainingden.app, or by post to our registered office (clause 1).

13.2 Notices to the Club go by email to the Club's data protection contact and its administrators as recorded in Training Den. If a postal address for the Club has been recorded, notices can also go by post to the address last recorded under clause 2.

14. Law and courts

This agreement, and any dispute about it, is governed by the law of Scotland. The Scottish courts can hear any dispute about it, but this does not stop a claim being brought in another court that has jurisdiction.

15. General

15.1 If this agreement conflicts with our terms of use, or with anything else agreed between the Club and us about Club Data, this agreement wins.

15.2 If any part of this agreement is found to be invalid, the rest of it still applies.

Schedule 1: Details of the processing

Subject matter. Hosting and running Training Den for the Club: planning swim, land and other training, recording attendance, absences and results, and the other features of Training Den.

Duration. The life of this agreement, and afterwards only as clause 10 allows.

What we do with Club Data (nature and purposes):

• store and show swimmer, parent, guardian and coach records for the Club;
• plan swim, land and general activity sessions (such as running or cycling), including drafting sessions with AI from what a coach types, says or photographs (clause 5.3);
• record attendance, and notice of absence given in advance by swimmers or families, including illness and injury (clause 4.2);
• record what swimmers or their families report about sessions: done or skipped, effort from 1 to 10, time spent, and notes;
• record changes to sets for individual swimmers, competition results, and swimmers' season goals (target times with an optional note);
• work out training-load and attendance flags for coaches, by fixed rules rather than AI. The Club can switch these off, or leave one swimmer out;
• answer coaches' questions through the coach assistant, which can look up the Club's data;
• turn a coach's speech into text, and keep voice transcripts only if the Club switches that on, for as long as the Club sets;
• build coaches' dashboards and analyses from the Club's data;
• handle data protection complaints about the Club, including sending emails about them;
• provide the downloads, corrections, erasure and deletion in clauses 7 and 10;
• keep a log of who changed what, measure AI use against limits, and keep Training Den working and secure.

Whose data (categories of data subjects):

• swimmers, most of them children under 18;
• parents and guardians;
• coaches, club administrators and other club staff;
• people who complain about how the Club uses personal data.

What data (types of personal data):

• Swimmers: first and last name and, optionally, date of birth; squads; attendance; notice of absence (a reason and an optional note); what they or their family report about sessions (done or skipped, effort, minutes, notes); changes to sets; competition results; season goals; training-load and attendance flags; and an email address if they have their own login.
• Parents and guardians: name and email address if they have a login, and which swimmer they are linked to.
• Coaches and staff: name, email address and role; the session plans and notes they write (a coach's session notes are private to them unless they share them); their conversations with the coach assistant, kept with real names for as long as the Club's settings allow; and voice transcripts, if the Club keeps them.
• People who complain: name, email address, what they wrote, and how the complaint was handled.
• Everyone who signs in: a log of the changes they make, and counts of AI use (not what was said).

Special category data. Illness and injury as reasons for absence are health data (clause 4.2). Notes written by swimmers, families or coaches, and the text of complaints, may also contain health or other sensitive details, although Training Den does not ask for them. Training Den does not ask for swimmers' addresses, photographs, medical records or emergency contacts.

How long it is kept. For as long as the Club uses Training Den, unless the Club sets shorter periods in Club settings (for notice of absence, coaches' session notes, assistant conversations and voice transcripts) or deletes the data sooner. New clubs start with notice of absence kept for 365 days.

Schedule 2: Security measures

• Where data is kept. Club Data is stored by Supabase in London, and our website and our API, which handles most requests, run on Vercel in London.
• In transit. Every connection to Training Den uses HTTPS.
• Who can see what. Every request is checked, so a person sees only the clubs they belong to, and only what their role allows. Where the app reads data straight from the database, the database itself keeps each club's data separate. A coach's session notes are private to them by default.
• Passwords. Sign-in is handled by Supabase. We never see or store passwords.
• Our own accounts. Training Den's staff screens, which can see across clubs, open only after multi-factor sign-in.
• AI. Names are replaced with labels before typed text reaches an AI provider (clause 5.3), and the app refuses to send the text at all if it cannot load the names to replace.
• Keeping only what is needed. A swimmer's record holds their name and, optionally, their date of birth.
• Records and limits. A log of who changed what, request logs that do not contain what people wrote, and limits on how often AI features can be used.

Limits the Club should know about. We will update this list if either changes.

• Backups. Our database plan does not include point-in-time recovery, and we have not tested restoring from a backup, so we cannot promise how quickly lost data could be restored, or exactly how long our database host keeps backups. The Club can download its data at any time (clause 7.2).
• One database connection. Our API reaches the database through one service connection, so on that path club separation is enforced by our own code rather than by the database as well.

This agreement is between your swimming club and Freeboard LTD, which runs Training Den. It sets out how we handle the personal data your club keeps in Training Den, as UK data protection law requires (Article 28 of the UK GDPR). Your club decides what data it keeps and why. We use that data only to run Training Den for your club.

1. The parties

The Club is the club whose administrator accepts this agreement in Training Den. The Club's legal name, address and data protection contact are as recorded when the Club's administrator accepts this agreement in the product. The Club is the controller of the Club Data.

Training Den ("we", "us") is Freeboard LTD, a company registered in Scotland (company number SC897840). Our registered office is 8 Duntreath Place, Edinburgh EH16 4ZA. We are registered with the Information Commission (the ICO), registration reference ZC262248. Our contact for this agreement is admin@trainingden.app. We are the processor of the Club Data.

2. How this agreement is made

2.1 An administrator of the Club accepts this agreement in Training Den, either when setting up the Club or later in Club settings. By accepting, they confirm they are authorised to accept it on the Club's behalf. This electronic acceptance takes the place of a signature.

2.2 When they accept, we record the version of this agreement, the date and time, who accepted it (their account and the email address they signed in with), and the Club's legal name, address and data protection contact as they entered them. That record is the evidence of this agreement. The Club's administrators can see it in Club settings.

2.3 This agreement takes effect at the date and time recorded under 2.2 (the "Effective Date"). It also covers any Club Data we processed for the Club before the Effective Date.

2.4 If the Club's details change, an administrator can accept again with the new details. The latest record applies.

2.5 This is version 2026-10-02. If we change this agreement, we will publish a new version with a new version identifier and ask the Club's administrators to accept it. Until the Club accepts a new version, the version it last accepted continues to apply, and we keep every version a club has accepted published with this agreement.

3. What this agreement covers

3.1 "Club Data" means the personal data that the Club, its staff, its swimmers and their families put into Training Den for the Club, and that we process on the Club's behalf. Schedule 1 describes it: what we do with it, whose data it is, what kinds of data, and how long it is kept.

3.2 We are a controller in our own right, not the Club's processor, for: sign-in and account data, including the emails we send about accounts; complaints and support requests about Training Den itself; billing and payments for coach subscriptions; referrals; and running, supporting and administering the platform across clubs and keeping it secure. Our privacy notice covers that data. This agreement does not.

3.3 Words such as "personal data", "processing", "controller", "processor", "personal data breach" and "special category data" mean what they mean in the UK GDPR. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time, including by the Data (Use and Access) Act 2025.

4. The Club's responsibilities

4.1 The Club decides what Club Data to put into Training Den, and why. It is responsible for having a lawful basis for that, and for telling its members and families how their data is used.

4.2 If the Club records illness or injury as a reason for absence, that is health data, which is special category data. Before it can, the Club must record in Club settings how it meets Article 9 of the UK GDPR. There are two choices:

• explicit consent, which most clubs should use: a parent or guardian confirms their consent each time illness or injury is recorded, and Training Den stores that confirmation with the notice; or
• a condition in Schedule 1 to the Data Protection Act 2018 that the Club identifies and documents itself. A club should choose this only after taking advice, and must then also keep an appropriate policy document.

Until the Club records its choice, Training Den does not let anyone record illness or injury as a reason. Which choice fits the Club is the Club's decision. We cannot make it for the Club.

4.3 The Club decides who gets a login. We recommend that swimmers under 13 use Training Den through a parent's or guardian's account rather than their own.

4.4 The Club's instructions to us must comply with Data Protection Law. The Club keeps its administrators' details in Training Den up to date, so that notices under this agreement reach it.

5. How we process Club Data

5.1 Only on the Club's instructions. We process Club Data only on the Club's documented instructions, including about transfers outside the UK, unless the law requires us to do otherwise. If it does, we will tell the Club before we process the data, unless the law forbids that. The Club's instructions are this agreement, the settings the Club chooses in Training Den, and any other instructions it gives us in writing. We will tell the Club straight away if we think an instruction breaks Data Protection Law.

5.2 No other use. We do not use Club Data for our own purposes, except for the limited platform administration in clause 3.2. For example, our staff screens show each club's staff list and how the club uses Training Den, so that we can support and bill the service; for that use we are a controller in our own right. We do not sell Club Data, use it for advertising, combine it with another club's data, or use it to train AI models.

5.3 AI features. When a coach uses an AI feature, some Club Data is sent to an AI provider listed as a sub-processor (clause 6). Before typed text is sent, we replace the names of the Club's swimmers and coaches with labels, and put the names back in the reply. This does not cover voice audio or photos, which the provider receives as recorded, or the names of squads. Distances, totals and other figures are always worked out by our own code, never by the AI. Sessions and dashboards the AI drafts are not saved until a coach has checked them. Conversations with the coach assistant are saved, with real names, for as long as the Club's settings allow (Schedule 1). A Club administrator can limit what the coach assistant may look up with the Assistant privacy setting. New clubs start on the strict setting.

5.4 Confidentiality. Everyone we allow to process Club Data is bound by a duty of confidentiality and has only the access their work needs.

5.5 Security. We take the technical and organisational measures that Article 32 of the UK GDPR requires. Schedule 2 describes them, including what is not yet in place.

6. Sub-processors

6.1 The Club gives us general authorisation to use other companies (sub-processors) to process Club Data. The current list, with what each one does and where it processes data, is published in our privacy notice.

6.2 Before a new sub-processor starts processing Club Data, we will update the published list and email each of the Club's administrators at least 30 days before it starts. The email says who the sub-processor is, what it will do and where it will process the data. The same applies if we replace a sub-processor. We keep a record of each notice we send.

6.3 The Club may object to a new sub-processor on reasonable data protection grounds by emailing admin@trainingden.app within those 30 days. We will discuss the objection with the Club in good faith. If we cannot resolve it and still go ahead, the Club may end this agreement by deleting the Club in Training Den, without any charge.

6.4 Each sub-processor is bound by a written contract that gives Club Data the same protection as this agreement does. For the sub-processors we use today (Supabase, Vercel, Resend, OpenAI and Anthropic), that contract is the provider's standard data processing agreement, which forms part of its terms of service. We will have such a contract in place before a new sub-processor processes Club Data. We remain responsible to the Club for how each sub-processor meets its obligations.

7. Helping the Club with people's rights

7.1 People have rights over their personal data: to see it, correct it, have it deleted, restrict or object to its use, and take a copy. The Club answers requests about Club Data. We help, as far as the nature of the processing allows, with the tools in 7.2 and in the ways set out below.

7.2 These tools are in Training Den:

• A Club administrator can download the Club's records as a ZIP file of spreadsheet (CSV) and data (JSON) files.
• A Club administrator can download the data Training Den holds about one swimmer, to help answer a request from that swimmer or their family.
• Anyone with a Training Den login can download the data held about them from their account ("download my data").
• A Club administrator can correct swimmer records, and can erase one swimmer's record. The erasure screen explains what it removes and what it does not, such as text written about a whole session, and AI conversation history, which the Club's retention settings control.
• Anyone with a login can delete their own account.

7.3 If we receive a request about Club Data directly, we pass it to the Club without undue delay. We do not answer it ourselves unless the Club asks us to.

7.4 If the Club needs Club Data that the tools in 7.2 do not provide, we will provide it on request, quickly enough for the Club to meet its deadlines under Data Protection Law.

7.5 Training Den provides an online complaints form and a place in Club settings to acknowledge complaints and record the response. The Club remains responsible for handling complaints about how it uses Club Data, including acknowledging each one within 30 days and replying without undue delay. These tools help the Club do that. They do not do it for the Club.

8. Security incidents and impact assessments

8.1 We will tell the Club without undue delay, and in any event within 24 hours, after we become aware of a personal data breach affecting Club Data. We will email the Club's administrators and its data protection contact. We will give the Club the information it needs to decide whether to report the breach to the ICO and whether to tell the people affected, as far as we have it at the time, and send the rest as we learn it. We will take reasonable steps to contain the breach and limit its effects.

8.2 We will help the Club with any data protection impact assessment, and any consultation with the ICO, that concerns our processing. On request we will give the Club our own impact assessment of Training Den, which the Club can adapt for its own.

9. Transfers outside the UK

9.1 We will transfer Club Data outside the UK, or let a sub-processor do so, only where the transfer meets the UK GDPR's rules for international transfers. That means the destination is covered by UK regulations (for example, a US company certified under the UK Extension to the EU–US Data Privacy Framework), or appropriate safeguards are in place (such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses) and the protection is not materially lower than in the UK.

9.2 The published sub-processor list (clause 6.1) says which sub-processors process data outside the UK. We keep a written assessment of each such transfer, and will give it to the Club on request.

10. How long this agreement lasts, and what happens at the end

10.1 This agreement lasts while we process Club Data for the Club. It ends when the Club is deleted in Training Den, or when the Club's use of Training Den otherwise ends.

10.2 The Club can download its data at any time (clause 7.2). Deleting the Club in Training Den deletes the Club Data from our live database straight away, apart from the records in 10.5.

10.3 If this agreement ends another way, then within 30 days of the end we will, as the Club chooses, either return the Club Data to the Club (in the format of the download in clause 7.2, or another format we agree) and then delete it, or just delete it. If the Club has not told us its choice within those 30 days, we will delete it.

10.4 We keep Club Data after that only where the law requires us to, or as clause 10.5 says. If so, we will tell the Club what we keep and why, and this agreement continues to protect it. Deleted data can remain in our database host's backups until those backups expire. We do not restore it from backups except to recover the service.

10.5 When the Club is deleted, we keep two records. We keep them as a controller in our own right, not as the Club's processor, because we have a legitimate interest in being able to show how complaints were handled and that this agreement existed, and in defending legal claims:

• records of data protection complaints about the Club, and how each was handled. A complaint that was answered is deleted three years after the answer. A complaint that was never answered is deleted three years after the Club was deleted.
• the record of the Club's acceptance of this agreement (clause 2.2), deleted six years after the Club was deleted.

11. Information and audits

11.1 On reasonable request, we will give the Club all the information it needs to show that we meet this agreement and Article 28 of the UK GDPR. This includes our record of processing, our impact assessment, our breach procedure, our sub-processor list and our transfer assessments.

11.2 We will allow for and contribute to audits, including inspections, by the Club or by an auditor the Club appoints who is bound by a duty of confidentiality. The Club will give us at least 30 days' written notice of an audit, and no more than one audit in any 12 months, unless there has been a personal data breach affecting Club Data or a regulator requires it.

12. Liability

12.1 Nothing in this agreement limits or excludes liability that cannot be limited or excluded by law, the right of anyone whose personal data is Club Data to compensation under Article 82 of the UK GDPR, or a party's responsibility for any fine a regulator imposes on it.

12.2 Subject to 12.1, each party's total liability to the other, under this agreement and the club agreement in our terms of use together, is limited to the greater of £100 and the fees the Club paid us for Training Den in the 12 months before the claim. That is one limit, shared with section 6 of our terms of use, not a second one.

12.3 Neither party is liable to the other for indirect or consequential loss.

13. Notices

13.1 Notices to us go by email to admin@trainingden.app, or by post to our registered office (clause 1).

13.2 Notices to the Club go by email to the Club's data protection contact and its administrators as recorded in Training Den, or by post to the Club's address as last recorded under clause 2.

14. Law and courts

This agreement, and any dispute about it, is governed by the law of Scotland. The Scottish courts can hear any dispute about it, but this does not stop a claim being brought in another court that has jurisdiction.

15. General

15.1 If this agreement conflicts with our terms of use, or with anything else agreed between the Club and us about Club Data, this agreement wins.

15.2 If any part of this agreement is found to be invalid, the rest of it still applies.

Schedule 1: Details of the processing

Subject matter. Hosting and running Training Den for the Club: planning swim, land and other training, recording attendance, absences and results, and the other features of Training Den.

Duration. The life of this agreement, and afterwards only as clause 10 allows.

What we do with Club Data (nature and purposes):

• store and show swimmer, parent, guardian and coach records for the Club;
• plan swim, land and general activity sessions (such as running or cycling), including drafting sessions with AI from what a coach types, says or photographs (clause 5.3);
• record attendance, and notice of absence given in advance by swimmers or families, including illness and injury (clause 4.2);
• record what swimmers or their families report about sessions: done or skipped, effort from 1 to 10, time spent, and notes;
• record changes to sets for individual swimmers, competition results, and swimmers' season goals (target times with an optional note);
• work out training-load and attendance flags for coaches, by fixed rules rather than AI. The Club can switch these off, or leave one swimmer out;
• answer coaches' questions through the coach assistant, which can look up the Club's data;
• turn a coach's speech into text, and keep voice transcripts only if the Club switches that on, for as long as the Club sets;
• build coaches' dashboards and analyses from the Club's data;
• handle data protection complaints about the Club, including sending emails about them;
• provide the downloads, corrections, erasure and deletion in clauses 7 and 10;
• keep a log of who changed what, measure AI use against limits, and keep Training Den working and secure.

Whose data (categories of data subjects):

• swimmers, most of them children under 18;
• parents and guardians;
• coaches, club administrators and other club staff;
• people who complain about how the Club uses personal data.

What data (types of personal data):

• Swimmers: first and last name and, optionally, date of birth; squads; attendance; notice of absence (a reason and an optional note); what they or their family report about sessions (done or skipped, effort, minutes, notes); changes to sets; competition results; season goals; training-load and attendance flags; and an email address if they have their own login.
• Parents and guardians: name and email address if they have a login, and which swimmer they are linked to.
• Coaches and staff: name, email address and role; the session plans and notes they write (a coach's session notes are private to them unless they share them); their conversations with the coach assistant, kept with real names for as long as the Club's settings allow; and voice transcripts, if the Club keeps them.
• People who complain: name, email address, what they wrote, and how the complaint was handled.
• Everyone who signs in: a log of the changes they make, and counts of AI use (not what was said).

Special category data. Illness and injury as reasons for absence are health data (clause 4.2). Notes written by swimmers, families or coaches, and the text of complaints, may also contain health or other sensitive details, although Training Den does not ask for them. Training Den does not ask for swimmers' addresses, photographs, medical records or emergency contacts.

How long it is kept. For as long as the Club uses Training Den, unless the Club sets shorter periods in Club settings (for notice of absence, coaches' session notes, assistant conversations and voice transcripts) or deletes the data sooner. New clubs start with notice of absence kept for 365 days.

Schedule 2: Security measures

• Where data is kept. Club Data is stored by Supabase in London, and our website and our API, which handles most requests, run on Vercel in London.
• In transit. Every connection to Training Den uses HTTPS.
• Who can see what. Every request is checked, so a person sees only the clubs they belong to, and only what their role allows. Where the app reads data straight from the database, the database itself keeps each club's data separate. A coach's session notes are private to them by default.
• Passwords. Sign-in is handled by Supabase. We never see or store passwords.
• Our own accounts. Training Den's staff screens, which can see across clubs, open only after multi-factor sign-in.
• AI. Names are replaced with labels before typed text reaches an AI provider (clause 5.3), and the app refuses to send the text at all if it cannot load the names to replace.
• Keeping only what is needed. A swimmer's record holds their name and, optionally, their date of birth.
• Records and limits. A log of who changed what, request logs that do not contain what people wrote, and limits on how often AI features can be used.

Limits the Club should know about. We will update this list if either changes.

• Backups. Our database plan does not include point-in-time recovery, and we have not tested restoring from a backup, so we cannot promise how quickly lost data could be restored, or exactly how long our database host keeps backups. The Club can download its data at any time (clause 7.2).
• One database connection. Our API reaches the database through one service connection, so on that path club separation is enforced by our own code rather than by the database as well.

This agreement is between your swimming club and Freeboard LTD, which runs Training Den. It sets out how we handle the personal data your club keeps in Training Den, as UK data protection law requires (Article 28 of the UK GDPR). Your club decides what data it keeps and why. We use that data only to run Training Den for your club.

[Training Den still has to arrange a review of this agreement by a data protection practitioner or solicitor. This version was written by Training Den without that review.]

1. The parties

The Club is the club whose administrator accepts this agreement in Training Den. The Club's legal name, address and data protection contact are as recorded when the Club's administrator accepts this agreement in the product. The Club is the controller of the Club Data.

Training Den ("we", "us") is Freeboard LTD, a company registered in Scotland (company number SC897840). Our registered office is 8 Duntreath Place, Edinburgh EH16 4ZA. We are registered with the Information Commission (the ICO), registration reference ZC262248. Our contact for this agreement is admin@trainingden.app. We are the processor of the Club Data.

2. How this agreement is made

2.1 An administrator of the Club accepts this agreement in Training Den, either when setting up the Club or later in Club settings. By accepting, they confirm they are authorised to accept it on the Club's behalf. This electronic acceptance takes the place of a signature.

2.2 When they accept, we record the version of this agreement, the date and time, who accepted it (their account and the email address they signed in with), and the Club's legal name, address and data protection contact as they entered them. That record is the evidence of this agreement. The Club's administrators can see it in Club settings.

2.3 This agreement takes effect at the date and time recorded under 2.2 (the "Effective Date"). It also covers any Club Data we processed for the Club before the Effective Date.

2.4 If the Club's details change, an administrator can accept again with the new details. The latest record applies.

2.5 This is version 2026-09-30. If we change this agreement, we will publish a new version with a new version identifier and ask the Club's administrators to accept it. Until the Club accepts a new version, the version it last accepted continues to apply, and we keep every version a club has accepted published with this agreement.

3. What this agreement covers

3.1 "Club Data" means the personal data that the Club, its staff, its swimmers and their families put into Training Den for the Club, and that we process on the Club's behalf. Schedule 1 describes it: what we do with it, whose data it is, what kinds of data, and how long it is kept.

3.2 We are a controller in our own right, not the Club's processor, for: sign-in and account data, including the emails we send about accounts; complaints and support requests about Training Den itself; billing and payments for coach subscriptions; referrals; and running, supporting and administering the platform across clubs and keeping it secure. Our privacy notice covers that data. This agreement does not.

3.3 Words such as "personal data", "processing", "controller", "processor", "personal data breach" and "special category data" mean what they mean in the UK GDPR. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time, including by the Data (Use and Access) Act 2025.

4. The Club's responsibilities

4.1 The Club decides what Club Data to put into Training Den, and why. It is responsible for having a lawful basis for that, and for telling its members and families how their data is used.

4.2 If the Club records illness or injury as a reason for absence, that is health data, which is special category data. Before it can, the Club must record in Club settings how it meets Article 9 of the UK GDPR. There are two choices:

• explicit consent, which most clubs should use: a parent or guardian confirms their consent each time illness or injury is recorded, and Training Den stores that confirmation with the notice; or
• a condition in Schedule 1 to the Data Protection Act 2018 that the Club identifies and documents itself. A club should choose this only after taking advice, and must then also keep an appropriate policy document.

Until the Club records its choice, Training Den does not let anyone record illness or injury as a reason. Which choice fits the Club is the Club's decision. We cannot make it for the Club.

4.3 The Club decides who gets a login. We recommend that swimmers under 13 use Training Den through a parent's or guardian's account rather than their own.

4.4 The Club's instructions to us must comply with Data Protection Law. The Club keeps its administrators' details in Training Den up to date, so that notices under this agreement reach it.

5. How we process Club Data

5.1 Only on the Club's instructions. We process Club Data only on the Club's documented instructions, including about transfers outside the UK, unless the law requires us to do otherwise. If it does, we will tell the Club before we process the data, unless the law forbids that. The Club's instructions are this agreement, the settings the Club chooses in Training Den, and any other instructions it gives us in writing. We will tell the Club straight away if we think an instruction breaks Data Protection Law.

5.2 No other use. We do not use Club Data for our own purposes, except for the limited platform administration in clause 3.2. For example, our staff screens show each club's staff list and how the club uses Training Den, so that we can support and bill the service; for that use we are a controller in our own right. We do not sell Club Data, use it for advertising, combine it with another club's data, or use it to train AI models.

5.3 AI features. When a coach uses an AI feature, some Club Data is sent to an AI provider listed as a sub-processor (clause 6). Before typed text is sent, we replace the names of the Club's swimmers and coaches with labels, and put the names back in the reply. This does not cover voice audio or photos, which the provider receives as recorded, or the names of squads. Distances, totals and other figures are always worked out by our own code, never by the AI. Sessions and dashboards the AI drafts are not saved until a coach has checked them. Conversations with the coach assistant are saved, with real names, for as long as the Club's settings allow (Schedule 1). A Club administrator can limit what the coach assistant may look up with the Assistant privacy setting. New clubs start on the strict setting.

5.4 Confidentiality. Everyone we allow to process Club Data is bound by a duty of confidentiality and has only the access their work needs.

5.5 Security. We take the technical and organisational measures that Article 32 of the UK GDPR requires. Schedule 2 describes them, including what is not yet in place.

6. Sub-processors

6.1 The Club gives us general authorisation to use other companies (sub-processors) to process Club Data. The current list, with what each one does and where it processes data, is published in our privacy notice.

6.2 Before a new sub-processor starts processing Club Data, we will update the published list and email each of the Club's administrators at least 30 days before it starts. The email says who the sub-processor is, what it will do and where it will process the data. The same applies if we replace a sub-processor. We keep a record of each notice we send.

6.3 The Club may object to a new sub-processor on reasonable data protection grounds by emailing admin@trainingden.app within those 30 days. We will discuss the objection with the Club in good faith. If we cannot resolve it and still go ahead, the Club may end this agreement by deleting the Club in Training Den, without any charge.

6.4 Each sub-processor is bound by a written contract that gives Club Data the same protection as this agreement does. For the sub-processors we use today (Supabase, Vercel, Resend, OpenAI and Anthropic), that contract is the provider's standard data processing agreement, which forms part of its terms of service. We will have such a contract in place before a new sub-processor processes Club Data. We remain responsible to the Club for how each sub-processor meets its obligations.

7. Helping the Club with people's rights

7.1 People have rights over their personal data: to see it, correct it, have it deleted, restrict or object to its use, and take a copy. The Club answers requests about Club Data. We help, as far as the nature of the processing allows, with the tools in 7.2 and in the ways set out below.

7.2 These tools are in Training Den:

• A Club administrator can download the Club's records as a ZIP file of spreadsheet (CSV) and data (JSON) files.
• A Club administrator can download the data Training Den holds about one swimmer, to help answer a request from that swimmer or their family.
• Anyone with a Training Den login can download the data held about them from their account ("download my data").
• A Club administrator can correct swimmer records, and can erase one swimmer's record. The erasure screen explains what it removes and what it does not, such as text written about a whole session, and AI conversation history, which the Club's retention settings control.
• Anyone with a login can delete their own account.

7.3 If we receive a request about Club Data directly, we pass it to the Club without undue delay. We do not answer it ourselves unless the Club asks us to.

7.4 If the Club needs Club Data that the tools in 7.2 do not provide, we will provide it on request, quickly enough for the Club to meet its deadlines under Data Protection Law.

7.5 Training Den provides an online complaints form and a place in Club settings to acknowledge complaints and record the response. The Club remains responsible for handling complaints about how it uses Club Data, including acknowledging each one within 30 days and replying without undue delay. These tools help the Club do that. They do not do it for the Club.

8. Security incidents and impact assessments

8.1 We will tell the Club without undue delay, and in any event within 24 hours, after we become aware of a personal data breach affecting Club Data. We will email the Club's administrators and its data protection contact. We will give the Club the information it needs to decide whether to report the breach to the ICO and whether to tell the people affected, as far as we have it at the time, and send the rest as we learn it. We will take reasonable steps to contain the breach and limit its effects.

8.2 We will help the Club with any data protection impact assessment, and any consultation with the ICO, that concerns our processing. On request we will give the Club our own impact assessment of Training Den, which the Club can adapt for its own.

9. Transfers outside the UK

9.1 We will transfer Club Data outside the UK, or let a sub-processor do so, only where the transfer meets the UK GDPR's rules for international transfers. That means the destination is covered by UK regulations (for example, a US company certified under the UK Extension to the EU–US Data Privacy Framework), or appropriate safeguards are in place (such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses) and the protection is not materially lower than in the UK.

9.2 The published sub-processor list (clause 6.1) says which sub-processors process data outside the UK. We keep a written assessment of each such transfer, including the ones not yet concluded, and will give it to the Club on request.

10. How long this agreement lasts, and what happens at the end

10.1 This agreement lasts while we process Club Data for the Club. It ends when the Club is deleted in Training Den, or when the Club's use of Training Den otherwise ends.

10.2 The Club can download its data at any time (clause 7.2). Deleting the Club in Training Den deletes the Club Data from our live database straight away, apart from the records in 10.5.

10.3 If this agreement ends another way, then within 30 days of the end we will, as the Club chooses, either return the Club Data to the Club (in the format of the download in clause 7.2, or another format we agree) and then delete it, or just delete it. If the Club has not told us its choice within those 30 days, we will delete it.

10.4 We keep Club Data after that only where the law requires us to, or as clause 10.5 says. If so, we will tell the Club what we keep and why, and this agreement continues to protect it. Deleted data can remain in our database host's backups until those backups expire. We do not restore it from backups except to recover the service.

10.5 When the Club is deleted, we keep two records. We keep them as a controller in our own right, not as the Club's processor, because we have a legitimate interest in being able to show how complaints were handled and that this agreement existed, and in defending legal claims:

• records of data protection complaints about the Club, and how each was handled. A complaint that was answered is deleted three years after the answer. A complaint that was never answered is deleted three years after the Club was deleted.
• the record of the Club's acceptance of this agreement (clause 2.2), deleted six years after the Club was deleted.

[To be confirmed by a data protection practitioner: keeping these two records after the Club is deleted, on this basis, and for these periods.]

11. Information and audits

11.1 On reasonable request, we will give the Club all the information it needs to show that we meet this agreement and Article 28 of the UK GDPR. This includes our record of processing, our impact assessment, our breach procedure, our sub-processor list and our transfer assessments.

11.2 We will allow for and contribute to audits, including inspections, by the Club or by an auditor the Club appoints who is bound by a duty of confidentiality. The Club will give us at least 30 days' written notice of an audit, and no more than one audit in any 12 months, unless there has been a personal data breach affecting Club Data or a regulator requires it.

12. Liability

[To be completed by Training Den with its solicitor: whether, and how, each party's liability under this agreement is limited.]

13. Notices

13.1 Notices to us go by email to admin@trainingden.app, or by post to our registered office (clause 1).

13.2 Notices to the Club go by email to the Club's data protection contact and its administrators as recorded in Training Den, or by post to the Club's address as last recorded under clause 2.

14. Law and courts

This agreement, and any dispute about it, is governed by the law of Scotland. The Scottish courts can hear any dispute about it, but this does not stop a claim being brought in another court that has jurisdiction.

15. General

15.1 If this agreement conflicts with our terms of use, or with anything else agreed between the Club and us about Club Data, this agreement wins.

15.2 If any part of this agreement is found to be invalid, the rest of it still applies.

Schedule 1: Details of the processing

Subject matter. Hosting and running Training Den for the Club: planning swim, land and other training, recording attendance, absences and results, and the other features of Training Den.

Duration. The life of this agreement, and afterwards only as clause 10 allows.

What we do with Club Data (nature and purposes):

• store and show swimmer, parent, guardian and coach records for the Club;
• plan swim, land and general activity sessions (such as running or cycling), including drafting sessions with AI from what a coach types, says or photographs (clause 5.3);
• record attendance, and notice of absence given in advance by swimmers or families, including illness and injury (clause 4.2);
• record what swimmers or their families report about sessions: done or skipped, effort from 1 to 10, time spent, and notes;
• record changes to sets for individual swimmers, competition results, and swimmers' season goals (target times with an optional note);
• work out training-load and attendance flags for coaches, by fixed rules rather than AI. The Club can switch these off, or leave one swimmer out;
• answer coaches' questions through the coach assistant, which can look up the Club's data;
• turn a coach's speech into text, and keep voice transcripts only if the Club switches that on, for as long as the Club sets;
• build coaches' dashboards and analyses from the Club's data;
• handle data protection complaints about the Club, including sending emails about them;
• provide the downloads, corrections, erasure and deletion in clauses 7 and 10;
• keep a log of who changed what, measure AI use against limits, and keep Training Den working and secure.

Whose data (categories of data subjects):

• swimmers, most of them children under 18;
• parents and guardians;
• coaches, club administrators and other club staff;
• people who complain about how the Club uses personal data.

What data (types of personal data):

• Swimmers: first and last name and, optionally, date of birth; squads; attendance; notice of absence (a reason and an optional note); what they or their family report about sessions (done or skipped, effort, minutes, notes); changes to sets; competition results; season goals; training-load and attendance flags; and an email address if they have their own login.
• Parents and guardians: name and email address if they have a login, and which swimmer they are linked to.
• Coaches and staff: name, email address and role; the session plans and notes they write (a coach's session notes are private to them unless they share them); their conversations with the coach assistant, kept with real names for as long as the Club's settings allow; and voice transcripts, if the Club keeps them.
• People who complain: name, email address, what they wrote, and how the complaint was handled.
• Everyone who signs in: a log of the changes they make, and counts of AI use (not what was said).

Special category data. Illness and injury as reasons for absence are health data (clause 4.2). Notes written by swimmers, families or coaches, and the text of complaints, may also contain health or other sensitive details, although Training Den does not ask for them. Training Den does not ask for swimmers' addresses, photographs, medical records or emergency contacts.

How long it is kept. For as long as the Club uses Training Den, unless the Club sets shorter periods in Club settings (for notice of absence, coaches' session notes, assistant conversations and voice transcripts) or deletes the data sooner. New clubs start with notice of absence kept for 365 days.

Schedule 2: Security measures

• Where data is kept. Club Data is stored by Supabase in London, and our API, which handles most requests, runs on Vercel in London.
• In transit. Every connection to Training Den uses HTTPS.
• Who can see what. Every request is checked, so a person sees only the clubs they belong to, and only what their role allows. Where the app reads data straight from the database, the database itself keeps each club's data separate. A coach's session notes are private to them by default.
• Passwords. Sign-in is handled by Supabase. We never see or store passwords.
• AI. Names are replaced with labels before typed text reaches an AI provider (clause 5.3), and the app refuses to send the text at all if it cannot load the names to replace.
• Keeping only what is needed. A swimmer's record holds their name and, optionally, their date of birth.
• Records and limits. A log of who changed what, request logs that do not contain what people wrote, and limits on how often AI features can be used.

Not yet in place. We will update this list as each item is done.

• Vercel's data processing agreement covers its paid plans. We have not yet recorded confirmation that our Vercel account is on one of them.
• Transfer checks (clause 9.1). Resend says it is certified under the UK Extension to the EU–US Data Privacy Framework; we have not yet checked this on the official list. Our written assessments of the transfers to OpenAI and Anthropic, which rely on the EU standard contractual clauses with the UK Addendum in their data processing agreements, are not yet concluded.
• A database plan with point-in-time recovery, and a tested restore. Until then we cannot say how quickly lost data could be restored, or exactly how long backups are kept.
• Multi-factor sign-in for Training Den's own operator accounts is built, but not yet confirmed as switched on.
• The region Vercel uses to serve our website (as opposed to our API) is not yet confirmed.
• The daily jobs that delete data under the Club's retention settings are set up, but their first run has not yet been confirmed.
• Our API reaches the database through one service connection, so on that path club separation is enforced by our own code rather than by the database as well.