Data Processing Agreement (DPA) — annex to the Terms of Sale

The DPA forms an integral part of the Terms of Sale and prevails over them on data-protection matters. It applies during the subscription, trial included, and then until the purge: after termination or an account-deletion request, the data remain accessible for 30 days before automatic deletion (section 12); encrypted backups then expire within 90 days at most.

• The Shop is the controller for the data of its end customers, its staff and its supplier contacts: it determines the purposes, ensures lawfulness, informs data subjects and collects any required consent.
• GolfSpec is the processor: it processes these data solely to provide the Service, on the Shop’s documented instructions, with no use for its own purposes.
• GolfSpec is the controller for its contractual relationship with the Shop (account, billing via Stripe, support, alerts, error logging): see the privacy policy. [TO CONFIRM with the lawyer: qualification for the Shop’s staff accounts.]

Purposes, on the Shop’s instructions: fitting; quotes and, at its request, invoices and credit notes; workshop; after-sales with suppliers; online booking; customer messaging (portal); AI assistance (analysis, summary, assistant, drafts); automatic reminders; sales tracking and export. The Service neither collects nor records any payment from end customers.

Data subjects: the Shop’s end customers (including prospects booking online and walk-in workshop customers); the Shop’s staff; suppliers’ sales contacts (after-sales).

Categories of data:

• Identity and contact details: surname, first name, e-mail, telephone, home club, external CRM identifiers, free-text notes by the Shop; no date of birth or postal address.
• Playing data: handicap index, handedness, frequency, skill level, swing speeds, goals, current bag.
• Body measurements: height, wrist-to-floor distance, arm length.
• Fitting interview, including declared physical constraints and free-text comments, which may contain health data (Article 9 GDPR): the Shop warrants a valid legal basis, in practice the data subject’s explicit consent, and enters only what is strictly necessary. The “Physical constraints” field only opens after an explicit, timestamped consent checkbox that mentions analysis by the AI assistant; without consent the data is neither stored nor sent to the model. [TO CONFIRM with the lawyer: wording of the consent.]
• Launch-monitor data, shot by shot (up to 100 shots per club tested), entered manually or imported from a CSV file and, if the Shop enables the TrackMan import, taken from a TrackMan report imported by link; recommendations and quotes (specifications, fitter’s notes, prices, order status).
• Workshop: description, internal notes, measurements, before/after and step photos, timing, technician, immutable log. After-sales: product, warranty, proof of purchase, photos, exchanges with the supplier.
• Handwritten signatures (fitting and workshop), stored as images in the database.
• Messaging: messages, attachments, templates, AI drafts. Bookings: type, date, fitter, contact details entered, booking token.
• Invoices and credit notes issued at the Shop’s request: billing identity (name, company, address, VAT number), items and amounts; no payment or card data.
• Satisfaction: rating, verbatim comments, click-through to the Google review. Notifications: staff push tokens (browser, iOS), the customer’s e-mail for the portal. E-mail log: recipient, subject, delivery status, with no tracking pixel or click tracking.

Duration: the subscription, then 30 days before purge (section 12).

The Shop’s instructions are the Terms of Sale, this DPA and its settings in the interface (AI drafts and instructions, connected CRM, launch-monitor data import — including the TrackMan import by link, if enabled —, reminders, online booking, roles and sites). GolfSpec does not process the data for any other purpose and flags any instruction that appears to infringe the GDPR; additional instructions in writing to [TO CONFIRM: data-protection contact address].

Persons authorised to access production are bound to confidentiality by contract or by law; GolfSpec’s access to the Shop’s data is limited to support, maintenance and security. [TO CONFIRM: persons with production access and signed confidentiality undertaking.]

Measures in place:

• Encryption in transit (TLS) on all exchanges, database included; encryption at rest by the database host (Neon default); CRM integration credentials encrypted with AES-256-GCM; no end-customer payment data.
• Passwords hashed with bcrypt (cost 12), 12 characters minimum mixing several character types, known compromised passwords refused (hash-prefix check, k-anonymity), attempts limited per e-mail and IP and per account, single-use reset link valid for 15 minutes, signed-token sessions of 7 rolling days revoked when the password or e-mail changes and when the account is deleted; portal links revocable by the Shop; log of sensitive actions (invoices, credit notes, deletions, erasures, accounts).
• Multi-tenant isolation through PostgreSQL constraints (composite foreign keys) and an automated test; access control by role (administrator, manager, fitter) and by site; superadmin restricted to a list of e-mail addresses, closed by default.
• Rate limiting on authentication, the portal, booking, uploads, messaging and AI, failing closed on sensitive endpoints when unavailable; uploads limited to 10 MB and to allowed types.
• Encrypted backups (GPG, AES-256) daily, kept for 30 days (90 for the backup of the 1st of the month), completeness check, quarterly restore test; host PITR limited to 6 hours.
• Errors logged in Sentry (production) with alerts on scheduled-task failure; scheduled tasks protected by a secret; Stripe and Resend webhooks verified by signature with replay protection.

Known limitations:

• No two-factor authentication. [TO CONFIRM: 2FA roadmap.]
• Files (workshop photos, attachments, after-sales receipts, PDF cache) protected by non-guessable URLs that are neither signed nor time-limited; deterministic key for the PDF cache. [TO CONFIRM after fix: private access or signed URLs.]
• Sentry: personal-data filtering (e-mails and access tokens masked, including in URLs; cookies and authentication headers removed); session replays sampled and masked, disabled on public pages (portal, booking, satisfaction).
• No named access log for customer records.

Sub-processors generally authorised by the Shop:

• Vercel Inc. — hosting, server functions, scheduled tasks, file storage (Blob) — London, United Kingdom (lhr1).
• Neon Inc. — PostgreSQL database — London, United Kingdom (AWS eu-west-2).
• Upstash — rate-limiting Redis (temporary keys, including IP, 15 minutes at most) — United States.
• Resend Inc. — transactional e-mails (via Amazon SES) and delivery receipts — [TO CONFIRM: region].
• Google (Gemini API, Gemini Flash models) — AI features (section 9) — [TO CONFIRM: region and non-use for training].
• Apple (APNs) and Web Push services (Google FCM, Mozilla, Apple) — iOS and browser push notifications; only the endpoint identifier and the notification pass through — [TO CONFIRM: location].
• Sentry — error logging — [TO CONFIRM: region].
• GitHub (Microsoft) — encrypted database backups (key not held by GitHub) and continuous integration — United States.
• cron-job.org and Better Stack (forthcoming) — availability monitoring; no personal data. [TO CONFIRM: activation of Better Stack.]
• Shopify or any CRM connected by the Shop — synchronisation of customer records, on its instruction and with its own credentials.

Stripe is not a sub-processor: it is involved only in the payment and invoicing of the GolfSpec subscription (GolfSpec–Shop relationship) and receives no end-customer data.

Any addition or replacement is notified to the account administrator with [TO CONFIRM: 30 days’] notice; the Shop may object in writing on legitimate grounds and, failing agreement, terminate without penalty before the change. GolfSpec imposes equivalent obligations on its sub-processors and remains liable for their performance.

Third-party data source, outside the list of sub-processors — TrackMan: if the Shop enables the TrackMan import (import by report link, an optional feature disabled by default), the Service reads, on its instruction, the report whose public link it provides; this report contains the player’s name. TrackMan does not act on GolfSpec’s behalf and no contract binds them; GolfSpec sends it only the report identifier. Collecting the measurements and sharing the report are the Shop’s responsibility. [TO CONFIRM with the lawyer: qualification adopted and Shop–TrackMan contractual framework.]

• United Kingdom (Vercel, Neon): European Commission adequacy decision [TO CONFIRM with the lawyer: validity and duration].
• United States (Upstash, GitHub and, depending on their region, Sentry, Google, Resend, Apple): standard contractual clauses or Data Privacy Framework certification depending on the provider [TO CONFIRM: instrument applicable to each and signed DPAs].

No other transfer outside the European Union and the European Economic Area.

The Service uses the Google Gemini API for structured analysis of a fitting, in-session directive and assistant, summary and reply drafts in messaging. Depending on the feature, requests contain: playing data, body measurements, home club, interview (including physical constraints and comments), per-club measurements (with their source and the measuring device declared by the Shop), quoted items, the fitter’s free-text notes, catalogue, the Shop’s name and its AI instructions and, for drafts, the last eight messages exchanged with the customer.

GolfSpec never inserts the customer’s name, e-mail or telephone into requests; they may appear if the fitter writes them in notes or if the customer mentions them in a message, of which the Shop informs its staff.

• Caps: 200 analyses per day per Shop, plus per-minute limits per feature.
• Each call is logged with the exact copy of the data sent and the response (FittingAnalysis). [TO BE SET: retention period.]
• AI drafts in messaging can be disabled in the settings (aiDraftEnabled) and are limited to certain plans; outputs are suggestions, the fitter remains the sole decision-maker, no decision with legal effect is automated.
• [TO CONFIRM: Google’s commitment to non-use for training, retention and region.]

Data-subject rights: the Shop handles its end customers’ requests itself using the interface:

• access and portability: full account export (compressed JSON archive of all data, files referenced by their address), restricted to administrators, two per hour; export of a customer’s data from the customer record (administrators and managers);
• rectification: from the fitting record, propagated to the customer record [TO CONFIRM: direct editing of the customer record];
• erasure: “Erase this customer” from the customer record (administrators) deletes their contact details, measurements, interviews, conversations and attachments, named appointments and notification subscriptions; invoiced fittings are kept, anonymised except for the billing name and address, under the legal obligation to keep invoices (Article 17.3.b GDPR); deleted messages are permanently erased within 30 days.

GolfSpec assists the Shop within [TO CONFIRM: 10 working days] with any request it cannot fulfil alone, refers back to the Shop any person who contacts GolfSpec directly, and contributes, with the information available to it, to the Shop’s impact assessments.

Data breaches: notification to the Shop within [TO CONFIRM: 48 hours] of becoming aware (nature, categories and approximate number of data subjects and records, likely consequences, measures taken); notification to the CNIL and communication to data subjects are the Shop’s responsibility.

GolfSpec makes available the documentation demonstrating compliance with the DPA (technical inventory, sub-processors, restore procedures and tests) and answers in writing within [TO CONFIRM: 30 days]. An on-site audit or an audit by an independent third party is possible [TO CONFIRM: once a year, 30 days’ notice, at the Shop’s expense, under confidentiality], except in the event of an established breach or a supervisory-authority request.

• Before the end of the subscription, the Shop exports its data (JSON and CSV sales export), with GolfSpec’s help on request.
• Account deletion is requested by an administrator (password confirmation); after 30 days, during which it can be cancelled and access is maintained, a daily task deletes all of the Shop’s data from the production database in cascade, then the associated stored files (photos, attachments, PDF copies).
• Encrypted backups expire within 30 days (90 for the monthly backup) and are used only to restore the service after an incident.

Implemented periods: customer-portal links at most 90 days, revocable, deleted 30 days after expiry or revocation; magic and reset links 15 minutes; portal session cookie 24 hours; staff session 7 rolling days; booking cancellation links erased the day after the appointment; e-mail log 12 months; deleted messages 30 days; cached PDF copies 30 days; rate-limiting keys (including IP) 15 minutes at most; business content kept for as long as the account is active.

Periods to be defined: [TO BE SET: AI logs, inactive customers, satisfaction, archived workshop tickets and log, Vercel and Sentry technical logs]; the Shop may request shorter periods.

Accounting obligations: the purge at day 30 also deletes the invoices and credit notes issued from the Service; the Shop, which alone bears accounting and tax retention duties, exports them before the end of the contract. [TO CONFIRM with the lawyer: separate retention of accounting records by GolfSpec.]

Each party is liable for damage caused by non-compliant processing under the conditions of Article 82 GDPR; GolfSpec’s liability follows the limitations of the Terms of Sale [TO CONFIRM: cap, for example 12 months’ subscription fees, and exclusions], except for gross negligence or wilful misconduct. The Shop indemnifies GolfSpec against any claim arising from a lack of legal basis, information or consent, in particular for health data.

French law; competent courts of Toulouse [TO CONFIRM with the lawyer: jurisdiction clause between professionals], after an attempt at amicable settlement. Data-protection contact: [TO CONFIRM: dedicated address and whether or not a DPO is appointed].

GolfSpec updates this DPA upon any significant change to the measures or sub-processors and informs the Shop.