Acuerdo de Tratamiento de Datos

Effective date: 30 July 2026

This Data Processing Addendum (the DPA) forms part of the Polo HQ Terms of Service or other written agreement governing access to the Polo HQ Service (the Agreement).

It applies where POLO HQ LTD, company number 17059471, registered at 43 Diamond Ridge, Camberley, England, GU15 4LB (Polo HQ or Processor) processes personal data on behalf of a Customer or Organisation (Customer or Controller) in connection with the Service.

By accepting the Agreement or using the Service to process personal data, the Customer enters into this DPA on its own behalf and, where applicable, on behalf of its authorised affiliates.

1. Definitions

Terms including controller, processor, data subject, personal data, personal data breach, processing, special category data and supervisory authority have the meanings given in applicable Data Protection Law.

Customer Personal Data means personal data processed by Polo HQ on behalf of the Customer through the Service, excluding personal data for which Polo HQ acts as an independent controller, such as direct Account administration, billing, security and corporate records.

Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, the Data (Use and Access) Act 2025 to the extent applicable, and other data-protection legislation applying to the processing.

Subprocessor means a third party engaged by Polo HQ to process Customer Personal Data on behalf of the Customer.

2. Order of precedence

If this DPA conflicts with the Agreement on a data-protection issue, this DPA prevails.

If approved international-transfer clauses conflict with this DPA, the mandatory transfer clauses prevail for the restricted transfer.

3. Scope and details of processing

The subject matter, duration, nature, purpose, categories of data subjects and categories of personal data are described in Schedule 1.

Processing lasts for the term of the Agreement and any limited period required to return, delete, secure or lawfully retain data after termination.

4. Customer instructions

Polo HQ will process Customer Personal Data only:

• on the Customer's documented instructions, including instructions expressed through configuration and ordinary use of the Service;

• as necessary to provide, secure, maintain and support the Service;

• as set out in the Agreement and this DPA; or

• where required by applicable law.

If law requires processing beyond the Customer's instructions, Polo HQ will inform the Customer before processing unless the law prohibits that notice.

Polo HQ will notify the Customer if it reasonably believes an instruction infringes Data Protection Law. Polo HQ may suspend the affected processing while the parties clarify or modify the instruction.

5. Customer obligations

The Customer is responsible for:

• complying with Data Protection Law;

• determining the lawful purposes and legal bases for Customer Personal Data;

• providing required privacy information;

• obtaining valid consent where consent is relied upon;

• ensuring instructions are lawful, fair and proportionate;

• limiting the data uploaded to what is necessary;

• configuring roles and access appropriately;

• responding to data-subject requests as controller;

• assessing whether special category, criminal-offence or children's data may lawfully be processed;

• ensuring it has authority to upload documents and personal data; and

• maintaining any records, DPIAs, policies and regulator registrations required of it.

The Customer must not instruct Polo HQ to process personal data unlawfully.

6. Confidentiality

Polo HQ will ensure that personnel authorised to process Customer Personal Data:

• are subject to confidentiality obligations;

• receive appropriate instructions or training; and

• access data only where reasonably necessary for their duties.

Confidentiality duties continue after access ends.

7. Security

Polo HQ will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

The current categories of measures are described in Schedule 3.

The Customer acknowledges that security measures evolve. Polo HQ may update them where the overall level of protection is not materially reduced.

The Customer is responsible for its own devices, credentials, User management, lawful configuration and secure use of exports and integrations.

8. Personal data breaches

Polo HQ will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

The notification will include available information reasonably required under Data Protection Law, which may be provided in phases as the investigation progresses.

Polo HQ will take reasonable steps to contain, investigate and mitigate the breach and will cooperate with the Customer's legally required notification and response obligations.

Notification is not an admission of fault or liability.

The Customer is responsible for notifying affected individuals and supervisory authorities unless law assigns that obligation to Polo HQ.

9. Data-subject rights

Taking into account the nature of the processing, Polo HQ will provide reasonable assistance through technical functions or support so the Customer can respond to lawful requests for access, correction, erasure, restriction, objection and portability.

If Polo HQ receives a request relating primarily to Customer Personal Data, it may direct the requester to the Customer and notify the Customer, unless prohibited by law.

Polo HQ will not independently respond on the Customer's behalf unless authorised or legally required.

10. Compliance assistance

Taking into account the nature of processing and information available, Polo HQ will provide reasonable assistance with:

• security obligations;

• breach assessment and notification;

• data-protection impact assessments;

• prior consultation with a supervisory authority; and

• reasonable compliance information about the Service.

Assistance beyond standard Service functionality may be chargeable at reasonable rates where the request is extensive, repetitive or caused by the Customer's non-compliance, unless law requires otherwise.

11. Subprocessors

The Customer gives Polo HQ general written authorisation to appoint Subprocessors.

The current material Subprocessors are listed in Schedule 2.

Polo HQ will:

• impose written data-protection obligations on each Subprocessor that are no less protective in substance than the obligations applicable to Polo HQ for the relevant processing;

• remain responsible to the Customer for the Subprocessor's performance of those obligations; and

• provide reasonable notice of a new material Subprocessor before it begins processing Customer Personal Data, where practicable.

The Customer may object within 15 days of notice on reasonable, documented data-protection grounds. The parties will work in good faith to resolve the objection. If no commercially reasonable resolution is available, Polo HQ may allow termination of the affected Service without penalty for the unused prepaid period, or may decide not to use the proposed Subprocessor for that Customer.

An emergency replacement needed for security, legal compliance or service continuity may occur before notice. Polo HQ will provide notice as soon as reasonably practicable.

12. Stripe and controller activities

Stripe is used for billing and payment services. Customer operational content is not intentionally sent to Stripe as part of ordinary module use.

For billing data, Stripe may act as a processor for some activities and an independent controller for activities it determines are necessary to provide payment services, prevent fraud or comply with law.

Polo HQ's processing as an independent controller is governed by the Privacy Policy and is not Customer Personal Data under this DPA merely because it relates to a Customer Account.

13. International transfers

Polo HQ will not make a restricted transfer of Customer Personal Data unless the transfer is covered by a lawful mechanism.

Mechanisms may include:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved EU standard contractual clauses;

• binding corporate rules; or

• another safeguard or exception permitted by Data Protection Law.

Where required, Polo HQ or the relevant exporting party will complete a transfer risk assessment and apply appropriate supplementary measures.

If the Customer's use of the Service itself initiates a restricted transfer, the Customer is responsible for ensuring that transfer is lawful unless Polo HQ is the exporting party.

14. Government and law-enforcement requests

Polo HQ will disclose Customer Personal Data to a public authority only where legally required or authorised.

Where legally permitted, Polo HQ will notify the Customer before disclosure and may challenge a request that appears unlawful, disproportionate or outside the requesting body's authority.

15. Audits and information

Polo HQ will make available information reasonably necessary to demonstrate compliance with Article 28 obligations.

The Customer may conduct an audit no more than once in any 12-month period, unless a Personal Data Breach, regulator request or credible evidence of material non-compliance justifies another audit.

Audits must:

• begin with review of available documentation and written responses;

• be conducted on reasonable notice;

• avoid disruption to the Service and other customers;

• protect Polo HQ and third-party confidential information;

• use an independent, qualified auditor who is not a competitor; and

• comply with reasonable security and access requirements.

The Customer bears its audit costs. Polo HQ may charge reasonable costs for an audit that requires substantial bespoke work, unless it identifies a material breach by Polo HQ.

No audit permits access to another customer's data, source code, vulnerability details that would increase risk, or information restricted by law or third-party confidentiality.

16. Return and deletion at end of processing

At the Customer's written choice and subject to available functionality, Polo HQ will return or delete Customer Personal Data after the processing services end, unless law requires retention.

The Customer should request an export before Account closure. Polo HQ may provide a standard export or reasonable support-assisted export depending on technical capability.

Following verified closure or deletion instruction, Polo HQ will ordinarily delete operational Customer Personal Data within 90 days, except:

• data required by law;

• data subject to an active legal hold, dispute, fraud or security investigation;

• limited controller records described in the Privacy Policy; and

• residual copies in protected backups until overwritten under normal backup cycles.

Backup copies will remain protected and will not be used for ordinary purposes.

The abandoned-Trial deletion process operates as described in the Terms of Service and Data Retention Policy. Selecting any Plan, including the Free Plan, takes the Account outside that automatic deletion process.

17. Records and regulatory cooperation

Each party will maintain records required by Data Protection Law and cooperate with a competent supervisory authority in relation to processing under this DPA.

Polo HQ may provide the Customer with information about its processing records to the extent reasonably necessary and legally permitted.

18. Liability

Liability under this DPA is subject to the liability provisions of the Agreement, except to the extent a limitation is prohibited by Data Protection Law.

Nothing limits a data subject's statutory rights or the powers of a supervisory authority.

19. Term and termination

This DPA starts when Polo HQ first processes Customer Personal Data on behalf of the Customer and continues until that processing ends.

Provisions concerning confidentiality, deletion, audit, liability and international transfers survive as necessary to give them effect.

20. Governing law

This DPA is governed by the laws of England and Wales.

The jurisdiction provisions of the Agreement apply.

Schedule 1: Processing details

A. Subject matter

Hosting and operation of a multi-tenant SaaS platform for polo and equestrian operational management, including Account access, players or members, staff, horses, practices, lessons, calendars, stables, maintenance, financial records, analytics, timelines, breeding, tasks, documents, communications and related functions selected by the Customer.

B. Duration

For the term of the Agreement and any limited post-termination period required for return, deletion, backups, security, legal obligations or claims.

C. Nature and purpose

Collection, recording, organisation, storage, retrieval, consultation, display, transmission, restriction, deletion and other processing necessary to provide, secure, maintain, support and administer the Service on the Customer's instructions.

D. Categories of data subjects

May include:

• Account Managers and Users;

• players and members;

• junior players or members;

• staff, grooms, coaches and managers;

• contractors and volunteers;

• horse owners and riders;

• veterinary, farrier and service professionals;

• suppliers and customer contacts;

• event or lesson participants;

• payers, payees and invoice contacts; and

• other people whose information the Customer lawfully enters.

E. Categories of personal data

May include:

• identity and contact details;

• dates of birth and age category;

• Organisation role and permissions;

• account and authentication identifiers;

• availability, attendance and scheduling information;

• player participation, handicap and performance-related information;

• staff tasks and operational activity;

• contracts, identification, visa and immigration documents;

• invoices, fees, expense and transaction-related information;

• notes, messages and uploaded documents;

• device and usage information connected to authorised Users; and

• other Customer-selected operational records.

F. Special category and sensitive data

Polo HQ does not require special category data for ordinary use. Customers may choose to upload health, injury, biometric, safeguarding or other sensitive information. The Customer must establish an Article 6 lawful basis, an Article 9 condition where required, and appropriate safeguards.

Criminal-offence data must not be uploaded unless the Customer has a lawful basis, legal authority and appropriate policy safeguards.

G. Frequency

Continuous or recurring while the Customer uses the Service.

Schedule 2: Material Subprocessors

Polo HQ may maintain a current list at a legal or subprocessor page within polohq.com.

Schedule 3: Technical and organisational measures

Measures are risk-based and may include:

1. Access control

   • role-based access;

   • unique User accounts;

   • restricted administrative access;

   • service credentials limited to server-side functions;

   • removal or adjustment of access when no longer needed.

2. Authentication and session security

   • password and authentication controls;

   • single-use, expiring activation links;

   • short-lived native-to-web handoff links;

   • session revocation and password reset capability.

3. Tenant and database protection

   • row-level security and tenant restrictions;

   • database-level capacity and integrity controls;

   • restrictions on public execution of sensitive guard functions;

   • separation of public client access from privileged server operations.

4. Transmission security

   • encrypted network transport using current industry-standard protocols where supported;

   • secure provider endpoints.

5. Billing-event security

   • Stripe-hosted card entry;

   • signature verification of Stripe webhooks;

   • idempotency controls and event-processing records.

6. Logging and monitoring

   • authentication, application, email and billing-event logs;

   • error and security monitoring;

   • investigation and incident-response procedures.

7. Availability and resilience

   • managed cloud infrastructure;

   • provider backup and recovery capabilities;

   • deployment and change-management procedures;

   • reasonable business-continuity planning.

8. Personnel and governance

   • confidentiality obligations;

   • least-privilege access;

   • service-provider review;

   • privacy and security processes appropriate to the size and risk of the business.

9. Deletion and restriction

   • automated abandoned-Trial deletion safeguards;

   • hard checks preventing deletion of Accounts that have selected a Plan;

   • deactivation rather than deletion when capacity is reduced;

   • support-assisted deletion for verified requests.

Contact

POLO HQ LTD
Company number: 17059471
Registered office: 43 Diamond Ridge, Camberley, England, GU15 4LB
Email: info@polohq.com