GDPR · How we comply
How Clybo’ complies with the General Data Protection Regulation (GDPR), including the Data Processor role we take on for each club.
This page summarises how Clybo’ complies with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and the Maltese legislation that supplements it (Data Protection Act, Chapter 586), and clarifies the roles of the club (Controller) and Clybo’ (Data Processor).
1. GDPR roles
| Role | Who takes it on | What it decides |
|---|---|---|
| Data Controller | The sports club | The purposes for which the data of athletes, guardians and staff is processed. |
| Data Processor | FlamaTech Consulting LTD (Clybo’) | Processes the data on the club's behalf following its instructions, under the signed DPA. |
| Sub-processors | The providers listed in the privacy policy (hosting, authentication, payments, email, analytics and invoicing) | Specific services under a processing contract in accordance with Article 28 GDPR. The AEAT (the Spanish tax agency) is not a sub-processor: it receives tax records because of a legal obligation. |
2. Data Processing Agreement (DPA)
Before creating the club, its administrator must electronically accept the current Terms and DPA. The system records the user, the date, the versions accepted and technical evidence of acceptance. The DPA must include the requirements of Article 28 GDPR:
- Subject matter, duration, nature and purpose of the processing.
- Type of personal data and categories of data subjects.
- The Processor's obligations: confidentiality, security, assistance to the Controller, breach notification.
- Rules for sub-processors with prior general authorisation.
- Return or deletion of the data at the end of the contract.
If you need a copy of the DPA before signing up, write to dpo@clybo.app.
3. Technical and organisational measures
- Encryption: AES-256 at rest, TLS 1.3 in transit.
- Access control: provider-based authentication (Supabase Auth), role-based control, signed claims.
- Multi-tenant segregation: isolation by
club_id+ Row-Level Security in PostgreSQL. - Traceability: activity log for sensitive operations.
- Backups: encrypted daily backups with 30-day retention.
- Provider review: prior assessment and annual reassessment of each sub-processor.
4. Security breach notification
In the event of a security breach affecting personal data, we will notify the Controller club within 72 hours at most of becoming aware of it, in accordance with Article 33(2) GDPR. The notification will include the nature, categories and volume of the data affected, the measures taken and a contact person.
5. Data subjects' rights
When a guardian, athlete or staff member exercises a data protection right (known in Spain as ARCO+: Access, Rectification, Erasure, Objection, Restriction, Portability), they must contact the Controller club. Clybo’ will assist the club with the technical tools needed to respond to the data subject within the legal deadline.
6. International transfers
Data is mainly stored on infrastructure located in the European Union. Some sub-processors may process data outside the EEA; in those cases we apply standard contractual clauses approved by the European Commission or an adequacy decision, ensuring a level of protection equivalent to that of the GDPR.
7. Contact and complaints
Data Protection Officer: dpo@clybo.app.
Clybo’s lead supervisory authority is the Information and Data Protection Commissioner (IDPC) of Malta. Any data subject may also lodge a complaint with the authority of their own Member State (in Spain, the AEPD, the Spanish Data Protection Agency).