Organization Data Processing Addendum

This Data Processing Addendum ("Organization DPA") supplements the Terms & Conditions and governs the processing of personal data by IX Baseball ("we", "us", "Processor") on behalf of any team, academy, training facility, school, provincial body, national body, or other baseball organization that uses IX Baseball to manage athletes, coaches, rosters, assessments, and development programs ("Organization", "Controller").

1. Roles and scope

For data that the Organization uploads, enters, or causes to be collected within its workspace on IX Baseball. Including roster, coach assignments, athlete videos and assessments uploaded by Organization-affiliated coaches, and development records. The Organization is the data controller and IX Baseball is the data processor.

For data IX Baseball collects directly from parents (account creation, billing, consent records, communications with IX Baseball), IX Baseball is the controller, as described in our Privacy Notice.

2. Processing instructions

IX Baseball processes Organization-controlled personal data only on the Organization's documented instructions, which include the configuration of the Organization's workspace, the assignments and permissions granted by the Organization, the Terms, this DPA, and applicable law.

3. Organization responsibilities

• Ensure that the Organization has a lawful basis (typically parental consent for minors) to onboard each athlete and to grant access to the Organization's coaches and administrators.
• Manage roster, coach assignments, and access revocation in a timely manner (for example, removing access when a coach leaves the program).
• Provide athletes' parents/guardians with appropriate privacy information about the Organization's own processing.
• Ensure that the Organization's coaches comply with the Coach DPA.
• Respond to athlete or parent rights requests it receives directly, and forward to IX Baseball any request that requires platform-level action.

4. Confidentiality and security

IX Baseball will ensure that personnel with access to Organization-controlled data are subject to confidentiality obligations and trained appropriately, and will implement and maintain technical and organizational security measures consistent with industry standards and Section 11 of the Privacy Notice.

5. Subprocessors

The Organization authorizes IX Baseball to engage the subprocessors listed at /subprocessors. We will notify Organizations of material changes to that list via the Service or by email. The Organization may object to a new subprocessor on reasonable data protection grounds; if we cannot reasonably accommodate the objection, the Organization may terminate the affected subscription.

6. International transfers

Personal data may be processed in Canada, the United States, and the European Union, subject to the safeguards described in Section 7 of the Privacy Notice (Standard Contractual Clauses, adequacy decisions, or equivalent).

7. Assistance to the Controller

Taking into account the nature of processing and the information available, IX Baseball will provide reasonable assistance to the Organization in responding to athlete or parent rights requests, performing data protection impact assessments, and complying with security and breach notification obligations.

8. Breach notification

IX Baseball will notify the Organization without undue delay after becoming aware of a personal data breach affecting Organization-controlled data, with the information reasonably available at the time and updates as the investigation progresses.

9. Return and deletion

On termination of the Organization's subscription, IX Baseball will, at the Organization's choice, delete or return Organization-controlled personal data within a reasonable period, subject to the retention windows in Section 8 of the Privacy Notice and applicable legal requirements.

10. Audit

On reasonable written request and no more than once per year (except where required by a supervisory authority), IX Baseball will make available the information necessary to demonstrate compliance with this DPA, including, where appropriate, the results of independent audits and security certifications.

11. Acceptance

By creating or operating an Organization workspace on IX Baseball, the Organization accepts this DPA. A signed counterpart can be requested at privacy@ixbaseball.ca.