PUBLIC DATA PROCESSING ADDENDUM
GDPR / EEA CUSTOMER DATA

Effective date: September 24, 2026

Processor	QwikCut, LLC, 1731 Timber Hills Dr, DeLand, FL 32724, United States
Controller	Customer, including the applicable club, league, school, association, or other organization
Effective Date	The effective date of the applicable Services agreement, Sales Order, or the date this DPA is accepted, whichever is later
Purpose	To govern QwikCut’s processing of Customer Personal Data and applicable international transfers

This Data Processing Addendum (“DPA”) forms part of the agreement between QwikCut, LLC (“QwikCut”) and Customer governing Customer’s use of QwikCut’s products and services (the “Agreement”). Capitalized terms not defined in this DPA have the meanings given in the Agreement.

1. Roles and Scope

1.1 Customer is the controller of Personal Data it submits to, makes available through, or instructs QwikCut to process in connection with the Services. QwikCut is the processor of that Personal Data and will process it only on Customer’s documented instructions, including the Agreement, this DPA, Customer’s use and configuration of the Services, and other written instructions agreed by the parties. Customer’s selection of privacy, sharing, and publication settings within the Services constitutes documented instructions regarding the processing and availability of Customer Personal Data.

1.2 Where Customer affirmatively designates a video or highlight as public, QwikCut may display it in accordance with Customer’s selected settings and use public Customer Content only as permitted by the Agreement and applicable law. Public designation of a video or highlight does not itself designate other Personal Data relating to a minor as public or authorize separate promotional use of that minor’s identity. QwikCut will not use private Customer Content for its marketing, advertising, or promotional purposes.

1.3 QwikCut may act as an independent controller for limited processing undertaken for QwikCut’s own business purposes, such as business contacts, account administration, billing, fraud prevention, security, legal compliance, and QwikCut’s own marketing activities. Such processing is outside the scope of QwikCut’s role as processor under this DPA.

1.4 If QwikCut believes a Customer instruction violates Applicable Data Protection Law, QwikCut will inform Customer unless prohibited by law and may suspend the affected processing until the parties resolve the issue.

2. Processing Obligations

2.1 QwikCut will process Customer Personal Data only to provide the Services and in accordance with Customer’s documented instructions, unless otherwise required by applicable law.

2.2 QwikCut will ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

2.3 QwikCut will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data as described in Schedule 2.

2.4 QwikCut will not sell Customer Personal Data or use private Customer Personal Data for third-party advertising, behavioral advertising, or QwikCut promotional purposes. Public status of a video or highlight does not by itself authorize other disclosure or promotional use of identifiable minors’ information.

2.5 Customer is responsible for establishing a lawful basis for its processing, providing required notices, obtaining required permissions or consents, and ensuring its instructions to QwikCut comply with Applicable Data Protection Law.

2.6 Taking into account the nature of the processing and information available to QwikCut, QwikCut will provide reasonable assistance to Customer with data subject requests, security obligations, personal data breach obligations, data protection impact assessments, and consultations with supervisory authorities where required by Applicable Data Protection Law.

3. Youth and Minors’ Data

3.1 Customer Personal Data may include information relating to athletes or players under 18. QwikCut will process such information only to provide the Services, on Customer’s documented instructions, and subject to the safeguards in this DPA.

3.2 Customer is responsible for determining and documenting the lawful basis and any parental, guardian, athlete, league, school, or other authorization required for Customer’s collection and use of minors’ data.

3.3 QwikCut will not use private Customer Personal Data relating to minors for third-party advertising, remarketing, or QwikCut promotional purposes. Customer’s designation of a video or highlight as public does not make associated roster, profile, or contact information public. Any distinct promotional use of an identifiable minor must have the applicable lawful basis and required permissions.

4. Security and Confidentiality

4.1 QwikCut will maintain the technical and organizational measures described in Schedule 2 and may update those measures from time to time, provided the overall level of protection is not materially reduced.

4.2 Access to Customer Personal Data will be restricted to authorized personnel with a business need for access.

4.3 QwikCut will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data and will provide reasonably available information necessary for Customer to meet applicable notification obligations. Notification does not constitute an admission of fault or liability.

5. Subprocessors

5.1 Customer provides general written authorization for QwikCut to engage the subprocessors identified in Schedule 3 and to replace or add subprocessors as necessary to provide the Services, subject to Section 5.3.

5.2 QwikCut will impose data protection obligations on subprocessors that are no less protective in substance than the obligations applicable to the relevant processing under this DPA and will remain responsible for its subprocessors as required by Applicable Data Protection Law.

5.3 QwikCut will provide at least 30 days’ advance notice of an intended addition or replacement of a subprocessor, where reasonably practicable. If advance notice is not practicable, QwikCut will notify Customer as soon as reasonably possible before the subprocessor processes Customer Personal Data. Customer may object on reasonable data-protection grounds before the new subprocessor begins processing, and the parties will work in good faith to address the objection.

6. Return and Deletion

6.1 At Customer’s choice and subject to applicable law, QwikCut will return or delete Customer Personal Data following termination of the Services or a valid deletion instruction.

6.2 QwikCut will delete temporary copies and access credentials when no longer required for the applicable processing. Personal Data contained in backups will remain protected and will be deleted or rendered inaccessible in accordance with QwikCut’s backup lifecycle unless applicable law requires longer retention.

7. Audits and Compliance

7.1 QwikCut will make available information reasonably necessary to demonstrate compliance with its processor obligations under Applicable Data Protection Law.

7.2 If such information is insufficient, Customer may request a reasonable audit by Customer or an independent auditor subject to confidentiality obligations, reasonable advance coordination, protection of other customers’ information, and measures designed to avoid unnecessary disruption. Audits will ordinarily occur no more than once annually unless required by a supervisory authority or following a material security incident.

8. International Transfers

8.1 QwikCut processes Customer Personal Data in the United States, including through the subprocessors identified in Schedule 3. Where Customer Personal Data protected by the GDPR or other Applicable Data Protection Law is transferred internationally, the transfer will be subject to the applicable transfer mechanism identified in Schedule 4.

8.2 Where the EU Standard Contractual Clauses apply, the parties agree that the SCCs form part of and are incorporated into this DPA. The SCCs will control over conflicting provisions of this DPA or the Agreement with respect to the covered transfer.

8.3 The parties will reasonably cooperate with transfer impact assessments and supplementary safeguards required by Applicable Data Protection Law.

9. Order of Precedence and Term

9.1 This DPA remains in effect for as long as QwikCut processes Customer Personal Data on Customer’s behalf.

9.2 In the event of a conflict concerning the processing or protection of Customer Personal Data, the applicable Jurisdiction-Specific Terms will control over the general terms of this DPA, and applicable SCCs will control over both this DPA and the Agreement to the extent required by the SCCs.

9.3 Except as expressly modified by this DPA, the Agreement remains in effect, including its commercial terms and limitations of liability to the extent permitted by Applicable Data Protection Law and the SCCs.

10. Definitions

“Applicable Data Protection Law” means privacy, data protection, and data security laws applicable to the processing of Customer Personal Data under the Agreement, including the GDPR where applicable. “Customer Personal Data” means Personal Data processed by QwikCut on Customer’s behalf. “GDPR” means Regulation (EU) 2016/679. “Personal Data,” “Controller,” “Processor,” “Processing,” “Personal Data Breach,” and “Supervisory Authority” have the meanings given by Applicable Data Protection Law.

11. Acceptance

This published DPA forms part of an applicable Agreement or Sales Order only where that document incorporates it or the parties otherwise validly accept it. A person accepting on behalf of an organization represents that the person has authority to bind the organization. For a separately signed version, contact QwikCut.

12. Jurisdiction-Specific Data Protection Terms

12.1 If Customer Personal Data is subject to a data protection regime identified in Schedule 4, the provisions assigned to that regime will supplement this DPA and apply only to the processing governed by that regime. If those supplemental provisions differ from the general terms of this DPA, the supplemental provisions will govern the affected processing.

SCHEDULE 1 – DETAILS OF PROCESSING

Item	Description
Subject Matter	Sports video, analytics, storage, migration, account administration, support, and related QwikCut platform services.
Duration	For the term of the Services and any limited period required for return, deletion, backup lifecycle, security, or legal compliance.
Nature and Purpose	Hosting, storing, organizing, transmitting, displaying, analyzing, migrating, supporting, securing, and deleting Customer Personal Data in order to provide the Services.
Data Subjects	Customer administrators and staff; coaches; athletes and players, including minors; team personnel; and other individuals appearing in or associated with Customer Content.
Categories of Personal Data	Names; contact and account information; usernames and identifiers; team and roster information; athlete information; video and audio; game and event information; performance and statistical information; support communications; and technical and security logs.
Special Categories	QwikCut does not require special-category data to provide the Services. Video or other Customer Content may incidentally reveal characteristics that are protected under Applicable Data Protection Law.
Frequency	Continuous or Customer-initiated during use of the Services.
Documented Instructions	The Agreement, this DPA, Customer’s platform configuration and use, privacy/sharing/publication selections, migration or support requests, and other documented instructions accepted by QwikCut.

SCHEDULE 2 – TECHNICAL AND ORGANIZATIONAL MEASURES

Encryption of production Customer Personal Data in transit and at rest.
Multi-factor authentication for applicable platform and administrative access.
Role-based and user-based access controls designed to limit access to authorized users and personnel.
System logging and monitoring appropriate to the Services.
Backups and recovery processes designed to support availability and resilience.
Restricted personnel access based on business need and confidentiality obligations.
No third-party advertising or remarketing tracking within the authenticated QwikCut platform.
Processes for deletion of customer accounts, athlete data, video, temporary copies, and access credentials where applicable.
Use of established cloud infrastructure and managed database providers as identified in Schedule 3.
Periodic updates to safeguards as technology, risk, and the Services evolve, without materially reducing the overall level of protection.

SCHEDULE 3 – AUTHORIZED SUBPROCESSORS

Subprocessor	Service	Processing Location	Processing
Amazon Web Services (AWS)	Cloud infrastructure, storage, and hosting	United States – AWS us-east-1 (Northern Virginia)	Production data and video
MongoDB, Inc. / MongoDB Atlas	Managed production database	United States – hosted in AWS us-east-1	Production database records

SCHEDULE 4 – JURISDICTION-SPECIFIC DATA PROTECTION TERMS

A. European Economic Area / GDPR

A.1 These terms apply when Customer Personal Data is protected by the GDPR.

A.2 For Customer Personal Data processed by QwikCut on Customer’s behalf, Customer acts as Controller and QwikCut acts as Processor, except to the extent a party acts in another role for a separate processing activity as described in this DPA or required by law.

A.3 If Customer Personal Data is transferred to QwikCut in the United States and the transfer is not covered by an applicable adequacy decision or another lawful transfer mechanism, the Standard Contractual Clauses adopted by the European Commission in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “EU SCCs”) are incorporated into this DPA without modification except for the selections and information expressly permitted by the EU SCCs.

A.4 The EU SCCs are configured as follows:

Module Two (Controller to Processor) applies.
Clause 7 (Docking Clause) applies.
Clause 9(a), Option 2 (General Written Authorization) applies. QwikCut will provide reasonable advance notice of intended additions or replacements of subprocessors as described in Section 5.
Clause 11(a) optional independent dispute-resolution language does not apply unless the parties expressly agree otherwise.
For Clause 17, Option 1 applies. The governing law is the law of Ireland, an EU Member State whose law allows third-party beneficiary rights.
For Clause 18(b), disputes arising from the EU SCCs will be resolved by the courts of Ireland. A data subject retains the rights provided by Clause 18(c).
For Annex I.C, the competent Supervisory Authority will be determined under Clause 13 of the EU SCCs based on the establishment or, where applicable, representative or location of affected data subjects of the applicable Data Exporter.

A.5 For purposes of the EU SCC Appendix: Annex I.A is completed by the Customer and QwikCut details in this DPA together with the applicable Agreement, Sales Order, or accession identifying the Customer’s legal name, address, contact details, role, and acceptance date. Annex I.B is completed by Schedule 1, Annex II by Schedule 2, and Annex III by Schedule 3. The parties will supply missing mandatory Appendix details before relying on the SCCs for a particular transfer.

A.6 The parties agree that the authoritative EU SCC text is the text set out in the Annex to Commission Implementing Decision (EU) 2021/914, as published in the Official Journal of the European Union. That official text is incorporated into this DPA as if set out in full. The parties may retain or attach a copy of the official text for convenience, but no convenience copy modifies the authoritative text.

A.7 QwikCut and Customer will comply with Clause 14 of the EU SCCs. QwikCut’s transfer impact assessment and documented supplementary measures may be used to support the parties’ assessment where applicable.

A.8 If the European Commission replaces or updates the EU SCCs, the parties may use the successor clauses or another lawful transfer mechanism as required by Applicable Data Protection Law.

B. Additional Jurisdictions

If another jurisdiction requires supplemental contractual terms for QwikCut’s processing of Customer Personal Data, the parties may add the applicable terms to this Schedule 4 without changing the remainder of the DPA. Any such terms apply only to processing governed by that jurisdiction’s Applicable Data Protection Law.