This Data Processing Agreement ("DPA") is between the subscribing golf club (the "Club", controller) and Optimisation Australia Pty Limited (ABN 94 116 927 354), trading as oa agency, operating HoleMarked ("HoleMarked", processor). It forms part of the HoleMarked Terms of Service.
1. Subject matter
HoleMarked processes personal data on behalf of the Club to provide the HoleMarked Service.
2. Duration
This DPA applies for as long as HoleMarked processes Club personal data, including any period after the subscription ends until deletion or return.
3. Nature and purpose
Hosting, storing, organising and displaying data so members can complete rules and etiquette quizzes, view club local rules, appear on leaderboards, hold a Holemark Pass, and so committee officials can manage settings, members and invites. This includes sending invites and service emails.
4. Data types and data subjects
Data subjects: club members, invited members and committee officials.
Data types: names, email addresses, quiz progress and scores, leaderboard positions, Holemark Pass status, sign in data and technical data.
The Club must not upload special category or sensitive information.
5. Processor obligations
HoleMarked will:
- process personal data only on the Club's documented instructions, including these terms and the Club's use of the Service, unless required by law;
- ensure people authorised to process the data are bound by confidentiality;
- apply appropriate technical and organisational security measures, including encryption in transit, access controls and backups;
- use sub processors only under written terms with equivalent protections, and give the Club notice of new or replaced sub processors so it can object;
- assist the Club, taking into account the nature of processing, with data subject rights requests, security, breach notification and impact assessments;
- notify the Club of a personal data breach without undue delay after becoming aware of it, with the information reasonably available;
- at the end of the Service, delete or return Club personal data at the Club's choice, unless law requires retention;
- make available information reasonably needed to show compliance and allow for audits, including inspections, on reasonable notice and at reasonable intervals.
6. International transfers
Where Club personal data subject to the UK GDPR or EU GDPR is transferred to a country without an adequacy decision, the parties rely on the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, as applicable, which are incorporated by reference where needed.
7. Australian Privacy Act alignment
For personal information subject to the Privacy Act 1988 (Cth), HoleMarked will handle it consistently with the Australian Privacy Principles, take reasonable steps to protect it from misuse, interference, loss and unauthorised access, and cooperate with the Club in assessing and notifying eligible data breaches under the Notifiable Data Breaches scheme.
8. Sub processors
HoleMarked currently uses the following sub processors:
| Sub processor | Purpose | Data |
|---|---|---|
| Lovable (Lovable Labs Incorporated) | Website and application hosting, delivered through Cloudflare's network | All Service data in transit and the application |
| Supabase (via Lovable Cloud) | Database, sign in and file storage | Member and official names, email addresses, quiz progress, leaderboard and Holemark Pass data, club logos and settings |
| Resend | Sending invites and service emails | Names and email addresses of invited members and officials |
| Crisp | Live chat on the website and app | Messages, and contact details people choose to give in chat |
| Paddle.com | Checkout, payments, invoicing and tax as Merchant of Record | Billing contact details for the Club (no member data) |
- Lovable (Lovable Labs Incorporated)
- PurposeWebsite and application hosting, delivered through Cloudflare's network
- DataAll Service data in transit and the application
- Supabase (via Lovable Cloud)
- PurposeDatabase, sign in and file storage
- DataMember and official names, email addresses, quiz progress, leaderboard and Holemark Pass data, club logos and settings
- Resend
- PurposeSending invites and service emails
- DataNames and email addresses of invited members and officials
- Crisp
- PurposeLive chat on the website and app
- DataMessages, and contact details people choose to give in chat
- Paddle.com
- PurposeCheckout, payments, invoicing and tax as Merchant of Record
- DataBilling contact details for the Club (no member data)
We will update this list and notify the Club before adding or replacing a sub processor.
9. Club obligations
The Club confirms it has a lawful basis for the processing and has given members any notices required, including for invites.
10. Acceptance
The Club accepts this DPA when a committee official ticks the acceptance box during club setup. The person ticking confirms they are authorised to bind the Club.
11. Contact
Questions about this DPA: get@holemarked.com.