Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") forms part of the agreement between:

• Customer / Team Owner: the organisation, team or person that creates and manages a Race Planner team workspace.
• LasseGashi Racing Team, organisation number 937 565 259, registered in Norway, operating LGRacingTeam Race Planner ("LGRacingTeam").

For privacy and DPA questions, contact privacy@lgracingteam.com.

2. Roles Under GDPR

For customer-controlled team content, the Customer is the data controller and LGRacingTeam is the data processor. Customer-controlled team content may include invited users, driver lists, optional phone numbers, role assignments, planner notes, race settings and stint plans.

LGRacingTeam remains an independent controller for account administration, authentication, platform security, billing status, trial-abuse prevention, service analytics needed to operate the platform, and legal/compliance records.

3. Subject Matter and Duration

LGRacingTeam processes personal data to provide the Race Planner service, including team workspaces, planner access, authentication, role-based permissions, realtime sync, invite handling, support, security and billing-related access control.

This DPA applies for as long as LGRacingTeam processes personal data on behalf of the Customer, unless longer retention is required by law, security, billing, dispute handling or legitimate abuse-prevention purposes.

4. Categories of Personal Data

• Email address.
• First name and last name.
• Optional phone number.
• Team membership, role and planner access.
• Invite records and account status.
• Planner data entered by the team, such as driver cards, race settings, stint plans and notes.
• Authentication, device/session, security and operational logs.
• Billing identifiers and subscription status when subscriptions are enabled.

5. Categories of Data Subjects

• Team Owners.
• Admins.
• Race Control users.
• Drivers.
• Viewers.
• Invited users who have not yet accepted an invite.

6. Customer Instructions

LGRacingTeam will process customer-controlled personal data only to provide and secure the Race Planner service, comply with this DPA and the Terms & Privacy Notice, follow documented Customer instructions, or comply with legal obligations.

The Customer is responsible for ensuring that personal data entered into the service is lawful, accurate and limited to what is necessary for race planning and team coordination.

7. Confidentiality

LGRacingTeam will ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations and only access data where needed to operate, support, secure or improve the service.

8. Security Measures

LGRacingTeam uses appropriate technical and organisational measures designed to protect personal data, including:

• Email/password authentication and password reset flows.
• Role-based access controls.
• Team-scoped database access and security policies.
• Billing/subscription access gates.
• Session/device controls.
• Transport encryption provided by hosting and platform infrastructure.
• Operational logging for security and troubleshooting.
• Restricted use of privileged service credentials.

9. Sub-processors

The Customer authorises LGRacingTeam to use sub-processors needed to provide the service. Current or intended sub-processors include:

• Supabase: database, authentication, realtime sync, security logs and backend infrastructure. Current primary database region: EU West, Ireland.
• SiteGround: website/app hosting, domain/email infrastructure and operational email delivery, depending on configuration.
• Stripe: payment processing, invoices, customer portal, subscription status and payment-related records when subscriptions are enabled.

LGRacingTeam will use commercially reasonable efforts to ensure sub-processors are bound by appropriate data protection obligations. If a new material sub-processor is added, LGRacingTeam will update the public Terms/DPA or otherwise provide reasonable notice.

10. International Transfers

Some sub-processors may process personal data outside Norway or the EEA. Where required, LGRacingTeam relies on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions or equivalent contractual protections.

11. Assistance With Data Subject Rights

LGRacingTeam will provide reasonable assistance to help the Customer respond to data subject requests related to customer-controlled team data, taking into account the nature of the processing and the functionality available in the service.

Users may also contact privacy@lgracingteam.com directly for privacy requests.

12. Personal Data Breach

If LGRacingTeam becomes aware of a personal data breach affecting customer-controlled personal data, LGRacingTeam will notify the affected Customer without undue delay after becoming aware of the breach.

Where GDPR requires notification to a supervisory authority, LGRacingTeam aims to support notification within 72 hours after becoming aware of the breach. If a breach is likely to result in a high risk to affected individuals, LGRacingTeam will assist with user notification where legally required.

13. Deletion and Return of Data

On termination of the service or upon valid request, LGRacingTeam will delete or return customer-controlled personal data where reasonably possible, unless continued retention is required for legal obligations, billing/accounting records, security, audit logs, dispute handling, legal claims or prevention of repeated trial abuse.

Team Owners and authorised users may delete certain team/planner data directly in the app where functionality is provided.

14. Audit and Documentation

LGRacingTeam will make reasonable information available to demonstrate compliance with this DPA. Any audit request must be reasonable, proportionate, avoid disruption to the service, protect other customers' data and be subject to appropriate confidentiality obligations.

15. Customer Responsibilities

• Use the service only for lawful race planning and team coordination.
• Invite only users who should have access to the team or planner.
• Assign roles carefully and remove users who no longer need access.
• Avoid entering unnecessary sensitive personal data.
• Keep login credentials secure and report suspected unauthorised access.

16. Governing Law

This DPA is governed by Norwegian law, unless mandatory data protection law provides otherwise.

17. Contact

DPA and privacy requests: privacy@lgracingteam.com

General contact: mail@lgracingteam.com