Club Data Processing and Privacy Agreement

My EOI is operated and provided by Laundro Group Pty Ltd (ABN 75 687 684 546). The participating sporting club identified in the applicable account, subscription, order, onboarding record or signed agreement is the "Club".

This agreement applies when an authorised Club representative expressly accepts it through My EOI onboarding or subscription, or when it is incorporated into another binding Club agreement. The accepting representative confirms that they have authority to act for the Club. Once this agreement applies, the Club instructs and authorises My EOI to process Applicant Data for the documented purposes described below and in accordance with the Club's lawful documented instructions.

Through the applicable account or invitation flow, an individual User agrees to the Terms & Conditions and Acceptable Use Policy, and acknowledges that personal information will be handled as described in the Privacy Policy and any applicable collection notice. Creating or using an individual account does not by itself bind a Club unless the User is authorised to act for the Club and expressly accepts this agreement on its behalf.

This agreement does not operate as blanket consent to every handling of personal information. Where applicable law requires specific consent or another legal authority, the responsible party must obtain it separately.

• Applicant Data means personal information submitted, created or managed for a Club EOI, applicant, player, parent, guardian, coach, trial, review, message, offer or related Club workflow
• Club means the sporting club, association or organisation using My EOI under the Club Agreement
• Club User means a person authorised by the Club to use its My EOI workspace
• My EOI means the service operated by Laundro Group Pty Ltd (ABN 75 687 684 546)
• Data Protection Law means privacy, data protection, spam, health-record and breach-notification law that applies to a party or the relevant processing
• Security Incident means confirmed or reasonably suspected unauthorised access, loss, disclosure, alteration or destruction of Applicant Data
• Subprocessor means a provider engaged by My EOI to process Applicant Data in delivering the service

Controller and processor have the meanings given by an applicable data-protection law. Australian privacy law may instead regulate each entity that collects or holds personal information, regardless of these labels.

The Club determines the purpose and content of its EOIs, the information it asks applicants to provide, its access permissions, recruitment and trial processes, sporting assessments, communications, offers and selection decisions. For these activities, the Club is responsible for its collection and use of Applicant Data and, where the terminology applies, is the controller.

My EOI processes Applicant Data to provide, secure, support and administer the Club's requested service. To the extent My EOI processes Applicant Data solely on the Club's documented instructions, My EOI acts as the Club's processor or service provider.

My EOI acts independently for its accounts, authentication, billing, platform security, fraud prevention, support administration, audit, legal compliance, service analytics, public-directory moderation and its own consent-based marketing. Each party remains responsible for obligations imposed directly on it by law.

The processing continues for the term of the Club Agreement and any limited retention or transition period described in this agreement.

• Subject matter: operating a platform for EOIs, applicant profiles, reviews, trials, messaging, offers and related Club workflows
• Nature: collection, recording, organisation, storage, retrieval, access, communication, review, export, restriction, de-identification and deletion
• Purpose: providing the service selected by the Club, supporting authorised users, maintaining security and meeting agreed legal or operational requirements
• People: applicants, players, coaches, parents, guardians, family members, Club Users, referees and other people identified in Club content
• Information: identity and contact data, dates of birth, location, sporting history, preferences, custom responses, guardian data, images, links, notes, messages, trial and review records, offers, consent records and technical metadata

Sensitive information is not part of the standard service unless the Club deliberately configures a lawful field or workflow that requires it. The Club must notify My EOI before using the service for systematic health, criminal-record, biometric or other sensitive-information processing.

The Club instructs My EOI to process Applicant Data as reasonably necessary to provide the configured service, comply with the Club's lawful use of product features and follow additional written instructions accepted by My EOI.

My EOI will process Applicant Data only on documented Club instructions unless processing is required or authorised by law or falls within an independent My EOI purpose disclosed in the Privacy Policy.

If My EOI reasonably considers an instruction unlawful, insecure, technically infeasible or outside the agreed service, it may suspend that instruction and explain the concern. The parties will work in good faith to agree a lawful alternative.

The Club must:

• Have a lawful and fair basis for every field, upload and use of Applicant Data
• Provide applicants with an accurate Club collection notice and any consent wording required for sensitive information, media or children
• Collect only information reasonably necessary for the explained sporting purpose
• Verify and regularly review Club Users, permissions and trial assignments
• Ensure Club Users are trained, bound by confidentiality and subject to appropriate child-safety requirements
• Use and export Applicant Data only for legitimate Club purposes and protect any exported copy
• Respond to sporting, recruitment and Club-record requests and coordinate privacy requests with My EOI
• Notify My EOI promptly of suspected misuse, unauthorised access or inaccurate Club information
• Comply with applicable privacy, health-record, spam, child-safety and sporting laws

The Club must not ask applicants to place medical records, identity documents or other highly sensitive material in a general-purpose field without first agreeing an appropriate secure process with My EOI.

My EOI will:

• Provide the agreed service and process Applicant Data consistently with this agreement
• Restrict personnel access to people who require it for authorised support, security, administration or legal purposes
• Require personnel with access to preserve confidentiality
• Maintain reasonable technical and organisational security measures appropriate to the service and risk
• Assist the Club, taking account of the nature of the processing and information available, with rights requests, privacy assessments and breach obligations
• Maintain records reasonably needed to demonstrate its compliance with this agreement
• Inform the Club of a material change to Applicant Data processing or subprocessors where required by the Club Agreement

My EOI's security program will include measures appropriate to the nature and risk of the service, which may include:

• Authentication, role-based permissions and Club-level access controls
• Database rules and separation of Club workspaces
• Encryption in transit and provider-managed encryption at rest where supported
• Restricted privileged access, audit records and monitoring
• Secure development, dependency maintenance, backups and recovery processes
• Incident response, provider oversight and periodic access review

No security measure eliminates all risk. Each party must use the service securely and promptly remediate a vulnerability or access issue within its control.

The Club generally authorises My EOI to use subprocessors reasonably required to provide hosting, storage, authentication, email, payments, analytics, support and other service functions.

My EOI will use written or electronic terms intended to impose appropriate confidentiality, security and data-handling obligations on subprocessors. My EOI remains responsible for managing its subprocessor relationships to the extent required by applicable law and the Club Agreement.

Some subprocessors may process information outside Australia. My EOI will maintain information about its material provider categories and likely processing locations and will take reasonable steps required by applicable cross-border privacy law.

My EOI will provide reasonable assistance for an access, correction, deletion, withdrawal or complaint request concerning Applicant Data. The Club remains responsible for decisions about its independent records, assessment notes, selection decisions and legal retention requirements.

If either party receives a request relating primarily to the other party's handling, it will promptly route or coordinate the request where lawful. The parties will verify identity and avoid disclosing another person's information.

A party that becomes aware of a Security Incident affecting Applicant Data will notify the other without undue delay and provide information reasonably available about the nature, affected information and people, likely consequences, containment and remediation.

The parties will preserve relevant evidence, cooperate with assessment and take reasonable containment and remediation steps. Neither party will notify a regulator or affected person on behalf of the other without consultation unless immediate notice is legally required.

The parties will agree which party leads communications. This allocation does not remove an independent legal notification obligation.

During the subscription, the Club may use available export functions for Applicant Data it is authorised to retain. The Club must secure exported data and manage it under its own retention policy.

Following termination, My EOI may provide a limited export or transition period where included in the Club Agreement. After that period, My EOI may delete, anonymise, de-identify, archive or restrict Applicant Data in accordance with its documented retention schedule, backup cycles, security requirements and legal obligations.

My EOI may retain limited billing, audit, security, dispute and legal records where reasonably necessary. Data in protected backups may remain until the applicable backup cycle expires and will not be restored for ordinary use after a valid deletion decision.

On reasonable written request, My EOI will provide information reasonably necessary for the Club to assess compliance with this agreement, subject to confidentiality, security, privilege and third-party restrictions.

Any audit must be proportionate, coordinated in advance, avoid access to another club's information and not unreasonably disrupt the service. The requesting Club is responsible for its audit costs unless a material breach by My EOI is established.

My EOI will not use identifiable Applicant Data to train a general-purpose artificial-intelligence model under this agreement without separate notice, a documented lawful basis and any Club authorisation or individual consent required by law.

Before introducing a tool that makes or materially assists a decision that could significantly affect an applicant, the parties will document the purpose, information used, human oversight, transparency, testing and rights required by applicable law.

The Club remains responsible for final sporting, trial, recruitment and selection decisions.

If this agreement conflicts with the general Terms about the processing of Applicant Data, this agreement prevails to the extent of the conflict. The remaining commercial liability, indemnity and dispute terms are governed by the Club Agreement and applicable law.

My EOI may propose changes where services or legal requirements change. A material change will apply as provided in the Club Agreement and will not retrospectively authorise an unrelated use of Applicant Data.

Questions about this agreement or privacy responsibilities can be sent to richard@myeoi.co.