This Data Processing Agreement forms part of the ClubTrack agreement between MFG Developments and the Customer.
1. Roles and scope
The Customer determines the purposes and authorised use of Customer Data. MFG Developments processes Customer Data to provide, secure and support ClubTrack and as otherwise documented in the agreement or lawfully instructed by the Customer.
Processing may include collection from the Customer, storage, organisation, access, transmission, backup, retrieval, support access, deletion and de-identification.
2. Customer instructions and obligations
- provide lawful, documented instructions and not require processing that would breach applicable law;
- ensure it has authority and any required consent to disclose Customer Data to MFG Developments;
- provide collection notices and manage individual rights and requests;
- limit Customer Data to information reasonably necessary for its purposes;
- configure and review access permissions and security settings; and
- notify MFG Developments of special handling requirements before uploading unusually sensitive information.
3. MFG Developments obligations
- process Customer Data only for the documented purposes and lawful instructions;
- ensure personnel with access are bound by confidentiality and receive appropriate training;
- maintain reasonable security controls appropriate to the nature and risk of the data;
- maintain records of material subprocessors and processing locations;
- provide reasonable information demonstrating compliance, subject to security and confidentiality restrictions;
- assist with relevant access, correction, deletion and incident requests where reasonably necessary; and
- delete or return Customer Data after termination in accordance with the agreement and retention policy.
4. Security measures
The security program will include, as appropriate: identity and access management; least privilege; multi-factor authentication; encryption in transit and at rest; logging and monitoring; secure development and change management; vulnerability and patch management; backups and recovery; incident response; supplier controls; staff confidentiality; and periodic testing.
5. Subprocessors
MFG Developments will impose appropriate confidentiality, privacy and security obligations and remains responsible for its contractual obligations.
The Customer may raise a reasonable, evidence-based objection relating to privacy or security. The parties will work in good faith on a commercially reasonable solution.
Due to the nature of the data stored within ClubTrack, subprocessors are not published. They may be discussed on request with the account administrator.
6. Security incidents
MFG Developments will notify the Customer without undue delay after confirming unauthorised access to, disclosure of, alteration of, loss of or destruction of Customer Data that materially affects the Customer.
The notification will include information reasonably available about the nature of the incident, affected data, containment, likely consequences and remediation. Information may be provided progressively as the investigation continues.
The Customer remains responsible for determining whether it must notify individuals, regulators, insurers or other parties, except for obligations that apply directly to MFG Developments. The parties will cooperate to avoid inconsistent or premature communications.
7. Individual requests
Where a request relates to data controlled by the Customer, MFG Developments may refer the requester to the Customer. On request, MFG Developments will provide reasonable assistance using available platform functions or agreed professional services.
8. Return, export and deletion
The Customer may export Customer Data during the subscription using available functions. Following termination, MFG Developments will provide the standard export and deletion process in the Terms of Service and Data Retention & Deletion Policy.
Deletion from backups may occur through scheduled overwrite rather than immediate deletion, provided backup data remains protected and is not restored except for continuity, recovery or legal reasons.
9. Audit and assurance
On reasonable written request no more than once annually, MFG Developments will provide relevant security questionnaires, policies, test summaries or independent assurance information that it can lawfully disclose. On-site or intrusive audits require a demonstrated material concern, reasonable scope and notice, confidentiality safeguards and reimbursement of reasonable costs.
Schedule A: Processing details
Subject matter: Provision of the ClubTrack SaaS platform and subscribed services.
Duration: Subscription Period plus permitted retention and backup periods.
Individuals: Club members, applicants, visitors, juniors, parents/guardians, emergency contacts, staff, volunteers, suppliers and other authorised users.
Data categories: Identity, contact, membership, attendance, event, training, licence, firearm-related, communications, billing references, authentication, audit and support information.
Sensitive or higher-risk data: Firearm licence, national police checks, junior information and personal information.
Processing locations: Australian server data centres.