Data Processing Agreement
Version 2026-09-29.
1. Who is who
The Club is the controller. It decides what is held about its members and why.
Rondas Exports Ltd (Registered in England and Wales, company number 14519851, registered office 158 The Parklands, Dunstable, LU5 4GW, United Kingdom), trading as EveryDojo, is the processor. It processes that data only on the Club's instructions.
Where EveryDojo deals with someone directly for its own purposes — an account login, or billing the Club for the software — EveryDojo is a controller for that limited data.
2. What is processed, and for how long
Member records: names, dates and places of birth, addresses, contact numbers, emergency contacts, nationality, governing-body licence details, grade history, attendance, payment method and status, messages, photographs, and health declarations, which are special category data under Article 9.
Data subjects include children, their parents and guardians, and club staff.
Processing continues while the Club has an active account, and for the retention period the Club sets after a member leaves.
3. What EveryDojo commits to
- Process the data only on the Club's documented instructions.
- Keep everyone with access under a duty of confidentiality.
- Maintain appropriate security measures, published openly at everydojo.com/security.
- Not add another subprocessor without telling the Club. The current list is at everydojo.com/subprocessors and forms part of this agreement.
- Help the Club respond to access, correction, erasure and portability requests.
- Report any personal data breach to the Club within 24 hours of becoming aware of it, with enough detail for the Club to meet its own 72-hour duty to the ICO.
- On termination, delete or return the data at the Club's choice.
- Make available what the Club needs to verify compliance, and allow audits on reasonable notice.
4. Where the data is stored
EveryDojo's database is hosted in the United States. Personal data about your members, including children and health information, is transferred outside the UK.
EveryDojo relies on its infrastructure providers' standard data protection terms for that transfer. By accepting this agreement the Club instructs EveryDojo to make it. The Club will be told if where data is stored ever changes.
This is stated prominently rather than buried in a schedule. A club handing over children's health data should know where it goes and decide knowingly.
5. What the Club commits to
- Have a lawful basis for what it collects, including an Article 9 condition for health data, and give its members the privacy information they are entitled to.
- Grant the Safeguarding, Finance and Register roles only to appropriate people, and review them.
- Set a retention period for departed members and keep records accurate.
- Not instruct EveryDojo to do anything that would breach data protection law.
6. Term and governing law
This agreement takes effect when the Club accepts it and continues while EveryDojo processes the Club's data. It is governed by the law of England and Wales.
Questions: hello@everydojo.com.