Data Processing Addendum

Last updated: 26 July 2026

This service is operated by SLIEMA LABS PTY LTD (ACN 696 584 166) as trustee for the Spiteri Family Trust (ABN 12 525 966 898). ClubStats™ is a trade mark of SLIEMA LABS PTY LTD.

Roles

The Customer (Club) acts as the Data Controller. ClubStats acts as the Data Processor.

Scope of Processing

ClubStats processes personal data only to provide the platform and associated services.

Third Party Data Imports

Where the Customer enables authorised imports from third party systems, processing is based on the data and access made available through those systems.

Import behaviour may evolve over time as connected systems and their available data change.

Instructions

Data is processed only on documented instructions from the Customer.

Customer Data Warranty

The Customer confirms that it has the appropriate rights and consents to provide personal data for processing.

Subprocessors

We may use third party providers to support service delivery, subject to appropriate obligations.

Security

Appropriate measures are implemented including encryption, access controls, and monitoring.

Backup and Disaster Recovery

Customer Data is protected by two independent backup layers, designed so that the club's history is not dependent on a single system remaining healthy.

Continuous protection, day to day. The hosted database is backed up continuously, with recovery points covering the previous seven days and available within minutes. This layer is intended to address accidental changes, technical faults, and similar day-to-day recovery scenarios.

Independent offsite backup, every night. In addition, a complete copy of the master and active tenant databases is created each night and stored separately from the primary hosting environment. This provides a separate recovery path for a serious incident affecting the primary infrastructure.

Backups are encrypted in transit and at rest. Recovery time depends on the nature and scope of an incident, the selected recovery point, provider availability, and the validation required before service is restored.

Data Subject Rights

We assist customers with access, correction, deletion, and portability requests.

Data Breach

If we become aware of a notifiable data security incident affecting Customer Data, we will notify the Customer without undue delay.

Data Retention

Data is retained only as necessary to provide services.

Deletion or Return

Upon termination, data will be returned or deleted within a reasonable timeframe.

International Transfers

Where data is transferred internationally, appropriate safeguards are applied.

If you have questions, contact [email protected].