Data processing agreement

Effective date: 10 November 2026 · Last updated: 10 November 2026

This Data Processing Agreement ("DPA") forms part of the Noventa Pro Terms of Service between FluxiCode FZE, Block B, B33-063, SRTIP, Sharjah, United Arab Emirates ("FluxiCode", "we"), and the organisation that orders the service (the "Customer"). The Customer accepts it when it accepts the Terms.

1. Definitions

Terms such as personal data, processing, controller, processor and data subject have the meanings given in the applicable Data Protection Law. "Data Protection Law" means UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Egyptian Law No. 151 of 2020 on the Protection of Personal Data and their implementing regulations, and any other data protection law that applies to the processing. "Customer Data" means personal data in the footage, rosters and other content the Customer uploads, and the analysis outputs derived from it.

2. Roles

1. The Customer is the controller of Customer Data. FluxiCode processes it as processor, on the Customer's behalf.
2. FluxiCode is a separate controller for its account, billing, security and support data, and for Customer Data used to train its models under a recorded training consent (section 9). The Privacy Policy covers that processing.

3. Details of processing

4. FluxiCode's obligations

FluxiCode will:

1. process Customer Data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use of the service, and tell the Customer if it believes an instruction breaks the law;
2. ensure everyone with access to Customer Data is bound by confidentiality;
3. apply the security measures in Annex 1;
4. help the Customer, as far as reasonably possible, to respond to data subject requests, carry out impact assessments and consult authorities;
5. notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data, with the information then available;
6. honour takedown requests for share links and highlight reels within 48 hours, by revoking, blurring or removing the content;
7. make available the information reasonably needed to show compliance with this DPA, and allow one audit or inspection per year on 30 days' notice, at the Customer's cost, unless a breach or regulator requires more.

5. Customer's obligations

The Customer:

1. is responsible for having a lawful basis for the footage and rosters it uploads, and for giving data subjects any notice the law requires;
2. must obtain, before upload, the consent of each adult rostered player and of the parent or guardian of each rostered player under 18, for each use it enables: sharing, highlight reels and model training;
3. must record those consents accurately in the service and update them when withdrawn;
4. must have the right to record and upload the footage, including any permission from the venue, league or competition organiser;
5. must not upload footage that is unlawful or that it has no right to use;
6. must answer data subject requests about Customer Data, with FluxiCode's help.

6. Sub-processors

1. The Customer authorises FluxiCode to use the sub-processors listed in Annex 2.
2. FluxiCode will give at least 30 days' notice by email before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected service and receive a pro-rata refund of prepaid, unused fees.
3. FluxiCode will bind each sub-processor to data protection terms no less protective than this DPA and remains responsible for its performance.

7. International transfers

Customer Data is stored and processed in data centres in the European Union. FluxiCode will transfer Customer Data outside the UAE or Egypt only to countries with adequate protection, or with appropriate contractual safeguards, and, for data subject to Egyptian law, under the licences and permits that law requires.

8. Data subject requests

If FluxiCode receives a request about Customer Data directly, it will pass it to the Customer within 5 business days and not respond itself, except to confirm receipt, act on a takedown under section 4.6, or as the law requires.

9. Model training

FluxiCode will use Customer Data to train or improve its models only where the Customer has recorded a training consent for the rostered player concerned. For that use FluxiCode acts as an independent controller. Players who are not on the roster are not used for training in any way that identifies them. When consent is withdrawn, FluxiCode removes the footage from future training sets within 30 days.

10. Anonymised benchmarking

1. Where the Customer has accepted this DPA and has given its consent to anonymised benchmarking in its privacy settings, FluxiCode may combine season figures calculated from the Customer's approved matches with those of other customers that have done the same, grouped by position and by year of birth, to show each taking-part customer percentiles for its own players and teams. For this use FluxiCode acts as an independent controller.
2. Only figures calculated from matches analysed on the platform are used: no names, footage, contact details or data from outside the platform. A customer is never shown another customer's identity, players, matches or years of birth, or the figures of any single player of another customer. A group is shown only above a minimum size, when it draws on at least three customers and no single customer provides more than half of it.
3. FluxiCode stores no result of the comparison for any single player; it is calculated when it is read.
4. The Customer may withdraw its consent at any time in its privacy settings. Its data leaves the comparison from the next calculation, and there is nothing stored to delete. A later version of this DPA that the Customer has not accepted pauses its taking part until it accepts.

11. Deletion and return

1. Raw uploaded video is deleted 30 days after delivery; unpaid uploads are deleted after 7 days.
2. On termination, or on the Customer's written request, FluxiCode will delete the remaining Customer Data within 30 days, unless the law requires it to be kept. Before deletion, the Customer may download its reports and clips.
3. Copies in backups are overwritten within 35 days and are not restored except for disaster recovery.
4. On request, FluxiCode will confirm deletion in writing.

12. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service. If this DPA and the Terms conflict on data protection, this DPA prevails.

Annex 1: Security measures

• Encryption in transit (TLS 1.2 or higher) and at rest for all storage holding Customer Data.
• Video delivered only through signed, time-limited URLs; no direct public access to storage.
• Each organisation's data separated by access controls tested with an authorisation test suite.
• Staff access by role and least privilege, with sign-in by one-time code and logging of access to footage.
• Draft analyses visible only to reviewers until approved.
• Automatic deletion rules for raw video and unpaid uploads.
• Error monitoring and an incident response procedure.

Annex 2: Sub-processors

The Customer authorises sub-processors in these categories:

FluxiCode gives the Customer the current list of named sub-processors on request at info@fluxicode.com, and notifies changes under section 6.2.

Our payment provider processes payments as an independent controller and is not a sub-processor.