Policies
Data Processing Agreement.
How GoFathom handles personal data on behalf of the organisations that use it, and the commitments each side makes.
- Last Updated
- October 2026
- Company
- GoFathom Ltd
- Company Number
- 14466293
- ICO Registration
- ZB631188
- Contact
- [email protected]
This Data Processing Agreement (“DPA”) forms part of the GoFathom Subscription Agreement (the “Agreement”) between GoFathom Ltd (company number 14466293, ICO registration ZB631188) (“GoFathom”) and the Customer identified in the Order Form (“Customer”).
It sets out how GoFathom handles personal data on the Customer’s behalf when providing the Services, and the commitments each Party makes to comply with Data Protection Laws.
1. Definitions
Capitalised terms not defined in this DPA have the meanings given in the Agreement. In this DPA:
- “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” and “Special Category Data” have the meanings given in the UK GDPR.
- “Customer Personal Data” means Personal Data contained in Customer Data that GoFathom Processes on behalf of the Customer under clause 2.1.
- “Feed Content” means posts, feedback, comments, media and reports published to a player’s feed.
- “Restricted Transfer” means a transfer of Customer Personal Data to a country outside the UK that is not covered by UK adequacy regulations.
- “Sub-processor” means any third party appointed by GoFathom to Process Customer Personal Data.
- “Transfer Mechanism” means the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum, or any other mechanism permitted under Data Protection Laws.
- “Wellbeing Data” means answers given by or about a player through the Services’ wellbeing check-in features, any notes added to them, and any flags or measures derived from them.
2. Roles of the Parties
2.1 GoFathom as Processor. When providing the Services to the Customer, the Customer is the Controller and GoFathom is the Processor of Customer Personal Data. This includes player profiles, attendance, Wellbeing Data, assessments and assessment results, internal coach notes (including voice notes and their transcripts), training data and player information that the Customer and its Authorised Users upload to or create within the Services.
2.2 GoFathom as independent Controller. GoFathom acts as an independent Controller, and not as the Customer’s Processor, when it Processes Personal Data for its own purposes, namely:
(a) creating and administering user accounts, billing, support and service communications;
(b) creating and using Usage Data and anonymised data to operate and improve the Services;
(c) safeguarding, preventing fraud or misuse, and complying with legal obligations.
For this Processing, GoFathom complies with Data Protection Laws and its Privacy Policy, and is responsible for its own compliance.
2.3 Wellbeing Data stays with the Customer. Wellbeing Data, assessment results and internal coach notes are not Feed Content. They are not shared across organisations, and GoFathom Processes them only as the Customer’s Processor.
2.4 Joint Controllers. The Customer and GoFathom are joint Controllers of Feed Content because:
(a) the Customer, through its coaches, decides what Feed Content to publish and why; and
(b) GoFathom decides how Feed Content is made available to families and, in line with the privacy controls chosen by coaches and families, to coaches in other organisations, and how long it is kept.
The Parties’ respective responsibilities are set out in Annex 4, which is their arrangement under Article 26 UK GDPR. Clauses 3 to 11 of this DPA do not apply to Feed Content except where Annex 4 says they do.
2.5 Details of Processing. The subject matter, duration, nature and purpose of the Processing, and the types of Personal Data and categories of Data Subjects, are set out in Annex 1.
3. Customer obligations
3.1 The Customer is responsible for ensuring it has a lawful basis for the Processing it instructs GoFathom to carry out, including, where required, consent from parents or guardians for any Data Subject under 18.
3.2 Special Category Data. The Services’ wellbeing check-ins record a player’s sleep, mood, physical state, motivation and sources of stress; whether they have a knock or injury, and to which body part; and free-text notes. This is health data and therefore Special Category Data. Where the Customer turns on wellbeing check-ins, the Customer is responsible for having a valid condition for Processing it under Article 9 UK GDPR, such as explicit consent from the parent or guardian, and for telling players and families what is collected and why.
3.3 The Customer will ensure its instructions to GoFathom comply with Data Protection Laws.
3.4 Configuration. The Customer’s choices in the Services are part of its instructions under clause 4.1. These include whether to turn on wellbeing check-ins; which assessments to record; whether to show leaderboards, and how players’ names appear on them; and which assessments are internal only. The Customer is responsible for those choices being appropriate for the ages of its players.
4. GoFathom’s obligations as Processor
When Processing Customer Personal Data as a Processor, GoFathom will:
4.1 Instructions. Process Customer Personal Data only on the Customer’s documented instructions, unless required to do otherwise by law. Those instructions are given by the Agreement, this DPA and the Customer’s use and configuration of the Services. GoFathom will tell the Customer if it believes an instruction breaches Data Protection Laws, unless the law prevents this.
4.2 Confidentiality. Ensure that anyone it authorises to Process Customer Personal Data is bound by a duty of confidentiality.
4.3 Security. Implement appropriate technical and organisational measures to protect Customer Personal Data, including those set out in Annex 2.
4.4 Data Subject requests. Taking into account the nature of the Processing, assist the Customer by appropriate measures in responding to requests from Data Subjects to exercise their rights. If GoFathom receives a request directly that relates to Customer Personal Data, it will pass it to the Customer without undue delay, unless the request also relates to Processing for which GoFathom is a Controller.
4.5 Other assistance. Provide reasonable assistance to the Customer with data protection impact assessments, prior consultations with the Information Commissioner’s Office, and the Customer’s security obligations, taking into account the nature of the Processing and the information available to GoFathom.
4.6 Records. Maintain records of its Processing activities as required by Data Protection Laws.
5. Children’s data
5.1 GoFathom recognises that most Data Subjects whose data is Processed through the Services are children. GoFathom designs and operates the Services with regard to the Information Commissioner’s Age Appropriate Design Code, including high-privacy default settings, parental oversight and control, and player feeds, Wellbeing Data and internal coach notes that are never visible to other players.
5.2 GoFathom will not use Personal Data of children for marketing, advertising or profiling unrelated to the coaching services provided.
5.3 Comparison features. Assessments and leaderboards are set up by the Customer, and leaderboards show only results from the Customer’s own assessments. Assessment results are shown to other players only where the Customer turns on a leaderboard, and only in the form the Customer chooses. Group averages are shown only where at least three players have a result.
5.4 Wellbeing flags. The Services may automatically flag a wellbeing check-in for a coach’s attention based on the answers given. A flag is a prompt for human follow-up. The Services take no action about a player on the basis of a flag alone.
6. AI processing
6.1 The Services use Google’s Gemini AI service, accessed through the paid Gemini API, to support transcription, drafting and analysis of coaching content, transcription of internal coach voice notes, and AI summaries. Google acts as a Sub-processor under the Gemini API Additional Terms of Service for paid services and Google’s applicable data processing terms.
6.2 Customer Personal Data is not used to train Google’s or any other third party’s AI models.
6.3 AI-assisted content is reviewed by a coach before it is published to a player’s feed. GoFathom does not use AI to make decisions about a Data Subject that produce legal or similarly significant effects without human involvement.
7. Sub-processors
7.1 Authorisation. The Customer gives GoFathom general authorisation to engage Sub-processors. The Sub-processors in use at the date of the Agreement are listed in Annex 3.
7.2 Sub-processor terms. GoFathom will engage each Sub-processor under a written contract that imposes data protection obligations no less protective than those in this DPA, and will remain responsible to the Customer for each Sub-processor’s performance.
7.3 Changes. GoFathom will give the Customer at least 30 days’ notice of any new or replacement Sub-processor, by email or by updating the list in Annex 3 and notifying the Customer. The Customer may object on reasonable data protection grounds within that period. If the Parties cannot resolve the objection, the Customer may terminate the affected Services by written notice, and GoFathom will refund any prepaid Fees for the period after termination.
8. International transfers
8.1 Customer Personal Data is stored on servers located in the UK (London). Some Sub-processors process limited Personal Data in the EU, namely email delivery (Ireland) and in-app support (Germany). The UK recognises the EU and EEA as providing adequate protection, so no additional Transfer Mechanism is required for those locations.
8.2 Some Sub-processors may Process Customer Personal Data outside the UK and EU, as shown in Annex 3. GoFathom will only make a Restricted Transfer where an appropriate Transfer Mechanism is in place, and will carry out and keep a record of a transfer risk assessment where required.
9. Personal Data Breaches
9.1 GoFathom will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
9.2 The notification will include, so far as known at the time: the nature of the breach; the categories and approximate number of Data Subjects and records affected; the likely consequences; and the measures taken or proposed. GoFathom will provide further information as it becomes available.
9.3 GoFathom will take reasonable steps to contain and investigate the breach. It will provide reasonable assistance to help the Customer meet its obligation to notify the Information Commissioner’s Office within 72 hours and, where required, Data Subjects.
10. Return and deletion of data
10.1 On termination of the Agreement, GoFathom will make Customer Data available for export for 30 days, in line with the Agreement.
10.2 After the export period, GoFathom will delete or anonymise Customer Personal Data in line with its retention timelines: account data is deleted within 30 days; feed content, media, Wellbeing Data, assessment results and internal coach notes are anonymised within 6 months. Backups may retain data for up to 90 days before permanent deletion. Sub-processors delete data in accordance with their own data processing terms.
10.3 Clause 10.2 does not apply to Personal Data GoFathom must keep by law, or to Personal Data GoFathom holds as a Controller under clause 2.2 or as a joint Controller under clause 2.4, such as a player’s feed that remains available to their family through another organisation.
11. Audits and information
11.1 GoFathom will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including answers to reasonable security questionnaires.
11.2 Where that information is not sufficient, or following a Personal Data Breach, the Customer may carry out an audit, or have an independent auditor bound by confidentiality do so, no more than once in any 12-month period, on at least 30 days’ written notice, during business hours and at the Customer’s cost.
12. General
12.1 Liability. Each Party’s liability under this DPA is subject to the limitations of liability in the Agreement.
12.2 Precedence. If there is a conflict between this DPA and the Agreement in relation to the Processing of Personal Data, this DPA prevails.
12.3 Term. This DPA continues for as long as GoFathom Processes Customer Personal Data under the Agreement.
12.4 Governing law. This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Annex 1: Details of Processing
| Subject matter | Provision of the GoFathom coaching and player development platform to the Customer. |
| Duration | The Term of the Agreement, plus the export and deletion periods in clause 10. |
| Nature and purpose | Hosting, storing, organising and displaying coaching feedback, media, assessments, training, attendance and Wellbeing Data; flagging wellbeing check-ins for coach follow-up; showing assessment comparisons and leaderboards as configured by the Customer; enabling communication between coaches, players and families; AI-assisted transcription, drafting, summarising and analysis of coaching content; notifications and support. |
| Categories of Data Subjects | Players (mostly under 18); parents and guardians; coaches; Customer administrators and staff. |
| Types of Personal Data | Players: name, date of birth, gender, profile photo, optional email address, family relationships, group and sport memberships. Parents and guardians: name, email address, optional phone number, and a record of consent. Coaches and staff: name, email address, phone number, role and groups. Coaching feedback, comments, reflections, reports and internal coach notes. Coach voice recordings and their transcripts. Assessment results, with date, recorder and notes. Attendance, and session check-in and check-out times. Wellbeing Data. Photographs, video and audio of players. Training session, activity and platform engagement data. Account and technical data, such as IP address and device information. |
| Special Category Data | Health data in Wellbeing Data: sleep, mood, physical state, stress, knocks or injuries and the body part affected, and related notes and flags. Processed only where the Customer turns on wellbeing check-ins. |
| Frequency | Continuous, while the Services are in use. |
Annex 2: Security measures
GoFathom maintains the following technical and organisational measures:
- Encryption of data in transit and at rest.
- Media held in private, access-controlled storage that is never publicly accessible or searchable.
- Role-based access controls, so coaches only access players in groups they actively coach.
- Database row-level security, so that each user’s access is enforced by the database itself and not only by the app.
- Client applications use a public key that operates under row-level security, not an administrative key.
- Safeguarding information is excluded from the data sent to coaches’ devices.
- Group averages are shown only where at least three players have a result.
- Logging of media uploads with the uploading coach’s identity.
- Restricted and audited staff access to Customer Data, with data protection training for staff.
- Regular security reviews and updates.
- Backups retained for up to 90 days.
Annex 3: Sub-processors
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Supabase Inc. | Authentication, database, file storage, edge compute | UK (London) | Not required |
| Google (Gemini API, paid tier) | AI processing of coaching content, including voice note transcription | Global Google infrastructure | Google’s data processing terms for paid Gemini API services, with EU Standard Contractual Clauses and UK Addendum |
| Google (Firebase) | Push notifications | Global Google infrastructure | Google Cloud Data Processing Addendum with EU Standard Contractual Clauses and UK Addendum |
| Resend | Transactional email | EU (Ireland) | UK adequacy regulations for the EU |
| Gleap | In-app support and user feedback | EU (Germany) | UK adequacy regulations for the EU |
Annex 4: Joint controller arrangement (Feed Content)
| Responsibility | Customer | GoFathom |
|---|---|---|
| Lawful basis for publishing Feed Content, including parental consent for photos and video | ✓ | |
| Lawful basis for family access and cross-organisation sharing | ✓ | |
| Accuracy and appropriateness of what its coaches post | ✓ | Removes content that breaks platform guidelines |
| Privacy information | Tells families it uses GoFathom and points them to GoFathom’s Privacy Policy | Publishes the Privacy Policy, including a summary of this arrangement |
| Main point of contact for Data Subjects | Passes requests to GoFathom without undue delay | ✓ ([email protected]) |
| Responding to Data Subject requests about Feed Content | Helps where a request concerns its coaches’ opinions | ✓ Leads, and consults the Customer where needed |
| Security of the platform | Secures its own users’ accounts and devices | ✓ (Annex 2 measures) |
| Personal Data Breach | Tells GoFathom without undue delay of any breach involving its users | Tells the Customer within 48 hours; leads the assessment and any notification to the ICO for platform breaches |
| Retention and deletion | ✓ Per the Privacy Policy, including after the Customer leaves |
Each Party is responsible for its own obligations under this arrangement. This does not limit a Data Subject’s right to exercise their rights against either Party.