DEENRegisterStart for free

Legal · Data processing (DPA)

Convenience translation. This English version is provided for information only. Only the German version is legally binding; in case of any discrepancy the German version prevails. German version

Data Processing Agreement (AVV, Art. 28 GDPR)

Version 1.1 · As of 14.10.2026

between the registered club or registered organisation (controller, hereinafter "Client")

and iqmeta GmbH, Am Sonnenhang 24, 71111 Waldenbuch, Germany, represented by its managing director Otto Neff, e-mail support@shootingscore.app (processor, hereinafter "Contractor").

This agreement is concluded by consent upon registration on svscore.de and supplements the Terms and Conditions (AGB).

§ 1 Subject Matter and Duration

  1. The subject matter is the processing of personal data by the Contractor on behalf of the Client in the provision of the platform svscore.de (Software as a Service for competition and club management for shooting clubs).
  2. The duration of this agreement corresponds to the term of the user contract (including the free "Basis" package). Provisions that have effect beyond the end of the contract (in particular § 9) remain in force.

§ 2 Nature and Purpose of the Processing

  1. Nature of the processing: collection, recording, storage, organisation, adaptation, reading, retrieval, use, disclosure by transmission (e.g. sending e-mails, public result lists as specified by the Client), erasure.
  2. Purpose: conducting and managing shooting competitions, club championships, leagues and club events; cash register and settlement of entry fees; preparation of results and rankings, certificates; online registration, members' area and participant app with training book, weapons book and documents; range operation (attendance, range supervision, duty roster, shooting range log); shooting record; sending invitations, notifications and reminders; export to associations.

§ 3 Types of Data and Categories of Data Subjects

  1. Types of data:
    • Master data of shooters, participants and members (surname, first name, gender, date of birth, home club, membership number, start number, age class)
    • Contact data (address, e-mail address, telephone/mobile)
    • Competition and result data (series, rings, Teiler (distance-from-centre values), shot patterns, placements, titles, entries, range times)
    • Cash register data (series purchased, amounts, payment status of entry fees)
    • Training data (training series with hit positions, rings, Teiler values, notes)
    • Weapons book (designation, calibre, manufacturer, serial number if entered, shot counter, maintenance entries) and documents (type, number, validity, optionally file, e.g. WBK (firearms ownership card), Sachkunde (certificate of competence), hunting licence)
    • Attendance and range operation data (check-in/check-out, range, discipline, range supervision, duty roster, shooting range log)
    • Consents and distribution list membership (invitations, privacy statements)
    • User data of the club administration (name, e-mail, role, login logs)
    • Payment and invoice data of the clubs for svscore.de (billing address, package, invoices; payment instrument data are stored exclusively by the payment service provider)
  2. Data subjects: shooters/participants of events, club members, recipients of invitations, users of the club administration, contact persons of the clubs.

§ 4 Obligations of the Contractor

  1. The Contractor processes personal data exclusively within the scope of the agreements made and on documented instructions from the Client, unless it is required by law to carry out other processing (Art. 28 (3) (a) DSGVO (GDPR)).
  2. The Contractor ensures that the persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
  3. The Contractor takes the technical and organisational measures pursuant to Art. 32 GDPR in accordance with Annex 1.
  4. The Contractor assists the Client with appropriate measures in fulfilling the rights of data subjects (Art. 12–23 GDPR) and with the obligations under Art. 32–36 GDPR. For this purpose the platform provides, among other things, export, modification and deletion functions.
  5. The Contractor informs the Client without undue delay if it becomes aware of personal data breaches.
  6. The Contractor informs the Client without undue delay if, in its opinion, an instruction infringes data protection provisions.
  7. Processing generally takes place in a Member State of the EU or the EEA. A transfer to third countries takes place only under the conditions of Art. 44 et seq. GDPR.

§ 5 Obligations of the Client

  1. The Client is responsible for the lawfulness of the processing, in particular for the existence of a legal basis (e.g. consent, membership relationship).
  2. The Client informs the Contractor without undue delay if it detects errors or irregularities in the processing.
  3. The Client itself decides which data are displayed publicly (e.g. public result lists, TV display) and which functions are used.

§ 6 Instructions

  1. Instructions result in the first instance from this agreement and the Client's use of the platform's functions (configuration in the administration area).
  2. The Client issues further instructions in text form to support@shootingscore.app. The users registered as administrators of the club are authorised to issue instructions.

§ 7 Sub-processors

  1. The Client grants general authorisation to engage sub-processors. The following are currently engaged:
    Sub-processorServicePlace of processing
    Hetzner Online GmbH, Industriestr. 25, 91710 GunzenhausenOperation of server and databaseFalkenstein data centre (Germany)
    Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, IrlandPayment processing and invoices for svscore.de packages (only data of the clubs as customers)EU; transfer to the USA possible (adequacy decision/standard contractual clauses)
    own mail server of iqmeta GmbHSending system e-mails (login links, confirmations, invitations)Falkenstein (Germany)
  2. The Contractor informs the Client in text form or via svscore.de before engaging or replacing further sub-processors. The Client may object within four weeks for good cause relating to data protection; in this case either party may terminate the agreement.
  3. The Contractor contractually binds sub-processors to the same data protection obligations.

§ 8 Audit Rights

  1. The Client is entitled to satisfy itself of the Contractor's compliance with its obligations. For this purpose, the Contractor provides the necessary information on request (e.g. description of the TOMs (technical and organisational measures), evidence, certificates of the sub-processors).
  2. On-site inspections are possible after timely notice (usually two weeks) during customary business hours without disrupting operations. The Contractor may demand reasonable remuneration for inspections exceeding one inspection per calendar year.

§ 9 Deletion and Return

  1. During the term of the agreement, the Client may export and delete data itself at any time.
  2. After termination of the agreement, the Contractor deletes all personal data of the Client within 30 days, unless there is a legal obligation to store them. Before deletion, the Client may request an export.
  3. Backups are overwritten within the regular backup cycle (30 days).

§ 10 Liability, Final Provisions

  1. Art. 82 GDPR applies to liability; otherwise the liability provisions of the AGB apply.
  2. In the event of contradictions, the provisions of this agreement take precedence over the AGB insofar as they concern data protection.
  3. German law applies. The place of jurisdiction is – insofar as permissible – Stuttgart.

Annex 1: Technical and Organisational Measures (Art. 32 GDPR)

Confidentiality

  • Physical access control to the data centre: by the hosting provider, Falkenstein data centre (Germany), certified according to ISO/IEC 27001
  • System access control: personal user accounts; passwords stored only as a hash (ASP.NET Core Identity PasswordHasher, PBKDF2); minimum password requirements; limitation of login attempts (rate limit)
  • Two-factor login (TOTP) available for users of the administration area
  • Data access control: roles (administrator, entry, platform operator); strict tenant separation – every data query is restricted to the club of the logged-in user
  • Members' area and participant app with one-time login links by e-mail or signed personal access codes (can be blocked and regenerated)
  • Documents (e.g. WBK) viewable only by the data subject and the administrators of their club
  • Photos of targets and printouts are evaluated in the browser and not uploaded
  • Separation control: logical separation of club data in the database via the club identifier

Integrity

  • Transmission exclusively encrypted via HTTPS (TLS) with HSTS; redirection from HTTP to HTTPS
  • Security headers (including X-Content-Type-Options, X-Frame-Options, Referrer-Policy)
  • Error log for server and browser errors with limited retention (resolved: 90 days, otherwise at most 1 year)
  • Input control: logging of relevant operations (e.g. who entered/changed results, cash register bookings and cancellations, payment status); cash register bookings can be cancelled only by a reversing entry

Availability and Resilience

  • Regular backups of the database: daily, retention 30 days, encrypted in Germany
  • Server location: Falkenstein data centre (Germany)
  • Protection against overload by rate limits on public interfaces
  • Installation of security updates for operating system and runtime environment: monthly in the maintenance window, critical security updates without undue delay

Procedures for Regular Review

  • Review of the measures in the event of material changes to the platform, at least annually
  • Automated tests of the business logic before each release
  • Payment data (card, account, PayPal data) are not processed on svscore.de but exclusively by the payment service provider Stripe