1. Scope and incorporation
This Data Processing Addendum (DPA) forms part of the Terms or other agreement between M4EIQ Inc. and the organizer using Kabola. It applies when M4EIQ processes personal information on the organizer's behalf. Capitalized terms not defined here have the meaning in the Terms or applicable privacy law.
2. Roles and instructions
The organizer is the controller or organization responsible for league data. M4EIQ is the processor or service provider. The organizer instructs M4EIQ to process data to provide Kabola, support authorized users, secure the service, prevent abuse, meet legal obligations, and perform the documented product functions.
M4EIQ is independently responsible for information it controls for accounts, intake, security, support, and direct organizer billing.
3. Organizer obligations
- Comply with applicable privacy, youth, employment, electronic-communications, sport, and safeguarding law.
- Provide notices and obtain lawful authority and any required guardian or participant consent.
- Issue only lawful instructions and minimize submitted data.
- Configure workspace access and public visibility appropriately and respond to participant requests.
4. M4EIQ obligations
- Process organizer data only on documented instructions unless law requires otherwise.
- Ensure personnel with access are subject to confidentiality obligations.
- Maintain safeguards appropriate to the nature of the service and data.
- Notify the organizer if, in M4EIQ's reasonable opinion, an instruction violates applicable privacy law.
5. Security measures
- Workspace-scoped database access and row-level security.
- Role and grant checks for staff, family, scorekeeper, referee, and volunteer functions.
- Encryption in transit and vendor-managed encryption at rest where available.
- Restricted service-role and platform-administrator access.
- Logging, dependency updates, backup and recovery measures, and tested tenant-isolation controls appropriate to the service.
6. Subprocessors
The organizer authorizes the subprocessors listed on the Subprocessors page. M4EIQ will impose data-protection obligations appropriate to their services and remains responsible for its obligations under this DPA. M4EIQ may update the list to operate Kabola and will publish material changes. An organizer with a reasonable data-protection objection should contact M4EIQ promptly.
7. Individual requests
Taking account of the nature of processing, M4EIQ will provide reasonable assistance for access, correction, deletion, portability, consent, and objection requests that concern organizer data. If M4EIQ receives such a request directly, it may refer the requester to the organizer unless law requires M4EIQ to respond.
8. Security incidents
M4EIQ will notify the organizer without undue delay after confirming a breach of organizer-controlled personal information and will provide information reasonably available to support assessment, notice, and remediation. Notice is not an admission of fault. The organizer remains responsible for notices it is legally required to give.
9. Assistance and audits
M4EIQ will provide information reasonably necessary to demonstrate compliance and assist with legally required privacy-impact or regulator consultations. Audits must be reasonable, protect other customers and security, use available reports first, and be at the organizer's expense unless an audit identifies a material breach by M4EIQ.
10. Return, deletion, and retention
On workspace termination, M4EIQ will delete or return organizer data within a commercially reasonable period on request, except where retention is required for law, security, backup, transactions, disputes, or enforcement. Data retained in backups will remain protected and be deleted through normal rotation.
11. International transfers
The organizer authorizes processing in Canada, the United States, and other locations used by listed vendors. The parties will cooperate on additional transfer terms legally required for a particular jurisdiction.
12. Processing details
- Subject matter: operation of a multi-tenant league-management, scorekeeping, family, media, volunteer, payment-support, and fundraising platform.
- Duration: the agreement term plus documented retention and backup periods.
- People: players, guardians, organizers, staff, coaches, referees, volunteers, donors, customers, fans, and other workspace contacts.
- Data: identifiers, contact information, roles, rosters, youth age fields, schedules, participation, performance, communications, volunteer and tryout records, photos, transactions, donations, and technical logs.
- Sensitive context: youth records, guardian relationships, volunteer verification, tryout assessments, payment metadata, and public participation choices.
13. Youth data and governing law
The Youth Data Addendum is incorporated into this DPA. This DPA is governed by the laws of Ontario and the federal laws of Canada applicable there unless the parties' signed agreement states otherwise. Contact info@m4eiq.tech. M4EIQ Inc.'s registered address is 168C Rivington St., Carp, ON K0A 1L0 CA.