Agency terms and data processing addendum

These terms apply between Leandro Fernandes Lemos Pires, operating ScoutPath (Entrepreneur individuel (EI), micro-entreprise, SIREN 912 561 560, France), and each agency that opens a workspace, in addition to the Terms of service. Part B is the data processing agreement required by Article 28 of the GDPR for the athlete data the agency enters. [Click-through acceptance by the person who opens the workspace, order of precedence (order form, these terms, Terms of service) and governing law to be confirmed by counsel.]

Part A — Commercial terms

• Service: access for the agency's invited members to the features and limits of its plan, as listed in the Terms of service, or of an order form agreed with the agency. No paid service is active yet.
• Professional use: the agency opens its workspace for its professional activity and gives accurate organization details.
• Agency responsibilities: lawful basis and information of athletes and families for the data entered; consent of a parent or guardian for athletes under 18; accuracy of athlete data; consent recorded before sharing a profile or videos with a coach; rights to the videos it shares; no passport, visa or SEVIS numbers; compliance with athletic-association recruiting rules and with agent laws; no use of roster data to contact or profile listed players.
• Recruitment Management (Elite): the agency's own tracking of each athlete's steps. The agency records official outcomes (admission, eligibility, visa, enrollment, signed agreements) with their source; ScoutPath does not verify them and decides nothing.
• College data: provided as is, with its source and date; ScoutPath does not guarantee that a program will recruit, admit or fund an athlete.
• Confidentiality: each party keeps the other's non-public information confidential.
• Term and closure: monthly, renewed until cancelled [notice to be confirmed]. The owner can delete the workspace at any time in Settings: its data is deleted at once, except the security log (identifiers and actions only), which follows its own retention, and backups, which expire within 12 months.
• Liability: [cap and exclusions to be drafted by counsel; the proposal in the Terms of service applies meanwhile].

Part B — Data processing addendum

B1. Scope and roles

The agency is the controller of the athlete data it enters and of what it records about them (profiles, documents, notes, consents, matching results, pipeline, recruitment files, messages it sends about an athlete). ScoutPath processes it as processor, only to provide the service and on the agency's documented instructions, which are these terms and the agency's use of the product.

B2. Nature of the data

• Athletes: identity, date of birth, nationality and languages, sporting profile and video links, academic record and English test scores, budget and preferences, documents chosen by the agency (including agreements and offer letters), notes, consent records.
• Recruitment files: the universities followed, the status and dates of each step (English tests, coach contact, application, commitment, eligibility, visa process, arrival), who handles it, the source of official outcomes, internal notes and the history of changes. No passport, visa or SEVIS numbers: the software refuses those it recognizes.
• Data subjects: athletes (some under 18), their parents or guardians, and the agency's staff named in the file.
• Duration: until the agency deletes the data, the athlete or the workspace.

B3. ScoutPath's commitments

• Only the agency's members see its data, according to their role; coaches never see a recruitment file or the athlete record.
• Personnel with access are bound by confidentiality.
• Security measures: isolation of each agency's data, role-based access, hashed passwords, limits on sign-in attempts, administrator sign-in within 12 hours, encrypted backups with tested restoration, audit log of sensitive actions.
• Sub-processors: [hosting, database and backup storage, email provider — to be listed with locations]; Anthropic only when AI explanations are enabled (no athlete name or document). The agency is told in advance of a new sub-processor and can object [notice period to be set].
• Assistance: tools to export and delete an athlete's data, including the recruitment file; help with requests from athletes, answered within 30 days by default.
• Personal data breach: notification to the agency without undue delay after becoming aware of it [maximum delay, 48 hours proposed], with the information the agency needs for its own notification.
• End of service: deletion at once when the workspace is deleted, after the agency has exported what it needs; backups expire within 12 months.
• Audits: information needed to demonstrate compliance; [audit arrangements to be agreed].
• Transfers outside the EU/UK only with appropriate safeguards [to be specified once hosting is chosen].

B4. Data ScoutPath controls

Roster data, coach accounts and the needs they publish, and the account data of agency staff are processed by ScoutPath as controller under its privacy policy, not under this addendum. In a conversation with a coach, each side is responsible for what it sends.