Your data, your obligations: Terms, DPA and GDPR in plain language
In short
- You accept the Partner Terms once during onboarding by ticking a box, not at every login, and again only if the terms change materially legal review pending.
- For booking data you and the player are each independently responsible; for the SaaS dashboard openmatch is your processor under a separate agreement (a DPA) legal review pending.
- You can request a full data export or the deletion of your venue account at any time. Payment records still have to be kept for 8 years by law (§ 14b UStG, since the fourth Bureaucracy Relief Act) legal review pending.
What you sign at the start
In the last step of the onboarding wizard you tick a box to accept the Partner Terms for businesses, a generic document with no per-venue blanks legal review pending. That is the only place you actively agree; after that the app asks nothing again at each login. A fresh acceptance comes only when openmatch changes the Terms materially, and then you are given notice in advance (the notice period follows the EU P2B Regulation) and have to agree once more before carrying on legal review pending. Only the text of the Terms themselves is binding; this article explains only when and how you agree.
Who owns the data? Controller versus processor
Two separate roles that are easy to blur, so in plain language:
| Data flow | Who decides | openmatch's role |
|---|---|---|
| A player booking with you | You AND the player, each on your own account | None. You are both independently responsible legal review pending |
| Your dashboard, analytics, notifications | You (on your instructions) | openmatch processes on your behalf legal review pending |
The second case, meaning everything to do with your venue account, your reports and your communication with players, legally requires a data processing agreement (DPA) under Art. 28 GDPR. In one sentence: a DPA is a written commitment from openmatch to do only what you ask with your data, keep it confidential, and delete or return it cleanly at the end legal review pending. There is nothing extra for you to do; the DPA runs alongside your Partner Terms automatically once it is final.
Export and deletion: your rights
You can request a full data export of your venue at any time: a JSON bundle with your master data, bookings and key figures that you can take with you (portability under Art. 20 GDPR) legal review pending. You can equally request deletion of your venue account.
Deletion is deliberately not a single tap. You have to type your venue name again to confirm, plus your password (or, if you sign in with Google or Apple, a 6-digit code we email you). Only then does the deletion take effect, and it cascades immediately: bookings and tournaments in progress at your venue are cancelled and refunded, your Stripe subscription is cancelled, and your account is signed out of the system.
One important point: deletion does not mean instantly and entirely gone. Certain records, payment receipts above all, have to be kept for 8 years under German tax law (§ 14b UStG / § 147 AO as amended by the fourth Bureaucracy Relief Act), even after you have requested deletion of your account legal review pending. In practice it works like this: your visible profile is deactivated immediately and anonymised after 30 days (name, address, bank details gone), and only the records relevant to tax law stay in the background as an anonymised dataset until the retention period expires. That is normal practice, not something particular to openmatch.
An important note about this article
The Terms, the privacy policy and the DPA are currently written as a reviewed self-assessment and are still awaiting final sign-off by a German lawyer legal review pending. That is an ordinary step before going live, not a warning sign. This article already describes the structure reliably: what you accept and when, who is responsible for what, and what rights you have. Only the exact wording may still change with the legal review. What binds in the end is the finally approved Terms alone, not this article.