Draft wording, pending legal review. It is shown so the flow can be tested; it is not yet the agreement a club will be asked to sign.
iSwim processes personal data about children on behalf of your club. Your club is the data controller and decides what happens to that data; iSwim is the data processor and acts only on your instructions. This agreement sets out what that means in practice. An administrator must accept it before the club can enter swimmers or run a meet.
1. The parties and their roles
Your club is the data controller (behandlingsansvarlig) for the swimmers, guardians and staff it registers. iSwim is the data processor (databehandler) and processes that data solely to provide the service. Neither party may treat the other’s role as transferable without a written change to this agreement.
2. Purpose of the processing
iSwim processes the data to run swim meets and club activity: managing a swimmer registry, planning meets, timing races, publishing results, scheduling training, and communicating with invited clubs. iSwim does not use the data for any other purpose, and never sells it, rents it or uses it to train models.
3. What data is processed
Swimmers: first and last name, date of birth, optional sex, club, guardian contact details, meet entries and race times. Club staff: name, email address and role. iSwim does not collect addresses, telephone numbers or national identity numbers, and asks the club not to enter them into free-text fields.
4. Acting on instructions only
iSwim processes the data only on your club’s documented instructions, which are the actions you take in the application plus this agreement. If iSwim believes an instruction breaches data protection law, it will say so rather than carry it out.
5. Children’s data and publication
Publication is restricted in software, not by convention. iSwim publishes no rankings at all: no placement, no medal and no podium on any public surface, at any age. Live heats read in lane order and result lists are alphabetical, so a published swimmer shows name, club and time whatever their age. A swimmer under 15 with no recorded guardian consent is not published at all. Your club remains responsible for obtaining that consent, for prizes, and for briefing its volunteers.
6. Security
Data is encrypted in transit and at rest. Access is restricted by role, every operator change is written to an audit log, and application logs redact swimmer names and contact details. Accounts are protected by a magic link or a password, and sessions expire after inactivity.
7. Sub-processors and location
iSwim uses Neon (database), Vercel (web hosting), Microsoft Azure (timing server), Upstash (ephemeral meet state), Resend (email) and Stripe (payments). All data storage is located within the EU/EEA. iSwim will give notice before adding or replacing a sub-processor, and your club may object.
8. Helping you answer data subjects
Guardians can file access and erasure requests from the public privacy page, and they land in your club’s inbox. iSwim provides a per-swimmer data export and a single erasure action that de-identifies a swimmer while leaving race results intact. Answering within the one-month deadline remains your club’s responsibility.
9. Retention
A swimmer whose entire meet history is older than 24 months, and who is on no active training group, is automatically de-identified: the name is removed and the results survive anonymously. Audit records are kept for 36 months. Your club can erase any swimmer sooner at any time.
10. Personal data breaches
If iSwim becomes aware of a personal data breach affecting your club’s data, it will notify your club without undue delay and provide the information your club needs to assess and report it. Notifying the Norwegian Data Protection Authority is your club’s obligation as controller.
11. Ending the agreement
Either party may end this agreement in writing. On termination, your club may export its data, after which iSwim deletes it within 90 days, except where law requires a copy to be kept. Ending the agreement ends the right to use the service.
12. Terms of use
The service is provided on an annual club subscription. iSwim is semi-automatic phone-based timing intended for unsanctioned meets and club time trials; it is not approved for sanctioned competition, and results from it cannot be used as qualifying times or records. iSwim aims for continuous availability but does not guarantee it, and is not liable for indirect losses arising from an interrupted meet.
