PlayCheck Data Sharing Agreement — Tournament Organizers

Version v1.0-2026-08 · Governed by Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and NPC Circular No. 2020-03 on Data Sharing Agreements.

This Agreement is between PlayCheck (operated by PlayCheck, Philippines) and your organization — the tournament organizer, league, or event organization whose account you are creating or operating.

You are being asked to accept this because PlayCheck will disclose personal data about children to your organization. Both parties are separate Personal Information Controllers under the Data Privacy Act, each independently accountable for what we do with that data.

Do not accept this Agreement unless you are authorized to bind your organization.

1. The disclosure you are accepting responsibility for

Read this section carefully, because your position differs from that of a club.

A training organization sees only its own members — families who chose that club and have a direct relationship with it. Your organization is different. When a club enters a team into your event, PlayCheck discloses personal data about that club's children to you, even though those families have no direct relationship with your organization and may never have heard of it.

You are receiving children's personal data from third parties. That places a heightened duty of care on your organization, and this Agreement is written on that basis.

2. Purpose of the sharing

PlayCheck discloses personal data to your organization for these purposes only:

• Determining whether a player is eligible for the category or division they have been entered in, including age and gender eligibility
• Verifying identity at match-day check-in, so that the child who plays is the child who was registered
• Administering entries, rosters, fixtures, results, and disciplinary matters for your own events
• Collecting and reconciling entry fees and related charges for your own events
• Meeting insurance, venue, or sanctioning requirements that apply to your event

Any other use is outside this Agreement. In particular you may not use data obtained through PlayCheck to recruit children to a club, to market unrelated events or products to families, to compile a talent or scouting database beyond the administration of your own event, or to share rosters with sponsors or media in identifying form.

3. What PlayCheck actually discloses to you

This section describes the system as it currently operates.

For each player on a roster entered into your event:

• Full name
• Date of birth and exact age
• Gender
• PlayCheck verification status — the badge only (Verified, Federation Verified, or Unverified)
• The training organization that entered them

At check-in for your event:

• Player name and roster membership, for the purpose of admitting or refusing entry

For entries and payments in your event:

• The entering organization, team name, category and division
• Amounts billed, waived, paid, refunded, and outstanding
• Payer name, payment method, reference numbers, payment dates
• Uploaded proof-of-payment images
• PlayCheck ID, on payment records
• For individual entries, the entrant's full name

Exports available to you include an entries report, payment records, and competition, registration, and financial reports. Note that in the entries export, team rows carry a player count rather than player names; individual-entry rows carry the entrant's name. Exports are stamped with the identity of the user who generated them and the time of generation.

4. What PlayCheck does NOT disclose to you

• Uploaded identity documents. Your organization can never view, download, or link to a birth certificate, school ID, passport, or any other identity document. Only PlayCheck's verification staff can open those files, and each access is logged. You receive the verification badge as evidence, never the document. If you require stronger identity assurance for your competition, require PlayCheck Verified status as a condition of entry — do not ask clubs or families to send you documents outside the platform.
• Guardian contact details. Parent names, mobile numbers, and email addresses are not disclosed to tournament organizers. Where a payer's name appears on a payment record, that is the payer, not a general contact disclosure. Communicate with families through the entering club.
• Medical information and emergency contacts. These are not currently exposed to organization accounts of any type. If PlayCheck later makes them available for match-day safety purposes, it will be under a separate, clearly notified consent, and the safeguards in this Agreement will apply.
• Payment instrument details. Card and account numbers are held by our payment provider and are never shown to you. Proof-of-payment images visible to you may, however, contain the payer's account name and reference numbers.
• Players who are not entered in your event. Your access is scoped in software to players on rosters submitted to your own events. You cannot browse the platform's player base, search for children generally, or view a club's wider membership.

5. Your organization's obligations

By accepting, your organization undertakes to:

1. Limit purpose. Use the data only for the purposes in Section 2.
2. Limit access internally. Grant access only to staff and officials who need it for their role in your event, remove access promptly when their involvement ends, and never share login credentials.
3. Protect exported data. Any export you download leaves PlayCheck's control permanently and is your sole responsibility. Store it encrypted or in access-controlled storage, do not circulate it over personal messaging or public links, and delete it when the event and any dispute window have closed. PlayCheck has no technical means to recall, expire, or delete a file you have already downloaded.
4. Keep your own access records. PlayCheck does not currently log which of your staff viewed player data. Exports carry in-file provenance, but that is not a substitute for an access log. If you need that audit trail — and for child-protection purposes you should — maintain it yourself.
5. Publish results without exposing children. You may publish fixtures, results, standings, and team names. Do not publish a child's date of birth, exact age, gender, contact details, or PlayCheck ID in any public output, including brackets, programmes, livestream overlays, or social media. Publishing a squad list of names requires a lawful basis and, for minors, guardian consent obtained through the entering club or through PlayCheck.
6. Retain no longer than necessary. Dispose of personal data obtained through PlayCheck once your event, its results, and any protest or disciplinary window have concluded, unless you are independently required to keep it.
7. Honour data subject rights. Where a guardian exercises a right under the Data Privacy Act in respect of data your organization holds, respond as the controller of that copy. Forward to PlayCheck, without delay, any request concerning data held on the platform. Where a request reaches you but concerns a child entered by a club, coordinate with that club rather than acting unilaterally.
8. Report breaches. Notify PlayCheck at dpo@playcheck.app within 24 hours of becoming aware of any breach, loss, unauthorized access, or accidental disclosure affecting data obtained through PlayCheck. Because that data belongs to third-party clubs' families, PlayCheck will also inform the affected clubs. This is separate from your own obligation to notify the National Privacy Commission and affected data subjects where the law requires it.
9. Do not re-disclose. Do not transfer data obtained through PlayCheck to any third party — including federations, sponsors, scouts, agents, photographers, media, or other organizers — without a lawful basis and, where consent is the basis, guardian consent. Sanctioning bodies are not an exception unless disclosure is required by a rule the family was told about.
10. Protect children. Recognise that substantially all data you receive concerns minors, most of whom have no relationship with your organization, and apply a correspondingly higher standard of care.

6. PlayCheck's obligations

PlayCheck undertakes to:

• Disclose only the categories of data described in Section 3, and enforce the scoping described there in software
• Never expose uploaded identity documents to any organization account
• Stamp exports with the identity of the generating user and the time of generation
• Maintain reasonable and appropriate organizational, physical, and technical security measures as required by the Data Privacy Act
• Operate a retention and disposal regime for platform-held data, including legal-hold interlocks that prevent premature deletion of records subject to a dispute or investigation
• Notify you without undue delay of a breach on the platform affecting your events
• Inform participating clubs where a breach affects their members' data
• Notify you of material changes to this Agreement, and require re-acceptance where the change is substantive
• Make our Data Protection Officer available to you, to participating clubs, and to the families whose data is shared

7. Lawful basis and the family's control

A guardian consents to their child's participation, and a club's decision to enter a team is the act that discloses that child's data to you. Guardians retain their rights under the Data Privacy Act throughout.

A guardian may withdraw consent, archive a player, or request erasure at any time. Where that happens your access through PlayCheck ends, and the player may become ineligible or be removed from a roster. Your obligation in respect of any copy already exported does not end — you must delete it, subject to Section 5.6.

Where a withdrawal would affect the integrity of a completed competition, published historical results may be anonymized rather than deleted. Consent withdrawal does not retroactively invalidate processing that was lawful when it occurred.

8. Term, suspension, and termination

This Agreement takes effect when you accept it and continues while your organization holds a PlayCheck account.

PlayCheck may suspend or terminate your organization's access immediately where we reasonably believe this Agreement has been breached, where there is a risk to the safety or privacy of a child, or where required by law or by the National Privacy Commission.

On termination, you must cease using and securely dispose of all personal data obtained through PlayCheck, except where retention is independently required of you by law.

Sections 5, 6, 7, and 9 survive termination.

9. Accountability and evidence

PlayCheck records your acceptance of this Agreement: the accepting user, your organization, the date and time, the originating IP address, this version number, and a cryptographic hash of this exact text. That record is append-only and is retained as evidence of the agreement reached.

If this text changes, a new version is issued and acceptance is requested again. Your earlier acceptance is preserved rather than overwritten, so it remains possible to establish precisely which terms applied at any past date.

10. Contact

PlayCheck Data Protection Officer Jamie Francis Dy — Data Protection Officer and Security Architect dpo@playcheck.app

National Privacy Commission 5th Floor, Delegation Building, PICC Complex, Vicente Sotto Street, Pasay City 1307 privacy.gov.ph

By ticking the acceptance box, you confirm that you are authorized to bind your organization, that you have read this Agreement, and that your organization accepts these obligations in respect of the personal data of children — including children entered by other organizations — disclosed to it through PlayCheck.

Other organization agreements: Training Org · Tournament Org · Facility Services