Draft, not yet legally reviewed. This text is a draft and does not apply yet. Hubra and a lawyer must review it before it is published. Passages marked in yellow are assumptions that still need to be confirmed. This English version is a translation; the German version prevails.
1. Parties and subject
This agreement applies between the club that runs a club space on Hubra ("controller") and Mike Keller, Hubra, Grossfeld 17, 6423 Seewen, Switzerland ("processor"). It becomes part of the contract when the club space is opened. On request we send it as a PDF to sign.
Its subject is running the Hubra club software for the club: storing, displaying, backing up and transmitting the data the club and its members enter in Hubra, and support.
2. Term
This agreement applies as long as Hubra processes the club's data, that is until deletion after the contract ends (section 11).
3. Nature, purpose and scope
| Description | |
|---|---|
| Purpose | Member and club management: membership, fees and invoices, finance, events and attendance, votes, groups and offices, inventory and access, notifications, club mail and the plugins the club installs. |
| Data subjects | Members, prospective members and applicants, board and officers, guests, parents or legal guardians of minor members, contacts at suppliers and partners. |
| Types of data | Master data (name, date of birth, address, contact details, photo), membership data (tier, joining and leaving, offices, groups, roles), financial data (fees, invoices, payments, IBANs from bank files), participation and attendance, votes, checkouts, keys and door codes, posts and comments, contents of club mailboxes, log data. |
| Special categories | Hubra is not designed for them. If the club still records sensitive data (e.g. health information in free-text fields), it is responsible for doing so lawfully. |
4. Instructions
Hubra processes the data only on the club's documented instructions. These follow from the contract, this agreement and the settings and actions the club makes in Hubra. The club gives further instructions by mail to [email protected]. If Hubra considers an instruction unlawful, it tells the club and may suspend it until clarified.
Hubra does not process the data for its own purposes. The exception is anonymised aggregate operating figures (e.g. number of clubs, storage used, response times) that allow no conclusions about individuals.
5. Confidentiality
Everyone at Hubra with access to club data is bound to confidentiality. Only people who need it for operations or support get access. Support access to a club space needs a reason, is time-limited, is logged and shows as a banner in the club.
6. Security
Hubra takes the technical and organisational measures in the annex and keeps them up to date with the state of the art without lowering the level of protection.
7. Sub-processors
The club authorises Hubra to use these sub-processors:
| Sub-processor | Service | Location | Safeguard |
|---|---|---|---|
| Contabo GmbH, Munich, DE | Servers and object storage for encrypted backups | Germany | EU, DPA |
| Infomaniak Network SA, Geneva, CH | Sending mail | Switzerland | Adequacy decision, DPA |
| Brevo SAS, Paris, FR | Backup mail sending during an outage | EU | EU, DPA |
Only when the club or a member switches on the feature: Discord Inc. (USA) for the Discord plugin, and the respective browser's push service for push notifications. Services the club connects itself (e.g. an external mailbox in the shared inbox plugin) are not Hubra's sub-processors.
Hubra announces new or changed sub-processors at least 30 days in advance by mail to the club's administrators. The club may object for an important data protection reason; if no solution is found, it may terminate as of the date of the change. Hubra binds every sub-processor contractually to an equivalent level of protection.
8. Transfers abroad
Club data is stored in Germany. Transfers to countries without an adequate level of data protection only happen with appropriate safeguards, in particular the EU-U.S. and Swiss-U.S. Data Privacy Framework or the European Commission's standard contractual clauses with the Swiss amendments.
9. Assisting the club
- Data subject rights: The club can handle most requests itself in Hubra (view, change, export, delete). Where that isn't enough, Hubra helps. If a person contacts Hubra directly, Hubra forwards the request to the club.
- Data breaches: Hubra notifies the club of a security breach affecting its data without undue delay, where possible within 48 hours of becoming aware, with what is known about its nature, scope, the data affected and the measures taken. Notifying authorities and data subjects remains the club's task; Hubra helps.
- Impact assessment: Hubra provides the information the club needs for a data protection impact assessment.
10. Evidence and audits
On request Hubra gives the club the information needed to show it meets these obligations. The club, or an auditor it appoints who is bound to confidentiality, may check compliance by arrangement and with reasonable notice. On-site audits are limited to what is necessary and must not put other clubs' data at risk. Define who bears audit costs.
11. Return and deletion
After the contract ends the club can export its data for 30 days; Hubra helps. Hubra then deletes the club space with all data and the club's keys. In the rotating backups the data remains encrypted for up to six months and is then overwritten. On request Hubra confirms the deletion in writing. Data Hubra must keep by law is excepted.
12. Final provisions
Where they conflict on the protection of personal data, this agreement takes precedence over the terms of use. Liability follows the terms of use. Swiss law applies; where the GDPR applies, its mandatory provisions prevail.
Annex: technical and organisational measures
Confidentiality
- Data centres with access control, video surveillance and fire protection at the hosting provider (Contabo, ISO 27001).
- Server access only with personal keys, no password login; administration only over encrypted connections.
- Separate database spaces per club; the application checks the club on every access.
- Roles and permissions in the club down to single objects; Hubra staff need two-factor sign-in.
- Passwords stored only as hashes; passkeys and two-factor sign-in for everyone; a mail on sign-in from a new device; clubs can require 2FA for admins or all members.
- Confidential fields (e.g. door codes, credentials) encrypted with a separate key per club; the keys are protected by a master key that can be rotated.
Integrity
- Encrypted transport (TLS) on all connections.
- A log of changes in the club (who, what, when), visible to the board.
- Plugins only from the Hubra marketplace, signed and verified before installation.
- Protection against forged requests (CSRF) and rate limits on sign-in attempts.
Availability and resilience
- Daily backups, encrypted before they leave the server, stored separately; 7 daily, 4 weekly and 6 monthly backups are kept.
- Replicated database on several servers; monitoring with alerts for outages, failed backups and mail problems.
- Maintenance mode with a notice in the club.
Review
- Regular security reviews of the code; security updates are installed promptly.
- A public security policy with a way to report vulnerabilities (security.txt).
- Privacy by default: modules a club doesn't need are off; the member directory only shows what each member chooses to share.