Data Processing Addendum

Effective date: August 15, 2026

This Data Processing Addendum ("DPA") is incorporated into and forms part of the Course Operator Agreement between On The Tee ("Processor") and the Course Operator ("Controller"). It governs On The Tee's processing of personal data on behalf of Course Operators in connection with the On The Tee platform.

1. Definitions

"Controller" means the Course Operator, who determines the purposes and means of processing personal data of their golfers and customers.

"Processor" means On The Tee, which processes personal data on behalf of the Controller.

"Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject") submitted through the course storefront.

"Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.

"Sub-processor" means any third party engaged by On The Tee to process Personal Data on behalf of a Controller.

2. Scope and Purpose

On The Tee processes Personal Data solely to fulfill the services described in the Course Operator Agreement: operating the branded merchandise storefront, processing merchandise orders, coordinating embroidery and fulfillment, and handling customer support related to orders. On The Tee will not process Personal Data for any other purpose without the Controller's written authorization, except as required by law.

3. Categories of Personal Data and Data Subjects

Data Subjects: Golfers and other end-customers who purchase merchandise through the course storefront.

Categories of Personal Data processed:

• Name and contact information (email address)
• Shipping address
• Order details (product type, size, quantity)
• Payment transaction identifiers (no raw card data — card processing is handled directly by Stripe)

4. Controller Obligations

The Controller represents and warrants that it has a lawful basis for collecting and transferring Personal Data to On The Tee for processing under this DPA, including providing any required notices to Data Subjects about the use of On The Tee as a fulfillment partner.

5. Processor Obligations

On The Tee agrees to:

• Process Personal Data only on documented instructions from the Controller (as set forth in the Course Operator Agreement and this DPA), unless otherwise required by applicable law
• Ensure that all personnel authorized to process Personal Data are bound by appropriate confidentiality obligations
• Implement and maintain appropriate technical and organizational security measures as described in Section 6
• Notify the Controller promptly (and in any case within 72 hours of becoming aware) of any confirmed personal data breach affecting Data Subjects' Personal Data
• Assist the Controller in fulfilling Data Subject rights requests (access, correction, deletion, portability) within a reasonable timeframe, to the extent technically feasible
• Not engage new Sub-processors without general authorization from the Controller, as described in Section 7
• At the Controller's election following termination, return or delete Personal Data within 90 days, subject to any retention required by applicable law

6. Security Measures

On The Tee maintains the following technical and organizational measures to protect Personal Data:

• Encrypted data transmission (HTTPS/TLS) for all data in transit
• Encrypted storage at rest via our database provider (Supabase)
• Role-based access controls limiting Personal Data access to authorized personnel
• Regular review of access rights and security configurations
• Incident response procedures for identifying and addressing security events

7. Sub-processors

By entering into this DPA, the Controller provides general authorization for On The Tee to engage the following Sub-processors. On The Tee will notify Controllers of any intended changes to this list by updating this DPA, and Controllers may object to a new Sub-processor within 30 days of notice.

• Supabase — database hosting and storage (USA)
• Stripe — payment processing (USA)
• Vercel — platform hosting and delivery (USA/global CDN)
• Fulfillment partners — embroidery production and shipping (USA); specific partner disclosed in the Course Operator Agreement

On The Tee will ensure all Sub-processors are bound by data protection obligations no less protective than those in this DPA.

8. International Data Transfers

On The Tee and its Sub-processors are based in the United States. If the Controller transfers Personal Data of EU, UK, or other internationally protected Data Subjects to On The Tee, such transfers are made subject to the applicable transfer mechanisms (such as Standard Contractual Clauses where required). Controllers with EU/UK Data Subjects should contact us at hello@onthetee.io to arrange appropriate transfer documentation.

9. Data Retention and Deletion

On The Tee retains Personal Data only as long as necessary to fulfill orders, operate the platform, and satisfy applicable legal and financial record-keeping obligations. Order records and transaction data are retained for up to seven years for tax and legal compliance. Following account termination, Personal Data not subject to legal retention obligations will be deleted within 90 days.

10. Audits

Upon reasonable written notice, On The Tee will make available to the Controller information reasonably necessary to demonstrate compliance with this DPA, and will cooperate with reasonable audits or inspections requested by the Controller (or a mutually agreed third-party auditor), conducted no more than once per year and at the Controller's expense.

11. Governing Law

This DPA is governed by the laws of the State of California, consistent with the Course Operator Agreement. For Controllers subject to GDPR, the parties agree to execute Standard Contractual Clauses upon request.

12. Contact

For questions about this DPA or to exercise Controller rights, contact On The Tee at hello@onthetee.io.