Data Processing Agreement

Last updated 5 October 2026

Data protection law requires this wherever one organisation handles personal data for another. The terms are the arrangement; this is the part about members’ data.

Who this is between

The club, which decides who its members are and what happens in its ladder and teams. In law it is the data controller.

Us — BillyChess, run by Martin Lambert in the UK, at martin@billychess.com. We handle the club’s member data on its behalf, as its data processor.

The club accepts this before the club is set up on BillyChess, and it lasts until thirty days after the club closes — for as long as we hold any of its member data.

What we handle

So that the club can run its ladder and teams: each member’s name and nickname, email address, English Chess Federation (ECF) code and the ratings fetched for it where one is linked, ladder position, challenges, results, check-ins, availability, the boards they are picked for, and a record of who changed what.

BillyChess has no field for health, ethnicity, religion or anything else the law treats as special, and does not ask anyone’s age.

What we do with it

Only what the club asks. Using BillyChess is the instruction — adding a member, recording a result, picking a team. We do not use the club’s member data for our own purposes, sell it, share it for advertising, or train anything on it. If the law ever compels us to do something else with it, we will say so unless forbidden to.

Anyone we allow to access the club’s data is bound to keep it confidential.

Keeping it safe

Connections use TLS and the database is encrypted with AES-256. Backups are encrypted before they are stored, and the key that can read them never touches Cloudflare or Backblaze. Seeing a club’s data requires membership of that club; administrative actions are restricted to its administrators and recorded.

Who else is involved

Cloudflare hosts the application, database and backups, and Backblaze keeps a second copy of the backups — both in the EU, and each backup encrypted before it leaves Cloudflare with a key Backblaze does not have.

We will tell the club before adding or changing either, and it may end its subscription if it objects.

Google and the ECF are not on this list: members sign in with their own Google accounts, and where an ECF code is linked we ask the ECF’s public rating service about that code and send nothing else.

Helping the club

Members’ requests. A member asking to see, correct or delete their data is asking the club, as controller, and most of it the club can do itself. For the rest, ask us and we will respond within ten working days. The club’s own one-month deadline runs from when its member asked, so the sooner it asks us, the more of that month is left.

Breaches. If member data is lost, exposed or reached by someone who should not have it, we will tell the club without undue delay, with what we know and what we are doing. Reporting to the ICO is the club’s decision; we will give it what it needs to decide.

Questions. We will answer by email what the club needs to know about how its data is handled. We do not have the resources to host an on-site audit.

Giving it back, and deleting it

When a club closes on BillyChess its data is deleted thirty days later, and within those thirty days the club can ask for a copy — its members, ladder standings and results, fixtures and team sheets, as files it can open in a spreadsheet. We keep nothing afterwards but the record that a deletion happened.

A member the club removes is a different case. They come off the ladder and every team, and their pending challenges are cancelled, but their past results stay — deleting them would move other members’ positions and make the club’s history wrong. We keep that history for as long as the club does. A member who wants their name off it can ask us to delete their account, which anonymises them everywhere.

A member’s BillyChess account is not the club’s data and is not deleted with it — an account belongs to the person, and we are its data controller. The privacy notice explains that split.

Changes, and law

If this changes materially we will tell the club rather than quietly editing it; the date above reflects the current version. It is governed by the law of England and Wales.