AmmoSuite
Request a demo
AmmoSuite
Request a demo

Data Processing Addendum (DPA) — AmmoSuite Club

Last updated: 31 October 2026

This Data Processing Addendum ("DPA") describes how AmmoSuite Club processes personal data on behalf of the customer, in the context of providing the AmmoSuite Club service (the "Service"). This DPA is Annex 1 (Data processing agreement) to the Terms and conditions. See also the Privacy notice.

1. Parties and roles

  • Customer: the shooting club or association using the Service and determining which member data is processed (data controller).
  • AmmoSuite, trading name of Davy Bammens (sole proprietorship), Zonhovenstraat 39, 3500 Hasselt, Belgium, company number 0699.928.640: provides the AmmoSuite Club Service (hereinafter in this DPA also "AmmoSuite Club") and processes personal data solely on the customer's instructions (processor).

2. Subject matter, nature and purpose of processing

AmmoSuite Club processes personal data to provide, maintain and secure the Service, including: member management and approval, bookings, sessions and events, rankings, the check-in kiosk, the member-to-member marketplace, communication (email and push notifications), account management and authentication (incl. 2FA), activity logging, backups, incident recovery and support. AmmoSuite Club does not process data for its own independent purposes such as advertising profiling, and does not sell data to third parties.

3. Categories of personal data

Depending on the modules the customer has enabled, the following data may be processed:

  • Identification and contact details: first name, last name, email address, phone number, address, date of birth, national registry number.
  • Membership data: membership type and end date, registration date, approval and blocking status, preferred language.
  • Licence and document data: firearms licences (Model 4: number, issue date, firearm details), hunting permits, and other uploaded documents/certificates with their approval status and expiry date.
  • Club firearms: name, calibre and notes — deliberately a limited data model without serial number or photo, so this module is not needlessly sensitive.
  • Usage data: bookings, session sign-ups, attendance, rankings/scores, messages and listings on the member-to-member marketplace (with price, without payment details).
  • Technical and security data: IP address, session data, login history, push notification subscriptions, device/browser information.

No payment card data or medical data are processed. Bank account numbers (IBAN) are only processed if the customer uses the CODA import (a beta feature). Uploaded photos automatically have EXIF and location metadata stripped on storage.

4. Categories of data subjects

  • Members and guest participants of the club.
  • Users of the Service (administrators, board members, lane officers).
  • Non-members who register for a public event.

5. Duration of processing and retention periods

Processing continues for the term of the subscription and/or for as long as the test environment is active. A member can be fully removed from the system ("right to erasure"): this deletes bookings, session and event registrations, ranking scores, federation data, documents, marketplace listings and membership history, and removes uploaded files. Activity log records are deliberately retained without a link to the deleted account, so the club's audit trail remains intact. Sent emails are cleaned up after 30 days, failed delivery attempts after 90 days. Members can also request their own data in an exportable format (data portability).

The customer's administrators can download the club's full archive at any time: all data as CSV files (one per table) and all uploaded files, in one zip file with explanations. Passwords, two-step verification keys and secret links are deliberately left out.

After the agreement ends, the Service remains available to the customer's administrators for 30 days, read-only: they can view all data and download the full archive. Members can no longer log in during that period and the Service no longer sends reminders or notifications. After those 30 days, AmmoSuite deletes the club database, all files, the feedback and the emails of the customer; they disappear from the backups within 30 days after that, unless a legal retention obligation applies. On request, AmmoSuite confirms the deletion in writing with a deletion certificate.

6. Instructions and confidentiality

AmmoSuite processes personal data solely on the customer's written instructions. This agreement and the settings the customer chooses in the Service count as such instructions. If AmmoSuite considers an instruction unlawful, AmmoSuite will notify the customer. AmmoSuite does not process the data for its own purposes, except for anonymised, aggregated usage statistics in which no customer or person is identifiable.

Everyone working for AmmoSuite who has access to the personal data is bound by confidentiality. That access is only used when needed for support, maintenance or security.

7. Security measures

AmmoSuite Club takes appropriate technical and organisational measures to secure personal data. Examples (non-exhaustive):

  • Encrypted connections (TLS) between users and the platform.
  • Passwords are stored hashed; an account is temporarily locked after repeated failed login attempts.
  • Optional two-factor authentication per account via an authenticator app (TOTP), with recovery codes; recommended for administrators.
  • Access control with roles and permissions per member (administrator, or a role with only the permissions it needs, e.g. range officer or treasurer), managed by the customer. Sensitive data such as licences requires a separate permission.
  • An activity log recording who performed which action, on what data, and when.
  • A separate database per customer (multi-tenant with database isolation), not shared with other customers.
  • Private documents (licences, certificates) accessible only via a secure, authenticated download after logging in — not directly via a public URL.
  • Automatic removal of EXIF and location data from uploaded photos.
  • Daily automatic backups, kept for 30 days.
  • Hosting in a secured data centre in the EU, with database encryption and physical access control at the hosting partner.
  • The database is not publicly reachable: the application connects to it over an isolated private network. Server administration only via SSH with keys.

AmmoSuite may change these measures, provided the level of protection does not decrease.

8. Sub-processors

The customer gives AmmoSuite general authorisation to engage the following sub-processors:

  • DigitalOcean, LLC (United States): hosting of servers, databases, files and backups. The data is stored in the Amsterdam data centre (Netherlands). Transfer basis: the EU-US Data Privacy Framework, with Standard Contractual Clauses as a fallback (DigitalOcean DPA).
  • SMTP2GO (Sand Dune Mail Ltd, New Zealand): sending email from the Service, hosted in the EU. Any access from New Zealand is covered by the European Commission's adequacy decision.

Files (documents, images) are stored per customer environment on our own servers, not with an external storage service. Push notifications use the open web-standard Web Push protocol: they pass through the push service of the member's browser (e.g. Google, Mozilla or Apple), but the content is end-to-end encrypted so those services cannot read it. Fonts, icons and scripts of the Service come from our own servers, not from an external CDN or font service. No payment processor or SMS service is connected to the Service. Sub-processors only receive access to personal data to the extent necessary and under appropriate contractual safeguards. We announce a new or replacement sub-processor at least 30 days in advance; the customer may object with reasons within that period.

9. Assistance with data subject rights

AmmoSuite Club supports the right of access, correction, erasure and portability with built-in features: the customer can view, correct, export (per member or as a full archive) and delete data, members can export their data, and an administrator can, at the member's request, remove them fully and irreversibly from the system. If AmmoSuite itself receives a request from a data subject, AmmoSuite forwards it to the customer within 5 working days and does not answer it itself. AmmoSuite provides reasonable assistance with a data protection impact assessment (DPIA), with a question from the data protection authority and with requests that cannot be handled via the built-in features. Assistance beyond the standard platform may be charged at the usual hourly rate.

10. Data breach / security incident

In the event of a personal data breach, AmmoSuite informs the customer without undue delay and at the latest 48 hours after AmmoSuite discovers the breach. AmmoSuite states, as far as known:

  • what happened;
  • which data and how many data subjects are affected;
  • the likely consequences;
  • the measures taken or proposed.

Missing information follows as soon as possible. The customer decides whether to notify the data protection authority and the data subjects; AmmoSuite does not do so on the customer's behalf.

11. Audit and information

On request, and at most once a year, AmmoSuite provides the customer with the information needed to demonstrate compliance with this DPA, including available audit reports of the hosting partner insofar as that partner allows. If that information is insufficient, the customer may have an audit carried out by an independent expert bound by confidentiality, with at least 30 days' notice and at the customer's cost.

12. Liability

Liability under this DPA is governed by article 13 of the Terms and conditions, without prejudice to article 82 GDPR.

13. Contact

Questions about this DPA? Contact contact@ammosuite.com.
Company number: 0699.928.640.

This English translation is provided for convenience. In case of any discrepancy, the Dutch version prevails.