Battle24 Organizer Data-Sharing and Joint Controller Agreement

Effective date: 25 October 2026 · Version: 1.0.0

This Organizer Data-Sharing and Joint Controller Agreement (the "Agreement") supplements the Battle24 Terms and Conditions (the "Terms"). It governs the collection, sharing and processing of personal data in connection with dance competitions, battles, cyphers, qualifiers and related events (each an "Event") organized through the Battle24 platform at http://localhost:8080 (the "Service").

The Agreement is made under Article 26 (joint controllers) and, where applicable, Article 28 (processors) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR"), and under the Law on Legal Protection of Personal Data of the Republic of Lithuania.

1. Parties and Electronic Execution

1.1 Platform Operator ("Battle24")

Name: MB Technologijų jėgainė
Legal form: small partnership (mažoji bendrija) established under the laws of the Republic of Lithuania
Legal entity code: 307171811 (Register of Legal Entities of the Republic of Lithuania)
Registered office: Ežero g. 72, Žudiškių k., Riešės sen., LT-14256 Vilniaus r. sav., Republic of Lithuania
Websites: http://localhost:8080 (platform) and https://mb-tj.lt (company)
Privacy, data subject rights and support: support@demo.battle24.invalid and info@mb-tj.lt
Personal data breach notifications: support@demo.battle24.invalid, with a copy to info@mb-tj.lt

1.2 Event Organizer ("Organizer")

Who the Organizer is: the natural person, at least 18 years of age as verified by the Service, or the legal entity, dance studio, club, crew, federation or association represented by that person, who registers or applies for Organizer access on the Service. The Organizer's identity is recorded in their Battle24 user account (username, email address, display name, date of birth, organization name, application note and organizer status).
Authority to bind: where the Organizer acts on behalf of a legal entity, club, studio or unincorporated association named in the Organizer's application or in an Event's settings, the natural person accepting this Agreement warrants that they have full legal authority to bind that organization.

1.3 Electronic Acceptance (No Handwritten Signature Required)

This Agreement is concluded electronically when the Organizer ticks the mandatory acceptance box and submits:
- the public Organizer registration form, or
- the Organizer application form for signed-in users, or
- the acceptance screen the Service presents when this Agreement is updated to a new version.
On submission, the Service creates an electronic record of the acceptance (the Agreement version, the account, the date and time, and the form used) and a corresponding entry in its security audit log.
Under Article 6.192 of the Civil Code of the Republic of Lithuania and Regulation (EU) No 910/2014 (eIDAS), this electronic acceptance constitutes a binding agreement in writing between Battle24 and the Organizer, with the same legal effect as a handwritten signature.
In respect of participant personal data, this Agreement takes effect when Battle24 activates the Organizer's account as an organizer account or grants the Organizer access to an Event as an event team member. If an Organizer application is rejected, no participant data is made available to the applicant.

2. Roles of the Parties

Battle24 and the Organizer both take part in determining the purposes and means of processing personal data for Events held on the Service. The Parties allocate their roles across four processing areas as follows:

Processing area	Role of Battle24	Role of the Organizer	Reason
A. Event registration, studio roster registration, qualification, check-in, brackets, judging and event operations	Joint controller (GDPR Art. 26)	Joint controller (GDPR Art. 26)	The Organizer decides to hold the Event, sets its categories and age limits, decides whether the legal name and phone number fields are off, optional or required, approves or rejects registrations, assigns judges and staff, and runs check-in and brackets. Battle24 determines the platform's data model, security controls, parental consent verification process (GDPR Art. 8), retention schedule and automated erasure and anonymization.
B. Public competition results and sporting archive	Independent controller of the published results archive	Joint controller while the Event runs; recipient afterwards	During the Event, the Organizer controls when phases and results are published. Once published, Battle24 maintains the public sporting record (stage or display name, category, battle outcomes, scores and rankings) on the basis of its legitimate interest (GDPR Art. 6(1)(f)), subject to the right to object (GDPR Art. 21), which Battle24 handles.
C. Participant entry fees paid through Stripe Connect or off the platform	Independent controller of the platform fee and the platform's payment records (Stripe payment identifiers, entry-fee status, amount and platform fee)	Independent controller and merchant of record for the entry-fee transaction, payout, invoicing, tax and refunds in the Organizer's connected Stripe account or bank account	Card entry fees are charged directly on the Organizer's own connected Stripe account, so the funds go straight to the Organizer and Battle24 never holds participant money. Off-platform payments (bank transfer or cash at the door) are received directly by the Organizer using the Service's short payment reference. Each Party is an independent controller for its own statutory accounting and tax obligations.
D. Platform user accounts, platform billing and security logs	Sole controller	Data subject (for the Organizer's own account and plan purchases)	Battle24 alone determines the purposes and means of managing user accounts, guardian approvals of minors' accounts, Organizer plan payments to Battle24, security and audit logs (including failed-login and rate-limit records) and the transactional email infrastructure.

3. Data Subjects and Personal Data

3.1 Categories of Data Subjects

Processing under this Agreement concerns the following natural persons in connection with the Organizer's Events:

Adult dancers and participants (16 years of age or older at registration).
Minor dancers (under 16 years of age; the threshold of 16 years follows GDPR Article 8(1) and Lithuanian law).
Parents and legal guardians of minor participants (name, relationship to the child and email address).
Studio trainers and team managers who keep dancer rosters and register several dancers through the Service's studio registration feature, with the trainer's recorded confirmation that parental consent was obtained offline.
Judges, hosts and MCs, door check-in staff and co-organizers invited or assigned by the Organizer.

3.2 Personal Data Available to the Organizer

Depending on the Event's settings and the Organizer's role in it, the Organizer has access to the following personal data through the Service:

Participant identity and sporting data (collected for every Event entry):
- dancer or stage name,
- crew or studio affiliation,
- country and nationality (where national-championship or country eligibility applies),
- selected categories, seed, registration status (pending, approved, rejected, withdrawn, waitlisted or no-show), check-in status and time, and QR check-in status.
Contact data:
- the participant's email address, used for registration confirmation, payment links and Event notices,
- the participant's phone number, collected only if the Organizer sets phone collection to optional or required for the Event (by default it is off and not collected).
Conditional identity and age data:
- legal name, requested unless the Organizer sets legal-name collection to off for the Event (by default it is requested as an optional field),
- date of birth, collected only when an Event category has an age limit (a minimum or maximum age) or to apply the under-16 parental consent requirement. For signed-in adults entering categories without an age limit, the date of birth is not collected on the registration form.
Parental consent data (participants under 16):
- guardian name, relationship to the child, guardian email address and consent status (pending, confirmed or withdrawn). Consent verification links are never shown to the Organizer.
Competition and operational data:
- cypher heat scores, per-criterion scores, normalized scores, bracket placements, battle wins and losses, tie-break votes, judge assignments, penalties and timestamped incident logs.
Entry-fee data:
- quoted entry fee, payment status (not required, unpaid, paid, waived, refunded or expired), payment method (card through Stripe or off-platform), short bank-transfer reference, Stripe payment and refund identifiers, reasons a refund is owed, and organizer or staff payment notes.
Special categories of personal data (GDPR Art. 9):
- Prohibited. The Service is not designed to process special categories of personal data (such as health data, medical certificates, biometric data, racial or ethnic origin, religious beliefs) or national identification numbers (asmens kodas). The Organizer must not request, import or record any such data in free-text notes, incident logs, penalty descriptions or CSV imports.

4. Allocation of Responsibilities (GDPR Article 26(1))

Under GDPR Article 26(1), Battle24 and the Organizer allocate their respective obligations as follows:

Obligation	Battle24 (MB Technologijų jėgainė)	The Organizer
1. Lawfulness, fairness and data minimization (Art. 5(1)(a)–(c), Art. 6)	Provide the technical controls for conditional data collection (per-Event settings for legal name and phone number, and date of birth requested only for age-limited categories). Ensure that the platform's own processing has a lawful basis under Art. 6(1)(b), (c) or (f).	Turn on the optional legal name and phone number fields only when the specific Event genuinely needs them. When importing participants by CSV or adding them manually (including at the door), ensure and document a valid legal basis and prior notice to, or consent from, each participant (or their guardian, if under 16) before uploading their data.
2. Transparency and privacy notice (Art. 12–14, Art. 26(2))	Publish and maintain the Battle24 Privacy Policy at http://localhost:8080/privacy in English and Lithuanian, including the essence of this joint controller arrangement required by Art. 26(2), and show privacy information on every Event registration form.	Make no statement to participants that contradicts the Battle24 Privacy Policy. When collecting participant data outside the Service (for example on paper, in external forms or studio rosters) and importing it into the Service, give those participants the Privacy Policy address (http://localhost:8080/privacy) at the time of collection (Art. 14).
3. Protection of children and parental consent (Art. 8, Art. 35)	Operate the parental consent process for participants under 16: keep their Event registrations pending until the parent or guardian confirms through the verification link sent to the guardian's email address, and keep dates of birth and legal names off all public views (Event pages, live and projector screens, brackets and results).	Never bypass or try to bypass the under-16 parental consent process (for example by entering a false adult date of birth for a child, or the Organizer's own email address as the guardian's). When checking in or entering a minor under 16 at the door, verify and record the parent's or guardian's authorization on site, and never publish photographs of a minor without recorded guardian consent.
4. No unsolicited marketing (Art. 5(1)(b), Art. 6(1)(a), ePrivacy rules)	Send only necessary transactional and service emails (verification links, guardian confirmation links, registration status, payment links and receipts, Event reminders).	Use participant and guardian email addresses and phone numbers only for operational communication about the Event the participant registered for. The Organizer must not add these contact details to mailing lists, newsletters, sponsor promotions or promotions of other events without separate, verifiable consent obtained outside the Event registration.
5. Data subject requests (Art. 15–22)	Act as the single point of contact (support@demo.battle24.invalid); provide self-service tools (data export in JSON under Art. 15 and 20, and an account deletion request under Art. 17); handle results anonymization on objection (Art. 21) and restriction of processing (Art. 18) on request; and complete erasure, rectification, anonymization or restriction within the one-month statutory time limit.	Forward any data protection request received directly from a participant or guardian (access, rectification, erasure, restriction, objection or withdrawal of guardian consent) to support@demo.battle24.invalid within 72 hours of receipt where it requires action in the Service. Promptly act on any erasure or objection notice relayed by Battle24 by deleting exported files, spreadsheets and local copies containing that participant's personal data.
6. Security of processing (Art. 32)	Maintain platform security: HTTPS/TLS, one-way password hashing (bcrypt), CSRF protection, rate limiting, Cloudflare Turnstile bot protection, per-Event role-based access control, session renewal on privilege changes, truncation of IP addresses after 90 days, regular backups kept in the EU/EEA, and audit logging.	Keep login credentials personal (one account per person; logins are never shared); use the Service's staff and judge invitations with the least privileged role that fits; keep downloaded participant and payment exports on encrypted devices; and never publish or share participant contact lists.
7. Personal data breaches (Art. 33, 34)	Maintain a breach response procedure and breach register. Assess every breach and, where Art. 33 requires, notify the State Data Protection Inspectorate (VDAI, https://vdai.lrv.lt) within 72 hours of becoming aware of it, and inform affected data subjects under Art. 34 where the breach is likely to result in a high risk.	Notify Battle24 at support@demo.battle24.invalid (copy to info@mb-tj.lt) without undue delay and in any event within 24 hours of discovering any actual or suspected breach involving Battle24 credentials, a device of the Organizer or its staff with Battle24 access or exported files, or unauthorized disclosure of participant data. Cooperate fully with Battle24's investigation and any notification to VDAI.
8. Deletion after the Event and retention (Art. 5(1)(e))	Enforce the platform's automated retention schedule, including erasing the contact details, legal name and date of birth of participants without a linked account 2 years after the Event, permanently purging deleted Events 12 months after deletion, and keeping statutory payment records for 10 years.	Delete all downloaded or exported copies of participant personal data (including participant export files, check-in sheets and contact lists) within 30 days after the Event ends, except payment records (payment exports and Stripe records) that the Organizer must keep for tax and accounting purposes under applicable law.
9. Processors and international transfers (Art. 28, 44–49)	Maintain GDPR Art. 28 data processing agreements, and where needed Chapter V transfer safeguards (EU–US Data Privacy Framework and European Commission Standard Contractual Clauses), with the platform's processors: Hostinger (EU/EEA hosting and backups), Stripe (payments) and Cloudflare (Turnstile and transactional email delivery).	Not upload or transfer participant personal data obtained through the Service to any third-party cloud service or recipient outside the EEA without an independent lawful basis and the safeguards required by GDPR Chapter V.
10. Records of processing and impact assessment (Art. 30, 35)	Maintain the platform's record of processing activities, the data protection impact assessment for minors, and the legitimate interest assessments for results publication and security logging.	Keep records of any processing the Organizer carries out independently outside the Service (for example its own bookkeeping, off-platform bank transfers or separate media consent forms).

5. Special Rules for Participants Under 16

Breaking and street-dance competitions regularly include youth and kids categories (for example U12, U15, U16 or Kids). Battle24 has carried out a data protection impact assessment for this processing under GDPR Article 35. Both Parties shall apply the following safeguards to every participant under 16 years of age:

Verifiable parental consent (GDPR Art. 8): an online registration of a child under 16 is not valid until the child's parent or legal guardian confirms consent through the verification link emailed to them, or until a verified studio trainer records a confirmation that written parental consent was obtained. Unconfirmed registrations of minors are never approved, and their personal data is erased under the retention schedule.
No public exposure: a child's legal name, exact date of birth, email address, phone number and guardian details are never shown on any public page, bracket, live score screen, projector view or public data feed. Only the stage or display name, crew, country, category, scores and placements appear in public brackets and results.
Photographs and video of minors: the Organizer shall not upload or publish identifiable photographs of participants under 16 on the Service without the guardian's documented consent. Where the Organizer films or livestreams an Event outside the Service (for example on YouTube, Instagram or Twitch, or through venue photography), the Organizer is an independent controller of that filming or broadcasting and is solely responsible for venue notices and for obtaining any image-rights or parental consents required by applicable law.
Erasure and anonymization for minors: in line with GDPR Recital 65 and the impact assessment for minors, any request by a child participant or their parent or guardian to erase their data, or to anonymize their published results (replacing the name with a "Deleted dancer" label), is carried out unconditionally, without undue delay and in any event within one month (GDPR Art. 12(3)).

6. Data Subject Rights and the Essence of the Arrangement (GDPR Article 26(2) and (3))

Single point of contact: the Parties designate Battle24 (MB Technologijų jėgainė), at support@demo.battle24.invalid and info@mb-tj.lt, as the point of contact for data subjects exercising their rights under GDPR Articles 15 to 22.
Rights against either Party (Art. 26(3)): irrespective of this Agreement, a data subject may exercise their GDPR rights in respect of and against each of the joint controllers.
Assistance: if a data subject or a supervisory authority contacts the Organizer directly about data processed through the Service, the Organizer shall forward the request to support@demo.battle24.invalid within 72 hours and shall not obstruct or delay any erasure, rectification, restriction or results anonymization carried out by Battle24.
Essence of the arrangement (Art. 26(2)): Battle24 makes the essence of this Agreement available to data subjects free of charge in Section 7 of the Battle24 Privacy Policy (http://localhost:8080/privacy) and publishes this Agreement in full at http://localhost:8080/organizer-agreement.

7. Personal Data Breach Procedure

Incidents on the Organizer's side: if the Organizer, or any co-organizer, host, MC, judge or staff member invited by the Organizer, becomes aware of an actual or suspected personal data breach (GDPR Art. 4(12)), including:
- a Battle24 organizer or staff login or session being compromised or shared,
- loss or theft of, or unauthorized access to, a laptop, phone, tablet, email account or cloud folder holding downloaded participant or payment export files, or
- participant personal data (email addresses, phone numbers, dates of birth, legal names or guardian details) being published or emailed to the wrong recipient by mistake,
the Organizer must notify Battle24 without undue delay and in any event within 24 hours by email to support@demo.battle24.invalid (copy to info@mb-tj.lt) with the subject line "URGENT: GDPR Data Breach Notice — [name of the Event]".
Content of the notice: the notice must state (a) the Event or Events affected, (b) what happened and when, (c) the approximate number of participants and minors affected and the categories of data involved, (d) any containment steps already taken (such as revoking staff access or deleting exposed files), and (e) the Organizer's direct phone number and email address for the next 72 hours.
Notification of the authority and data subjects: Battle24 is responsible for notifying the State Data Protection Inspectorate (VDAI, https://vdai.lrv.lt) within the 72-hour period under GDPR Article 33 for any breach involving the Service, and for coordinating notices to affected participants and guardians under GDPR Article 34. Neither Party shall make a public statement naming the other Party in connection with a breach without consulting it first, except where a statutory deadline or an order of a supervisory authority requires it.

8. Exports, Deletion After the Event and Retention

CSV exports:
- The Service lets the Organizer export Event participant lists and entry-fee records solely for running the Event and meeting statutory bookkeeping obligations.
- Within 30 calendar days after the Event ends, the Organizer must permanently delete all downloaded participant export files, printed check-in lists and working spreadsheets containing participants' contact details, dates of birth, legal names or guardian information from all devices, email folders and cloud storage.
Accounting exception:
- Under Article 19 of the Law on Financial Accounting of the Republic of Lithuania and the retention terms approved by the Chief Archivist of Lithuania (Order No. V-100), financial transaction records (payment exports and Stripe payout and charge records) are kept for 10 years from the end of the financial (calendar) year of the transaction. Free-text payment notes and the staff member who recorded a payment are erased when the participant's data is erased, while the statutory accounting fields (amount, currency, payment reference, status, timestamps and Stripe identifiers) are kept.
Platform retention schedule:
- The Organizer acknowledges that Battle24 automatically enforces the platform's retention schedule, including:
  - Guest and studio roster data, 2 years: for participants without a linked Battle24 account, the email address, phone number, legal name, date of birth, nationality and photo are erased 2 years after the Event ends, leaving the sporting record (stage name, crew, country, scores and placements). Studio roster members who were removed, or whose studio can no longer be run, are erased on the same principle.
  - Deleted Events, 12 months: Events moved to the trash are permanently purged 12 months after deletion.
  - Event operations data, 2 years: incident logs, head judge messages and judge feedback are deleted or anonymized 2 years after the Event ends.
  - Accounting records, 10 years: platform and entry-fee payment records are kept for 10 years from the end of the financial (calendar) year of the transaction.
  - Proof of consent and acceptance: minimized records of acceptance of this Agreement and of guardian and participant consents (with guardian contact details erased on erasure) are kept for the life of the account or registration and 5 years after withdrawal or account deletion, as proof of compliance under GDPR Articles 7(1), 17(3)(e) and 26.

9. Processors and International Transfers

The Organizer acknowledges that Battle24 uses the following processors to provide the Service, each bound by a GDPR Article 28 data processing agreement and, where applicable, Chapter V transfer safeguards:

Processor	Function	Location	Transfer safeguard
Hostinger (Hostinger International Ltd / UAB Hostinger)	Virtual private server and database hosting, encrypted backups	European Union / EEA (EU data centre)	No transfer outside the EEA; data processing agreement concluded 14 June 2026
Stripe (Stripe Payments Europe, Limited / Stripe, Inc.)	Organizer plan payments and participant entry fees charged directly through Stripe Connect	Ireland (EU) and United States	Stripe data processing agreement, EU–US Data Privacy Framework certification and European Commission Standard Contractual Clauses
Cloudflare, Inc.	Turnstile bot protection on public forms and transactional email delivery	EU edge network and United States	Cloudflare data processing agreement, EU–US Data Privacy Framework certification and European Commission Standard Contractual Clauses

Fonts, style sheets, scripts and QR code generation are served from Battle24's own EU server, so browsing and check-in do not send visitors' IP addresses to third-party content delivery networks.

10. Liability and Indemnity

Liability to data subjects (GDPR Art. 82(4)): where both joint controllers are involved in the same processing and are responsible for damage caused by processing that infringes the GDPR, each of them may be held liable for the entire damage, to ensure effective compensation of the data subject.
Allocation between the Parties (GDPR Art. 82(5)): as between Battle24 and the Organizer, each Party is responsible for any administrative fines, damages, claims or costs resulting from its own breach of this Agreement or of the responsibilities allocated to it in Section 4. In particular:
- the Organizer shall indemnify Battle24 (MB Technologijų jėgainė) against any claim, fine or damage arising from: (a) uploading or importing participant personal data without a valid lawful basis or required parental consent; (b) using participant or guardian contact details for unauthorized marketing or sharing them with third parties; (c) bypassing the under-16 parental consent process or publishing photographs of minors without consent; (d) failing to delete exported files or to act on an erasure or objection notice; or (e) its acts or omissions as merchant of record for entry fees and refunds;
- Battle24 is responsible for the compliance of the platform software, the EU hosting infrastructure, its processor agreements, automated retention and the platform security measures described in Section 4;
- a Party that has paid compensation to a data subject under GDPR Article 82(4) beyond its share of responsibility may claim from the other Party the part of the compensation corresponding to the other Party's share (GDPR Art. 82(5) and Article 6.280 of the Civil Code of the Republic of Lithuania).

11. Term, Suspension and Changes

Term: this Agreement enters into force on the Organizer's electronic acceptance under Section 1.3 and remains in force for as long as the Organizer has an active or pending organizer status, holds any event team role on the Service, or keeps any personal data obtained through the Service.
Suspension and revocation: if Battle24 reasonably determines that the Organizer has breached this Agreement or the Terms, Battle24 may immediately suspend or revoke the Organizer's role. This suspends all of the Organizer's event team memberships, cancels pending invitations, removes host and MC roles and ends active sessions.
Changes: Battle24 may update this Agreement to reflect legal, regulatory or technical changes by publishing a new version with a new version number. After an update, the Organizer must accept the new version electronically to continue using organizer features.
Survival: rows 5, 7 and 8 of the table in Section 4 and Sections 5, 6, 7, 8, 10 and 12 continue to apply after an Event ends, after Organizer access is revoked and after the Organizer's account is closed, for as long as either Party keeps personal data covered by this Agreement.

12. Governing Law, Jurisdiction and Language

This Agreement is governed by Regulation (EU) 2016/679 (GDPR) and the laws of the Republic of Lithuania.
The State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija, VDAI, L. Sapiegos g. 17, LT-10312 Vilnius, https://vdai.lrv.lt, ada@ada.lt) is the lead supervisory authority for processing under this Agreement (GDPR Art. 56).
Any dispute arising from or in connection with this Agreement that the Parties cannot settle amicably within 30 days shall be resolved by the competent courts of the Republic of Lithuania in Vilnius, without prejudice to the rights of data subjects under GDPR Articles 77 to 79.
This Agreement is made in Lithuanian and English. Both versions are equally authentic and are to be read as having the same meaning.