Data Processing Addendum

This Addendum applies where you (the "Commissioner") use Pick Pilot commissioner tooling to process personal data about identifiable league members other than yourself ("Member Data"). For that processing Pick Pilot acts as processor and the Commissioner acts as controller. For all other activities (your own account, the analytics you consume) Pick Pilot remains the controller under the Privacy Policy.

Subject: storage, analytics, and AI-assisted summarization of league-member rosters, transactions, and manager identifiers as disclosed by the upstream provider. Duration: the term of your Pick Pilot plan plus the termination provisions in section 11 and retention information in the Privacy Policy.

To provide league-health scoring, participation metrics, AI-generated weekly digests, and related commissioner analytics, strictly on the Commissioner's instructions.

• League members whose accounts appear in an eligible connected Yahoo or compatible Sleeper NBA league. Fantrax is request-access only; ESPN is planned.
• Manager identifiers (display name, provider user ID).

• Provider user IDs and display names.
• Roster, matchup, and transaction history.
• Activity timestamps (for health score).

We do not receive email addresses, phone numbers, or payment data of league members through this flow.

• Commissioner warrants they have authority to connect the league and process Member Data.
• Commissioner instructs Pick Pilot to process Member Data only for the purposes in §2.
• Commissioner is responsible for providing privacy notices to their league members where required.

• Process Member Data only on documented Commissioner instructions.
• Ensure personnel with access are bound by confidentiality.
• Implement the security measures listed in §9.
• Assist the Commissioner with data-subject requests within 30 days.
• Notify the Commissioner of a personal-data breach without undue delay.
• Delete or return Member Data at end of term, at the Commissioner's choice.

Pick Pilot uses the sub-processors listed in the Privacy Policy. Material changes will be announced at least 30 days in advance; Commissioners may object by ending their plan.

Where data is transferred outside the EU/UK, Standard Contractual Clauses apply between Pick Pilot and the sub-processor. The Commissioner and Pick Pilot execute these Clauses by reference in this Addendum.

• Access control: role-based, least-privilege, audit-logged.
• Encryption: TLS in transit, AES-256 at rest for the primary store.
• Credential hashing: argon2id.
• Network: segregated prod VPC, Cloudflare WAF, Turnstile bot challenge on signup/login.
• Monitoring: per-request audit trail, Sentry error reporting, SLO dashboard with p99 and 5xx alerts.
• Secret management: rotated at least annually or upon personnel change.

Pick Pilot will make available on written request a current SOC 2 Type II report (when issued) or a reasonable security questionnaire response, no more than once per 12 months, subject to NDA.

On termination of the plan, Pick Pilot will delete Member Data within 30 days unless the Commissioner requests a JSON export first. Backup media are overwritten on the standard rotation schedule.

DPA questions: privacy@pick-pilot.com.