This Data Processing Agreement (“DPA”) sets out the terms under which suPlay BV (“Processor”) processes Personal Data on behalf of the Customer (“Controller”) in connection with The Beer Game platform (“Service”). It is designed to meet the requirements of Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).
When this DPA is needed. Most use of The Beer Game is by individual instructors signing up for their own account and inviting their students to anonymous, single-session play. In that scenario the instructor is the controller for their own account data and there is no further controller–processor relationship. A signed DPA becomes relevant when an institution (university, school, training company) procures the Service centrally for its staff.
How to sign: request a PDF copy by emailing privacy@suplay.nl, complete Annex A with your organisation’s details, sign, and return. We will counter-sign within five business days.
This DPA applies to all Processing of Personal Data carried out by suPlay BV on behalf of the Controller under the Main Agreement. It is in force for the duration of the Main Agreement and survives until all Personal Data processed hereunder has been deleted in accordance with §10.
The Processor processes Personal Data solely to provide the Service: operating instructor accounts, hosting Beer Game sessions, sending transactional email (verification, password reset, classroom invitations), and producing CSV exports for the instructor’s own debriefs. A description of Processing activities, categories of Data Subjects, and categories of Personal Data is set out in Annex B.
The Processor processes Personal Data only on documented instructions from the Controller. Use of the Service through its documented user interfaces constitutes such instructions. The Processor will inform the Controller if, in its opinion, an instruction infringes the GDPR or other applicable data-protection law.
The Processor ensures that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
The Processor implements appropriate technical and organisational measures, described in full at /security. Measures include, at minimum:
The Controller authorises the Processor’s engagement of the Subprocessors listed on our Subprocessors page as of the Effective Date. The Processor will:
Taking into account the nature of the Processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller’s obligations to respond to Data Subject rights requests (Chapter III GDPR), data breach notification, and prior consultation with the supervisory authority.
The Processor notifies the Controller without undue delay, and in any case within 72 hours of becoming aware, of any Personal Data breach affecting the Controller’s data. The notification will describe the nature of the breach, categories and approximate number of affected Data Subjects, likely consequences, and remediation measures taken or proposed.
On termination of the Main Agreement, the Controller may export its instructor account data, session leaderboards, and per-session CSVs for 30 days. After that period, the Processor deletes all Personal Data processed under this DPA within 90 days, including from database backups on their next rotation, unless Union or Member State law requires longer storage (for example, Dutch tax law requires billing records to be retained for seven years).
The Processor makes available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR, including this DPA, the Subprocessors page, and the Security overview. The Processor supports remote, questionnaire-based audits at no cost, and on-site audits at the Controller’s reasonable expense, limited to once per calendar year unless required by a supervisory authority.
All primary processing and backups occur within the European Economic Area. Where any Personal Data is transferred outside the EEA to a Subprocessor, the transfer is made on the basis of the European Commission’s Standard Contractual Clauses (Decision 2021/914 or any successor), unless the recipient country has an adequacy decision under Art. 45 GDPR.
Each party’s liability under this DPA is subject to the liability limits of the Main Agreement. In case of conflict between this DPA, the Main Agreement, and the GDPR, the GDPR prevails, then this DPA, then the Main Agreement.
This DPA is governed by the laws of the Netherlands. Disputes are subject to the exclusive jurisdiction of the District Court of Overijssel (Rechtbank Overijssel, locatie Almelo), without prejudice to a Data Subject’s statutory rights of complaint to a supervisory authority.
Processor: suPlay BV, Enschede, The Netherlands. KvK: 70176264. VAT: NL858175691B01. Data Protection contact: privacy@suplay.nl.
Controller:
Subject matter and duration: operation of The Beer Game platform for the duration of the Main Agreement.
Nature and purpose: delivering a multiplayer educational simulation of a four-tier supply chain (Retailer, Wholesaler, Distributor, Factory) for use in classroom teaching of operations management. Includes instructor accounts, classroom session hosting, transactional email, and per-session CSV exports for debriefs.
Categories of Data Subjects:
Categories of Personal Data:
Special categories of data: none are knowingly processed. The Controller is responsible for ensuring students do not submit special-category data (Art. 9 GDPR) through chat fields or self-chosen aliases.
Processing operations: collection, storage, in-memory simulation, display to authorised parties (instructor and in-chain players), transmission to Subprocessors for email and error monitoring, erasure on request or schedule.
The current list of Subprocessors is maintained on our Subprocessors page and incorporated into this DPA by reference.