Last updated: 19 May 2026. Version 1.0.
This page documents the sub-processors used by Dragon Sports Media Limited when operating Dragon Team (dragonfc.co.uk). It also serves as a reference DPA for contributors and partners who require formal documentation of how their personal data is processed.
1. Parties and scope
This Data Processing Agreement ("DPA") governs the processing of personal data carried out by Dragon Sports Media Limited (the "Controller") in connection with the operation of the Dragon Team contributor portal.
Data controller
The data controller responsible for personal data collected via dragonfc.co.uk is:
- Dragon Sports Media Limited
- Company number: 15866644
- Registered office: 2 Alexandra Gate, Fford Pengam, Cardiff, United Kingdom, CF24 2SA
- ICO registration: ZA367891
- Contact: privacy@dragonfc.co.uk
Dragon Sports Media Limited operates the Dragon Team contributor hub and a network of independently branded sport editorial sites. Dragon Sports Media Limited (registered separately) and DragonBet are also part of the wider Lovells Group. DragonBet is licensed by the UK Gambling Commission (licence 64908).
This DPA applies to all personal data processed via dragonfc.co.uk including contributor application data, profile data, invoice data, and visitor analytics.
2. Definitions
Terms used in this DPA carry the meaning given to them in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
3. Roles
Dragon Sports Media Limited acts as Controller in respect of:
- Personal data submitted via the contributor application form
- Personal data created during the commissioning relationship (assigned sites, editorial notes, invoice records)
- Aggregated visitor analytics data
The third parties listed in Section 5 act as Processors or Sub-processors on behalf of Dragon Sports Media Limited, each subject to a written Data Processing Agreement.
4. Categories of data subjects and personal data
| Data subject category | Categories of personal data |
|---|---|
| Contributor applicants | Name, email, password (hashed), phone, country, bio, headshot, sectors, formats, portfolio links, publications, rates, capacity, social profile URLs, VAT and IR35 status |
| Approved contributors | All of the above, plus assigned sites, editorial notes, invoice records, brief activity, click promotion records |
| Site visitors | Truncated IP, browser/device info, page views, referrer (only with analytics consent) |
5. Sub-processors
The following sub-processors are engaged in the operation of dragonfc.co.uk. Each has a written Data Processing Agreement with Dragon Sports Media Limited.
| Sub-processor | Location | Purpose | Data processed | Transfer mechanism |
|---|---|---|---|---|
| 20i (Stack Internet Ltd) | United Kingdom | Website hosting, SFTP, MySQL database, mail relay | All data stored on the site | UK-adequate (no international transfer) |
| StackMail | United Kingdom | Transactional email delivery | Recipient email, message body | UK-adequate (no international transfer) |
| Cloudflare, Inc. | USA | DNS resolution, CDN, edge security | Visitor IP, request metadata | UK-US Data Bridge / Standard Contractual Clauses |
| Google LLC (Google Analytics 4) | USA | Site analytics (consent-gated) | Truncated IP, device, page views | UK-US Data Bridge / Standard Contractual Clauses |
| Xero (UK) Ltd | United Kingdom (data) / New Zealand (parent) | Finance, invoice processing, contributor payments | Name, email, VAT status, IR35 status, invoice data, bank details (collected separately by finance) | UK-adequate; intra-group access via SCCs |
| Automattic, Inc. | USA | WordPress core services (auto-updates, periodic health pings) | Site metadata only; no personal data routinely transferred | UK-US Data Bridge / SCCs |
Dragon Sports Media Limited will provide prior written notice of changes to sub-processors via this page. Material changes are notified to active contributors by email.
6. Security measures
Dragon Sports Media Limited implements appropriate technical and organisational measures as required by Article 32 UK GDPR, including:
- TLS encryption in transit (HTTPS, TLS 1.2 or higher)
- Encryption at rest for hosting provider database storage
- Salted password hashing using WordPress core functions
- Two-factor authentication enforced on administrator accounts
- Daily database backups managed by the hosting provider
- SPF, DKIM and DMARC configured on the sending domain
- IP addresses for click tracking immediately hashed with a daily-rotating salt
- Access logs and audit trail maintained for administrative actions
- Regular WordPress core, plugin and theme updates
7. International transfers
Where personal data is transferred outside the UK / EEA, Dragon Sports Media Limited relies on:
- Adequacy decisions where they apply (e.g. UK-EU adequacy)
- The UK-US Data Bridge for transfers to certified US providers
- Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA) otherwise
8. Data subject rights
Dragon Sports Media Limited provides data subjects with the means to exercise their rights under UK GDPR. Requests are handled within 30 days. Sub-processors assist as required.
For specific procedures and contact details, see Section 6 of our Privacy Policy.
9. Personal data breach
Dragon Sports Media Limited notifies the Information Commissioner’s Office within 72 hours of becoming aware of a personal data breach likely to result in a risk to the rights and freedoms of data subjects. Affected data subjects are notified without undue delay where the breach is likely to result in a high risk.
10. Termination and data return
On termination of a contributor relationship, personal data is retained or deleted in accordance with the schedule in Section 5 of our Privacy Policy. Data subjects may request deletion at any time, subject to legal retention obligations.
11. Updates to this DPA
The version number and date at the top reflect the most recent revision. Material updates that affect contributor or partner relationships are notified by email.
12. Contact
For data protection or DPA matters: privacy@dragonfc.co.uk
To request a counter-signed copy of this DPA for your records, email the same address. Dragon Sports Media Limited’s Data Protection Officer responds within 5 working days.