Data processing agreement

This agreement is concluded between the owner of a Gympli organization ("controller") and [Vor- und Nachname], [Straße und Hausnummer], [PLZ] [Ort], Deutschland ("processor"). It forms part of the Terms and is concluded when a subscription or trial is taken out; electronic form is sufficient (Article 28(9) GDPR).

1. Subject matter and duration

1. The processor provides the controller with the Gympli software (main contract). In doing so it processes personal data that the controller, their team and their clients record in the organization ("controller data") exclusively on the controller's behalf.
2. This agreement does not cover data for which the processor is itself the controller: user accounts, sign-in and security data, billing of the subscription, support requests and visits to the website (see the privacy policy).
3. The agreement runs for as long as the processor processes controller data and does not end before the main contract.

2. Nature, purpose, types of data and data subjects

3. Instructions

1. The processor processes controller data only on documented instructions from the controller, unless required to do so by Union or member state law; in that case it informs the controller of that legal requirement beforehand, unless that law prohibits this.
2. The instructions follow from this agreement, the Terms and the use of Gympli's features and settings by the controller and their team. The controller gives further instructions in text form to [E-Mail-Adresse].
3. If the processor considers an instruction unlawful, it informs the controller without delay and may suspend its execution until it is clarified.

4. Processor's obligations

1. Confidentiality: persons with access to controller data are committed to confidentiality or are under a statutory obligation of confidentiality. The processor accesses controller data only where necessary for operation, maintenance and troubleshooting; there is no administrative interface for reading coaching content.
2. Security: it takes the technical and organizational measures under Article 32 GDPR (section 7) and adapts them to the state of the art without lowering the level of protection.
3. Assistance: it assists the controller with appropriate measures in responding to requests from data subjects (Articles 12–22 GDPR) and with the obligations under Articles 32–36 GDPR. It forwards requests that reach it directly to the controller without delay.
4. Personal data breaches: it notifies the controller of a breach affecting controller data without undue delay, where possible within 48 hours of becoming aware of it, with the information under Article 33(3) GDPR as far as available.
5. Evidence: it makes available to the controller the information necessary to demonstrate compliance with Article 28 GDPR and allows for audits, including inspections, by the controller or an auditor mandated by them who is bound to confidentiality. Inspections must be announced with reasonable notice, take place during business hours and must not disrupt operations or the data of other customers.
6. Place of processing: controller data is stored in data centres in Germany. Transfers to a country outside the EU/EEA take place only through the sub-processors named in section 6 and only under the conditions of Articles 44 et seq. GDPR.

5. Controller's obligations

1. The controller is responsible for the lawfulness of the processing, in particular for having a legal basis, informing their clients and team and safeguarding their rights.
2. For their clients' health data (Article 9 GDPR) the controller obtains the required consent themselves, documents it and respects its withdrawal. The controller decides on their clients' requests for access, rectification and erasure; the processor supports them (section 4(3)).
3. The controller informs the processor without delay if they find errors or irregularities.

6. Sub-processors

1. The controller gives general authorization to engage sub-processors. They currently are:

1. Stripe Payments Europe, Ltd. (Dublin, Ireland) processes only the owner's billing data, for which the processor is itself the controller, and is therefore not a sub-processor for controller data.
2. The processor contractually binds every sub-processor to the obligations of this agreement. Transfers to the USA rely on the EU-US Data Privacy Framework where the provider is certified and otherwise, where applicable, on the European Commission's standard contractual clauses.
3. The processor informs the controller by email at least four weeks before engaging or replacing a sub-processor. The controller can object for an important data-protection reason; if no agreement is reached, they can terminate the main contract with effect from the date of the change.

7. Technical and organizational measures

• Encryption: all connections are encrypted with TLS (HTTPS with HSTS). Data exports are created encrypted (libsodium), are valid for 48 hours and can be downloaded only once.
• Access control: passwords are stored only as bcrypt hashes; two-factor sign-in (TOTP) is available and its secrets are stored encrypted. Sign-in attempts are rate-limited. Users see their sessions and can end them; a password change ends all other sessions. The mobile app keeps its token in the device's secure storage.
• Authorization: every request is restricted to the organization the signed-in account belongs to; ids from the request are not used for this. Within the organization fixed roles apply: clients see only their own data, team members only their assigned clients (access ends immediately on reassignment), the owner all clients. Conversations can be read only by their participants and the assigned trainer, not by the owner as such.
• File storage: photos, attachments and exports are kept in non-public object storage and served only after sign-in and an authorization check. The only exception is resized profile photos, which can be retrieved through an address that cannot be guessed.
• Separation: data of different organizations is separated logically; test and production systems are separate.
• Input control: a log records security-relevant events (e.g. sign-ins, role and membership changes, exports, attachment downloads) and is kept for 365 days.
• Availability: operation in data centres of Hetzner Online GmbH in Germany. [[Backups: describe procedure, frequency, retention and restore test]]
• Deletion: files of deleted accounts are removed by a background job and a daily sweep; technical data is deleted after fixed periods (see the privacy policy).
• Review: dependencies are checked for known vulnerabilities and updated; the measures are reviewed regularly.

8. Deletion and return

1. During the term, the controller can edit and delete controller data in Gympli themselves.
2. After the main contract ends, the controller data stays stored, so that the controller can resume the subscription, until they delete their account or request its deletion. Deleting the owner account deletes the organization and all controller data; files are then removed from object storage.
3. On request before deletion, the processor provides the controller data to the controller in a common machine-readable format.
4. The processor's statutory retention obligations remain unaffected.

9. Liability and final provisions

1. Liability is governed by Article 82 GDPR; otherwise the liability rules of the Terms apply.
2. In case of conflict, this agreement takes precedence over the Terms on matters of data protection.
3. Changes to this agreement follow the procedure for changes to the Terms. German law applies.