This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between Pickle Labs Collective Ltd, company number 17219315, which runs FitDesk ("FitDesk" or "Processor"), and the Personal Trainer using the Service ("Controller"). It applies whenever the Controller uses FitDesk to process personal data of their Clients and other contacts. Where the Controller's Clients are based in the UK or EEA, this DPA reflects the requirements of UK GDPR Article 28 and EU GDPR Article 28.
1. Subject matter and duration
FitDesk processes personal data on behalf of the Controller solely to provide the Service described in the Terms. Processing continues for the duration of the Controller's account.
2. Nature and purpose of processing
- storing Client records, bookings, sessions and payments;
- delivering messages and email notifications;
- hosting workout plans, exercise videos, progress photos and notes;
- generating invoices and processing card payments via Stripe;
- providing analytics and product features within the Controller's own dashboard.
3. Categories of data subjects and personal data
- Data subjects: the Controller's Clients, prospective clients, waitlist contacts and any emergency contacts the Controller records.
- Personal data: name, email, phone, date of birth, emergency contact details, photo, training notes, health tags, attendance, body measurements, payment metadata (including card brand, last four digits and expiry), free text messages and files the Client uploads.
- Special category data: health information (such as injuries, medical conditions, medications, allergies and health questionnaire answers) may appear in forms, health tags, notes, messages and progress data. The Controller must have a valid legal basis, including a condition for special category data, before entering it.
- Age: The Trainer must not add details of anyone under 16 to FitDesk. Where a client is 16 or 17, the Trainer is responsible for deciding whether that client can give their own consent to the health information the Trainer records.
4. FitDesk's obligations as processor
FitDesk will:
- process personal data only on documented instructions from the Controller (the Service configuration counts as instructions);
- ensure persons authorised to access the data are bound by confidentiality;
- implement appropriate technical and organisational measures (see Annex A);
- assist the Controller with data-subject rights requests and DPIAs where reasonably required;
- notify the Controller without undue delay (and within 72 hours where feasible) after becoming aware of a personal data breach affecting the Controller's data;
- at the end of the agreement, delete or return personal data at the Controller's choice, save where storage is required by law.
5. Sub-processors
The Controller authorises FitDesk to use the following sub-processors and any successors, on substantially equivalent data-protection terms:
- Supabase: database, authentication and file storage
- Lovable: application hosting and managed services, including sign-in handling and the AI gateway
- Lovable (email delivery, using Mailgun)
- Stripe: card payments, payouts and Connect
- Cloudflare: edge hosting and DDoS protection
- Expo: push notification relay for the mobile app
- Apple: Sign in with Apple and Apple Push Notification service
- Google: Sign in with Google, Google Calendar if a Trainer connects it, and Firebase Cloud Messaging to deliver push notifications on Android
- OpenAI and Google, as AI model providers, reached through the Lovable AI gateway: used only when a Trainer uses the AI assistant, asks for an AI plan or estimates meal figures
- Firecrawl: reads a Trainer's own website address to extract branding when the Trainer asks
We will give at least 30 days' notice of any new sub-processor. The Controller may object on reasonable data-protection grounds, in which case the parties will work in good faith to find a solution; if none can be found, the Controller may terminate the affected part of the Service.
6. International transfers
Our main database is hosted in the EU (Sweden). Some of our providers may process data outside the UK. We are confirming the transfer safeguards each provider uses and will update this section.
7. Audits
FitDesk will make available the information necessary to demonstrate compliance with this DPA. This includes the security and certification statements that key sub processors publish, such as Supabase's SOC 2 Type 2 and ISO 27001 statements and Stripe's PCI DSS certification. On reasonable written notice, the Controller may audit relevant FitDesk records once per year and at the Controller's cost.
8. Liability
Each party's liability under this DPA is subject to the limitations in the Terms.
Annex A: Security measures
- Row Level Security on tenant data in the database
- Data sent over TLS. The database, file storage and backups sit on encrypted disks (AES-256) run by Supabase, the provider behind Lovable Cloud
- Hashed passwords, and sign-in with Apple or Google
- Server secrets are kept in a managed secret store, not in our code
- Access to production systems is restricted to people and tools that FitDesk has authorised
- A documented process for handling incidents and notifying affected Controllers of a breach