This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between FitDesk ("Processor") and the Personal Trainer using the Service ("Controller"). It applies whenever the Controller uses FitDesk to process personal data of their Clients and other contacts. Where the Controller's Clients are based in the UK or EEA, this DPA reflects the requirements of UK GDPR Article 28 and EU GDPR Article 28.
1. Subject matter and duration
FitDesk processes personal data on behalf of the Controller solely to provide the Service described in the Terms. Processing continues for the duration of the Controller's account.
2. Nature and purpose of processing
- storing Client records, bookings, sessions and payments;
- delivering messages and email notifications;
- hosting workout plans, exercise videos, progress photos and notes;
- generating invoices and processing card payments via Stripe;
- providing analytics and product features within the Controller's own dashboard.
3. Categories of data subjects and personal data
- Data subjects: the Controller's Clients, prospective clients and waitlist contacts.
- Personal data: name, email, phone, photo, training notes, attendance, payment metadata, free-text messages, files the Client uploads.
- Special category data: health/fitness information may appear in notes and progress data - the Controller must have a lawful basis (typically explicit consent) before entering it.
4. FitDesk's obligations as processor
FitDesk will:
- process personal data only on documented instructions from the Controller (the Service configuration counts as instructions);
- ensure persons authorised to access the data are bound by confidentiality;
- implement appropriate technical and organisational measures (see Annex A);
- assist the Controller with data-subject rights requests and DPIAs where reasonably required;
- notify the Controller without undue delay (and within 72 hours where feasible) after becoming aware of a personal data breach affecting the Controller's data;
- at the end of the agreement, delete or return personal data at the Controller's choice, save where storage is required by law.
5. Sub-processors
The Controller authorises FitDesk to use the following sub-processors and any successors, on substantially equivalent data-protection terms:
- Supabase - managed Postgres, authentication and file storage
- Stripe - card payments, payouts and Connect
- Resend (or equivalent) - transactional email delivery
- Cloudflare - edge hosting and DDoS protection
We will give at least 30 days' notice of any new sub-processor. The Controller may object on reasonable data-protection grounds, in which case the parties will work in good faith to find a solution; if none can be found, the Controller may terminate the affected part of the Service.
6. International transfers
Where personal data is transferred outside the UK/EEA, FitDesk uses the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or relies on adequacy decisions, and applies supplementary measures such as encryption in transit and at rest.
7. Audits
FitDesk will make available the information necessary to demonstrate compliance with this DPA, including independent audit reports of key sub-processors where available. On reasonable written notice, the Controller may audit relevant FitDesk records once per year and at the Controller's cost.
8. Liability
Each party's liability under this DPA is subject to the limitations in the Terms.
Annex A - Security measures
- Row Level Security on all tenant data in Postgres
- TLS 1.2+ in transit; AES-256 at rest for the database and object storage
- Hashed passwords, optional two-factor authentication, OAuth via Google
- Secrets stored in a managed secret store and never in source control
- Audit logging of significant write operations
- Least-privilege access for engineers, with logged admin actions
- Regular dependency and configuration security scanning
- Documented incident-response process and breach notification workflow