1. Parties, Scope & Roles
This DPA forms part of the Terms of Service between HEATCOACH ([PLACEHOLDER: legal name], Greece — the “Processor”) and each coach using the Service in the course of business (the “Controller”). It applies to personal data of the coach’s clients that the coach manages through HEATCOACH (“Client Data”: profiles, health and fitness data, plans, messages, photos).
For clarity: HEATCOACH is an independent controller for platform account data, billing, security, and (opt-in) analytics, as described in the Privacy Policy.
2. Processing Details
- Subject matter & duration: providing the HEATCOACH platform for the duration of the coach’s account
- Nature & purpose: hosting, storage, display, transmission, and backup of Client Data to deliver coaching features
- Data subjects: the coach’s clients
- Categories: identity/contact data, and health & fitness data (special category — the coach is responsible for having a lawful basis, including the client’s explicit consent collected in-platform)
3. Processor Obligations (GDPR Art. 28(3))
- Process Client Data only on the coach’s documented instructions (given via the platform’s features), unless required by law — in which case we inform the coach unless prohibited
- Ensure persons processing the data are bound by confidentiality
- Implement appropriate technical and organizational security measures (encryption in transit and at rest, hashed credentials, row-level security, access controls, backups)
- Assist the coach, insofar as possible, in responding to data-subject requests and in meeting security, breach-notification, and DPIA obligations
- Notify the coach without undue delay after becoming aware of a personal data breach affecting Client Data
- Delete Client Data at the end of the relationship (account deletion removes it, subject to statutory retention), or return it on request via data export
- Make available information reasonably necessary to demonstrate compliance, and allow for audits (satisfied in the first instance by our documentation; on-site audits by prior agreement, at the coach’s cost, max once yearly)
4. Sub-processors
The coach gives general authorization for the sub-processors listed at /subprocessors. We will update that page at least 30 days before adding a sub-processor that processes Client Data; coaches may object on reasonable data-protection grounds, in which case the coach may terminate the account. Sub-processors are bound by data protection obligations no less protective than this DPA.
5. International Transfers
Where processing involves transfers outside the EU/EEA or UK, they are covered by the EU–U.S. Data Privacy Framework (and UK Extension) for certified providers and/or the European Commission’s Standard Contractual Clauses, as incorporated in our agreements with each sub-processor.
6. CCPA / US State Law Service-Provider Terms
To the extent US state privacy laws apply to Client Data, HEATCOACH acts as a “service provider”/“processor” and:
- Does not sell or share Client Data, and does not process it for targeted advertising
- Processes it only for the business purpose of providing the Service
- Does not combine it with personal information from other sources except as permitted for the service
- Will notify the coach if it can no longer meet these obligations
7. HIPAA Notice
HEATCOACH is not a HIPAA Business Associate and the Service must not be used to process protected health information subject to HIPAA (e.g. insurance-billed clinical records).