# DRAFT – Data Processing Agreement (Art. 28 GDPR)

> **DRAFT for legal review – do not sign, not legal advice.**
> This template describes processing as the software actually performs it today. Square brackets `[…]` mark
> details still to be filled in or confirmed. The German version (AVV) is the primary text.
> Version: [date]

## Parties

**Controller:** the coach or studio coaching clients on the platform [name, address]

**Processor:** HMO Europe B.V., Steenovenweg 36, 5708 HN Helmond, the Netherlands, KvK 87173442
[add authorised representative, email]

## 1. Subject matter and duration

1. Provision of the coaching platform [product name] (web app, iOS app, API), through which the controller manages
   its clients' training, nutrition, check-in and message data.
2. This agreement runs for as long as the controller uses the platform.

## 2. Nature, purpose and scope

- **Purpose:** planning and supporting training and nutrition, communication between controller and clients,
  AI-assisted drafts (plans, replies, reviews) that the controller reviews before they are sent.
- **Data:** contact data (name, email address, phone number where given), training logs, nutrition logs, body
  measurements and weight, check-ins, messages, uploaded photos and videos, readiness scores and health readings
  the client shares (e.g. sleep, resting heart rate, HRV) – **health data under Art. 9 GDPR**.
- **Data subjects:** the controller's clients; the controller and its staff.

## 3. Instructions

The processor processes data only on the controller's documented instructions; using the platform's features
counts as an instruction. The processor informs the controller without delay if it considers an instruction
unlawful.

## 4. Confidentiality

Everyone with access to the data is bound to confidentiality.

## 5. Technical and organisational measures

Measures under Art. 32 GDPR are set out in **Annex 2**. They may evolve provided the level of protection does not
fall.

## 6. Sub-processors

1. The controller authorises the sub-processors listed in **Annex 1**.
2. The processor announces intended changes [at least 30 days] in advance, among other places on the public page
   "Where your data lives" (`/trust`). The controller may object on reasonable data-protection grounds.
3. For transfers to third countries the processor ensures appropriate safeguards under Art. 44 et seq. GDPR
   [name per provider: adequacy decision / standard contractual clauses].

## 7. Assistance

The processor assists the controller with data subject requests (access, rectification, erasure, portability), data
protection impact assessments, and notifications under Art. 33 and 34 GDPR. It reports personal data breaches
without undue delay and within [48] hours of becoming aware of them.

## 8. Deletion and return

When the agreement ends, the processor deletes the controller's data unless the law requires retention. Database
backups are kept for 14 days and then expire. [Add: deletion of uploaded files – account deletion currently removes
database records but not yet photo/video files on disk.] On request, the processor provides an export first.

## 9. Audits

The processor makes available the information needed to demonstrate compliance and allows audits
[with notice, at the controller's cost, at most once a year unless there is cause].

## 10. Liability and final provisions

[Liability under Art. 82 GDPR; governing law; jurisdiction; written form – settle with counsel.]

---

## Annex 1 – Sub-processors

| Provider | Service | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting: app, database, uploads, backups | all platform data | [confirm data centre] |
| Supabase | Sign-in (authentication) | email address, password hash, sessions | [confirm region] |
| OpenAI | AI features; requests with health context go only here; photo analysis | content of each request, photos | [confirm region and safeguard] |
| DeepSeek, Moonshot AI | less sensitive AI text tasks, without name/email | request text | China [name safeguard] |
| Sentry | error reports, personal data sending switched off | technical error details | [confirm region] |
| Resend | transactional email | email address, message content | [confirm] |
| Apple | push notifications; in-app purchases (end users only) | push token, notification text | [confirm] |
| Meta (WhatsApp), Telegram | messaging, only if the controller connects the channel | phone number/chat ID, messages | [confirm] |
| Stripe | coach plan payments, once offered | controller's billing details | [confirm] |

## Annex 2 – Technical and organisational measures

- **Encryption in transit:** HTTPS with automatically renewed TLS certificates (Caddy / Let's Encrypt).
- **Network:** only HTTP/HTTPS via the reverse proxy is publicly reachable; the database is not exposed. Firewall:
  ports 22, 80, 443 only.
- **Access control:** sign-in via Supabase; client access via signed portal links; per-coach and per-client access
  checked server-side. [Reference the 2026-07 security audit results]
- **Availability:** nightly database backup with 14-day retention. [Confirm off-site copy]
- **Data minimisation:** error reports without personal data; the AI gateway's own telemetry is switched off; AI
  providers receive only what each request needs.
- **Human oversight:** AI drafts addressed to clients are approved by the controller.
- [Add: encryption at rest, logging, staff access rights, incident response plan]