Data processing agreement

Parties and purpose

This agreement is between you, the coach (the "Controller"), and PBd (the company's legal name and address are to be added) ("PBd", the "Processor"). It applies to the personal data PBd processes for you when you use the platform, under UK GDPR Article 28, and forms part of the PBd terms for coaches.

What is processed

• Subject matter and nature: hosting and running your coaching platform: storing, retrieving, displaying, emailing and deleting your clients' and prospects' information on your instructions.
• Duration: for as long as you use PBd, then deletion as described below.
• People: your clients and former clients, people who enquire or book through your website, and your own staff.
• Data: names, emails, phone numbers, training and attendance records, messages, check-in answers and measurements, food targets and food diaries, PAR-Q and health information, progress photos, payments records, and anything else you choose to record.
• Special category data: health information and progress photos are special category data. You must have a lawful basis and a condition under UK GDPR Article 9 (usually explicit consent) for it.

Our duties as your processor

PBd will:

• process the data only on your documented instructions, which are your use of PBd's features and these terms, and tell you if we think an instruction breaks the law
• make sure everyone who can access the data is bound by confidentiality
• keep the data secure (see below)
• only use the sub-processors listed on the sub-processor page, on terms that give the same protection, and tell you before adding or replacing one so you can object
• help you answer requests from people exercising their rights (access, correction, deletion, portability), including by providing exports
• help you with data protection impact assessments and with consulting the ICO where needed
• tell you without undue delay, and aim to within 48 hours, after becoming aware of a personal data breach affecting your data, with what we know and what we are doing
• at the end, delete or return all the data as you choose, and delete existing copies, unless the law requires us to keep it
• give you the information you reasonably need to show we comply, and allow for audits you reasonably require, with notice and without disrupting the service

Security

We use measures appropriate to the risk, including:

• every table is separated by coach with database row-level security, so one coach can never read another's data; this is tested automatically on every change
• encryption in transit (HTTPS) and at rest at our providers
• progress photos kept in private storage and only shown through short-lived links
• payments handled by Stripe, so PBd never sees card numbers
• access to production data limited to what is needed to run the service, with changes made through reviewed code
• rate limiting on public forms, and monitoring of errors and scheduled jobs

AI

Where you use an AI feature, the text you provide and the related programme or message text is sent to our AI provider to produce a draft. It is not used to train models. Nothing generated is sent to your clients unless you approve it.

International transfers

Some sub-processors may process data outside the UK. Where they do, we make sure there is a lawful transfer mechanism, such as the UK's adequacy regulations or the International Data Transfer Agreement or UK Addendum, and list the position on the sub-processor page.

Your duties as Controller

You are responsible for having a lawful basis and any consents, giving your clients the information they are entitled to, keeping the data accurate, and the content of any instructions you give. You must not ask PBd to process data in a way that breaks the law.