Data Processing Agreement (DPA)

1. Parties and Conclusion of the Agreement

The controller within the meaning of Art. 4(7) GDPR is the studio (the customer) using REPPPS to manage its training operations. The processor within the meaning of Art. 4(8) GDPR is REPPPS, operated by Stefan Pasch, Alte Bäckerei 9, 19057 Schwerin, Germany, email: hi@reppps.app. This data processing agreement (DPA) governs REPPPS's processing of personal data on the studio's behalf under Art. 28 GDPR.

This DPA is concluded in electronic form (Art. 28(9) GDPR): the person acting for the studio accepts it when starting the studio by ticking the corresponding checkbox. REPPPS logs the accepted version of this DPA, the time of acceptance, the studio and the user account used to accept it.

2. Allocation of Roles

REPPPS acts as a processor only insofar as personal data is processed for the studio's coach area (clause 6). Each member also uses REPPPS with their own account and their own training log. For that account and for the processing involved in the member's own use of REPPPS, REPPPS is an independent controller; that processing is not covered by this DPA.

Details of the processing for which REPPPS is the controller are set out in our privacy policy.

3. Subject Matter of Processing

The subject matter of the processing is the provision of a training-tracking application that lets the studio accompany, review and document its members' training.

4. Duration of Processing

Processing takes place for the duration of the studio's contractual use of REPPPS. It ends when the studio's subscription ends or the studio account is deleted; deletion and return of the data are governed by clause 16.

5. Nature and Purpose of Processing

REPPPS processes the data listed in clause 6 solely to enable the training support of the studio's members described in this DPA. In particular, this means displaying the members' training data and training progress in the studio's coach area, including when a member last trained, so that the studio can contact members after a prolonged break from training, and sending email invitations at the studio's request. Processing comprises storing, analysing (e.g. personal records and training frequency) and displaying this data.

6. Categories of Personal Data

In connection with the coach area, REPPPS processes only the following categories of personal data on the studio's behalf:

• Members' master data: name and email address
• Training sessions
• Sets with reps, weight and RIR
• Personal records (PRs)
• Skip reasons (see clause 7)
• Progression charts
• Training plans assigned by the studio and progress through them
• Email addresses of people the studio invites by email

Data the member keeps private and the studio cannot see, in particular body weight and personal notes, is not covered by this DPA.

7. Special Categories of Personal Data (Art. 9 GDPR)

Skip reasons may allow conclusions about a member's health, for example when an exercise is skipped because of “pain”. Such information may constitute health data within the meaning of Art. 9 GDPR. It is processed only within the scope of the consent to coach-area visibility that the member gave when joining the studio, and it is no longer visible to the studio once that consent is withdrawn. The studio may use this information solely to support the training of the member concerned and must not use it for any other purpose.

8. Categories of Data Subjects

Data subjects are the studio's members who use the studio's invite link and have consented to coach visibility, as well as people the studio invites by email to join.

9. Processing Only on Instruction

REPPPS processes the personal data only on the studio's documented instructions, unless required to do otherwise by European Union or member state law to which REPPPS is subject. In that case, REPPPS informs the studio of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The studio's instructions are set out in this DPA and in the studio's use of the REPPPS features. The studio gives any further instructions in text form (e.g. by email). If REPPPS considers that an instruction infringes the GDPR or other Union or member state data protection provisions, REPPPS informs the studio immediately (second subparagraph of Art. 28(3) GDPR).

10. Confidentiality

REPPPS ensures that persons authorized to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

11. Technical and Organisational Measures (Art. 32 GDPR)

REPPPS takes appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These include in particular:

• Encryption in transit (TLS/HTTPS) for all connections between users' devices and REPPPS
• Hosting in the EU in professionally operated data centres; the application, database and cache communicate over the hosting provider's private network
• Passwords stored only as hashes, plus optional two-factor authentication (authenticator app/TOTP, one-time code by email, backup codes)
• Role-based access control: the studio sees only members who have consented to coach visibility; this is checked server-side, for each individual member, on every request
• Rate limiting on sign-in, sign-up, password reset and two-factor verification to protect against brute-force attacks
• Logging of security-relevant events (e.g. enabling and disabling two-factor authentication, account deletions, administrative actions)
• Daily automated database backups, retained on a rotating 6-day basis, plus point-in-time recovery
• Access to production systems and data only by the operator, and only to the extent required for operation, maintenance, troubleshooting or support

12. Sub-processors

The studio hereby grants REPPPS general written authorisation to engage other processors (sub-processors) (Art. 28(2) GDPR). The sub-processors engaged when this DPA is concluded are deemed approved.

A complete, current list with role, jurisdiction and data protection agreement is available on our subprocessors page.

REPPPS informs the studio in advance of any intended addition or replacement of a sub-processor by updating the subprocessors page and notifying the owner of the studio account by email. The studio may object to the change in text form within 14 days of receiving the notification; the change takes effect no earlier than the end of that period. If no mutually acceptable solution can be found after an objection, the studio may cancel its studio subscription with effect from the date the change takes effect.

REPPPS contractually imposes on each sub-processor the same data protection obligations as set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures (Art. 28(4) GDPR). Where a sub-processor fails to fulfil its data protection obligations, REPPPS remains liable to the studio for the performance of that sub-processor's obligations.

13. Place of Processing and Third-Country Transfers

Processing takes place primarily in the European Union: the application, database and cache are operated in the hosting provider's europe-west4 region (Netherlands). Where sub-processors are established in a third country or transfer personal data to a third country when providing their services, this takes place only in compliance with Art. 44 et seq. GDPR, in particular on the basis of the adequacy decision for the EU-US Data Privacy Framework, where the recipient is certified under it, and/or the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

14. Assisting the Studio

Where reasonably possible, REPPPS assists the studio with appropriate technical and organisational measures in fulfilling requests from data subjects (Art. 12-23 GDPR) and in complying with the obligations under Art. 32 to 36 GDPR, including notification of personal data breaches (clause 15).

15. Personal Data Breaches

REPPPS notifies the studio of any personal data breach affecting data processed on the studio's behalf without undue delay, and at the latest within 48 hours of becoming aware of it. The notification is sent by email to the owner of the studio account and contains the information required by Art. 33(3) GDPR: a description of the nature of the breach including, where possible, the categories and approximate number of data subjects and records concerned, a contact point where more information can be obtained, the likely consequences of the breach, and the measures taken or proposed to address and mitigate it. Where it is not possible to provide this information at the same time, REPPPS provides it in phases without undue further delay.

16. Deletion and Return

When the studio subscription ends, REPPPS notifies the owner of the studio account by email and states the deletion date. The deletion date is 30 days after the end of the contract, but no earlier than 14 days after the notification. Until the deletion date, the studio can reactivate the subscription in the coach area, in which case the deletion no longer takes place. Likewise, until then the studio can request the return of the personal data processed on its behalf by email to hi@reppps.app; REPPPS then transmits the data to the studio in a common electronic format and deletes it only afterwards. Otherwise, the data is deleted automatically on the deletion date, unless a statutory obligation requires further storage. Deleted data can remain in backups and in the point-in-time recovery archive for up to about 4 weeks until it is overwritten in the regular rotation. The members' own accounts and training logs are not deleted, as REPPPS is an independent controller for them (clause 2); after the end of the contract, this data is no longer visible to the studio.

17. Information and Audit Rights

REPPPS makes available to the studio all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and in this DPA, and allows for audits, including inspections, by the studio or an auditor mandated by it. Compliance is demonstrated primarily through documentation, in particular information and records on the technical and organisational measures. On-site audits must be announced at least 14 days in advance and take place during normal business hours without disrupting REPPPS's operations. The studio bears its own costs incurred in connection with audits.

18. Final Provisions

Term and termination: This DPA applies for the term of the studio subscription, including any trial period, and ends when the subscription ends, without the need for separate termination. Obligations which by their nature continue beyond the end of the contract, in particular under clause 10 (confidentiality) and clause 16 (deletion and return), remain in force.

Precedence: In the event of any conflict between this DPA and the REPPPS Terms of Service, the provisions of this DPA prevail with regard to the protection of personal data.

Liability: Liability towards data subjects is governed by Art. 82 GDPR. Otherwise, liability between the studio and REPPPS is governed by the liability provisions of the Terms of Service.