For trainers
Data Processing Agreement
1. Parties and scope
This Data Processing Agreement ("DPA") is between you, the trainer ("you", the "controller"), and [Company legal name], tax ID [Tax ID], with registered office at [Registered address] ("Nivo", "we", the "processor").
It forms part of the Trainer Terms of Service ("Terms") and applies whenever we process personal data on your behalf in connection with Nivo ("client personal data"), in accordance with Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Spanish Organic Law 3/2018 (LOPDGDD).
It does not apply to data that Nivo processes as an independent controller, as described in the Privacy Policy, such as your clients' Nivo account and login data, security records, app analytics and records of acceptance of our terms.
2. Details of the processing
| Subject matter | Providing the Nivo platform to you and your clients. |
|---|---|
| Duration | For as long as the Terms are in force, plus the deletion period in section 9. |
| Nature and purpose | Hosting, storage, organisation, retrieval, display, transmission (including chat and invitation emails), adaptation (such as resizing images) and deletion of data, so that you can coach your clients through Nivo. |
| Data subjects | Your clients, and the prospective clients you invite. |
| Categories of data | Identification and contact data (name, surname, email address, photo, language); profile data (date of birth, sex, height, coaching dates, goals, habits, plan type); training and nutrition information and preferences; workout results; form answers; messages and shared files; your private notes about clients. |
| Special categories | Health data: weight, body measurements, progress photos, injuries or physical limitations, medical conditions, allergies and intolerances, and health information in forms, messages or files. |
3. Your instructions
We process client personal data only on your documented instructions. The Terms, this DPA, and your use and configuration of Nivo's features are your complete instructions. We will only process client personal data in any other way if EU or Member State law requires it, in which case we will tell you first unless that law prohibits it. We will tell you immediately if we believe that an instruction infringes data protection law.
4. Your responsibilities as controller
- Have a valid legal basis for all the client personal data you enter in Nivo or ask your clients to provide.
- Inform your clients about the processing, as required by Articles 13 and 14 GDPR, including that you use Nivo. Our Privacy Policy can help, but it does not replace your own duty to inform.
- Health data: Nivo asks your clients for their explicit consent in the client app when they join. Before a client has given that consent, for example when you enter information while creating their profile, you are responsible for having a valid legal basis, such as consent you have obtained directly. You must respect a client's refusal or withdrawal of consent.
- Only enter data that is adequate, relevant and limited to what is necessary for coaching.
- Handle your clients' requests to exercise their rights, with our help as described in section 7.
5. Confidentiality
We ensure that the people we authorise to process client personal data are bound by an obligation of confidentiality, and that they only access it when necessary to provide, support or secure Nivo.
6. Security
We implement appropriate technical and organisational measures to protect client personal data, as required by Article 32 GDPR, including the measures in the Annex. We review them regularly and may update them, provided the overall level of protection is not reduced.
7. Assistance
Taking into account the nature of the processing and the information available to us, we will help you:
- Respond to your clients' requests to exercise their rights. If we receive a request directly, we will pass it to you without undue delay and will not respond ourselves, other than to confirm that we have passed it on, unless you ask us to.
- Meet your obligations regarding security, breach notification, data protection impact assessments and prior consultation with the supervisory authority (Articles 32 to 36 GDPR).
8. Personal data breaches
We will notify you without undue delay, and where feasible within 48 hours of becoming aware of it, of any personal data breach affecting client personal data. We will give you the information you need to meet your own notification obligations, and take reasonable steps to contain the breach and limit its effects.
9. Deletion
- When you close your account or the Terms end, we will delete client personal data within 30 days, unless EU or Member State law requires us to keep it.
- Before closing your account, you can ask us for a copy of your clients' data in a commonly used format.
- When you remove a client in the app, that client's coaching data is deleted within the same period.
- Data in backups is deleted as those backups are overwritten.
10. Sub-processors
You give us general authorisation to use sub-processors. Our current sub-processors are:
| Sub-processor | Service | Location |
|---|---|---|
| Google Ireland Limited / Google LLC | Firebase: authentication, database, file storage, server functions, hosting and crash reporting | EU for the database and server functions. Other services may process data in the United States. |
| Stream.io, Inc. | In-app chat | [Stream data region] |
| Resend, Inc. | Transactional email, such as client invitations | United States |
- We impose data protection obligations on each sub-processor that are equivalent to those in this DPA, and we remain responsible to you for their performance.
- We will tell you about any new or replacement sub-processor at least 30 days in advance, by email or in the app.
- You can object on reasonable data protection grounds within that period. If we cannot resolve your objection, you can close your account without penalty before the change takes effect.
11. International transfers
Where a sub-processor processes client personal data outside the European Economic Area, we ensure an appropriate safeguard under Chapter V GDPR, such as a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified companies) or the Standard Contractual Clauses.
12. Information and audits
We will make available the information reasonably necessary to demonstrate compliance with this DPA, including security documentation and our sub-processors' certifications. If that is not enough, you may request an audit once a year, at your own cost and with at least 30 days' notice. It must be carried out during business hours by an independent auditor bound by confidentiality, in a way that does not compromise other users' data or our security.
13. Liability and precedence
Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not allow them. If this DPA conflicts with the Terms, this DPA prevails as regards the protection of personal data.
Annex: security measures
- Encryption of data in transit (TLS) and at rest (by our hosting provider).
- Authentication of every user.
- Access rules, covered by automated tests, that restrict each trainer to their own data and clients, and each client to their own data.
- Main database and server functions hosted in EU regions.
- Administrative access limited to authorised personnel who need it, with credentials and secrets kept in a managed secret store.
- Monitoring of errors and service health, and a process for responding to security incidents.
- Regular review of software dependencies and access rules.