This Data Processing Addendum ("DPA") forms part of the agreement between the customer ("Controller") and FitFocus IO PTY LTD (ACN 661 231 330) ("Processor", "FitFocus") under which FitFocus provides the coaching platform (the "Service"). It sets out the parties' obligations with respect to personal data processed in connection with the Service.
1. Definitions
Capitalised terms not defined here have the meaning given in the General Data Protection Regulation (EU) 2016/679 ("GDPR") or the Australian Privacy Act 1988 (Cth), as applicable.
2. Subject matter and duration
The subject matter of the processing is the operation of the Service for the benefit of the Controller. The duration of the processing is the term of the underlying subscription plus any post-termination data export window.
3. Nature and purpose
The nature of the processing is: storage, transmission, display, indexing, analytics, and backup of coaching data entered by the Controller's authorised users or imported from integrated systems, and the synchronisation of scheduling data with third-party services that the Controller's authorised users choose to connect.
4. Categories of data subjects
- Coaches and other authorised Controller personnel.
- End clients of the Controller (clients of the coaching business).
- Leads captured through the Controller's forms and scheduling flows.
5. Categories of personal data
- Identity and contact data (names, emails, phone numbers, avatars).
- Account credentials and authentication metadata.
- Health-related data (measurements, training data, wearable metrics, form responses).
- Communications (messages, attachments, call notes).
- Scheduling data (bookings, appointments, coach availability, time off and related notes).
- Connected-service data (the email address of a connected third-party account, an encrypted access token, and free and busy times, which are not stored).
- Financial and billing data (on the Controller side, cardholder data is held by Stripe).
Sensitive data may be processed where the Controller or its end clients choose to record it. The Controller is responsible for obtaining the necessary legal basis from end clients before entering such data.
6. Processor obligations
FitFocus will:
- Process personal data only on documented instructions from the Controller.
- Impose confidentiality obligations on personnel with access to personal data.
- Implement appropriate technical and organisational security measures (summarised on the Security page).
- Assist the Controller in responding to data subject requests and data protection impact assessments.
- Notify the Controller without undue delay after becoming aware of a personal data breach.
- At the Controller's choice, delete or return personal data at the end of the service, subject to legal retention obligations.
7. Sub-processors
The Controller authorises FitFocus to engage the sub-processors published at fitfocus.io/legal/subprocessors. FitFocus imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible for their performance.
FitFocus will give the Controller at least 30 days' notice before a new sub-processor begins processing the Controller's personal data, by updating that page and emailing the Controller's account owner. The Controller may object in writing within that period on reasonable data protection grounds. The parties will then discuss the objection in good faith. If it cannot be resolved, the Controller may terminate the affected part of the Service by written notice, and FitFocus will refund any prepaid fees for the period after termination.
8. Integrations enabled by the Controller
Where the Controller's authorised users connect a third-party service to the Service (for example, Google Calendar), FitFocus transfers the personal data needed for that integration to the third-party service on the Controller's instruction. For Google Calendar this includes session details and the first names of end clients booked into a session. That service processes the data under its own terms with the user who connected it and is not a sub-processor of FitFocus. The Controller is responsible for deciding whether to enable an integration and for having a lawful basis for the transfer. Disconnecting an integration stops further transfers. FitFocus deletes the credentials it holds for that integration and the calendar it created in the connected account.
9. International transfers
Where personal data is transferred outside the European Economic Area, the United Kingdom, or Australia, the parties rely on standard contractual clauses, the UK International Data Transfer Addendum, or other lawful mechanisms, as applicable.
10. Audit
On at least 30 days' prior written notice and not more than once in any 12-month period (except following a personal data breach), the Controller may audit FitFocus's compliance with this DPA. FitFocus will first make available the documentation and information reasonably needed to demonstrate compliance, which may include third-party attestations or reports where available. Any on-site audit takes place during business hours, is subject to reasonable confidentiality obligations, must not disrupt the Service or other customers' data, and is at the Controller's cost.
11. Liability
Liability under this DPA is subject to the limits of liability in the underlying agreement.
12. Term and termination
This DPA remains in force for the duration of the underlying agreement and, where applicable, for any period during which FitFocus continues to process personal data on behalf of the Controller after termination.
13. Contact
Questions about this DPA should be directed to support@fitfocus.io.