Data Processing Agreement
1. Context and Scope
1.1 Background
When a Coach uses MyCoach to manage Athletes, the Coach acts as the data controller for the personal data of those Athletes. The MyCoach operator acts as the data processor, processing Athlete data solely on the Coach's behalf and according to the Coach's instructions, as required by GDPR Article 28.
1.2 Applicability
This DPA applies automatically to all Coach accounts that invite or manage Athletes through the Service. By creating a Coach account and adding Athletes, you accept this DPA.
2. Definitions
- "Athlete Data" means any personal data of Athletes processed by the Processor on behalf of the Controller through the Service.
- "Data Protection Law" means Regulation (EU) 2016/679 (GDPR), applicable national implementing legislation, and the ePrivacy Directive 2002/58/EC as amended.
- "Subprocessor" means a third party engaged by the Processor to process Athlete Data.
- "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Athlete Data.
3. Subject Matter and Details of Processing
| Element | Description |
|---|---|
| Purpose | Providing the MyCoach coaching platform: storing, displaying, and analysing Athlete training data to enable the Coach to manage training plans, track progress, and communicate with Athletes. |
| Duration | For the duration of the Coach's active subscription. Upon account deletion or termination, Athlete Data is deleted within 30 days. |
| Nature | Automated processing: storage, retrieval, display, analytics, and transmission of data within the platform. |
| Categories of data subjects | Athletes invited by the Coach to the MyCoach platform. |
| Types of personal data | Name, email address, profile photo, workout data (distance, duration, pace, heart rate, cadence, elevation, lap splits), training plans, body measurements (weight, height), chat messages, push notification tokens, app usage data. |
| Special categories (Art. 9) | Fitness and health data (heart rate, training metrics, body measurements). Processing is based on the Athlete's explicit consent obtained at account creation. |
4. Controller Obligations
The Controller (Coach) shall:
- Ensure a valid legal basis exists for the processing of Athlete Data, including obtaining explicit consent for health data processing under GDPR Art. 9(2)(a).
- Provide Athletes with the necessary privacy information, including reference to this DPA and the MyCoach Privacy Policy.
- Not instruct the Processor to process Athlete Data in a manner that would violate Data Protection Law.
- Respond to data subject requests from Athletes where the request pertains to the Coach's controller responsibilities.
5. Processor Obligations
The Processor shall:
- Process Athlete Data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by EU or Member State law (in which case the Processor shall inform the Controller of that legal requirement before processing, unless legally prohibited).
- Ensure that persons authorised to process Athlete Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
- Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Section 7.
- Not engage another processor (Subprocessor) without the prior general written authorisation of the Controller, as described in Section 6.
- Assist the Controller in fulfilling its obligations to respond to data subject requests (access, rectification, erasure, portability, restriction, objection).
- Assist the Controller in ensuring compliance with obligations under GDPR Articles 32 to 36 (security, breach notification, data protection impact assessments, prior consultation).
- At the choice of the Controller, delete or return all Athlete Data upon termination of the Service, and delete existing copies unless EU or Member State law requires storage.
- Make available to the Controller all information necessary to demonstrate compliance with Article 28 obligations, and allow for and contribute to audits and inspections as described in Section 9.
- Immediately inform the Controller if, in the Processor's opinion, an instruction infringes Data Protection Law.
6. Subprocessors
6.1 General Authorisation
The Controller grants the Processor general written authorisation to engage Subprocessors. The Processor shall maintain a list of current Subprocessors (see Section 6.3) and inform the Controller of any intended changes by email at least 14 days in advance.
6.2 Obligations
The Processor shall impose on each Subprocessor, by way of a written contract, data protection obligations no less protective than those in this DPA (flow-down provisions). The Processor remains fully liable to the Controller for the performance of each Subprocessor's obligations.
6.3 Current Subprocessors
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Google Firebase (Alphabet Inc.) | Authentication, push notifications, crash analytics | EEA / USA | Standard Contractual Clauses |
| Paddle.com Market Ltd | Subscription billing and payment processing | UK / EEA | UK Adequacy Decision |
| Strava, Inc. | Activity import (only upon Athlete's explicit OAuth authorisation) | USA | Standard Contractual Clauses |
| Polar Electro Oy | Device data import (only upon Athlete's explicit OAuth authorisation) | Finland (EEA) | N/A (EEA) |
6.4 Objection
If the Controller objects to a new Subprocessor on reasonable data protection grounds, the Controller shall notify the Processor in writing within 14 days of receiving notice. The parties shall discuss the objection in good faith. If the objection cannot be resolved, the Controller may terminate the affected portion of the Service without penalty.
7. Security Measures
The Processor implements the following technical and organisational measures (GDPR Art. 32):
- Encryption in transit: TLS 1.2+ for all data transmission.
- Encryption at rest: AES-256 for stored sensitive data (databases, backups).
- Access control: Role-based access control (RBAC); principle of least privilege; multi-factor authentication for administrative access.
- Password storage: Industry-standard hashing algorithms (bcrypt/Argon2); no plain-text storage.
- Network security: Firewall rules, intrusion detection, and regular vulnerability scanning.
- Backup and recovery: Automated daily backups with point-in-time recovery capability; backups encrypted at rest.
- Personnel: All staff with access to personal data are bound by confidentiality obligations and receive data protection training.
- Incident response: Documented incident response plan with defined roles, escalation paths, and post-incident review.
8. Security Incident Notification
The Processor shall notify the Controller of any Security Incident without undue delay and no later than 48 hours after becoming aware of the incident. The notification shall include:
- The nature of the incident, including the categories and approximate number of data subjects and records affected.
- The likely consequences of the incident.
- The measures taken or proposed to address the incident and mitigate its effects.
- The name and contact details of the Processor's point of contact for further information.
The Processor shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the Security Incident. The Processor shall assist the Controller in fulfilling its obligation to notify the supervisory authority (within 72 hours under GDPR Art. 33) and, where required, the affected data subjects (Art. 34).
9. Audits
The Controller may audit the Processor's compliance with this DPA. Audits may be conducted:
- At the Controller's expense;
- With at least 30 days' written notice;
- During normal business hours;
- No more than once per 12-month period, unless a Security Incident has occurred or a supervisory authority requires an audit.
The Processor may satisfy audit requests by providing relevant certifications, third-party audit reports (e.g. SOC 2), or written responses to specific compliance questions, provided these are reasonably sufficient to demonstrate compliance.
10. International Transfers
The Processor shall not transfer Athlete Data outside the EEA unless an appropriate safeguard exists under GDPR Chapter V, including:
- An adequacy decision (Art. 45);
- Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c));
- Binding Corporate Rules (Art. 47).
Current transfers are documented in the Subprocessor list (Section 6.3). The Processor shall conduct transfer impact assessments where required.
11. Data Subject Requests
If the Processor receives a request from an Athlete to exercise rights under GDPR (access, rectification, erasure, portability, restriction, objection), the Processor shall promptly notify the Controller and shall not respond to the request directly unless instructed by the Controller or required by law. The Processor shall provide reasonable technical assistance to enable the Controller to respond within the statutory timeframe.
12. Data Deletion and Return
Upon termination or expiry of the Coach's subscription, the Processor shall, at the Controller's choice:
- Return all Athlete Data in a structured, machine-readable format (e.g. JSON or CSV export); and/or
- Delete all Athlete Data and existing copies within 30 days of termination.
The Controller may request data export at any time during the active subscription period via the app or by emailing support@mycoach.fitness. The Processor may retain Athlete Data beyond 30 days only where required by EU or Member State law, and shall inform the Controller of such retention requirements.
13. Liability
Each party's liability under this DPA is subject to the limitations set out in the Terms of Service. Nothing in this DPA limits either party's liability for breaches of Data Protection Law to the extent such limitation is prohibited by law.
14. Term and Termination
This DPA is effective from the date the Coach creates an account and remains in force as long as the Processor processes Athlete Data on behalf of the Controller. The DPA survives termination of the Terms of Service to the extent necessary for the Processor to complete its data deletion or return obligations under Section 12.
15. Governing Law
This DPA is governed by the laws of the Republic of Poland, without regard to conflict-of-law provisions. The courts of Warsaw, Poland have exclusive jurisdiction, subject to the right of EU consumers to bring proceedings in their local courts.
16. Contact
For DPA inquiries: support@mycoach.fitness.