Data Processing Agreement

This agreement takes effect for every FitFloww account from August 18, 2026. You do not need to request, negotiate, or countersign it. It forms part of the Terms of Service.

If your organisation needs a signed copy for its records, email legal@fitflowwcrm.com and we will execute one.

• We process client personal data only on your documented instructions. Your use of the platform’s features is such an instruction.
• We do not process it for our own purposes, do not sell it, and do not use it to train AI models.
• If we are legally required to process it otherwise, we tell you first unless the law forbids us from doing so.
• We will tell you if we consider an instruction to breach GDPR or UK GDPR.

Everyone we authorise to access client personal data is bound by confidentiality obligations and gets access only where needed to operate or support the service. Access is limited to the smallest set of people that makes support possible.

Technical and organisational measures in place:

• TLS 1.3 for all data in transit
• AES-256 encryption at rest, applied by our database and storage provider
• Session tokens mirrored into HttpOnly cookies so page scripts cannot read them
• Row-level security policies so one coach cannot read another coach’s records
• Passwords hashed by our authentication provider — we never see or store them
• Card details handled by Stripe and never stored on FitFloww systems
• Automated dependency and secret scanning on every build
• Encrypted database backups with point-in-time recovery

• You give general authorisation for us to engage the sub-processors listed at the sub-processors page, each under a written contract imposing obligations no less protective than these.
• We give at least 30 days’ notice before adding or replacing a sub-processor that handles client personal data.
• You may object on reasonable data-protection grounds within those 30 days. If we cannot resolve the objection, you may terminate the affected service and receive a pro-rata refund of any prepaid unused period.
• We remain liable to you for our sub-processors’ performance.

Current list and change notifications: Sub-processors.

• The platform lets you read, edit, export, and delete client records directly, which handles most requests without involving us.
• Where a request cannot be satisfied through the platform, we assist you, taking into account the nature of the processing.
• If a data subject contacts us directly about data you control, we refer them to you rather than acting ourselves — unless legally required to act.
• We assist with data protection impact assessments and prior consultation under Arts. 35 and 36 on request.

• We notify you without undue delay, and in any event within 48 hours of becoming aware of a breach affecting client personal data you control.
• The notice describes what happened, the categories and approximate number of records affected, the likely consequences, and the steps taken.
• We give you the information you need to meet your own 72-hour notification duty to your supervisory authority.
• We do not notify your supervisory authority or your data subjects on your behalf — that is your decision to make as controller.

Report a suspected breach to security@fitflowwcrm.com.

• You can export client data at any time — ask us and we provide a machine-readable copy within 30 days.
• On termination, we delete client personal data from live systems within 30 days.
• Encrypted backups roll over within a further 30 days, so deletion completes within 60 days of termination.
• We retain only what law requires us to keep — billing and tax records, per the schedule below.

• We make available the information needed to demonstrate compliance with Art. 28.
• You may request an audit once per year, or after a breach affecting your data. We ask for 30 days’ notice and reasonable scope, and you bear your own costs.
• We are not SOC 2 or ISO 27001 audited, so we cannot substitute a certification report for an audit. We will answer a security questionnaire honestly instead.

FitFloww and most of its sub-processors are in the United States. For personal data transferred from the EEA, the UK, or Switzerland, we rely on:

• The European Commission’s Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), incorporated into this agreement by reference. Clause 7 docking, Clause 9(a) Option 2 general authorisation with 30 days’ notice, Clause 17 governed by Irish law, Clause 18(b) courts of Ireland.
• The UK International Data Transfer Addendum (version B1.0) for UK transfers.
• The Swiss addendum, with the Federal Data Protection and Information Commissioner as supervisory authority, for Swiss transfers.
• The EU–US Data Privacy Framework where a sub-processor is certified under it.

We have completed transfer impact assessments for our sub-processors and provide them on request.

Liability under this agreement is subject to the limitations in §14 of the Terms of Service, except where GDPR Art. 82 provides otherwise.

Where this agreement conflicts with the Terms of Service on the processing of client personal data, this agreement prevails. Where it conflicts with the Standard Contractual Clauses, the Clauses prevail.