1. Roles
The coach is the data controller for personal data they collect from their clients. Coach Pro is the data processor, acting only on documented instructions from the coach (which the coach gives by configuring and using the platform).
2. Scope of processing
- Subject matter: providing the Coach Pro platform.
- Duration: for as long as the coach has an active account, plus any retention period required by law.
- Nature & purpose: hosting, storing, transmitting, and displaying coaching content.
- Categories of data: contact details, training logs, body metrics, photos, messages, payment metadata.
- Categories of data subjects: the coach's clients.
3. Coach's obligations
- Have a lawful basis to collect and process client data.
- Provide clients with a privacy notice covering the coach's own processing.
- Respond to client data-subject requests where the coach is the controller.
- Use the platform's security features (strong passwords, account hygiene).
4. Coach Pro's obligations
- Process data only on the coach's documented instructions.
- Ensure personnel with access are bound by confidentiality.
- Implement appropriate technical and organizational measures (TLS in transit, encryption at rest, RLS, access logging).
- Assist the coach with data-subject requests, security incidents, and DPIAs to the extent reasonably required.
- Notify the coach without undue delay (and within 72 hours where feasible) after becoming aware of a personal data breach affecting the coach's clients.
- Return or delete personal data at the end of the service, subject to legal retention.
5. Subprocessors
The coach gives general authorization for Coach Pro to use the following subprocessors:
- Lovable Cloud / Supabase — database, auth, file storage (EU region available).
- Stripe — payments and payouts.
- Cloudflare — application hosting and edge delivery.
- Apple & Google — mobile app distribution and push notifications.
We'll notify coaches in advance of any new subprocessor (at least 30 days) and give them the opportunity to object on reasonable grounds.
6. International transfers
Where personal data is transferred outside the EEA or UK, transfers are covered by the EU Standard Contractual Clauses (2021/914) or the UK International Data Transfer Addendum, as applicable.
7. Audits
On reasonable written notice, Coach Pro will provide the coach with information necessary to demonstrate compliance with Article 28 GDPR, including third-party audit reports of our subprocessors where available.
8. Return or deletion
On termination, Coach Pro will, at the coach's choice, delete or return all client personal data within 30 days, except where retention is required by law.
9. Contact
For DPA matters, contact Contact@Coachpro.website.