Data Processing Agreement (DPA)
Last updated: October 25, 2026
Purpose
This Data Processing Agreement governs the processing of personal data that Fitness Vendor (FV - Fitness Vendor) carries out on behalf of the client business as part of the service. It supplements the Terms of Service. In the event of any conflict regarding the processing of personal data, this agreement prevails.
Roles of the parties
The client business acts as data controller. FV - Fitness Vendor acts as processor. FV processes personal data only on the client's documented instructions, unless required otherwise by a legal obligation to which it is subject.
Nature, purpose and data processed
Purpose: qualify leads and book appointments on behalf of the business; make available to it accounting reconciliation documents for its card payments (monthly statement, Stripe's receipt for each payment), which carry the contact's name, email and phone, the purpose and the plan sold, the amount and the payment identifier. Data subjects: the business's leads and end customers. Data categories: identity, contact details (phone, email depending on the channel), conversation content, channel preferences and appointment history. Duration: the term of the subscription, unless a legal retention obligation applies.
Aggregated statistics
The client authorises FV - Fitness Vendor to produce, from the data processed on its behalf, aggregated statistics on how the service performs (for example the rate of SMS delivered, the reply rate or the rate of appointments booked by type of message or sender), for the sole purpose of improving the service. These statistics contain no personal data: no name, no number, no message content. A result covering fewer than 10 contacts is not displayed. No statistic can identify a business's contacts, and none is shared with another business in a form that makes the client recognisable.
Processor obligations
FV processes data only on the client's instructions, ensures the confidentiality of persons authorized to process it, and makes available the information needed to demonstrate compliance with its obligations.
Security
FV implements appropriate technical and organizational measures: encryption of secrets, strict data separation between businesses (multi-tenant isolation), access control and logging.
Sub-processors
FV uses the sub-processors listed on the Sub-processors page, available at /legal/sous-traitants. The client authorizes this use and is informed of any change, with the option to object on legitimate data-protection grounds.
Access by the customer's service providers
The customer may grant a provider of its choice (marketing agency or freelancer) a "Marketer" access. This provider is not a sub-processor of FV - Fitness Vendor: it acts on behalf of the customer, who is responsible for it and concludes with it the processing agreement required by Article 28 GDPR. FV limits this access to what is strictly necessary: no personal contact data (list, record, conversation, appointment, sale), aggregated statistics only, no export or import, and no sending without approval by an owner or administrator of the customer. Before any access, the provider accepts a timestamped confidentiality and non-reuse undertaking. Access may have an end date; the customer can revoke it at any time, and its actions are logged.
Assistance, rights and breaches
FV helps the client respond to data-subject rights requests and meet its security obligations. In the event of a personal data breach, FV informs the client without undue delay.
End of processing
At the end of the contract, FV deletes or returns the personal data at the client's choice, unless a legal retention obligation applies.