Data Processing Agreement

This Data Processing Agreement forms part of, and is inseparable from, the terms and conditions between you and us. Where it differs from the terms and conditions, it prevails in matters concerning the processing of personal data.

This agreement applies between T3 Technologies BV, VAT BE 0566.940.947, Egemsesteenweg 41, 8700 Tielt, Belgium, operator of the Coachbox service (the “Processor”, “we”), and the customer using the Coachbox service (the “Controller”, “you”).

The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning set out in the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).

You are the controller for the personal data you process through the service. We process that data solely on your behalf, as a processor, to deliver the service. You warrant that you have a valid legal basis for the processing you entrust to us.

The subject matter, duration, nature and purpose of the processing, the categories of data subjects and the types of personal data are set out in Annex 1. The processing continues for as long as the agreement between us is in force, unless the law requires longer retention.

We process the personal data only on your documented instructions, including regarding international transfers, unless a legal obligation requires us to process. In that case we inform you beforehand, unless the law prohibits this. Your use of the service and this agreement constitute your complete instructions. If, in our view, an instruction infringes the GDPR, we will inform you.

Everyone processing the data under our authority is bound by confidentiality, whether by contract or by law.

We implement appropriate technical and organisational measures as referred to in Article 32 GDPR. An overview is set out in Annex 3. We take into account that the state of the art and the risks evolve, and adjust the measures where necessary.

You grant us a general authorisation to engage subprocessors to deliver the service. For any new or replacement subprocessor, we notify you at least 30 days in advance through the subprocessors page and, where possible, by email. You may object on reasonable grounds within that period. If we cannot resolve the objection together, you may terminate the affected service.

We impose the same data protection obligations on each subprocessor as those set out in this agreement, and we remain fully liable to you for the performance of our subprocessors.

Taking into account the nature of the processing, we assist you, through appropriate technical and organisational measures, to:

• respond to requests from data subjects (access, rectification, erasure, restriction, portability, objection). The service provides self-service for this: account management, data export and account deletion;
• meet your obligations regarding security, notification of data breaches, data protection impact assessments (DPIAs) and prior consultation, taking into account the information available to us.

As soon as we become aware of a personal data breach, we notify you without undue delay, and in any event within 48 hours, with the information you need to meet your own notification obligations to the Data Protection Authority and the data subjects.

The personal data is processed and stored within the European Union (Akamai/Linode in Frankfurt and AWS regions in Frankfurt and Ireland). We do not transfer personal data outside the EEA without a valid transfer mechanism within the meaning of Chapter V GDPR (for example an adequacy decision or standard contractual clauses) and without your instructions.

At the end of the service we delete or return the personal data, at your choice, and delete existing copies, unless the law requires retention. You can export your data through the service during the term.

We make available the information needed to demonstrate compliance with Article 28 GDPR. On request we provide our documentation on the technical and organisational measures and, where available, reports from independent third parties. This replaces an on-site audit.

Liability under this agreement is governed by the liability provisions in the terms and conditions.

This agreement is governed by Belgian law. Disputes fall under the jurisdiction of the competent courts as set out in the terms and conditions.

Nature and purpose: providing the Coachbox coaching platform: account management, training planning, performance tracking, communication between coach and athlete, and billing.

Duration: the term of the agreement.

Categories of data subjects: coaches, athletes and users invited by the customer.

Categories of personal data:

• identity and contact details (name, email);
• account data (credentials, role, team membership);
• training and performance data, including physiological data (heart rate, power, lactate, VO₂ and similar measurements) that may qualify as health data;
• usage and log data;
• billing data (processed through our payment provider).

Special categories (Article 9 GDPR): health-related training and physiological data, where applicable.

• Encryption in transit: TLS 1.2 or higher for all traffic, with automatic redirection from http to https.
• Encryption at rest: production data is stored encrypted.
• Access control: role-based access; administrator access with multi-factor authentication; access on a least-privilege basis.
• Isolation: logical separation of customer data per team.
• Backups: daily backups with 21 days of retention.
• Logging: access and application logs.
• Development process: changes through version control, static code analysis and a staging environment before production.
• Deletion: self-service account deletion and full deletion on request.

Questions about this Data Processing Agreement? Contact us at contact@coachbox.app.