Data processing agreement

This Data Processing Agreement ("DPA") is part of the PowerSheets Terms of service. It applies automatically when a coach ("you", the controller) uses PowerSheets to process personal data about their athletes. PowerSheets (the processor) processes that data only on your behalf. This DPA meets the requirements of Article 28 of the GDPR.

1. What we process

• Subject matter: hosting and running PowerSheets so you can program, track and communicate with your athletes.
• Duration: as long as you have a PowerSheets account, plus the deletion period in section 9.
• Nature and purpose: storing, showing, organizing, calculating and sending data to deliver the features of PowerSheets.
• Data subjects: your athletes, and other coaches on your plan.
• Types of personal data: name, email, photo, unit preference, training data (programs, sets, weights, RPE, maxes), competition data, notes and check-in answers.
• Special category data: check-ins and notes can include health data, like bodyweight, nutrition or injuries. You decide whether to collect it.

2. Your responsibilities

As controller, you:

• make sure you have a legal basis for all athlete data you put in PowerSheets, including explicit consent for health data,
• get permission from a parent or guardian before adding athletes under 16 (or the age of digital consent in their country),
• tell your athletes how their data is used,
• only give us data you are allowed to share.

3. Our responsibilities

We will:

• only process the data on your documented instructions. Your use of PowerSheets and these terms are your instructions,
• tell you if we think an instruction breaks data protection law,
• not use athlete data for our own purposes,
• make sure everyone who can access the data is bound to confidentiality.

4. Security

We take appropriate technical and organizational measures to protect the data, including:

• encryption in transit (HTTPS),
• hashed passwords,
• database-level access rules so each coach only sees their own athletes,
• access to production data limited to what is needed to run and support PowerSheets,
• rate limiting and bot protection,
• regular backups.

5. Subprocessors

You give us general permission to use subprocessors. The categories we use are listed in our privacy policy. You can ask us for the current list of subprocessors at any time. We will tell you by email at least 30 days before adding or replacing a subprocessor that handles athlete data. You can object on reasonable data protection grounds. If we can't solve your objection, you can end your subscription before the change applies.

We make sure each subprocessor is bound by data protection terms at least as strong as this DPA, and we remain responsible for them.

6. International transfers

Athlete data is stored in the United Kingdom, which has an EU adequacy decision. Where a subprocessor handles data outside the EU or UK, we use the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

7. Helping you

Taking into account what we can reasonably do, we will help you:

• respond to athletes who use their GDPR rights (access, correction, deletion, portability). If an athlete contacts us directly, we will send them to you,
• with data protection impact assessments and talks with authorities where needed.

8. Data breaches

If we become aware of a breach affecting your athletes' data, we will tell you without undue delay, and within 48 hours where possible. We will share what we know so you can meet your own reporting duties.

9. Deleting data

When you delete an athlete or your account, we delete the related data from our live system right away. Backups are overwritten on a rolling schedule within 30 days. We keep only what the law requires us to keep.

10. Audits

We will give you the information you reasonably need to show that we meet this DPA. If that is not enough, you can ask for an audit once per year, with at least 30 days' notice, at your own cost, and under confidentiality.

11. Liability and conflicts

The limits of liability in the Terms of service apply to this DPA. If this DPA and the terms conflict about personal data, this DPA wins.

Contact

legal@powersheets.app