Data Processing Agreement

1. Definitions

"Data Protection Law" means the EU General Data Protection Regulation 2016/679 (EU GDPR), the UK GDPR and the Data Protection Act 2018, and any other data protection law that applies to the processing. "Personal Data", "Controller", "Processor", "Data Subject", "Processing", "Personal Data Breach" and "Supervisory Authority" have the meanings given in Data Protection Law. "Customer Personal Data" means personal data that we process on your behalf when providing StudioVita, as described in Annex 1.

2. Roles and scope

You are the Controller and we are the Processor of Customer Personal Data. You are responsible for having a lawful basis for the processing, for the accuracy of the data you enter, and for giving your members the information required by law (your own privacy notice). We act as a separate controller only for data about your account users, billing and our relationship with you, as set out in our Privacy Policy.

3. Our obligations

We will

1. process Customer Personal Data only on your documented instructions, including with regard to international transfers. The Terms of Service, this DPA and your use and configuration of StudioVita are your instructions. We will tell you if we believe an instruction breaks Data Protection Law, unless the law prohibits us from doing so;
2. ensure that everyone authorised to process Customer Personal Data is bound by confidentiality;
3. implement the technical and organisational security measures in Annex 2;
4. engage sub-processors only as set out in section 4;
5. taking into account the nature of the processing, help you respond to requests from Data Subjects exercising their rights. StudioVita's admin tools let you view, correct and delete member data yourself, and we will provide a data export on request. If we receive a request directly, we will pass it to you without undue delay and will not respond ourselves except to direct the person to you;
6. help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with a Supervisory Authority, taking into account the information available to us;
7. at the end of the services, delete Customer Personal Data in line with section 7;
8. make available the information needed to demonstrate compliance with this DPA and allow for audits as set out in section 6.

4. Sub-processors

You give general authorisation for us to use sub-processors. The current sub-processors are listed in Annex 3. We will give you at least 30 days' notice by email before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period. If we cannot reasonably resolve the objection, you may terminate the affected service and receive a pro-rata refund of prepaid fees for the remaining term. We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain liable to you for their performance.

5. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will include, as far as known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. We will update you as more information becomes available and will cooperate with you in investigating and mitigating the breach. Notifying you is not an admission of fault.

6. Audits and information

On written request, and no more than once in any 12-month period (unless required by a Supervisory Authority or following a Personal Data Breach), we will provide information reasonably needed to demonstrate our compliance, such as answers to a security questionnaire and a summary of our security measures. If that information is not sufficient, you may carry out an audit, at your own cost, on at least 30 days' notice, during business hours, subject to confidentiality and without access to other customers' data.

7. Return and deletion

During your subscription you can ask us for an export of your data at any time. After your subscription ends, your data remains available for export for 30 days. We then delete Customer Personal Data from our live systems, and it is removed from backups as they are overwritten on a rolling basis, unless the law requires us to keep it.

8. International transfers

We are based in the United Kingdom, which the European Commission recognises as providing an adequate level of protection, so transfers from EU customers to us need no additional safeguards. Where our sub-processors process Customer Personal Data outside the UK and EEA, we ensure an appropriate safeguard is in place: the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914, Module 3, processor to processor), the UK International Data Transfer Addendum, or certification under the EU-U.S. Data Privacy Framework and its UK Extension. We will provide copies of the relevant safeguards on request.

9. Liability, term and precedence

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service, except where Data Protection Law does not allow liability to be limited. This DPA lasts for as long as we process Customer Personal Data for you. If this DPA conflicts with the Terms of Service, this DPA takes precedence for the processing of Customer Personal Data. This DPA is governed by the law that governs the Terms of Service (England and Wales).

10. Changes

We may update this DPA to reflect changes in law or in our services. We will not reduce the overall level of protection for Customer Personal Data, and we will notify you by email of material changes at least 30 days before they take effect.

Annex 1: Details of processing

• Subject matter and duration: providing the StudioVita platform for the term of the Customer's subscription plus the 30-day export period.
• Nature and purpose: hosting, storing, organising and displaying data so the Customer can manage members, memberships, classes, bookings, waitlists, attendance, payments and communications, and so members can use the Customer's branded member app.
• Categories of Data Subjects: the Customer's members, prospective members and leads, and the Customer's staff and instructors.
• Categories of personal data: name, email address, phone number, postal address, date of birth, emergency contact details, profile photo, login details (passwords stored only as hashes), membership and plan details, class bookings, waitlist and attendance records, payment history and status (card details are processed by Stripe and never stored by us), notes entered by the Customer, notifications and messages, and technical data such as IP address and device type.
• Special category data: none is required by the service. The Customer must not enter health or other special category data in free-text fields unless it has a lawful basis and an appropriate condition under Data Protection Law.
• Frequency: continuous, for the duration of the subscription.

Annex 2: Technical and organisational measures

• Encryption in transit: all traffic uses HTTPS/TLS. Encryption at rest is provided by our hosting infrastructure.
• Tenant isolation: every studio's data is logically separated, and every request that reads or changes a record is checked against the requesting user's studio. This is covered by automated regression tests.
• Access control: role-based access (member, staff roles, studio admin, platform administrator). Members can only access their own records.
• Authentication: passwords stored only as bcrypt hashes; login rate limiting; secure, HTTP-only session cookies; forced password change for accounts created with a temporary password; single-use password reset links that expire within one hour.
• Application security: protection against cross-site request forgery, input sanitisation, API rate limiting, and responses stripped of password hashes and other secrets.
• Logging: server logs record request metadata (path, status, timing) and not the content of requests or responses.
• Payments: card data is handled entirely by Stripe (PCI DSS Level 1). We never receive or store full card numbers.
• Personnel: access to production systems is limited to authorised Freddie Media personnel bound by confidentiality.
• Resilience: managed database with provider backups; scheduled jobs protected against duplicate execution.
• Deletion: automated deletion of member accounts after the 30-day grace period, and deletion of Customer data after the post-termination export period.

Annex 3: Sub-processors

• Replit, Inc. (USA): application hosting, database and file storage. Transfer safeguard: EU Standard Contractual Clauses and UK International Data Transfer Addendum.
• Stripe, Inc. (USA) and Stripe Payments Europe Ltd (Ireland): payment processing for member payments through the Customer's own connected Stripe account. Transfer safeguard: EU-U.S. Data Privacy Framework (and UK Extension) and Standard Contractual Clauses.
• Resend (USA): transactional email delivery (booking reminders, receipts, account emails). Transfer safeguard: EU-U.S. Data Privacy Framework (and UK Extension) and Standard Contractual Clauses.