Data processing agreement

This agreement, under Article 28 of Regulation (EU) 2016/679 (GDPR), governs the processing of personal data that Mihai Stana Ionescu (the «processor») carries out on behalf of the box that subscribes to Wodmark (the «controller»). It is part of the Terms of service and is accepted when subscribing to them.

1. Subject, duration and nature

The processor processes the data needed to deliver the Wodmark service: managing bookings, attendance, athletes, plans, payments, training and the box's communications with its athletes. It lasts as long as the service. The processing consists of hosting, organising, consulting, communicating to athletes and erasing the data, by automated means.

2. Data and data subjects

• Data subjects: athletes, people who ask for a trial class and the box's staff.
• Data: identification and contact details, date of birth, bookings and attendance, plans, charges and payments, bank and SEPA mandate details, marks and sporting results, acceptance of waivers, notes the box decides to keep.
• The service is not designed for health data. If the box stores it in free-text fields, it does so on its own responsibility and must have a basis that allows it.

3. Processor's obligations

1. Process the data only on the controller's documented instructions, which are this agreement and the controller's use of the service.
2. Ensure that the people authorised to process it have committed to confidentiality.
3. Apply the security measures of Article 32 GDPR: encryption in transit, data separated by box, role-based access control, hashed passwords, encrypted backups and access logs.
4. Help the controller respond to data subjects' requests, and pass on any request it receives directly.
5. Notify the controller without undue delay, and in any case within 48 hours, of any security breach affecting its data, with the information available.
6. Help the controller with impact assessments and consultations with the authority, where applicable.
7. Make available the information needed to demonstrate compliance and allow reasonable audits, with prior notice.

4. Sub-processors

The controller gives general authorisation for the sub-processors on the published list. We will give at least 15 days' notice by e-mail of any addition or replacement, and the controller may object and, if there is no alternative, cancel. Each sub-processor is bound by obligations equivalent to those of this agreement.

5. End of the processing

When the service ends, the controller can ask for a copy of its data in a commonly used format for 30 days. After that the processor erases it, copies included, unless a law requires it to be kept. Backups are overwritten within 30 days at most.

6. Controller's obligations

To have a legal basis for processing its athletes' data, inform them of the processing (including that it uses Wodmark as processor) and respond to their requests.