Data Processing Agreement

Last updated: 11 November 2026

This Data Processing Agreement ("DPA") is part of the Terms & Conditions between the organisation that uses compleat ("the Organisation", "you") and MAX Hybrid Sport B.V., Mooie Vrouwenweg 45, 7608 RC Almelo, the Netherlands, Chamber of Commerce 68085885 ("compleat", "we", "us").

It applies from the moment the Organisation accepts the Terms & Conditions. No separate signature is needed. If you need a signed copy for your own records, send a request to info@compleatgym.com.

1. Definitions

Words such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given to them in the General Data Protection Regulation (GDPR).

• Customer personal data: the personal data of members, clients, staff and other people that the Organisation and its users put into the service, or that reaches the service through a connection they set up.
• Sub-processor: another company we engage to process customer personal data.
• Service and Terms: as defined in the Terms & Conditions.

2. Roles and scope

The Organisation is the controller of customer personal data. We are the processor and handle that data on the Organisation's behalf.

This DPA does not cover data for which we are the controller ourselves, such as login accounts, our own invoices and security logs. Our Privacy Policy applies to that data.

Annex 1 describes the processing: what it is for, how long it lasts, whose data it concerns and which kinds of data are involved.

3. Instructions

We process customer personal data only on the Organisation's documented instructions. Those instructions are the Terms, this DPA, and the settings and actions of the Organisation and its users in the service.

We do not use customer personal data for our own purposes. We do not sell it, share it for advertising, or use it to train AI models.

If we believe an instruction breaks the law, we tell the Organisation and may wait with carrying it out until that is cleared up. If a law requires us to process the data in another way, we inform the Organisation first, unless that law forbids it.

4. Confidentiality

Everyone who works for us and can reach customer personal data is bound by a duty of confidentiality. Access is limited to people who need it for their work. Our staff open an organisation's data only to give support or to fix a problem, and each such access is logged.

5. Security

We take the technical and organisational measures listed in Annex 2. We may change these measures as technology develops, as long as the level of protection does not go down.

The Organisation is responsible for the security of its own side: who gets an account, which rights they have, and the use of strong sign-in methods such as two-step verification.

6. Sub-processors

The Organisation gives general permission for the sub-processors listed in Annex 3.

• We bind each sub-processor by contract to data protection obligations that match this DPA.
• We remain responsible towards the Organisation for what our sub-processors do.
• We announce a new or replaced sub-processor at least 30 days in advance, by email or in the app.
• The Organisation may object within those 30 days on reasonable grounds relating to data protection. We then look for a solution together. If there is none, the Organisation may cancel the subscription as of the date the change takes effect and receives a refund of any amount paid in advance for the period after that date.

7. Transfers outside the European Economic Area

The database, sign-in system and file storage are in the European Union (Frankfurt, Germany).

Some sub-processors are based outside the European Economic Area. We transfer customer personal data to them only when the transfer is covered by an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or by the Commission's standard contractual clauses. On request we show which safeguard applies to a specific sub-processor.

8. Requests from data subjects

The service gives the Organisation and its users the tools to answer most requests themselves: viewing and correcting data, exporting a copy, withdrawing consent and deleting an account.

If a data subject sends us a request about data for which the Organisation is the controller, we pass it on to the Organisation without delay and do not answer it ourselves, unless the Organisation asks us to or the law requires it. Where the tools in the service are not enough, we give reasonable help.

9. Help with your obligations

Taking into account the kind of processing and the information we have, we help the Organisation with data protection impact assessments, with consultations with a supervisory authority, and with showing that it meets its obligations under the GDPR. We may charge a reasonable fee for work that goes beyond what a processor normally provides.

10. Personal data breaches

If we become aware of a personal data breach that affects customer personal data, we notify the Organisation without undue delay, and in any case within 48 hours.

The notification states, as far as known at that time:

• what happened and when;
• which kinds of data and roughly how many people are affected;
• the likely consequences;
• the measures we have taken or propose to take;
• who to contact for more information.

We keep the Organisation informed as more becomes known and take reasonable steps to limit the damage. The Organisation decides whether to report the breach to the supervisory authority and to the people concerned, and does so itself.

11. Health data and consent

The service processes health-related data only after the member or client has given explicit consent in the app. We record which version of the consent text was accepted and when, and we stop sharing the data with coaches as soon as consent is withdrawn.

The Organisation remains responsible for having a lawful basis for the data it puts into the service and for informing its own members and clients.

12. Audits

We give the Organisation the information it needs to check that we keep to this DPA.

The Organisation may carry out an audit once a year, or more often after a personal data breach or when a supervisory authority requires it. The following applies:

• The Organisation first uses the information we provide, including certificates and audit reports from our sub-processors. An on-site audit follows only if that information is not enough.
• An audit is announced at least 30 days in advance and takes place during working hours, without unnecessary disruption to the service.
• It is carried out by the Organisation or by an independent auditor who is bound by confidentiality.
• The Organisation bears the costs, unless the audit shows that we materially failed to keep to this DPA.

13. Return and deletion

During the subscription, and for 30 days after it ends, the owner can export the Organisation's data from the app.

Ninety days after the subscription ends we delete customer personal data. Backups are overwritten within 30 days after that. We keep only what the law requires us to keep, such as invoices, for the legal retention period. The Organisation can ask us in writing to delete the data sooner.

When an individual user deletes their account, their data is removed or made anonymous within 30 days.

14. Liability

The limits of liability in section 15 of the Terms & Conditions apply to this DPA as well.

15. Term and changes

This DPA runs for as long as we process customer personal data for the Organisation. Obligations that by their nature continue, such as confidentiality, stay in force after it ends.

We may change this DPA in the same way as the Terms & Conditions: we announce a change at least 30 days before it takes effect. We do not lower the level of protection without a legal reason.

16. Precedence, language and law

Where this DPA and the Terms & Conditions differ on the protection of personal data, this DPA prevails.

This DPA is available in Dutch and English. If the versions differ, the Dutch version prevails.

Dutch law applies. Disputes are submitted to the competent court of the district of Overijssel, the Netherlands.

Annex 1: Description of the processing

Purpose. Providing the service to the Organisation: planning and logging training, nutrition, check-ins and tests, messaging between coach and client, class schedules and bookings, memberships and payments, device connections, and AI features that the Organisation or a user starts.

Duration. The term of the subscription, plus the periods in section 13.

Nature of the processing. Storing, organising, displaying, sending to connected services chosen by the user, analysing on instruction, and deleting.

Data subjects.

• Members and clients of the Organisation
• Owners, coaches and staff of the Organisation
• People who sign up for a trial class or leave their details on the Organisation's public page
• Contact persons named by a member, such as an emergency contact

Kinds of personal data.

Special categories of personal data. Data concerning health: weight and measurements, sleep, resting heart rate, heart rate variability, mood, check-in answers, injury notes, progress photos, meal photos and health data from connected devices. This data is processed only with the explicit consent of the person concerned.

Contact. info@compleatgym.com

Annex 2: Security measures

Access

• Access rules are enforced in the database itself. Every record belongs to one organisation; a client sees only their own data; a coach sees only assigned clients unless the owner gives wider access.
• Two-step verification is available for owners and coaches, and an organisation can require it. It is required for our own administrator accounts.
• Our staff reach customer data only for support, and each access is logged.

Encryption

• All traffic is encrypted in transit (TLS).
• The database and file storage are encrypted at rest.
• Tokens for connected devices and payment providers are stored encrypted and cannot be read through the app.

Files

• Photos and attachments are kept in private storage and opened through short-lived links.

Operations

• Changes to the software are reviewed and tested before release, and database changes are recorded.
• Errors are monitored, and sign-in and security events are logged and kept for 12 months.
• Daily backups are kept for up to 30 days.
• Dependencies and infrastructure are kept up to date.

Organisation

• Staff and contractors are bound by confidentiality.
• Sub-processors are selected on their security and bound by a data processing agreement.
• We have a procedure for handling and reporting personal data breaches.

Annex 3: Sub-processors

Services that a user chooses to connect, such as Garmin and other wearables or Google Calendar, are not sub-processors. They receive or send data on the user's own instruction and under their own terms.