1. Roles and subject matter

This DPA forms part of the FitSpace Terms. The Author is controller for coaching, check-ins and student workspace purposes; FitSpace is processor on documented Author instructions. FitSpace remains a separate controller for accounts, payments, security, mandatory records, disputes and support.

2. Duration, people and data

• Duration: while the Author uses FitSpace and while processing is needed to deliver paid access or meet applicable duties.
• Data subjects: students, prospects and programme participants.
• Data: profile and buyer email, external customer/payment/event IDs, goals, check-ins, answers, coach notes, chat, progress, schedule, uploaded files, fitness and potentially health-related information, and device/security data.

3. Instructions and confidentiality

FitSpace processes data only to provide, secure and support FitSpace, or informs the Author if an instruction appears unlawful. Access is limited to authorised persons bound by confidentiality.

4. Security and incidents

FitSpace uses reasonable technical and organisational measures including access controls, transport encryption, logging, backup and vulnerability management. It notifies the Author without undue delay of a confirmed incident affecting processor data, with information then available.

5. Subprocessors and transfers

The Author gives general authorisation for subprocessors on the current list. FitSpace provides notice of material changes and imposes appropriate data-protection obligations. Available contractual and technical safeguards are used for international transfers.

6. Rights requests, export and deletion

FitSpace reasonably assists with data-subject and regulator requests. Available workspace data can be exported. The Author loses access when the relationship ends, while the student keeps account history. Account deletion removes or anonymises data except financial, security and other mandatory records.

7. Audit

On reasonable request FitSpace provides available information about its measures. Additional audits are limited to once yearly, during business hours, without compromising other customers, at the Author’s cost unless a material breach is established.