Data processing agreement
IMPORTANT NOTICE: This is a draft document prepared for review by a qualified solicitor. It does not constitute finalised legal advice or a binding agreement in its current form.
This Data Processing Agreement supplements the Coach terms of service between you (the Coach) and Verity AI Ltd (Fettle). It sets out the obligations of both parties regarding the processing of personal data under the UK General Data Protection Regulation (UK GDPR).
1. Roles of the parties For the purposes of client data uploaded to or managed within Fettle, the Coach is the Data Controller and Verity AI Ltd is the Data Processor.
2. Subject matter and duration The subject matter of this agreement is the processing of client personal data by Verity AI Ltd on behalf of the Coach. The processing will last for the duration of the Coach's subscription to Fettle, or until the data is deleted or returned.
3. Nature and purpose of processing Verity AI Ltd processes the data solely to provide the Fettle platform to the Coach, enabling the Coach to manage their fitness and nutrition coaching business.
4. Types of data and categories of data subjects The data subjects are the Coach's clients. The types of personal data processed include:
- Contact details (such as names and email addresses).
- Food, training, and health logs.
- Client progress metrics.
- Special-category data, specifically health and fitness data.
5. Obligations of the Processor Verity AI Ltd agrees that it will:
- Process the personal data only on the documented instructions of the Coach, unless required to do otherwise by law.
- Ensure that any personnel authorised to process the data are subject to a duty of confidentiality.
- Implement appropriate technical and organisational security measures. This includes storing data in the EU (London), encrypting data, and enforcing row-level security so that only the specifically consented Coach can read their clients' data.
- Notify the Coach without undue delay after becoming aware of a personal data breach.
- Assist the Coach in meeting their obligations regarding data security and data breach notifications.
6. Sub-processors The Coach provides general written authorisation for Verity AI Ltd to engage sub-processors to deliver the service. Our current sub-processors are:
- Supabase (for database hosting).
- Stripe (for processing payments). Verity AI Ltd remains fully liable to the Coach for the performance of its sub-processors' data protection obligations.
7. International transfers Client personal data is stored in the EU (London). Verity AI Ltd will not transfer client data outside of the UK or the European Economic Area unless appropriate safeguards are in place in accordance with UK data protection law.
8. Data subject rights Verity AI Ltd will assist the Coach, using appropriate technical measures, to fulfil the Coach's obligation to respond to requests from clients exercising their data protection rights. Because clients can revoke their explicit consent at any time, Verity AI Ltd will provide the functionality for the Coach to action such revocations.
9. Deletion or return of data When a client leaves the Coach's service, or when the Coach terminates their Fettle account, Verity AI Ltd will, at the choice of the Coach, delete or return all client personal data, unless the law requires us to retain a copy.
10. Audit rights Verity AI Ltd will make available to the Coach all information necessary to demonstrate compliance with this agreement. We will allow for and contribute to reasonable audits and inspections conducted by the Coach or their designated auditor, provided the Coach gives reasonable prior written notice.
11. Liability The liability of either party under this Data Processing Agreement is subject to the limitations of liability set out in the main Coach terms of service.