Data Processing Addendum

1. Roles & scope

The Controller determines the purposes and means of processing; the Processor processes on documented instructions. This DPA applies to the personal data the Controller causes to be submitted to the Services.

When a Provider or business uses the Services to manage their own end-users (e.g., their clients' bookings), that user is the Controller and FindACoach is a Processor for that data.

2. Processing purposes & categories

Processing is limited to providing the Services described in our Terms. Categories of data subject include members, coaches, and gym staff. Categories of data include account, booking, and limited payment metadata.

3. Processor obligations

Process personal data only on documented instructions; ensure confidentiality of personnel; take security measures appropriate to the risk; assist the Controller with data-subject requests, breach notification, and impact assessments; and delete or return data on termination.

4. Sub-processors

We engage sub-processors listed in our Privacy Policy (Clerk, Stripe, Cloudflare, Google, Resend/Twilio, hosting). We provide notice of material changes and remain liable for their performance.

5. International transfers

Where personal data transfers outside the EEA/UK/Switzerland, we rely on the Standard Contractual Clauses approved by the European Commission, supplemented as required.

6. Breach notification

We notify the Controller without undue delay after becoming aware of a personal data breach, with information to allow the Controller to meet its own notification obligations.

7. Contact

Data protection contact: privacy@findacoach.io. FindACoach.io, Inc., [Registered business address — to be inserted].