Data Processing Agreement

This agreement forms part of the coach’s Spot contract upon acceptance. The coach identified by their account is the controller; Nick Squared LLC, 7901 4th St N STE 300, St. Petersburg, FL 33702, USA, is the processor of client coaching data. It takes priority over conflicting general terms about that processing. It does not cover our independent account, billing or security purposes, or solo training, described in the Privacy Policy.

The subject is operating the coach’s training service for their clients. Processing includes storing, organising, displaying, transmitting, exporting and deleting client identifiers, training plans and records, measurements, health and injury information, check-ins, messages, photos, audio and videos. It lasts while we provide these services and complete return or deletion. Data subjects are the coach’s clients and people whose information the coach lawfully supplies.

The coach instructs us through the agreed service, settings and documented requests, and is responsible for lawful collection, notices and instructions. We process this data only on those instructions, including for transfers, unless applicable law requires otherwise; we will notify the coach of that requirement unless legally prohibited. We will immediately flag an instruction we believe infringes applicable data-protection law and suspend the affected processing while it is resolved. Personnel with access must be bound by confidentiality.

We will maintain measures appropriate to the risk, including transport encryption, authenticated access, restricted media access, separation of accounts, protected credentials, recovery procedures and review of security controls. We will assist with individual rights requests, security duties, impact assessments and regulator consultations, taking account of the processing and information available to us.

We will notify the coach without undue delay after becoming aware of a personal-data breach affecting their data, provide known scope, likely effects, mitigation and a contact, and supplement information as the investigation proceeds.

The coach generally authorises the applicable listed sub-processors. We will give at least 30 days’ email notice before adding or replacing one for coaching data, allowing a reasoned data-protection objection. We will seek a resolution; if none is practical, the coach may end the affected service before the change and receive a refund of unused prepaid fees for it. We impose equivalent processing obligations on sub-processors and remain responsible for their performance.

We will establish any required transfer mechanism before a restricted international transfer. This agreement alone is not an executed set of EU standard contractual clauses or a UK transfer addendum; where required, those documents must be completed with the relevant parties, schedules and assessments before the transfer.

At the end of the service, we will return or delete coaching data at the coach’s choice and delete remaining copies unless law requires retention. Use export before closing the account or contact us to arrange return. Restricted backup copies remain protected until deletion under the applicable schedule and legal deadlines. We will provide compliance information and allow reasonable audits, including inspections by the coach or their independent auditor, protecting other customers’ data. Reasonable scheduling cannot prevent legally required oversight.

Processing requests, objections and audit arrangements: [email protected].