Data Processing Agreement

The controller is the customer holding the Coach account (referred to below also as the Coach). The processor is Yilmaz Atakan Kara, omniOne Fitness, Roedernstr. 13, 12459 Berlin, Germany; privacy contact: support@omniOne.fitness. The DPA is accepted separately and expressly in the Coach account before the first Client invitation or processing of Client data on the customer's behalf; the platform contract under the Coach terms is already in place at that point. It applies for the duration of processing. Confidentiality, assistance and deletion/return obligations continue while processing data remains. Processing on behalf of the customer is distinct from omniOne's own contractual, billing and purpose-bound security processing described in the Privacy Policy.

omniOne processes the data described in Annex 1 exclusively to provide the agreed coaching platform services and on the customer's documented instructions. The contract, its annexes and agreed use constitute the initial instructions. Additional instructions may be documented through support@omniOne.fitness; the contact and their authority are verified. Instructions include third-country transfers. Where the law requires processing, omniOne informs the customer beforehand where legally permitted. If omniOne considers an instruction unlawful under data protection law, it informs the customer without undue delay and suspends the affected execution until clarified. Processing data is not used for omniOne's own advertising, sale or model training.

The customer determines lawful purposes, scope and legal bases, fulfils information duties, respects data subject rights and gives only lawful instructions. For health data, the customer particularly ensures the conditions of Art. 9 GDPR; for people who cannot validly consent themselves, in particular minors, the customer obtains the consent of the legal guardians. omniOne technically supports explicit consent on instructions and for the specifically named Coach; the wording is set out in the health-data consent in the version shown to the Client, and the evidence is available to the customer in the Coach account. The customer assesses whether this consent is suitable for their service. The customer informs omniOne of relevant restrictions, withdrawals and deletion instructions unless already communicated through the provided functions. omniOne remains responsible for its own statutory obligations.

omniOne restricts access to authorised persons bound by confidentiality or an appropriate statutory duty of confidentiality. The technical and organisational measures described in Annex 2 must be appropriate to the risks, particularly health-data processing. Technical and operational updates are permitted if the agreed level of protection is not reduced. Material changes are documented and made accessible to the customer.

The customer grants general authorisation for the sub-processors transparently described in Annex 3. Intended additions or replacements are announced in text form before use, identifying the service, affected data, countries and intended start; the customer normally receives at least 30 days before intended use to object on data-protection grounds. A shorter period, including in urgent cases, requires the customer's express agreement in text form to the specifically named provider and shortened period after receiving that information. Silence or subsequent information is insufficient. omniOne examines substantiated objections and reasonable, compliant alternatives. A new sub-processor subject to an objection is used for the affected data only after resolution or a lawfully agreed alternative.

If no reasonable, compliant solution is possible, either party may terminate the affected service in text form with at least 30 days of termination notice, no earlier than the announced start date. The whole contract may be terminated only if the affected service is essential and cannot reasonably be separated. The termination notice period must also be respected following a late objection; use for affected data must be postponed where necessary. Return and deletion and mandatory transition and data retrieval periods must be handled in an orderly manner without transferring affected data to an unauthorised provider. Prepaid fees for periods not provided are refunded proportionately. omniOne contractually imposes equivalent data-protection duties on each sub-processor, checks appropriate guarantees and remains responsible to the customer for their performance. Merely changing the list does not replace required advance information.

Taking account of the nature of processing, omniOne assists the customer with appropriate technical and organisational measures for requests under Chapter III GDPR and duties under Arts. 32 to 36 GDPR. This includes available information about processing, safeguards and incidents and assistance with data protection impact assessments and necessary prior consultation. Requests concerning processing data are forwarded to the customer without undue delay; no substantive decision about the customer's processing is made without instructions unless the law requires otherwise. Identity, competence and secure transmission must be checked before disclosure.

Ordinary assistance with data protection duties, required standard evidence and regular data return, including necessary manual work, are covered by the agreed fee. Individually requested custom data preparation, additional reports or other assistance beyond the scope already owed may be charged reasonably only where the scope and remuneration were agreed beforehand in text form. Services that must be free by law and work caused by a breach attributable to omniOne are not charged additionally. Assistance owed and statutory deadlines must neither depend on a fee agreement nor be delayed by a fee dispute. Mandatory Data Act requirements remain unaffected; where applicable, necessary provider switching and the associated data export must in particular be possible without switching or data egress charges from 12 January 2027. Section 8 additionally governs audits.

omniOne informs the customer without undue delay after becoming aware of a breach involving processing data. To the extent known, the information includes the nature and scope, affected data and person categories, contact details, likely consequences and measures taken or proposed. Missing information is supplemented without undue delay. omniOne preserves available evidence, limits effects and assists the customer with their notifications. A general time limit does not extend the duty to inform without undue delay.

omniOne provides the information necessary to demonstrate compliance with Art. 28 GDPR and allows and assists audits, including inspections by the customer or its auditor. Existing evidence and remote audits are used first where sufficient for effective verification. The customer retains the choice of a necessary, appropriate audit. Regular on-site inspections normally take place no more than once in twelve months per customer, with 30 days of advance notice during normal business hours. More frequent or shorter-notice audits are permitted where there are substantiated compliance concerns, relevant incidents, supervisory requirements or other necessity. Inspections are limited to relevant areas and coordinated to protect confidentiality, other customers and operations; this must not prevent effective or urgent audits. Supervisory authority powers remain unaffected.

Standard evidence and ordinary information are provided at no additional charge. The customer normally bears the costs of its own auditor. Additional assistance by omniOne may attract a reasonable fee agreed beforehand under section 6. If a breach attributable to omniOne is found, omniOne bears the necessary and reasonable audit costs causally related to it; rectifying its own breaches is not charged additionally. Necessary audits must not be refused or delayed because of a fee dispute.

After the commissioned services end, omniOne returns or deletes processing data at the customer's choice; remaining copies are deleted after return unless an applicable law requires retention. The customer is informed of such a duty and its scope where permitted, and remaining processing is restricted to that purpose. Annex 4 covers the choice, secure handling, deadlines, evidence and backups. Account-deletion periods do not replace the customer's choice when processing ends. Protection and confidentiality continue until actual completion.

Where the Coach terms conflict with this DPA concerning processing on instructions, this DPA takes priority. Statutory duties, data subject rights and liability under Art. 82 GDPR remain unaffected. Individual agreements take priority to the extent legally permissible. Changes to principal duties require agreement; technical updates and sub-processor changes follow the expressly described procedures. The annexes below form part of this version and may not be silently overwritten.

Purposes and operations: providing a workspace for digital coaching relationships: receipt, collection, organisation, storage, technical preparation, association, calculation and presentation of progress information, provision to authorised users, transmission, correction, restriction and deletion. Technical calculations and reminders assist the Coach; they do not authorise independent medical decisions or new uses of the data.

Data subjects: the customer's Clients and invited prospects; the customer or their authorised persons where represented in coaching content, associations or communications.

Data categories: identity, contact, profile and association data; required account/authorisation data; coaching, health and progress data including associated drafts, assessments, plans and change histories; communication content and files including necessary media metadata; associated processing, delivery and evidence states. Examples are questionnaire information, goals, measurements, training entries, photos and messages. Special categories under Art. 9 GDPR may appear in structured information and free content. Unnecessary data must not be collected speculatively.

Scope and duration: according to agreed use and documented instructions, with deletion/return under section 9 and Annex 4. New purposes, additional special categories or substantially different recipients are not authorised by an unrestricted feature clause.

Confidentiality and access: personal authenticated accounts, password hashing, time-limited and revocable session/setup credentials, role- and relationship-based authorisation, private preparation areas and task-based administrative permissions. Private media is provided only through authorised application access.

Transmission and storage: HTTPS/TLS for public access and service connections over public networks; internal service connections are protected by TLS or by demonstrably suitable encrypted private connections with restricted access; database and object storage in the hosting provider's EU region; private object storage with server-side encryption; disk encryption by the hosting provider. Keys and credentials are managed separately from source code and rotated if compromise is suspected.

Integrity and separation: input/file validation, media normalisation, rate limiting, transaction/version controls and Coach/Client association checks on every access. Automated tests cover authorisation and deletion boundaries. Logs are limited to necessary technical information and deleted after 30 days at the latest.

Availability and recovery: Technical monitoring of the availability and operating status of essential services, bounded automatic retries, daily encrypted database backups with staged retention of at most 90 days, backup of files held in object storage and separate recovery of database and objects. Recovery is rehearsed and documented at risk-appropriate intervals, at least annually and additionally when warranted, particularly after material changes to backup or recovery procedures. After a recovery, intervening deletions and anonymisations are reapplied without undue delay. Affected data remains excluded from normal processing until completion. Unaffected areas may resume operation only where effective isolation of the affected data has been demonstrated. No specific recovery time is promised without a separate agreement.

Organisation: binding and restricting authorised persons, access management, security incident handling, documented instructions, supplier review, a record of processing activities, regular effectiveness checks and a privacy review of new data categories before their introduction. This annex describes measures, not a certification.

Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA: hosting of the website and app frontend, backend, database and object storage; selected region EU West (Amsterdam, Netherlands), object storage in the EU. This concerns account/association data, coaching content, communications, private files and necessary operational data. EU standard contractual clauses (Module 3) are the intended basis for support and operational access from the USA. Before transfer, omniOne checks and documents their effective incorporation, the required transfer assessment and suitable supplementary measures, considering the EU storage region, encryption and access restrictions. The agreement with the provider must cover the data actually processed, including health data.

Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (EU): email delivery and associated email operation. This concerns necessary recipient/sender information, system messages and delivery information; coaching content is not included in system emails.

Other providers: Additional sub-processors directly appointed by omniOne may be engaged only under the procedure in section 5. Stripe is used exclusively for omniOne's own billing and does not process processing data. omniOne provides the current list and copies of the safeguards used to the customer on request at support@omniOne.fitness.

Third-country transfers: they take place only on documented instructions and with an applicable basis under Art. 44 et seq. GDPR. An EU storage region does not rule out third-country access; omniOne must therefore check and document the applicable safeguards and required assessments and measures for each provider before a transfer. No transfer takes place without a valid basis. New transfers or providers follow the procedure under section 5.

Customer choice and complete exit: The Coach communicates the choice of return or deletion and its scope in text form to support@omniOne.fitness. omniOne checks authority, ongoing coaching relationships and permissible residual retention. Where return is chosen, omniOne provides the processing data within 30 days after the commissioned services have ended and the choice has been received, through a secure transfer channel: structured data as JSON or CSV and files in their original format. Regular return, including necessary manual handling, is included at no additional charge. An extension is possible only for specific, justified and legally permissible circumstances; omniOne communicates the reasons and revised date in good time. Mandatory deadlines, particularly for data subject rights and under the applicable Data Act, remain unaffected.

Deletion after exit: Following completed return or, where deletion is chosen, after the commissioned services have ended and the choice has been received, omniOne deletes remaining processing data in the database and object storage without undue delay and within 30 days at the latest, and confirms completion in text form. Mandatory transition and data retrieval periods are respected; where they prevent earlier deletion, this deletion period starts upon their expiry. Statutory retention duties are communicated case by case and restricted to their purpose; backups follow the final paragraph. The periods for deleting individual Client accounts do not extend this exit deadline.

Account-deletion workflow as documented instruction: technical account deletion initiates immediate profile anonymisation, communication deletion after 30 days, health/coaching deletion for the deleted Client after 90 days, and minimised evidence deletion after one year. By accepting this DPA, the customer issues these periods as the instruction for processing data; a deviating lawful individual instruction takes precedence. Professional drafts, histories and photos remain health/coaching data and are not reclassified as long-term evidence. A pause, end of coaching, subscription end or Coach account deletion does not replace the customer's choice under paragraph 1.

Private objects and backups: deletion includes database references, files, previews and necessary derivatives; failed object deletions are retried until they succeed. Backup copies are kept encrypted, restricted to authorised persons, used exclusively for recovery and overwritten or destroyed after 90 days at the latest. After a recovery, intervening deletions and anonymisations are reapplied without undue delay. Affected data remains excluded from normal processing until completion. Unaffected areas may resume operation only where effective isolation of the affected data has been demonstrated.