Data Processing Addendum

This Data Processing Addendum forms part of the agreement between Repit and the coach or organisation using the service. The customer is the controller of client personal data it submits to Repit, and Repit acts as its processor. Each party remains responsible for any processing it performs as an independent controller.

Repit will process customer personal data only to provide, secure, support and maintain the service, as documented in the agreement and the customer’s use of Repit, or as required by law. Repit will notify the customer if an instruction appears to infringe applicable data-protection law.

Processing may include collecting, storing, organising, retrieving, transmitting, analysing and deleting account, identity, coaching, communication, fitness, nutrition, readiness and health-related data. Data subjects may include customers, staff, coaches, prospects, athletes and coaching clients. Processing lasts for the subscription and any documented retention or deletion period.

Repit will ensure that authorised people are bound by confidentiality obligations and will maintain technical and organisational measures proportionate to the risk, including access controls, encrypted transport, managed infrastructure, logging and recovery practices.

The customer authorises Repit to use subprocessors needed to operate the service. Current categories and named providers are described in the Privacy Notice. Repit will impose materially equivalent data-protection duties on subprocessors and remains responsible for their processing under this Addendum. Repit will provide reasonable notice of material subprocessor changes and consider good-faith objections.

Where personal data is transferred outside the United Kingdom or another protected jurisdiction, Repit will use an applicable adequacy decision, the UK International Data Transfer Addendum, approved standard contractual clauses, or another lawful transfer mechanism.

Taking into account the nature of processing and information available to it, Repit will reasonably assist the customer with data-subject requests, security obligations, impact assessments and regulator consultations. Repit will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer personal data and provide available information needed for the customer’s response.

At the customer’s choice, on termination Repit will return or delete customer personal data and delete existing copies, unless applicable law requires retention. Repit will also act on verified deletion instructions during the service as described in the agreement and Privacy Notice. Data may remain temporarily in access-restricted backups until overwritten through the normal backup cycle and may not be used for any other purpose.

Repit will make information reasonably necessary to demonstrate compliance available to the customer and support proportionate audits. Audits must protect other customers, security and confidentiality, avoid unreasonable disruption, and use existing independent assurance before requesting intrusive access.

Questions and requests can be sent to support@repit.coach.