InGym Data Processing Addendum

1. Parties and scope

This Data Processing Addendum ("DPA") is part of the InGym Terms and Conditions (the "Terms") between the business that uses InGym (the "Customer") and Mohamed Wahib EI, an individual entrepreneur (entrepreneur individuel) trading as ElShore, registered in France under SIREN 108434846, whose address is 138 avenue Victor Hugo, 75116 Paris, France ("ElShore").

It applies when ElShore processes personal data on behalf of the Customer in providing InGym ("Customer Personal Data"). For that processing, the Customer is the controller and ElShore is the processor. ElShore's processing of personal data as a controller for its own customer relationship is described in the InGym Privacy Notice and is outside this DPA.

"GDPR" means Regulation (EU) 2016/679 and, where applicable, the UK GDPR and the UK Data Protection Act 2018. Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the GDPR. Where the Customer is subject to another data-protection law, ElShore will provide the assistance described in this DPA so far as it is relevant to that law.

2. Details of the processing

Subject matter and purpose: providing InGym to the Customer as a gym-management service, including hosting, storage, display, search, reporting, export, backup, security and support.

Nature of processing: collection through the Customer's entries and imports, storage, organization, consultation, updating, export, transmission to the Customer's users and to members where the Customer uses those features, and deletion.

Duration: for the term of the Terms and until deletion under section 9.

Data subjects: the Customer's members and prospective members (including members under 18), their emergency contacts and, for minors, their parents or guardians where recorded, and the Customer's staff and other users.

Categories of personal data, as entered by the Customer: identification and contact details (such as name, email address, phone number, member code and date of birth); member photos used for visual identification; membership, package and pass details, including cancellation reasons and freeze or pause reasons; attendance and check-in records; records of payments members make to the Customer; waivers and waiver signatures; access-card status; staff roles, branch assignments and shifts; notes written by the Customer's staff; and related audit records.

Special categories: the only special-category data the Service is designed to hold is the predefined "medical" reason code that the Customer may select when a membership is cancelled. The Customer records it only where it has both a legal basis under article 6 and a condition under article 9(2) of the GDPR, which the Customer determines. Free-text health details are not allowed, including in the "other" cancellation reason and in freeze or pause reasons. The safeguards for this code are described in Annex 1, part B.

Minors: the Customer may record members under 18. As controller, the Customer decides the lawful basis for those records and limits the data it records about minors to what is necessary. The consent rules for children in article 8 of the GDPR apply only where the Customer offers an online service directly to a child; in France the age is 15, and below 15 consent must be given jointly by the child and a parent or guardian. Where those rules or other laws require the consent of a parent or guardian, the Customer is responsible for obtaining it.

Excluded data: the Customer must not submit other special categories of data under article 9 of the GDPR, biometric data, identity-document data or full payment card numbers, and must not use member photos for biometric matching. These restrictions do not limit ElShore's statutory obligations or this DPA's protections. On discovering prohibited data, ElShore will notify the Customer and arrange secure removal on documented instructions, subject to law.

3. Processing on documented instructions

ElShore processes Customer Personal Data only on the Customer's documented instructions, unless required to do otherwise by EU or Member State law, in which case ElShore will inform the Customer before processing unless the law prohibits it. The Customer's instructions are the Terms, this DPA, the Customer's configuration and use of InGym, and any additional written instructions agreed by both parties.

ElShore will inform the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data-protection law.

The Customer is responsible for the lawfulness of the processing it instructs, including having a legal basis, giving members and staff the information required by law, and the accuracy of the data it enters.

4. Confidentiality and security

ElShore ensures that the persons it authorizes to process Customer Personal Data are bound by confidentiality.

ElShore implements technical and organizational measures appropriate to the risk, as required by article 32 of the GDPR, including:

• encryption of data in transit (TLS) and encryption at rest provided by the hosting provider;
• logical separation of each customer's data, enforced by database row-level access controls;
• role-based access control for users, and multi-factor authentication for staff accounts where enabled;
• restriction of internal access to the people who need it to operate and support the Service;
• rate limiting, anti-bot protection and security logging;
• regular backups managed by the hosting provider, with restore procedures; and
• review of the security of changes before they are released.

ElShore may update these measures, provided that the overall level of security is not reduced.

5. Subprocessors

The Customer gives ElShore general authorization to use subprocessors. The current subprocessors, with their contracting entity, function, processing location and transfer safeguard, are listed in Annex 1 (section 12) and in the InGym Privacy Notice. Stripe processes billing data for ElShore's own account relationship rather than Customer Personal Data.

ElShore imposes on each subprocessor data-protection obligations that offer the same level of protection as this DPA, in particular sufficient guarantees of appropriate technical and organizational measures, and remains responsible to the Customer for its subprocessors.

ElShore will inform the workspace owner by email at least 30 days before adding or replacing a subprocessor. The Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service before the change takes effect and receive a pro rata refund of prepaid fees for the unused period. Where an urgent replacement is needed to keep the Service secure or available, ElShore may give shorter notice and the same objection right applies.

6. International transfers

ElShore hosts the InGym production database in the European Union. ElShore transfers Customer Personal Data outside the EEA, or the UK, only with a transfer mechanism for each flow:

• Transfers to subprocessors: where a subprocessor, or its own subprocessor, processes Customer Personal Data outside the EEA, ElShore (as processor) relies on the EU-US Data Privacy Framework where the recipient is certified, or otherwise on Module 3 (processor to processor) of the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) included in that subprocessor's data processing addendum, together with the UK International Data Transfer Addendum where UK data is concerned. Annex 1 states the mechanism for each subprocessor.
• Return to customers outside the EEA: where the Customer is established outside the EEA in a country without an adequacy decision and is not itself subject to the GDPR for the processing concerned, the provision of Customer Personal Data by ElShore to the Customer is governed by Module 4 (processor to controller) of those clauses, which the parties incorporate by reference with the particulars in Annex 1.
• Customers subject to the GDPR under article 3(2): Module 4 does not cover a Customer outside the EEA that is itself subject to the GDPR under article 3(2). The Customer must tell ElShore in writing before it uses InGym for personal data that falls under article 3(2). ElShore makes no restricted transfer to such a Customer unless another valid article 46 mechanism is agreed in writing. Until then, ElShore does not provide the Service, or any return or export, for that data.
• ElShore's own controller data (account, billing, support and security data) is outside this DPA; its transfers are described in the Privacy Notice.

Before relying on standard contractual clauses for a transfer, ElShore assesses, with the information made available by the recipient, whether the law of the destination country allows the recipient to comply with them, and applies supplementary measures where needed.

7. Assistance to the Customer

Data subject requests: taking into account the nature of the processing, ElShore assists the Customer by appropriate technical and organizational measures in responding to requests from data subjects. InGym lets the Customer view, correct and export member records; for erasure or other requests that these features do not cover, ElShore will act on the Customer's instructions. If ElShore receives a request directly from a data subject about Customer Personal Data, it will forward the request to the Customer without undue delay and will not respond itself except to tell the data subject that it has done so.

Other assistance: ElShore assists the Customer, taking into account the nature of the processing and the information available to it, with security, personal data breach notification, data protection impact assessments and prior consultation of supervisory authorities, as required by articles 32 to 36 of the GDPR. ElShore may charge a reasonable fee for assistance that goes beyond the features of the Service, after telling the Customer in advance.

8. Personal data breaches

ElShore will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification is sent to the workspace owner's email address and includes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. ElShore will provide further information as it becomes available and take reasonable steps to contain the breach and mitigate its effects.

Notification of a breach is not an admission of fault or liability.

9. Return and deletion

During the term, the Customer can export its data using the export features of InGym. In restricted mode, ElShore may pause in-app exports; exports remain available on request through contact@ingym.net.

At the end of the services: at the Customer's choice, ElShore returns the personal data and deletes existing copies, or deletes it, unless applicable EU or Member State law requires retention. From account closure, the workspace can no longer be accessed or recovered. Until 30 days after closure, the Customer can obtain an export on request through contact@ingym.net, which ElShore provides; this is how ElShore returns the data. If no export is requested within those 30 days, ElShore deletes the data. The Customer must keep its own copies of records it is required to keep, such as its tax and accounting records of member payments.

Deletion is carried out by an automated process 30 days after account closure. It deletes Customer Personal Data from ElShore's live systems, including member, staff, attendance, payment and audit records and uploaded files (member photos and waiver signatures), and the sign-in identities of staff users who do not belong to another InGym customer.

Backups: copies in backups are deleted when the backups expire, within up to 30 days. Until then they are kept secure and used only to restore the Service after an incident. If a backup is restored, completed deletions are applied again before ordinary processing resumes.

Ending a trial, a failed payment, or the end of a paid subscription is not account closure, and does not by itself start the deletion period.

10. Information and audits

ElShore makes available to the Customer the information reasonably necessary to demonstrate compliance with article 28 of the GDPR, including answers to reasonable security questionnaires and relevant documentation of its subprocessors.

If that information is not sufficient, or a supervisory authority requires it, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, not more than once every 12 months (except after a personal data breach or at the request of an authority), on at least 30 days' written notice, during business hours and in a way that does not disrupt the Service or affect other customers' data. Frequency and notice restrictions do not prevent audits reasonably necessary following a breach, credible evidence of non-compliance or an authority request; urgent audits use reasonable shorter notice. Audits are carried out at the Customer's cost and, where possible, first through document review and remote interviews. For subprocessors, ElShore relies first on the information and certifications they make available, and remains responsible for enabling effective verification of compliance.

11. Liability, precedence and law

Each party's liability under this DPA is subject to the limitations, exclusions and limitation periods in the Terms, except where the law does not allow them to apply. Nothing in this DPA limits the rights of data subjects under article 82 of the GDPR.

If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. If the standard contractual clauses apply and conflict with this DPA, the standard contractual clauses prevail.

This DPA is governed by French law and disputes about it are subject to the courts specified in the Terms. It is updated in the same way as the Terms, including the re-acceptance of material changes.

Contact for processing questions: contact@ingym.net. Questions from members about a gym's handling of their records should be addressed to that gym.

12. Annex 1: transfer particulars and subprocessors

A. Parties for Module 4 transfers. Data exporter: ElShore (Mohamed Wahib EI trading as ElShore, SIREN 108434846, 138 avenue Victor Hugo, 75116 Paris, France; contact@ingym.net), acting as processor. Data importer: the Customer, acting as controller; its activity is operating a gym or similar business. Signup records the Customer's name and country only. Before it can accede to the clauses, the Customer must provide its full address and a privacy contact, in its account settings where available or by writing to contact@ingym.net. Completing these particulars is an express prerequisite for accession. The Customer then accedes when it has accepted the Terms and completed them, and the date of accession is the later of the date of acceptance in ElShore's acceptance record and the date the particulars are completed. ElShore makes no restricted transfer to the Customer under these clauses until the particulars are completed.

B. Description of the transfer. Data subjects, categories of data and special categories: as in section 2. Frequency: continuous, whenever the Customer's users access or export data from InGym. Nature and purpose: making the Customer's own data available to it through the Service and through exports. Retention: decided by the Customer as controller; ElShore's retention is governed by section 9.

Safeguards for the "medical" cancellation reason code: it is stored only as a predefined value, with no accompanying free text; it is not displayed on any InGym screen, and at database level it can be read only by the Customer's own authenticated staff, through the row-level isolation of each customer's data; it is encrypted in transit and at rest; and it is kept only as long as the membership record it belongs to, and deleted with that record or with the workspace.

C. Clause selections for Module 4: the optional docking clause (Clause 7) applies; Clause 17 governing law is French law; Clause 18 courts are the courts of Paris, France. The technical and organizational measures are those in section 4.

D. Subprocessors (Module 3 transfers, where applicable):

• Supabase (Supabase, Inc., United States): database, authentication and file storage. Primary location: European Union (Paris, France). Support and some subprocessors may access data from other countries. Safeguard: Supabase's data processing addendum and the standard contractual clauses it includes.
• Resend (Plus Five Five, Inc., United States): delivery of transactional emails, including the verification and password-reset emails sent by Supabase authentication. Sending region: European Union; message content, delivery logs and account records are stored in the United States. Safeguard: Resend's data processing addendum and the standard contractual clauses it includes, or the EU-US Data Privacy Framework where the provider is certified.
• Vercel (Vercel Inc., United States): website and application hosting and content delivery. Application functions run in the European Union (Paris); content is delivered through Vercel's global network, and Vercel's primary processing facilities are in the United States. Safeguard: Vercel's data processing addendum and the standard contractual clauses it includes, or the EU-US Data Privacy Framework where the provider is certified.
• Sentry (Functional Software, Inc., United States): error monitoring. Location: Sentry's European Union data region (Germany). Safeguard: Sentry's data processing addendum and the standard contractual clauses it includes for any access from outside the EEA.
• Inngest (Inngest, Inc., United States): scheduling and running background jobs. Location: as stated in Inngest's data processing addendum, which may include the United States. Safeguard: Inngest's data processing addendum and the standard contractual clauses it includes.
• Upstash (Upstash, Inc., United States): rate limiting, abuse prevention and caching. Location: as stated in Upstash's data processing addendum and the database region selected for InGym. Safeguard: Upstash's data processing addendum and the standard contractual clauses it includes.
• Cloudflare (Cloudflare, Inc., United States): Turnstile anti-bot verification on signup and sign-in forms. Location: Cloudflare's global network. Safeguard: Cloudflare's data processing addendum and the standard contractual clauses it includes, or the EU-US Data Privacy Framework where the provider is certified.

The competent supervisory authority for ElShore is the CNIL (Commission nationale de l'informatique et des libertés), France.