Data Processing Addendum (DPA)Data Processing Addendum (DPA)

In simple words

• The data about your Members and Trainers belongs to your gym. You decide how it is used (you are the Data Fiduciary). FitOS only processes it on your instructions (we are the Data Processor).
• We use this data only to run the Service, give support, keep it secure and follow the law. We never sell it.
• Our people must keep it confidential. FitOS staff access it only when needed, and that access is logged.
• We use a few service providers (such as Supabase for the database). We will tell you 15 days before adding or replacing one, and you can object.
• If we confirm a data breach affecting your gym, we will tell you within 72 hours.
• When your Account ends, you get 30 days to export, and then we delete the data, except payment and ledger records the law requires us to keep.
• This Addendum is part of the Terms of Service. You accept it when you tick the box at signup.

1. Parties and how this Addendum applies

1.1 This Data Processing Addendum ("DPA") is between the Gym Owner (as defined in the Terms of Service) and FitOS, operated by ApexGrid, Sikar, Rajasthan, India.

1.2 This DPA forms part of the Terms. The Gym Owner accepts it in the App at signup, together with the Terms and the Privacy Policy. Words defined in the Terms have the same meaning here.

1.3 For the Personal Data of Members and Trainers stored in the Service ("Gym Personal Data"), the Gym Owner is the Data Fiduciary and FitOS is the Data Processor. In this DPA, "Data Principal" means the Member or Trainer the data is about.

1.4 This DPA does not cover the Gym Owner's own Account details, Website visitors, leads, newsletter subscribers, blog authors, advertisers or support conversations. For those, FitOS is the Data Fiduciary and our Privacy Policy applies.

1.5 "Data Protection Law" means the laws of India on personal data that apply to the processing, including the Information Technology Act, 2000 and rules under it, and the Digital Personal Data Protection Act, 2023 and rules under it, as their provisions apply from time to time.

2. Subject matter, duration, nature and purpose

2.1 Subject matter: processing Gym Personal Data so that the Gym Owner can manage their gym using the Service.

2.2 Duration: for as long as the Gym Owner uses the Service, plus the 30-day export period after termination, and then for any period that FitOS must keep records by law (see clause 11).

2.3 Nature: collecting (as entered by the Gym Owner, Trainers or Members), storing, organising, displaying, masking, backing up, exporting, archiving and deleting data, and sending notifications.

2.4 Purpose: to provide the Service under the Terms, including Member records, attendance and QR check-in, fee and payment records, reminders, Trainer access, support, security and legal compliance.

2.5 Further details are in Schedule 1.

3. Types of data and people

3.1 The categories of Data Principals and Personal Data are listed in Schedule 1.

3.2 The Service is not designed to hold ID proof, health, medical or injury information, or body measurements. The Gym Owner must not enter these into the Service.

4. The Gym Owner's responsibilities

4.1 The Gym Owner is responsible for:

• having a lawful basis (such as consent) for the Gym Personal Data it puts into the Service;
• giving Members and Trainers a clear notice (a template is available from us);
• for any Member under 18, obtaining and recording verifiable consent from a parent or lawful guardian;
• keeping the data accurate and limited to what is needed; and
• giving FitOS lawful instructions.

4.2 The Gym Owner's instructions are: these Terms and this DPA, and the actions the Gym Owner or its Trainers take in the App (for example, adding, archiving or exporting data, or setting Trainer permissions). Any other instruction must be in writing (email is enough) and be reasonable and consistent with the Service.

5. Processing only on instructions

5.1 FitOS will process Gym Personal Data only on the Gym Owner's documented instructions, unless the law requires otherwise. In that case FitOS will tell the Gym Owner before processing, unless the law prohibits telling them.

5.2 If FitOS believes an instruction breaks Data Protection Law, it will tell the Gym Owner and may decline to follow that instruction.

5.3 FitOS will not sell Gym Personal Data, will not use it to market its own products to Members or Trainers, and will not use it for any other purpose of its own, except to create aggregated, de-identified statistics that do not identify any gym or person, as allowed by the Terms.

6. Confidentiality of personnel

6.1 FitOS will ensure that anyone it allows to access Gym Personal Data (including the founder, any staff or contractors) is bound by a duty of confidentiality and accesses the data only as needed.

6.2 FitOS staff with superadmin access view Gym Personal Data only to give support at the Gym Owner's request, to investigate security or abuse, to verify billing, or where the law requires. Superadmin access requires multi-factor authentication and is logged.

7. Security

7.1 FitOS will take reasonable security safeguards, appropriate to the nature of the data and the size of the business, to protect Gym Personal Data against breach, including unauthorised access, use, change, disclosure or loss. The current measures are described in Schedule 2.

7.2 FitOS may update these measures over time, as long as the overall level of protection is not reduced.

7.3 No system is completely secure. The Gym Owner is responsible for the security of its own devices and logins and for managing Trainer access.

8. Sub-processors

8.1 The Gym Owner gives general permission for FitOS to use the sub-processors listed in Schedule 3.

8.2 FitOS will give the Gym Owner at least 15 days' notice (by email, in the App, or by updating this page and notifying the Gym Owner) before adding or replacing a sub-processor that will process Gym Personal Data.

8.3 The Gym Owner may object on reasonable data protection grounds within that 15-day period by writing to support@fitosapp.in. The parties will discuss the concern in good faith. If it cannot be resolved, the Gym Owner may end its Plan before the change takes effect and receive a refund of fees for the unused part of the current paid period.

8.4 FitOS will use sub-processors that it reasonably believes provide adequate protection and will use their standard terms that include data protection commitments. FitOS remains responsible to the Gym Owner for its own obligations under this DPA.

8.5 In an emergency (for example, to keep the Service running or secure), FitOS may replace a sub-processor at shorter notice and will tell the Gym Owner as soon as possible.

9. Helping with Data Principal requests

9.1 The App lets the Gym Owner view, correct, export and archive Member and Trainer data. The Gym Owner should use these tools first to respond to requests from Members and Trainers.

9.2 If FitOS receives a request or complaint directly from a Member or Trainer about Gym Personal Data, FitOS will, where possible, direct the person to their gym and tell the Gym Owner without undue delay. FitOS will not respond on the merits without the Gym Owner's instructions, unless the law requires it.

9.3 For requests the App tools cannot handle (for example, a permanent deletion or restoring archived data), FitOS will give reasonable help on the Gym Owner's written request.

9.4 Account deletion requests made at /delete-account or in the App are handled as described in the Privacy Policy. Where a request concerns Gym Personal Data, FitOS will inform the Gym Owner and act on its instructions, subject to legal retention (clause 11.3).

9.5 If the Gym Owner does not respond to a forwarded deletion request from a Member or Trainer within a reasonable time, the Gym Owner instructs FitOS to delete that person's App login and profile and to delete or anonymise their other Gym Personal Data that the law does not require to be kept, as described at /delete-account.

10. Personal data breach

10.1 If FitOS confirms a personal data breach affecting Gym Personal Data, it will notify the Gym Owner within 72 hours of confirming the breach.

10.2 The notice will include, as far as known at the time: what happened, when, the types of data and approximate number of people affected, likely effects, steps taken or planned, and a contact person. FitOS will share further information as it becomes available.

10.3 FitOS will take reasonable steps to contain the breach and reduce harm, and will reasonably help the Gym Owner with any notice the Gym Owner must give to Data Principals or authorities. FitOS will also make any reports that the law requires FitOS itself to make.

10.4 Notifying a breach is not an admission of fault or liability.

11. Deletion or return at the end

11.1 After the Terms end, the Gym Owner has 30 days to export Gym Personal Data using the App's export tools or by asking us.

11.2 After the 30-day period, FitOS will delete or anonymise Gym Personal Data within a reasonable time, including from active systems. Copies in backups held by our provider are purged within 30 days as those backups expire, and will not be restored except for disaster recovery.

11.3 FitOS may keep payment and ledger records, acceptance records and audit logs for as long as the law requires (for example, tax and accounting laws) or as needed to establish or defend legal claims. These will be kept secure and used only for those purposes.

11.4 While the Service is running, an archive hides records from the Gym Owner but keeps them on the server. Permanent deletion is done by FitOS on the Gym Owner's written request, subject to clause 11.3.

12. Information and audit

12.1 FitOS will make available the information reasonably needed to show that it complies with this DPA.

12.2 The Gym Owner may send FitOS a reasonable written security and privacy questionnaire once a year (and additionally after a confirmed breach affecting it, or if an authority requires it). FitOS will answer within a reasonable time.

12.3 Because the Service is a shared platform for many gyms, on-site audits and access to FitOS systems are not offered, except where an authority with legal powers requires them.

12.4 Information shared under this clause is confidential information of FitOS under the Terms.

13. Cross-border transfers

13.1 Gym Personal Data is mainly stored with our database provider in the region shown in our sub-processor list. Some sub-processors (for example, for email, crash reports or app distribution) may process data in other countries, as listed in Schedule 3.

13.2 FitOS will transfer Gym Personal Data outside India only as permitted by Data Protection Law, and will not transfer it to any country or territory that the Government of India has restricted.

14. Liability

14.1 Each party's liability under this DPA is subject to the limits and exclusions in the Terms of Service, including the cap of fees paid in the last 12 months, to the extent permitted by law.

14.2 Nothing in this DPA limits a party's liability where the law does not allow it to be limited, or limits any right a Data Principal has under the law.

15. Precedence and changes

15.1 If this DPA conflicts with the Terms on a matter of data protection, this DPA applies. On all other matters, the Terms apply.

15.2 Changes to this DPA follow the change process in the Terms (notice and right to terminate).

15.3 If Data Protection Law changes in a way that requires changes to this DPA, FitOS may update it with notice, and the parties will work together in good faith to comply.

Schedule 1: Description of processing

Schedule 2: Security measures

These are the measures FitOS has in place at the date of this version. They are reasonable for a small business but are not a certification or guarantee.

Schedule 3: Sub-processors

This list deliberately covers only the providers that process Gym Personal Data or related technical data. The other providers listed in our Privacy Policy (such as Netlify for website hosting, Cloudflare Turnstile, website analytics or advertising) serve only the Website and do not process Gym Personal Data. If that changes (for example, if a web version of the App is hosted on Netlify), we will add them here with 15 days' notice under clause 8.2.

When a user chooses to send a message through WhatsApp from the App, that message is sent from the user's own WhatsApp account and is handled by WhatsApp/Meta under its own terms. FitOS does not send it.