Data processing agreement

1. The parties

• Controller, the gymThe gym that accepts the agreement, with the legal name and registration number on the gym's account in Riggd.
• Processor, RiggdAlistra AB, Swedish company registration number (organisationsnummer) 559600-4241, Utsädesgränd 14, 175 52 Järfälla, Sweden. Email info@riggd.se.

The agreement belongs to the terms for gyms at riggd.fit/en/villkor-gym. If the terms say something else on a question of personal data, this agreement applies.

2. What the agreement covers

Riggd provides a platform for running a gym: member app, web app and dashboard with bookings, waitlists, check in, door opening, schedule, memberships and payments through the gym's own Stripe account, group chat and the Feed, support requests, notifications and push notifications, training logs, leads and mailings.

The subject matter, nature and purpose of the processing, the types of personal data, the categories of data subjects and the retention periods are in Annex 1. The sub-processors are in Annex 2 and the security measures in Annex 3. The annexes are part of the agreement.

Riggd is itself the controller of the user account and login, which a person can use in several gyms, of support requests sent to Riggd, of the security of the platform and of what is left on riggd.fit. That processing is not covered by this agreement and is described in the privacy policy at riggd.fit/en/integritetspolicy.

3. The gym's responsibilities

As controller, the gym is responsible for:

• Legal basisthe processing the gym instructs Riggd to carry out having a legal basis, and data the gym adds or imports itself being allowed to be added.
• Informationmembers and staff receiving information about the processing under Articles 13 and 14. The gym may refer to Riggd's privacy policy for what concerns the platform.
• Instructionsits instructions to Riggd complying with data protection law.
• Permissionsthe right people having the right role in the gym, and permissions being removed when someone leaves.

4. Instructions

Riggd processes the personal data only on the gym's documented instructions, including with regard to transfers to a country outside the EU/EEA. The instructions are this agreement and the choices the gym makes in the platform: schedule, rules, memberships, groups, mailings, integrations and permissions. New instructions are given in writing, for example by email to info@riggd.se.

Riggd never uses the data for its own purposes, for advertising or to sell it.

If Riggd is required by Union or Swedish law to process the data in another way, Riggd informs the gym before the processing, unless the law prohibits it.

If Riggd considers that an instruction infringes the GDPR or other data protection law, Riggd informs the gym without delay.

5. Confidentiality

Riggd ensures that everyone who processes the data on Riggd's behalf, employees, consultants and others, has committed themselves to confidentiality or is under a statutory obligation of confidentiality, and only reaches what the task requires.

Riggd does not disclose the data to anyone other than the sub-processors in Annex 2, unless the law requires it. If an authority requests data the gym is responsible for, Riggd refers it to the gym in the first place and informs the gym, unless the law prohibits it.

6. Security

Riggd takes the technical and organisational measures required under Article 32, for a level of security appropriate to the risk. The measures are in Annex 3. Riggd may improve them, but never lower the level of protection.

7. Sub-processors

The gym gives Riggd a general prior written authorisation to engage the sub-processors listed in Annex 2. The list is the same as the providers in the privacy policy.

Riggd notifies the gym's owner by email at least 30 days before a new sub-processor is engaged or an existing one is replaced. The gym can object within that period, with reasons. The parties then seek a solution in good faith, and if there is none the gym may terminate the terms for gyms so that they end before the change applies, at no cost for the time after.

Riggd imposes on every sub-processor the same data protection obligations as in this agreement, by a written contract, and remains fully liable to the gym for the sub-processor's processing.

8. Transfers outside the EU/EEA

The database is in Stockholm, inside the EU. A transfer to a country outside the EU/EEA only goes to a sub-processor in Annex 2 and only with a transfer mechanism under Chapter V of the GDPR. The mechanism for each sub-processor is in Annex 2.

9. The rights of data subjects

The platform is built so that data subjects can exercise their rights themselves: in the app they download a data export as a machine-readable file (Articles 15 and 20), correct their details, manage their consents and delete their account.

If a request reaches the gym, Riggd assists the gym without undue delay with the technical and organisational measures needed, so the gym can reply within one month. If a request reaches Riggd directly and concerns data the gym is responsible for, Riggd forwards it to the gym without undue delay. A request to delete the account is handled by Riggd on the gym's behalf, as the privacy policy and riggd.fit/en/radera-konto describe.

10. Personal data breaches

Alistra AB is responsible for Riggd's incident procedure. The person responsible for incidents is Ali Storm, with Hans Grobecker and Mia in the Riggd team. The gym reaches them at info@riggd.se.

Riggd notifies the gym's owner by email without undue delay, and within 24 hours at the latest of becoming aware of it, of a personal data breach concerning the gym's data. That gives the gym time for its assessment and to notify the Swedish Authority for Privacy Protection (IMY) within 72 hours when required (Article 33).

The notification contains what the gym needs, as far as it is known, and is supplemented as more becomes known: what happened and when, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures Riggd has taken or proposes to limit the harm, and whom at Riggd the gym can ask.

The gym notifies IMY and, where needed, informs the data subjects (Article 34). Riggd assists, documents the breach and does not inform the gym's members itself unless the gym asks or the law requires it.

11. Assistance with security and impact assessments

Riggd assists the gym with what is needed for the gym to comply with Articles 32 to 36, taking into account the nature of the processing and the information available to Riggd: security, breaches, data protection impact assessments (Article 35) and prior consultation with IMY (Article 36).

12. When the agreement ends

The agreement applies from when the gym accepts it and for as long as Riggd processes personal data on the gym's behalf.

When the terms for gyms end, the gym can within 30 days choose to receive its data in a structured, commonly used and machine-readable format. After that Riggd deletes all personal data processed on the gym's behalf, at the latest 30 days after the agreement ended, unless Union or Swedish law requires it to be kept. Backups are overwritten as the provider rotates them and are not used in the meantime. Riggd confirms the deletion in writing if the gym asks.

Members' user accounts, which Riggd is itself responsible for, are not deleted because the gym leaves Riggd: an account can belong to several gyms. An account whose memberships have been ended for 24 months is deleted as described in Annex 1.

13. Information and audits

Riggd gives the gym the information needed to demonstrate that the obligations in Article 28 and in this agreement are met, and keeps a record of the processing as a processor under Article 30(2).

The gym may audit Riggd's compliance with the agreement, itself or through an independent auditor bound by confidentiality, once a year and more often after a breach or if IMY requests it. The audit is announced 30 days in advance, must not disrupt operations and must not reveal other gyms' data. The gym bears its own costs. Riggd may in the first place show existing certifications and reports, including the sub-processors'.

14. Liability

Each party is liable for damage under Article 82 of the GDPR. Otherwise the limitation of liability in the terms for gyms applies, except in cases of gross negligence or intent, and except where the GDPR says otherwise.

15. Changes, law and disputes

Riggd notifies changes to the agreement to the gym's owner by email at least 30 days before they apply. A change in substance gets a new version, which the gym accepts on the dashboard under Gymmets konto (The gym's account). The annexes are kept in step with the platform, and new sub-processors follow section 7.

Swedish law applies. Disputes are settled by the general courts of Sweden.

Annex 1: The processing

The subject matter and purpose is running the gym's member service: accounts on the gym's behalf, booking of classes and waitlists, check in and door opening, memberships and payment status, schedule, group chat and the Feed with reporting, word filter, blocking and suspension from writing, support requests to the gym, notifications in the app and push notifications, mailings to members who have turned on E-postutskick (email newsletters), training logs and personal records, body measurements and injuries (optional, with consent), PT bookings and goal sessions, merchandise reservations, cancellations, leads and the gym's website. The nature of the processing is collection, storage, structuring, display, transfer to sub-processors and erasure.

The data subjects are the gym's members with an account in the app (from age 13), the staff (coaches, head coaches and owners), guardians of members under 18, leads who have left their details in the gym's forms, and visitors to the gym's website, who are counted without cookies.

• Name, email, profile pictureThe person and the gym's staff. Other members see the name and chosen profile picture in participant lists, groups and leaderboards.
• Phone, date of birthThe person and the gym's staff, in separate storage with its own access rule.
• Membership, role, status, payments, receiptsThe person and the gym's staff.
• Bookings, waitlist place, check ins, the door logThe person and the gym's staff, the participant list for other participants. Shows activity patterns.
• Training results and recordsThe person, the gym's staff, and other members in leaderboards unless the person has chosen anonymous mode.
• Body measurements and injuriesHealth data (Article 9). Processed only with the member's explicit consent, asked for separately. The person and the gym's staff, never other members.
• Group chat and comments in the FeedThe group's members and the gym's staff. Reported messages also Riggd. Free text.
• Support requestsThe person and the recipient, the gym or Riggd. Free text.
• ConsentsThe person and the gym's staff, with type, decision and time.
• Guardian's name, email, phoneThe gym's staff, on the membership of a member under 18.
• Push token, phone model, app versionNo person. Only used to deliver push.
• Leads: name, email, phone, messageThe gym's staff.

Location is only read on the phone when the member opens the door, compared with the gym's position on the phone and never stored.

Retention: group chat 90 days (pinned posts are kept), reported messages up to 1 year while the report is investigated, notifications after 90 days when read and 180 when unread, push tokens until the person logs out, deletes the account or the phone stops receiving notifications and at most nine months after last use, counted visits to the gym's website 13 months, and the whole account 24 months after all memberships have ended, with a notice in the app one month before. Payments and order history are kept for 7 years under the Swedish Bookkeeping Act, attached to a profile without name and email. Everything else is kept until the account is deleted or the gym removes it.

Besides the personal data, the gym's own content is stored: logo and product images, which are publicly readable as shop content, and keys to the gym's external systems, which are confidential. The gym is responsible for product images showing products and not identifiable people.

Annex 2: Sub-processors

• Supabase Inc.Database, login, file storage, server functions and scheduled jobs. Location: AWS eu-north-1, Stockholm. Transfer: storage is inside the EU, and any access from the United States, for example for support, happens under Supabase's data processing agreement with the European Commission's standard contractual clauses.
• Cloudflare, Inc. (hosting)Hosting and delivery of riggd.fit, the web app, the dashboard and the gyms' websites. Sees technical data such as IP addresses. Location: Cloudflare's global network. Transfer: EU-U.S. Data Privacy Framework (certified).
• Cloudflare, Inc. (email)Email through Cloudflare Email Service: the gym's mailings, login codes, password reset links and notices about support requests. Receives the recipient's address and the email's content. Transfer: EU-U.S. Data Privacy Framework (certified).
• 650 Industries, Inc. (Expo)Builds the app, delivers updates and receives the push notifications to hand them to Apple and Google. Receives the push token and the notification's title and text, and for updates a technical request with the IP address. Location: United States. Transfer: EU-U.S. Data Privacy Framework (certified).
• Apple Inc. (Apple Push Notification service)Delivers push to iPhone. Receives the push token and the notification's title and text. Location: United States. Transfer: the European Commission's standard contractual clauses, under Apple's terms.
• Google LLC (Firebase Cloud Messaging)Delivers push to Android. Receives the push token and the notification's title and text. Location: United States. Transfer: EU-U.S. Data Privacy Framework (certified).

Under the gym's own agreement, not sub-processors of Riggd: Stripe receives the payments for memberships, PT and fees to the gym's own Stripe account, connected to Riggd's platform account with Stripe Connect. The gym has its own agreement with Stripe, and Riggd sends Stripe the member's name, email and an internal reference for the purchase. Card details never reach Riggd. Stripe, LLC is certified under the EU-U.S. Data Privacy Framework. The gym's lock system, currently KiiOn, receives an order to open a specific door with the gym's own credentials, and no data about the member.

Planned, and only activated after notice under section 7: a language model for Träningshjälpen (the training assistant), which is not in the app today. The terms are reviewed and the privacy policy is updated before the feature is switched on.

Annex 3: Security measures

Each item describes something that is built and running, not an ambition.

• Access in the data layerRow level security on every table. Each gym's data is isolated per gym, and the boundary is tested with automated leak tests. The roles (member, coach, head coach, owner) are checked in the database, not only in the interface, and only the owner changes permissions.
• Data minimisation per rolePhone numbers and dates of birth are in separate storage that only the person and the gym's staff reach. Health data is only seen by the person and the gym's staff. The member can choose anonymous mode towards other members.
• EncryptionTLS (HTTPS) for all traffic, and encryption at rest at the cloud provider.
• RetentionScheduled nightly jobs delete data as in Annex 1: chat, reports, notifications, push tokens, website visits and inactive accounts.
• Rights as self serviceData export as a machine-readable file, correction, consents and account deletion directly in the app.
• DeletionAccount deletion goes through a single reviewable function that removes personal data, pseudonymises the remaining profile and blocks the login. Exceptions: payments and order history under the Bookkeeping Act, and chat messages that remain under Borttagen medlem (Deleted member) until the 90 day deletion takes them.
• ModerationA word filter in the database stops the worst words and sends others to the gym for review. Reports go directly to the gym's owner and head coach, and Riggd looks at what has not been handled within 24 hours. Riggd only reads what has been reported, and every read is logged.
• Riggd's own accessRiggd's staff only reach the gyms' data through limited functions, and every read leaves a trace in a log.
• Secrets and keysKeys and tokens are never stored in the code, and every change is scanned automatically. The door integration's secrets are in a table without read rules, reached only by server functions. The gym's own integration keys are only reached by the gym's owner and head coach, are only read on the server and are always shown masked.
• File storageUploaded files are in separate storage buckets where only the owner or head coach writes in the gym's own folder. The buckets for logos and product images are publicly readable and not intended for personal data.
• Change controlThe schema only changes through versioned migrations, with an automated check of row level security. Every code change passes type checks, tests and secret scanning before deployment.
• BackupsBackups at Supabase, inside the same EU region, rotated on the provider's schedule.
• IncidentsAlistra AB is responsible for the incident procedure, with Ali Storm as the person responsible for incidents and Hans Grobecker and Mia in the Riggd team. A breach concerning the gym's data is notified to the gym's owner under section 10. Contact: info@riggd.se.