Data processing agreement

1. Parties and scope

This agreement is part of the terms of service and is accepted when a coach creates an account. The coach is the controller of their clients’ data. Método X(Daniel Millán Marco, tax ID 54166429A, C/ Can Donadeu, n12, 1o 2a, 08120, La Llagosta, Barcelona) is the processor. It applies for as long as the coach’s account exists.

2. What is processed

• Purpose: providing the service: storing and displaying programs, nutrition, check-ins, messages, reports and the client app.
• Data subjects: the coach’s clients and prospects who use the sign-up form.
• Data: identification and contact details, training and nutrition logs, bodyweight and body measurements, progress photos, sleep and steps, injuries or notes the coach records, and messages. Some of this is health data (Article 9 GDPR).

3. What Método X commits to

• Process the data only on the coach’s documented instructions, which are the settings and actions in the product, and never for its own purposes. If an instruction appears to break the law, we will tell the coach.
• Keep it confidential: only people bound by confidentiality can access it, and only when needed to run or support the service.
• Apply appropriate security measures (Article 32): isolation between workspaces checked on the server, encryption in transit, access control, data stored in the EU, and daily backups tested for restoration.
• Help the coach answer their clients’ rights requests (access, rectification, erasure, portability…): the product lets the coach export and delete data directly.
• Notify the coach of any personal data breach affecting their data without undue delay, and in any case within 48 hours of becoming aware of it, with the information available to help them meet their own obligations.
• Help the coach, where applicable, with impact assessments and prior consultations.
• Make available the information needed to demonstrate compliance and allow reasonable audits, with prior notice and at the coach’s expense.

4. Subprocessors

The coach gives general authorisation for the subprocessors listed on the subprocessors page. Método X imposes on them the same data protection obligations and remains responsible for them. We will announce any new subprocessor on that page and by email at least 15 days in advance; the coach may object and, if no solution is found, cancel without penalty. Transfers outside the EU are covered by the European Commission’s standard contractual clauses.

5. The coach’s obligations

The coach guarantees that they have a valid legal basis to collect their clients’ data, in particular explicit consent for health data, that they inform their clients, and, for clients under 14, that they have their parents’ or guardians’ consent.

6. When the service ends

The coach can export all the data at any time. When the account is deleted, the data is permanently erased after 30 days, and the last copies disappear from the backups within the following 14 days, unless the law requires us to keep something.