June 2026 edition
(hereinafter – the DPA)
Data processor appointment under Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter – GDPR).
This DPA is entered into between:
You, as a coach, partner, or other person using the Sportstep platform to process your clients’ data in providing sports, training, nutrition, or related services (hereinafter – the Coach, Data Controller, or Controller),
and
Sportstep, UAB, company code 307605923, registered address Rimvydo g. 15-16, LT-50233 Kaunas, Lithuania (hereinafter – Sportstep, Data Processor, or Processor).
The Controller and Processor are together referred to as the Parties, and each individually as a Party.
PREAMBLE
A. The Parties have entered into or are entering into a principal services, platform use, or other agreement under which Sportstep grants the Coach access to the Sportstep platform, website, mobile application, and related functions for organising coach activity, managing clients, administering bookings and orders, communication, community features, plan delivery, progress tracking, and other functions related to providing coach services (hereinafter – the Principal Agreement).
B. In performing the Principal Agreement, the Coach may process personal data of their clients. Where Sportstep processes such personal data on behalf of and in accordance with the instructions of the Coach, Sportstep acts as a data processor and the Coach acts as a data controller.
C. The purpose of this DPA is to set out the terms under which Sportstep, as data processor, processes personal data on behalf of the Coach in accordance with Article 28 GDPR.
D. The Parties agree that this DPA forms an integral part of the Principal Agreement to the extent Sportstep acts as the Coach’s data processor.
1. Appointment of the data processor
1.1. The Coach appoints Sportstep as data processor under Article 4(8) and Article 28 GDPR to the extent Sportstep processes personal data on behalf of the Coach relating to the Coach’s clients or other persons to whom the Coach provides services.
1.2. Sportstep undertakes to process such personal data only in accordance with this DPA, the Principal Agreement, the Coach’s documented instructions, and applicable data protection law.
2. Subject matter and scope of the DPA
2.1. This DPA governs only those processing operations that Sportstep carries out on behalf of the Coach as data processor.
2.2. This DPA does not apply to processing operations that Sportstep carries out as an independent data controller for its own business purposes, including but not limited to:
2.2.1. administration of its own account and relationship with the coach;
2.2.2. administration of its own payments, subscriptions, and accounting;
2.2.3. legal, security, fraud prevention, dispute resolution, and other lawful or legally required purposes of Sportstep.
2.3. The purpose and duration of this DPA are directly linked to the Principal Agreement and continue for as long as Sportstep processes personal data on behalf of the Coach.
3. Nature, purpose, and duration of processing
3.1. Sportstep processes personal data on behalf of the Coach to the extent necessary for the Coach to use the Platform to provide services to clients.
3.2. Processing purposes include:
3.2.1. administration of client accounts, contacts, and bookings;
3.2.2. organisation of orders and delivery of coach services;
3.2.3. administration of free consultations (including Guest data);
3.2.4. maintaining communication between coach and client, including direct messages;
3.2.5. technical support for client invitations and linking with the coach;
3.2.6. technical support for coach plans, progress, workout feedback, community, and other coach-selected features;
3.2.7. storage, structuring, display, transmission, and other technical actions necessary to ensure Platform functionality;
3.2.8. assistance to the Coach in handling requests related to clients’ use of the Sportstep environment.
3.3. Personal data is processed by automated and, where applicable, non-automated means.
3.4. Processing is carried out for the duration of the Principal Agreement and for as long as necessary after its termination to fulfil data return, deletion, retention, or other lawful obligations.
4. Data subjects and categories of personal data
4.1. Data subjects under this DPA may include:
4.1.1. the Coach’s existing or potential clients;
4.1.2. community members;
4.1.3. persons who register for the coach’s services or otherwise interact with the coach through the Platform, including persons linked to the coach via invitation or after consultation conversion;
4.1.4. other persons whose data the Coach lawfully uploads or processes through the Platform in providing services.
4.2. Categories of personal data processed may include:
4.2.1. identity data, for example first name and last name;
4.2.2. contact data, for example email address, phone number, and other contact information provided in the account;
4.2.3. booking, order, consultation, and coach service usage data;
4.2.4. client profile data entered by the coach during invitations and linking information;
4.2.5. direct message content and related metadata;
4.2.6. data from coach-created plans, progress, workout feedback, notes, or communications;
4.2.7. files, documents, photos, descriptions, or other content submitted by the Coach or their clients through the Platform;
4.2.8. other data the Coach decides to process using the Platform in accordance with law.
4.3. If the Coach processes special categories of personal data through the Platform, including data concerning health, physical condition, body parameters, progress, or other sensitive data under Article 9 GDPR, the Coach is solely responsible for having an appropriate legal basis and fulfilling all legal obligations towards data subjects.
5. Processor processing rules
5.1. Sportstep processes personal data only in accordance with documented instructions from the Coach, except where Sportstep is required by law of the European Union or the Republic of Lithuania to act otherwise.
5.2. Coach instructions include:
5.2.1. agreements set out in the Principal Agreement;
5.2.2. provisions of this DPA;
5.2.3. the Coach’s actions when using Platform features;
5.2.4. other documented instructions from the Coach communicated to Sportstep through reasonable and customary communication channels.
5.3. If Sportstep believes that a Coach instruction violates the GDPR or other applicable data protection law, Sportstep may inform the Coach and suspend execution of that instruction until it is clarified, corrected, or withdrawn.
6. Obligations of Sportstep as data processor
6.1. Sportstep undertakes to process personal data only to the extent necessary to fulfil the purposes set out in this DPA and the Principal Agreement.
6.2. Sportstep ensures that persons authorised to process personal data are bound by confidentiality obligations under contract, internal rules, or law.
6.3. Sportstep implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing, including where applicable:
6.3.1. access control;
6.3.2. system and data protection;
6.3.3. backups;
6.3.4. incident management processes;
6.3.5. measures for data integrity, availability, and resilience.
6.4. Taking into account the nature of processing, Sportstep assists the Coach, where possible, in fulfilling data subjects’ rights under the GDPR, including requests for access, rectification, erasure, restriction of processing, data portability, or objection.
6.5. If a data subject submits a request directly to Sportstep, Sportstep may refer the request to the Coach or inform the data subject to contact the Coach, except where it is clear that Sportstep must provide direct technical assistance in the specific circumstances.
6.6. Taking into account the nature of processing and information available to it, Sportstep assists the Coach in fulfilling obligations relating to:
6.6.1. processing security;
6.6.2. management of personal data breaches;
6.6.3. data protection impact assessments;
6.6.4. consultation with supervisory authorities where necessary.
6.7. If Sportstep becomes aware of a personal data breach relating to data processed on behalf of the Coach, Sportstep shall inform the Coach without undue delay and provide such information as may reasonably be necessary for the Coach to assess the breach and fulfil legal obligations.
7. Sub-processors
7.1. The Coach grants Sportstep general prior authorisation to engage sub-processors where necessary for Platform operation, security, infrastructure, communication, data storage, technical payment processing, or other related technical functions.
7.2. Sportstep undertakes to ensure that each sub-processor is bound by data protection obligations no less stringent than those set out in this DPA, to the extent applicable to its functions.
7.3. Sportstep remains liable to the Coach for sub-processors’ actions to the extent required by the GDPR.
7.4. The Coach understands and agrees that sub-processors engaged by Sportstep may change in response to technological, security, business continuity, or business needs, provided such changes do not contravene applicable law.
8. Data transfers outside the European Economic Area
8.1. If personal data is transferred outside the European Economic Area in performing this DPA, Sportstep ensures that such transfer is based on a lawful transfer mechanism and appropriate safeguards under the GDPR.
8.2. Such safeguards may include:
8.2.1. an adequacy decision of the European Commission;
8.2.2. standard contractual clauses;
8.2.3. other safeguards permitted under the GDPR.
9. Records of processing activities and information
9.1. To the extent required by law, Sportstep maintains records of its activities as data processor.
9.2. Upon reasonable request by the Coach, Sportstep provides information necessary to demonstrate compliance with this DPA and Article 28 GDPR, to the extent such information is in Sportstep’s possession and its disclosure does not breach other clients’ confidentiality, security, or legal obligations.
10. Audits and compliance checks
10.1. The Coach has the right to verify Sportstep’s compliance with this DPA no more than once per calendar year, except where:
10.1.1. applicable law clearly requires it; or
10.1.2. there is reasonable evidence of a significant personal data breach or material breach of this DPA.
10.2. The Coach must give written notice of an audit at least 30 calendar days in advance.
10.3. An audit must be conducted so that:
10.3.1. Sportstep’s operations are disrupted as little as possible;
10.3.2. other clients’ confidentiality and data security are not breached;
10.3.3. it is proportionate to the purpose sought.
10.4. Sportstep may propose that the audit be conducted first on a documentary, remote, or questionnaire basis if such method is reasonably sufficient.
10.5. If an on-site physical audit is necessary, it is conducted during business hours in compliance with reasonable Sportstep security and confidentiality requirements.
10.6. The Coach bears the costs of the audit, auditors, representatives, and other related expenses, except where a material breach of this DPA by Sportstep is established during the audit.
11. Return and deletion of data
11.1. Upon termination of the Principal Agreement or when Sportstep ceases processing personal data on behalf of the Coach, Sportstep, at the Coach’s choice and to the extent technically feasible and reasonable:
11.1.1. deletes personal data; or
11.1.2. returns personal data to the Coach.
11.2. This obligation does not apply to the extent Sportstep must retain data under law of the European Union or the Republic of Lithuania, or where retention is necessary to establish, exercise, or defend legal claims.
11.3. Where data is retained after the relationship ends, Sportstep ensures it is not further processed for other purposes except as permitted or required by law.
12. Obligations of the Coach as data controller
12.1. The Coach confirms and warrants that for all data processed using the Platform, it has an appropriate legal basis and complies with all applicable legal requirements.
12.2. The Coach is responsible for:
12.2.1. informing data subjects about processing of their data;
12.2.2. having a lawful basis;
12.2.3. lawful processing of special categories of data;
12.2.4. accuracy, currency, and lawful collection of data;
12.2.5. lawfulness of instructions given;
12.2.6. ensuring only data the Coach is entitled to process is processed through the Platform.
12.3. The Coach is also responsible for the content, scope, methods, creation of individual plans, recommendations, communication, and other decisions related to their professional activity towards clients.
13. Liability
13.1. Each Party is liable for breach of its obligations under the GDPR, other applicable law, the Principal Agreement, and this DPA.
13.2. The Coach is liable for:
13.2.1. its obligations as data controller;
13.2.2. informing data subjects;
13.2.3. having a legal basis;
13.2.4. lawful processing of special categories of data;
13.2.5. lawfulness, accuracy, and professional content of services provided to clients.
13.3. Sportstep is not liable for the Coach’s chosen purposes of processing, lawful basis, content decisions, or professional recommendations, except to the extent damage arises from Sportstep’s unlawful acts or omissions in performing its obligations as data processor.
13.4. Nothing in this DPA limits liability where such limitation is not permitted under applicable law.
14. Term, termination, and suspension
14.1. This DPA takes effect from the effective date of the Principal Agreement or from the moment Sportstep begins processing personal data on behalf of the Coach, whichever occurs first.
14.2. This DPA remains in force for as long as Sportstep processes personal data on behalf of the Coach.
14.3. Upon termination of the Principal Agreement, this DPA continues to apply to the extent necessary to complete data deletion, return, retention, confidentiality, or other continuing obligations set out herein.
14.4. Sportstep may immediately suspend execution of an unlawful instruction or terminate the relevant processing if the Coach requires actions that, in Sportstep’s reasonable assessment, violate the GDPR or other applicable data protection law.
15. Final provisions
15.1. If any provision of this DPA becomes invalid or unenforceable, this shall not affect the validity of the remaining provisions.
15.2. If changes in law, supervisory practice, or technology make it necessary to amend this DPA, the Parties undertake to cooperate and, if needed, update it accordingly.
15.3. This DPA is governed by the law of the Republic of Lithuania.
15.4. All disputes arising from or relating to this DPA shall be resolved in the courts of the Republic of Lithuania unless mandatory law provides otherwise.