Data Processing Agreement

Last Updated: June 18, 2026

1. Scope and Roles

This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the Terms of Service between Mygymdesk Technologies Private Limited ("MyGymDesk", "Processor") and the customer ("You", "Tenant", "Controller"). It governs MyGymDesk's processing of personal data on your behalf when you use the Service.

Roles. With respect to gym member personal data that you upload to or generate through the Service, you act as the Controller (Data Fiduciary under the DPDP Act) and MyGymDesk acts as the Processor (Data Processor). With respect to your own account and billing data, MyGymDesk acts as Controller/Data Fiduciary, as described in the Privacy Policy.
Precedence. Where this DPA conflicts with the Terms of Service in respect of the processing of personal data, this DPA prevails.
Applicable law. This DPA is intended to satisfy the requirements of Article 28 of the EU/UK GDPR (where applicable to you or your members) and the relevant provisions of the Digital Personal Data Protection Act, 2023.

2. Definitions

Terms such as "personal data", "processing", "data subject", "controller", "processor", "personal data breach", and "supervisory authority" have the meanings given in the GDPR; "Data Fiduciary", "Data Processor", and "Data Principal" have the meanings given in the DPDP Act. "Sub-processor" means any third party engaged by MyGymDesk to process personal data on your behalf.

3. Subject Matter, Duration, Nature and Purpose

Subject matter: Processing of personal data necessary to provide the Service (gym management SaaS).
Duration: For the term of your subscription and any post-termination retention period set out in the Terms and Privacy Policy.
Nature and purpose: Hosting, storage, organisation, retrieval, transmission, and deletion of personal data to operate gym management, billing, attendance, communications, and related features, strictly on your documented instructions.
Categories of data subjects: Your gym members, prospective members/leads, and your staff.
Categories of personal data: Names, contact details (phone, email), addresses, membership and subscription records, attendance/check-in records, payment records, body-measurement and fitness/progress data, and — where you use biometric attendance devices — biometric identifiers.

4. Processor Obligations

MyGymDesk shall:

(a) Documented instructions. Process personal data only on your documented instructions (including those given through the Service), unless required to do otherwise by applicable law, in which case MyGymDesk will inform you (unless legally prohibited).
(b) Confidentiality. Ensure that personnel authorised to process personal data are bound by confidentiality obligations.
(c) Security. Implement appropriate technical and organisational measures as described in Annex B.
(d) Sub-processing. Engage sub-processors only in accordance with Section 6.
(e) Data-subject requests. Assist you, by appropriate technical and organisational measures and insofar as possible, in responding to data-subject/Data-Principal requests (access, correction, erasure, portability, restriction, objection).
(f) Assistance. Assist you in ensuring compliance with security, breach-notification, data-protection-impact-assessment, and prior-consultation obligations, taking into account the nature of processing and information available to MyGymDesk.
(g) Deletion or return. At your choice, delete or return all personal data after the end of the provision of the Service, and delete existing copies, except where storage is required by applicable law (e.g. tax/accounting retention).
(h) Demonstrating compliance. Make available information reasonably necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, as set out in Section 8.

5. Controller Obligations

You shall:

Establish and maintain a lawful basis (including valid consent where required) for the personal data you process through the Service, including obtaining verifiable parental/guardian consent for members who are minors.
Provide all required notices to your members and respond to their data-subject requests as the responsible Controller.
Issue only lawful processing instructions and warrant that your instructions will not cause MyGymDesk to breach applicable law.

6. Sub-processors

You provide general authorisation for MyGymDesk to engage sub-processors to provide the Service. The current sub-processors, with the specific purpose of each, are listed in Annex A.
Tenant-connected integrations. Third-party tools and integrations that you connect to the Service (including your own WhatsApp BSP) are governed by Annex A-1 and are not MyGymDesk sub-processors.
MyGymDesk will impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and remains liable for its sub-processors' performance.
Change notice. MyGymDesk will give you prior notice of the addition or replacement of any sub-processor and a reasonable opportunity to object on reasonable data-protection grounds.

7. International Transfers

Personal data is primarily hosted in India (Supabase, Mumbai). Certain sub-processors may process personal data outside the country of origin.
Where personal data subject to the EU/UK GDPR is transferred to a country without an adequacy decision (including India), such transfer is governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission (and the UK International Data Transfer Addendum), which are incorporated into this DPA by reference and set out / linked in Annex C, together with any supplementary measures required following a transfer risk assessment.
For personal data subject to the DPDP Act, transfers are made in accordance with the Act and any restrictions notified by the Government of India.

8. Audit Rights

MyGymDesk will make available, on written request, information (including relevant third-party certifications, summaries of penetration tests, or security questionnaires) reasonably necessary to demonstrate compliance with this DPA.
Where that information is insufficient, you may conduct an audit no more than once per year (and following a personal data breach), on reasonable prior written notice, during business hours, subject to confidentiality, and without unreasonably disrupting MyGymDesk's operations.

9. Personal Data Breach

MyGymDesk will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting your personal data, and will provide information reasonably required for you to meet your own breach-notification obligations (nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed). MyGymDesk will report to the Data Protection Board of India where required under the DPDP Act and will support you in any notification to a relevant supervisory authority or affected data subjects.

10. Liability and Term

The liability of each party under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.
This DPA takes effect on your acceptance of the Terms of Service and continues until MyGymDesk has ceased all processing of personal data on your behalf and completed deletion or return under Section 4(g).

11. Contact

Data protection contact / Grievance Officer: Biswanath Sarkar — biswa@mygymdesk.com — Mygymdesk Technologies Private Limited, Flat J705, Aparna Sarovar Zicon, Nallagandla, Serilingampally, Hyderabad - 500019, Telangana, India.

Annex A — Sub-processors

Each sub-processor below processes personal data only for the specific purpose stated. The categories of personal data shared are limited to those necessary for that purpose.

| Sub-processor | Specific purpose | Personal data processed | Location | |---|---|---|---| | Supabase Inc. | Core platform: database hosting, authentication, and file/object storage for all Service data | All platform personal data (encrypted at rest and in transit) | India (Mumbai); USA | | Razorpay Software Pvt. Ltd. | Subscription and member payment processing for Indian customers | Billing/contact details, payment amounts, tokenised card mandate | India | | Stripe, Inc. | Subscription and member payment processing for international customers | Billing/contact details, payment amounts, tokenised card mandate | USA; EU | | PayPal (Europe) S.à r.l. et Cie / PayPal, Inc. | Subscription and member payment processing for international customers | Billing/contact details, payment amounts | EU; USA | | Meta Platforms, Inc. (WhatsApp Business Platform / Cloud API) | Sending and receiving WhatsApp messages via the official Meta WhatsApp Business API — transactional notifications, reminders, and approved-template marketing messages | Member/recipient phone numbers, message content, delivery metadata | USA; EU | | WhatsApp Web connection (Baileys-based), self-hosted by MyGymDesk | Optional, tenant-enabled WhatsApp messaging over an unofficial WhatsApp Web connection where a tenant chooses this channel instead of the official API; used at the tenant's election and risk per the WhatsApp Web waiver | Member/recipient phone numbers, message content | Self-hosted (MyGymDesk VPS) | | Resend Inc. | Email delivery — both transactional email (receipts, account/security, onboarding) and, depending on the sending flow, gym-owner marketing/product email | Email addresses, email content | USA | | Brevo (Sendinblue SAS) | Email delivery — both bulk marketing campaigns and, depending on the sending flow, transactional email; gym-owner contacts (not member data for marketing) | Email addresses, email content | EU | | Sentry (Functional Software Inc.) | Error tracking and performance monitoring for Service reliability | Error logs, device info, IP addresses (anonymised where feasible) | USA | | OpenAI, L.L.C. | AI features: business insights, support assistant, WhatsApp assistant, and AI-generated workout/diet plans | Prompt content for the feature used — gym activity and metrics; where the feature requires it, a named member's contact and fitness details (goals, attendance, measurements) | USA |

Note on email: MyGymDesk uses both Resend and Brevo for email delivery, and the routing between them may depend on the type of message and sending flow rather than a fixed transactional-vs-marketing split. Marketing email is sent only to gym-owner/staff contacts and not to gym members on a Controller's behalf except on the Controller's instruction and lawful basis.

Note on WhatsApp: The official channel is the Meta WhatsApp Business API (Cloud API). Where a tenant elects the unofficial WhatsApp Web (Baileys) channel, it operates under the separate WhatsApp Web risk acknowledgement and is provided at the tenant's election and risk.

Annex A-1 — Tenant-Connected Third-Party Integrations

The Service allows you (the Controller) to connect your own third-party tools and integrations (including your own WhatsApp Business Solution Provider/BSP, or other external services). Where you connect such an integration:

That third party acts as your processor (or independent controller), not a sub-processor of MyGymDesk, and is not covered by Annex A.
You are responsible for your own data-processing terms, lawful basis, and transfer mechanisms with that third party.
MyGymDesk's responsibility is limited to transmitting data to the integration endpoint you have configured, on your instruction; MyGymDesk is not responsible for that third party's processing.

Annex B — Technical and Organisational Security Measures

Encryption of personal data in transit (TLS 1.2+) and at rest.
Tenant isolation via database Row-Level Security (RLS); no cross-tenant data access.
Role-based access controls and authenticated access (Supabase Auth).
Encrypted storage of sensitive credentials (e.g. payment-gateway keys); no storage of full card numbers (tokenised by payment partners).
Logging, monitoring, and periodic security reviews of application and infrastructure.
Access on a least-privilege, need-to-know basis; confidentiality obligations on personnel.
Backup and restoration procedures; defined retention and deletion windows.

Annex C — Standard Contractual Clauses

For transfers of EU/EEA personal data, the European Commission's Standard Contractual Clauses (Module Two: Controller-to-Processor), and for UK transfers the UK International Data Transfer Addendum, are incorporated by reference. The applicable clauses are available at: EU Standard Contractual Clauses.

Module: Controller (you) to Processor (MyGymDesk).
Annexes to the SCCs (parties, description of transfer, competent supervisory authority, technical/organisational measures) are populated by reference to Section 3 and Annexes A–B of this DPA.