Data Processing Agreement

This agreement takes effect when the business owner accepts it together with the Terms of Service at sign-up or in the panel; no separate signature is needed. If you would like a signed copy, write to support@workoutos.app. If this agreement and the Terms of Service conflict on personal data, this agreement prevails.

Data subjects: members, clients, prospects and guests, the Customer's staff and trainers, members' parents or guardians where applicable, and emergency contacts.

Types of data (depending on the features the Customer uses):

• Identity and contact: name, date of birth, gender, phone, e-mail, address, profile photo
• Membership and contract: pack, session credits, start and end dates, freezes, signed forms and consents
• Finance: payment, instalment and debt records. Card numbers are not stored in the Service; with the optional online payment add-on they are processed in the Customer's own payment-provider account.
• Attendance: check-ins, class and booking attendance, waitlists
• Training and progress: programmes, exercise logs, goals, measurements
• Message content: reminder and notification texts, WhatsApp conversations (if the Customer connected its own number)
• Technical: app push token, device type, session and audit logs

Body measurements, weight, body fat, injuries and health notes, health questionnaires, pregnancy or medical certificate information may be special category (health) data under Article 9 GDPR and Article 6 KVKK.

• The Customer decides whether to enter such data and is responsible for the legal basis (as a rule, explicit consent) and for informing the data subject. The Service provides health questionnaire, explicit consent and guardian consent forms for this.
• The Customer enters only what is necessary, in the fields intended for it, and avoids writing details such as diagnoses into free-text notes.
• Laten Lukken applies the same security measures to this data as to all Customer Data. In addition, health fields and notes are masked before anything is sent to error tracking, and our team accesses this data only on the Customer's support request and only as far as needed.
• The adequate measures for special category data set by the Turkish Personal Data Protection Board (decision 2018/10) are taken into account.

• Processes the data only on the Customer's documented instructions. The Terms of Service, this agreement and the Customer's settings and actions in the panel are those instructions. Where the law requires other processing, it informs the Customer beforehand unless the law prohibits this.
• Informs the Customer immediately if it believes an instruction infringes the GDPR, KVKK or other law.
• Ensures that employees and contractors with access are bound by confidentiality and limits access to what is needed.
• Implements the security measures below and keeps them up to date with the state of the art.
• Reasonably assists the Customer with data subject requests, personal data breaches, data protection impact assessments (DPIA) and prior consultation with supervisory authorities.
• Does not use the data for its own purposes, sell it, use it for advertising or combine it with other customers' data. It may use only anonymous, aggregated statistics that identify no one to improve the Service.

• Inform its members, clients and staff, and obtain explicit consent where required
• Collect data lawfully and keep it accurate and up to date
• Give panel users the right permissions and remove access for staff who leave
• Have the necessary contracts with the providers of any third-party accounts it connects (payment provider, WhatsApp Business)
• Send electronic marketing only with the required consents and in line with applicable rules

Laten Lukken implements at least the following technical and organisational measures (Article 32 GDPR, Article 12 KVKK):

• Encryption in transit: all connections use TLS
• Encryption of secrets: payment-provider and WhatsApp keys are stored encrypted with AES-256-GCM and never returned in responses
• Tenant isolation: each business's data is separated from others with PostgreSQL row-level security
• Authentication: passwords are stored as irreversible hashes; sessions use HttpOnly, Secure cookies
• Authorisation: role-based access (owner, manager, staff, trainer)
• Audit logs: significant actions in the panel are logged with who did what and when
• Backups: automatic database backups; nightly backups are kept 14 days and weekly backups 8 weeks; backups are kept in the EU (Railway) and are not copied to any other storage
• Rate limiting and protection against automated attacks
• Regular updates of dependencies and servers; error and uptime monitoring
• Minimal data in error logs: user, IP, cookies and request bodies are not sent; e-mails, phone numbers, ID numbers and health fields are masked
• Team access: only when needed, with personal accounts; two-factor authentication for the admin console
• Incident response process and breach register

The Customer gives Laten Lukken general written authorisation to use the sub-processors listed below and on the Sub-processors page.

• Laten Lukken has a written contract with each sub-processor containing data protection obligations essentially equivalent to those in this agreement, and remains liable to the Customer for the sub-processor's acts.
• Laten Lukken informs the Customer by e-mail and in-panel notice at least 30 days before adding or replacing a sub-processor.
• The Customer may object within that period on reasonable data protection grounds. If the parties cannot resolve it, the Customer may cancel the subscription and receive a refund of any prepaid, unused period.
• Where urgent security or service-continuity reasons require it, the change may be made immediately; notice follows as soon as possible and the right to object applies in the same way.

Customer Data is hosted in the EU, in Railway's region in the Netherlands (Amsterdam). Laten Lukken is established in Türkiye. Data is transferred only to the listed sub-processors and with appropriate safeguards:

• For Customers in Türkiye: Transfers rely on appropriate safeguards under Article 9 KVKK, the standard contracts published by the Personal Data Protection Board: a standard contract is signed with each recipient abroad and notified to the Board within 5 business days of signature.
• For Customers in the EU/EEA: for transfers to Türkiye and other third countries, the European Commission's Standard Contractual Clauses 2021/914; Module 2 (controller to processor) between the Customer and us, and Module 3 (processor to processor) with sub-processors. The SCCs are incorporated into this agreement by reference; the optional Clause 7 (docking) and the optional wording in Clause 11 do not apply, Option 2 (general authorisation) with the notice period above applies under Clause 9(a), and Irish law (Clause 17) and the courts of Ireland (Clause 18) apply. Clause 13 and Annex I.C: the competent supervisory authority is the Customer's supervisory authority if the Customer is established in the EU; if the Customer is established outside the EU and has appointed a representative under Art. 27 GDPR, the authority of the Member State where the representative is; otherwise the Irish Data Protection Commission. Annex I.B (description of the transfer) and Annex II (technical and organisational measures) are the corresponding sections of this agreement; Annex III is the sub-processor list.
• Annex I.A (list of parties): the data exporter is the Customer, with the name and contact details in its panel account (role: controller); the data importer is Laten Lukken Yazılım Sanayi Ticaret Ltd. Şti. (role: processor; Our registered address is published in the Turkish Trade Registry Gazette; we send it straight away on request by e-mail. Contact: support@workoutos.app). The business owner's acceptance of this agreement in the panel constitutes signature of the SCCs; the date of acceptance is the date of signature.
• For Customers in the UK: the UK Information Commissioner's International Data Transfer Addendum (UK Addendum) to the SCCs above
• For US sub-processors, additionally, EU-US Data Privacy Framework certification where they have it

If this section and the SCCs conflict, the SCCs prevail.

If a member or client contacts Laten Lukken directly, we do not answer the request ourselves; we forward it to the Customer without delay and tell the person to contact the Customer.

The Customer can handle most requests in the panel: viewing and correcting a person's data, export and erasure or anonymisation. Where the panel is not enough, Laten Lukken helps within a reasonable time.

Laten Lukken notifies the Customer of a personal data breach affecting Customer Data without undue delay and within 48 hours at the latest after becoming aware of it. The notice includes, as far as known at the time:

• The nature and time of the breach and how it was discovered
• The categories and approximate number of data subjects and data types affected
• Its likely consequences
• Measures taken and proposed
• A contact point for more information

Information may be provided in phases. Notifying the supervisory authority and the Turkish Personal Data Protection Board (72 hours in both cases) and data subjects is the Customer's obligation as controller; Laten Lukken provides the information needed.

Laten Lukken makes available the information needed to demonstrate compliance with this agreement: a description of security measures, the sub-processor list, independent audit reports where available and answers to security questionnaires.

If that is not sufficient, the Customer may audit, or have an independent auditor audit, at most once a year, with at least 30 days' written notice, during business hours, under confidentiality and at its own cost. Audits do not extend to other customers' data or security. Requests from authorities and audits following a breach are not subject to this frequency limit.

• The Customer can export all its data free of charge from the panel at any time (CSV files and a full JSON export). This is how data is returned.
• After the account is closed the panel stays available read-only for 90 days; Customer Data is then deleted from live systems. Copies in backups are deleted as the backups expire, within 8 weeks at most; until then backups are used only for restoring the Service. Deletion takes place unless deletion must be paused for a legal obligation, an authority's request or your written request; if we pause it, we tell the Customer.
• Data that must be retained by law is excluded and kept only for that purpose and as long as required.
• On request, we confirm deletion in writing.

Liability under this agreement is subject to the limitations in the Terms of Service. Those limitations do not affect liability towards data subjects that cannot be limited by law (e.g. Article 82 GDPR).

Governing law and jurisdiction are as set out in the Terms of Service; for transfers covered by the SCCs, the governing law and jurisdiction clauses of the SCCs apply.