1. Parties and conclusion
This agreement is entered into between:
Customer: the professional person or entity identified in the order, professional registration or subscription agreement and in Annex I, represented by the person with sufficient authority accepting it.
Provider: Trainingforever OÜ, an Estonian company entered in the business register under code 16941437, VAT number EE102717330, registered office at Narva mnt 5, Kesklinna linnaosa, Tallinn, Harju maakond, 10117, Estonia, and privacy and security contact [email protected], hereinafter “TrainingForever”.
The Customer and TrainingForever are bound in writing, including through verifiable electronic acceptance. The order, the accepting person's identity and authority, and the complete version of this agreement and its annexes must be associated in a manner allowing them to be consulted and retained.
An athlete's ordinary acceptance of terms does not constitute conclusion of this DPA on behalf of their coach or club. Nor does the agreement replace information to or consent from athletes.
2. Subject matter, roles and precedence
This agreement governs personal data processing carried out by TrainingForever on behalf of the Customer to provide the contracted TrainingForever features, under Article 28 of Regulation (EU) 2016/679, the “GDPR”.
The Customer normally acts as controller and TrainingForever as processor. If the Customer acts as processor for another entity, TrainingForever will be a subprocessor for that processing. The Customer will identify the original controller and demonstrate the necessary authorisation and instructions. Obligations will be interpreted to preserve the chain of protection under Article 28, without attributing powers to the Customer that it does not hold.
Account data, TrainingForever's own invoicing, security and other operations that TrainingForever lawfully determines for its own purposes are governed by its Privacy Policy. Athletes' data do not become data for its own purposes merely because they are processed on TrainingForever infrastructure or through AI.
If the parties jointly determine purposes and essential means, they must separately regulate joint controllership under Article 26. This agreement does not replace that arrangement or remove the classification arising from the facts.
For the processing covered, this DPA takes precedence over incompatible provisions in the Terms of Service or order. Mandatory rules and valid applicable safeguards for international transfers take precedence over both.
3. Scope and duration of the entrusted processing
Annex I specifies the subject matter, duration, nature, purpose, categories of people and data, operations, instructions and contacts. Annex II contains the required security measures and Annex III the authorised subprocessors and transfers.
Processing begins when a valid agreement exists and information is enabled or received on the Customer's behalf. It lasts as long as necessary for the contracted service and, after its end, solely to return, erase or retain data under an applicable legal obligation. Confidentiality and protection obligations continue for as long as data are retained.
Processing of additional categories or different purposes is not authorised merely because they can technically be entered in a free-text field or file.
The data source provider's limits on purpose, disclosure and retention also apply to the entrusted processing. A general period in this DPA does not permit exceeding a stricter restriction imposed by the source.
4. Documented instructions
TrainingForever will process data exclusively on the Customer's documented instructions, including those concerning recipients, subcontracting and transfers, unless Union or Member State law requires other processing. In that case, it will inform the Customer of that requirement in advance unless the law prohibits this on important grounds of public interest.
Documented instructions comprise this agreement, the order and its annexes, valid configuration of features and permissions, operations performed by authorised persons and requests verified through contractual channels. The instruction must be within the service's scope and the powers of the person giving it.
An output generated by a model is not, by itself, considered an autonomous and valid Customer instruction. Assistant or MCP actions require the user's authorisation context and corresponding controls. They do not extend approved purposes or recipients.
If TrainingForever considers an instruction to infringe the GDPR or other applicable data protection law, it will immediately inform the Customer and may suspend the affected operation while the matter is clarified. It will not suspend unrelated processing without a proportionate need.
If technical fulfilment of an instruction requires extending the service, the parties will agree its scope and cost where appropriate. This does not allow essential legal obligations to be made conditional on or evaded through disproportionate charges.
5. Customer obligations
The Customer is responsible for:
The Customer does not guarantee the absolute absence of incidents or assume responsibility for TrainingForever's own breaches. A Customer declaration does not exempt TrainingForever from reporting unlawful instructions, applying security or fulfilling its legal obligations.
6. TrainingForever's general obligations
TrainingForever undertakes to:
If TrainingForever determines its own purposes and means contrary to this agreement, it will assume the role and responsibilities legally applicable to that processing. No provision permits it unilaterally to change the purpose of the entrusted processing.
7. Confidentiality and personnel access
The confidentiality obligation continues even after the employment, professional or contractual relationship ends. TrainingForever must restrict access to personnel who need it to operate or support the service, with individual assignment, permission controls and review.
Support access to health data requires a documented need and minimum scope. Routine staff access to histories for generic quality, development or training reasons is not authorised. Privileged access must have enhanced measures and traceability.
Disclosure required by an authority will be limited to the data and scope legally required, with information to the Customer where not prohibited and assessment of legally appropriate challenges or safeguards.
8. AI, inferences and tools
AI will be used on entrusted data only where the feature has been contracted, the Customer has issued a valid instruction and the applicable authorisation exists for the data subjects' data. Consent from a Customer representative does not replace those individuals' consent.
The AI provider, any routing intermediary and the final providers that may receive data must appear in Annex III before activation. Authorisation of an intermediary does not mean authorisation of any model, destination or country it may select.
Inputs will be limited to necessary data. Messages, history, context and tool outputs must be subject to the same control: excluding names from the initial message is insufficient if a tool subsequently returns identifiable or health data. Inferences, summaries and outputs retain the corresponding protection.
Provider retention, abuse logs, caching and subcontracting must be documented and compatible with this agreement. The absence of training does not mean zero retention or exclusively European storage.
Tool calls will not receive greater powers than the authorised account. Necessary limits, validations and confirmations will apply, particularly for bulk changes, destruction, external communications and sensitive data. Imported third-party text cannot become authorisation to execute actions or disclose data.
AI used for the entrusted processing will not be used for Article 22 decisions with legal or similarly significant effects without specific agreement and information and a prior lawfulness assessment. Human review must be effective where required.
9. External services and MCP selected by the Customer
A connection to ChatGPT, Claude or another external service may create a different flow from that of the integrated AI provider. The recipient, role, contractual plan, permissions, data, country and retention must be identified before entrusted data are enabled.
If that service acts as a subprocessor contracted by TrainingForever, it will be included in Annex III and all subcontracting obligations will apply. If the Customer contracts it directly, the Customer must formalise the necessary legal relationship and safeguards and document the disclosure instruction. TrainingForever retains its processor obligations when executing that instruction and will not disclose data under an unauthorised or manifestly unlawful instruction.
A personal account or default configuration of an external AI client is not presumed suitable for third parties' health data. Technical authorisation through MCP does not, by itself, authorise a new purpose, transfer or health data processing.
Data source restrictions must be respected. A connection cannot disclose to AI or other users information that a sports provider prohibits from being used that way, even if the Customer wishes to do so.
10. Subprocessors
The Customer authorises the subprocessors identified and fully specified in Annex III and grants general authorisation for changes, subject to the following procedure. An empty list, a list of candidates or one lacking relevant destinations does not constitute sufficient authorisation for production use.
TrainingForever will notify the addition or replacement of a subprocessor at least 30 calendar days in advance, by a means allowing the notice to be retained. The communication will identify the entity, service, data, countries and sufficient safeguards to assess the change.
The Customer may object on reasonable data protection grounds before activation, preferably within the first 15 days to facilitate resolution. TrainingForever will not begin the new access during the notice period. An outstanding reasonable objection will be addressed before the affected data are sent to it.
The parties will seek a proportionate alternative. If no compatible solution exists, the Customer may terminate the affected part without penalty, with a proportionate refund of prepaid amounts for service not provided and return or erasure of data. Failure to respond is not interpreted as consent to a new health purpose; this procedure concerns subcontracting within the authorised processing.
TrainingForever will enter into a contract with each subprocessor imposing, as relevant, the same protection, confidentiality, security, assistance, erasure and transfer obligations. It will verify sufficient guarantees and remain liable to the Customer for the subprocessor's fulfilment of its obligations under Article 28.4.
11. Locations and international transfers
Storage regions, remote access countries and subcontracting will be recorded in Annex III. Changing a European region does not allow the assessment of support or processing outside the EEA to be omitted.
No transfers or access from a third country will take place without the Customer's documented instructions and a valid basis under Chapter V GDPR. Applicable adequacy for the destination will be checked or appropriate safeguards formalised, with the necessary assessment and supplementary measures.
Where standard contractual clauses for transfers are used, the module corresponding to the parties and their actual roles will be selected, their annexes completed and the relevant documentation provided. If an adequacy framework for a certified entity is relied on, its current validity and specific coverage will be checked.
This DPA does not, by itself, constitute standard contractual clauses for international transfers. Nor does it constitute athletes' consent to Article 49 derogations. Routine transfers will not be based generically on consent at registration.
If a safeguard ceases to be valid, TrainingForever will inform the Customer without delay and suspend the affected flow where no lawful alternative exists, cooperating on necessary measures and data recovery.
12. Rights requests
TrainingForever will provide appropriate assistance for the Customer to address access, rectification, erasure, restriction, objection, portability and rights concerning automated decisions.
Where it directly receives a request about entrusted data, it will forward it to the Customer's contact without undue delay and, contractually, within a maximum of three working days. It will not respond on the Customer's behalf without instructions unless legally required or the request concerns separate processing for its own purposes.
It will provide the necessary data, searches and operations sufficiently in advance to meet statutory deadlines, considering any communicated urgency. Technical complexity does not authorise allowing a deadline to expire without notice. Identity checks will be coordinated proportionately.
Where appropriate, it will help communicate rectifications, erasures or restrictions to recipients and subprocessors and identify data that cannot be erased because of a specific legal obligation.
13. Personal data breaches, impact assessment and consultation
TrainingForever will notify the Customer of a personal data breach affecting entrusted data without undue delay and, in any event, within 24 hours of becoming aware of it. Initial notification will not be delayed until an investigation is completed. A well-founded suspicion requiring urgent action will be communicated without waiting for exhaustive certainty.
The following will be provided progressively, as available:
TrainingForever will preserve evidence securely, cooperate in the investigation, document actions and coordinate communications. It will not notify people or authorities on behalf of the Customer without instructions, unless subject to its own legal obligation. The Customer retains its deadlines: the processor's contractual 24-hour period does not extend the controller's statutory deadline.
Considering the nature of the processing and the information available, TrainingForever will assist the Customer in complying with Articles 32 to 36, including impact assessments, assessment of measures, provider information and prior consultation where appropriate. Assistance will include information necessary to assess the service's AI, health data, minors, profiles and transfers.
14. Return, termination and erasure
At the end of the entrusted processing, TrainingForever will, at the Customer's choice, return or erase the data and delete existing copies, unless Union or Member State law imposes a retention obligation.
The initial choice in Annex I may be changed through a valid instruction. The default initial instruction agreed is return followed by erasure: the Customer will be provided with a secure export and a recovery period of 30 days from termination, with processing limited to that purpose. At the end of that period, data will be erased from active systems unless another lawful instruction has been given or a different statutory period is required. Preparation and delivery of the export will be completed within that period.
If the Customer chooses erasure without return, it will be carried out without undue delay and, in any event, within 30 days following the valid instruction. Rights request deadlines and stricter statutory deadlines take precedence. Where specific switching or recovery periods under the Data Act apply, the schedule will be adjusted accordingly before erasure.
Data erased from active systems will be erased or overwritten in backups within a maximum of 90 days from that erasure. During that cycle they will not be available for ordinary use, model training or commercial exploitation. A restoration must reapply erasures. If the provider requires a different cycle, this must be resolved before it is accepted as compatible with this agreement.
TrainingForever will require the same execution from its subprocessors, with any applicable shorter specific cycles, and will provide confirmation of return or erasure at the Customer's request. Disconnecting an API does not itself establish that erasure has been completed. For Garmin Connect data, the Customer instructs the automatic erasure provided for in section 9.1 of the Privacy Policy on disconnection or receipt of revocation, including derived outputs containing that data and propagation to subprocessors. This requires no further Customer request and is not postponed by the return or recovery period; any applicable shorter periods are respected.
A statutory retention obligation will be identified and communicated, unless legally prohibited, with categories, reason and duration. The data will be kept isolated and restricted to that obligation and erased when it expires. This does not permit retention of the entire history for commercial interest or a generic possibility of a claim.
Records that TrainingForever must retain as controller to evidence this contract or its own invoicing will be limited to that purpose and will not unnecessarily include entrusted health data.
15. Information, audits and inspections
TrainingForever will make available to the Customer the information necessary to demonstrate compliance and allow and contribute to audits, including inspections by the Customer or an authorised independent auditor.
For ordinary reviews, the parties may organise a documentary review first and agree reasonable notice, normally 15 days, scope, confidentiality and measures to protect other customers' data and security. These arrangements do not remove the right to an inspection where necessary or limit authorities' powers.
An incident, well-founded indication of non-compliance or authority request may require an additional or urgent review. No maximum annual frequency or notice period preventing fulfilment of the obligation will be imposed. Certifications or reports, if they exist, may serve as evidence, but no certification is presumed and they do not replace all audit rights.
Extraordinary assistance costs that do not constitute an ordinary obligation may be agreed in advance and reasonably. They will not be used to prevent verification or effective fulfilment of legal obligations. Each party will communicate relevant findings without delay and cooperate in their correction.
16. Liability and cooperation
Each party assumes the responsibilities applicable to its involvement and established breaches. The Customer does not automatically indemnify TrainingForever for any athlete claim, and TrainingForever is not exempt merely by stating that it followed instructions.
Affected persons' compensation rights, including liability and recourse under Article 82 GDPR, and authorities' enforcement powers are not reduced by this DPA or a commercial limit. Liability to authorities is determined according to law; this agreement does not guarantee that a penalty can be transferred to another party.
The parties will cooperate in good faith to contain harm, address requests and document their actions. A commercial dispute does not permit denial of protective measures or retention of data in breach of the rules.
17. Amendments, law and disputes
Material amendments must be documented, communicated before application and accepted where necessary. They cannot reduce Article 28 safeguards through a mere silent update to a page. Subprocessor changes follow section 10 and new purposes require their own agreement.
The GDPR, Union law and the national rules applicable to the processing apply. The contractual relationship between the parties is subject to the law and jurisdiction in the Terms of Service, without prejudice to mandatory rules, competent authorities and data subjects' rights.
Annex I. Description of processing and instructions
A. Identification and contacts
| Field | Information to be linked to acceptance |
|---|---|
| Customer and role | Pending: razon social o nombre nif pais y papel |
| Customer address | Pending: domicilio cliente |
| Representative | Pending: nombre cargo y facultad |
| Original controller if the Customer is a processor | Pending: identidad contacto y autorizacion o no aplica |
| Customer operational privacy contact | Pending: nombre o funcion y correo |
| Customer incident contact | Pending: correo y medio urgente valido |
| Customer DPO, if any | Pending: contacto o no aplica |
| TrainingForever contact | [email protected], subjects “Privacy”, “DPA” or “Security incident” |
| Order, organisation and contracted features | Pending: identificador pedido organizacion y alcance |
| Accepted date and version | Pending: fecha hora version dpa y registro subencargados |
B. Subject matter, purpose and operations
Subject matter: provision of the training management platform to persons authorised by the Customer.
Purpose: to host and organise athletes' data, plan and record training, facilitate communication and sports analysis, and execute specifically instructed integrations or optional features.
Nature and operations: collection or receipt, recording, storage, organisation, consultation, calculation, updating, generation of metrics, disclosure to authorised persons, import, export, restriction, return and erasure. AI and any profiling are included only with the specific authorisation below.
Duration and frequency: during the contractual relationship and limited exit periods; ongoing processing with queries, changes and synchronisations according to use and permissions. Indefinite reuse after account closure is not included.
C. People and data
Data subjects: the Customer's athletes; coaches and authorised personnel; contacts and club members; legal representatives where appropriate. Minors are included only where the applicable procedure and legal authorisation exist.
Ordinary data: identifiers, contact details, account, role, membership, discipline, goals, calendar, training sessions, strength and endurance, activities, messages, relevant files, participation, minimum technical data and administrative data for the Customer's service.
Data that may reveal health information: heart rate, zones, physiological metrics, fitness, recovery, weight or other necessary measurements, fatigue, pain, injuries, limitations, observations and health profiles or inferences. Routes and location may reveal sensitive information.
Exclusions: inclusion of complete medical records, genetic data, biometric data for identification, criminal offence data, beliefs or other special categories unrelated to the service is not authorised. A case requiring them needs prior assessment and agreement, rather than their entry in free text.
Enhanced safeguards: Article 9 basis documented by the controller; separation by organisation and role; no publication by default; minimisation of health data in messages and logs; authorised providers and countries; controlled privileged access; training and incident procedures.
D. Selection of features and recipients
| Item | Instruction and condition to be recorded |
|---|---|
| Ordinary planning and monitoring | Contracted features, necessary data and authorised persons |
| AI on entrusted data | Pending: activada o desactivada proveedor finalidades datos y habilitacion. Disabled for that processing if authorisation has not been established |
| Sports integrations | Pending: servicio direccion datos permisos restricciones y destinatarios |
| MCP or external clients | Pending: destinatario papel plan contrato alcance y garantias o desactivado |
| Automations | Pending: funcion objetivo disparador frecuencia limites y revocacion o no aplica |
| Clubs, challenges and visibility | Pending: datos publico autorizado y base para publicacion o privado |
| Minors | Pending: no incluidos o procedimiento edades paises representacion y habilitacion |
| Retention specified by the Customer during the relationship | Pending: plazos por categoria y revision. No unlimited retention by default For Garmin, the instruction to erase on disconnection in section 9.1 of the Privacy Policy applies, without extension through general retention instructions. |
| Termination | Return and erasure according to section 14, unless a choice of erasure without return is recorded |
Annex II. Technical and organisational measures
These measures are contractual minimum requirements that must be implemented and verified before the affected processing. Their operational detail may evolve without reducing the level of protection. Evidence will be provided within the framework of section 15.
| Area | Required measures |
|---|---|
| Governance and risk | Defined internal responsibilities, inventory of systems and processing, risk assessment and review of changes affecting health data, AI, minors or transfers |
| Separation of organisations | Server-side authorisation for each access, membership validation and isolation between customers; verification of queries, files, exports, tasks and tools, without relying solely on the interface |
| Privileges | Least privilege, individual accounts, periodic review, revocation when roles end and multi-factor authentication for administration and privileged access |
| Authentication and sessions | Passwords protected using appropriate derivation or hashing functions, secure recovery mechanisms, session protection and response to abuse; no plaintext password storage |
| Encryption | Encrypted communications using current protocols and cryptographic protection of storage and backups according to risk; restricted key management |
| Tokens and secrets | Protected storage, limited permissions, rotation and revocation; exclusion from prompts, general logs, public code and customer responses |
| Health and location | Minimisation, separate permissions, private profiles and routes by default, restricted exports and support access |
| AI and MCP | Authorised providers and limited destinations; server-side validation of arguments and permissions; protection against instructions in untrusted content; proportionate confirmation controls and no elevation of privileges by the model |
| AI history and outputs | Separation between functional history and diagnostic logs, minimisation of identifiers and outputs, limited retention and erasure covering relevant messages, outputs and caches |
| Logs | Recording of relevant events and privileged access, integrity protection and restricted access; no unnecessary dumps of health data, prompts or tokens |
| Support | Justified and limited exceptional access, record of the intervention and staff confidentiality |
| Development and changes | Environment separation, change review, vulnerability management, updates and proportionate verification of authorisation controls |
| Testing | Synthetic or effectively anonymised data by default; exceptional use of real data only with documented necessity, authorisation and controls |
| Backups and restoration | Protected backups under a documented plan, periodic restoration tests, a maximum cycle compatible with section 14 and reapplication of erasures after restoration |
| Continuity | Recovery and failure management plan according to risk; documented recovery objectives consistent with the purchased offer, without presuming a non-existent SLA |
| Incidents | Reporting channel, assessment and containment procedure, preservation of evidence and notification to the Customer in accordance with section 13 |
| Providers and physical access | Assessment of safeguards, contracts, locations and subcontracting; provider controls over physical infrastructure and administrative access |
| People and training | Confidentiality, instructions on health data and minors, security training and AI literacy appropriate to their involvement |
| Rights and exit | Procedures to locate, export, correct, restrict and erase data, including propagation to subprocessors and control of copies |
| Verification | Periodic review and after relevant changes; documentation of findings and corrective actions, without claiming non-existent certifications |
Annex III. Register of subprocessors, locations and transfers
Register version: TF-REG-2026-10-29-v2 Date: 26 October 2026.
This annex incorporates the description of purpose, data, countries, safeguards and retention in section 2 of Annex A to the Privacy Policy, version TF-REG-2026-10-29-v2, which must be attached to and retained with the accepted copy of this DPA. It is also available as a separate register. The reference is to that specific version; a changing page does not replace the accepted register copy. Subsequent changes follow section 10 of this agreement.
| Identified entity and service | Function within the entrusted processing, where applicable | Declared main location and other flows to assess | Specific condition |
|---|---|---|---|
| Supabase Pte. Ltd. — Supabase | Database and associated services used for the Customer | Project in Ireland; assessment of affiliates, support and other services | DPA, plan, scope and data cycles |
| Vercel Inc. — Vercel | Hosting and backend/API processing entrusted data | Backend in the EU/EEA; other services and access to verify | Verify DPA coverage for the plan before assuming its existence |
| BunnyWay d.o.o. — Stream and Storage | Coach and athlete content entrusted by the Customer | Storage and replicas declared only in the EU/EEA; CDN and access pending | Account DPA, file privacy and erasure of copies/caches |
| Plus Five Five, Inc. — Resend | Messages instructed by the Customer within its service | United States according to standard terms | Do not include unnecessary health information; check plan, contract and retention |
| OpenAI Ireland Ltd. — standard EEA API | Inference instructed for Customer data | No special European residency declared; international flows to assess | Feature and health information authorised, contract and endpoint configuration |
| Anthropic Ireland, Limited — standard EEA API | Inference instructed for Customer data | No special European residency declared; international flows to assess | Feature and health information authorised, contract, models and retention |
| Molina Studio — Stridee API | Sports synchronisation instructed by the Customer | Switzerland and EEA according to published infrastructure | Validate subprocessing chain and compatibility of periods |
| Stripe entity applicable to the service and contract | Only operations actually performed on the Customer's behalf, for example a feature for managing its payment collection if purchased | According to the service and Stripe's chain | Separate TrainingForever's own billing data and Stripe's independent processing; verify scope before including them in the entrusted processing |
This table does not include TrainingForever's own marketing processing as Customer subprocessing or make Google, Meta, Microsoft or independent sports services processors merely because they are connected. Any use of entrusted data for a different purpose requires its own analysis and authorisation.
MCP clients contracted directly by the Customer are governed by section 9 and the verified instructions in Annex I. Use of HealthKit does not allow Apple to be automatically assigned a subprocessor role. Sports source entities are described separately in section 4 of the register.
Compatibility verification pending: check this DPA's commitments on return, erasure, backups, assistance, incidents and subprocessor changes against the contracts actually accepted. Standard periods for Stridee, Resend and the AI APIs must not be presented as confirmation of the periods proposed in the body of the package. A discrepancy requires adjusting the service or agreeing lawful wording before formalisation; removing the warning does not resolve it.
Annex IV. Acceptance record
| Item | Evidence linked to the contract |
|---|---|
| Customer and organisation | Pending: identificador y razon social |
| Representative and declared or verified authority | Pending: identidad y cargo |
| DPA, order and annexes provided | Pending: versiones y copias integras |
| Subprocessor register | Pending: version y copia |
| Means and date of acceptance | Pending: fecha hora zona y accion afirmativa |
| Initial optional instructions | Pending: selecciones ia mcp menores conexiones y salida |
| Copy delivered to the Customer | Pending: medio fecha y referencia |
Additional technical evidence must be proportionate and retained only as long as necessary. The acceptance record must not contain health histories or metrics.