Data Processing Agreement

Last updated 03/31/2022

These Data Processing Terms form part of the Terms of Service between Martial Arts on Rails, LLC d/b/a Gymdesk and you and apply when we process Personal Data on your behalf in the course of providing the Services. These Data Processing Terms do not apply where we are the Controller. Defined and/or capitalized terms not defined here have the meanings given them in the Agreement. If not defined in the Agreement, capitalized terms have the meaning given them, or an equivalent term, in applicable data protection, privacy or security laws (“Privacy Laws”). These Data Processing Terms take precedence over any other terms of the Agreement in relation to the Processing of Personal Data.

1. Parties. “Gymdesk”, “we”, “us” or “our” means Martial Arts on Rails, LLC d/b/a Gymdesk or Affiliate(s) who execute or assent to the Order Form. “You” or “your” means collectively the other entity(ies) executing or assenting to the Order Form. “Affiliate” means any entity that controls, is controlled by, or is under common control with, another entity. An entity “controls” another if it owns directly or indirectly a sufficient voting interest to elect a majority of the directors or managing authority or otherwise direct the affairs or management of the entity.

2. Processing. With respect to the Processing of Personal Data, you act as a Controller, “business”, or Processor and Gymdesk is a Processor or “service provider”. We will only Process Personal Data as permitted under the Agreement and applicable Privacy Laws. We will not “sell” Personal Data. You agree that the Agreement represents your complete instructions to us and any additional changes you require must be mutually agreed. We will inform you if we believe that any of your instructions violate law, unless prohibited on important grounds of public interest. Details regarding the Processing of Personal Data are specified in Annex 1. You are solely responsible for complying with Privacy Laws regarding the Processing of Personal Data (including obtaining consents) and warrant that you comply with the same. You shall indemnify us, our Affiliates, subcontractors, and licensors from all third-party claims or losses arising from the Processing of Personal Data in accordance with this Agreement.

3. Subprocessors. You authorize us to use other Processors, including Gymdesk affiliates and service providers, (“Subprocessors”) in any jurisdiction to Process Personal Data, so long as they are required to abide by terms substantially similar to these Data Processing Terms. We will be liable to you for the performance of our Subprocessor’s obligations under the Agreement. Our current Subprocessors are listed here. You must subscribe to this link to receive notice of updates to our list of Subprocessors. You may object in writing to our appointment of a new Subprocessor within five (5) calendar days of such notice. If you legitimately object to a Subprocessor on reasonable data protection grounds and we do not resolve the matter within one month following notification, we may terminate the Services impacted by the new Subprocessor, without penalty, upon written notice.

4. Security. We will implement appropriate technical and organizational measures to protect Personal Data, as described in Annex 2 (“Security Measures”). We may update or modify the Security Measures, so long as the overall security level of the Services is maintained. You are solely responsible for determining whether the Security Measures meet your requirements. You agree that the level of security provided by the Security Measures is appropriate to the risk inherent in the Services. You are responsible for configuring the Services in a manner which enables you to comply with applicable Privacy Laws. We will ensure that only authorized personnel who are under written obligations of confidentiality or are under an appropriate statutory obligation of confidentiality may access Personal Data. The Services are not designed to Process Special Categories of Data, cardholder data subject to the Payment Card Industry Security Standard (“PCI DSS”), protected health information, children’s Personal Data, or other Personal Data inappropriate for the nature of the Services (collectively, “Prohibited Data”). You shall not submit Prohibited Data to us or to the Services, unless authorized to do so in writing by Gymdesk.

5. Security Incident. We will notify you without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorized access, disclosure or use of Personal Data while processed by us (each a “Security Incident”) in relation to the Services under the Agreement. We will investigate the Security Incident and provide you with relevant information about the Security Incident as required under Privacy Laws. We will use reasonable efforts to assist you in mitigating, where possible, the adverse effects of any Security Incident.

6. Compliance. On written request and subject to obligations of confidentiality, we will provide to you information reasonably necessary, including relevant certifications, to demonstrate our compliance with these Data Processing Terms. With respect to Subprocessors, we may fulfil our responsibilities under this Section 6 by providing you with audit reports or certifications provided by such Subprocessors.

7. Data Transfers. You authorize us and our Subprocessors to transfer Personal Data to locations outside of its country of origin for the performance of the Agreement, provided that we implement appropriate transfer safeguards to comply with applicable Privacy Laws. If we transfer Personal Data from the European Economic Area (“EEA”), UK, Switzerland or from any other jurisdiction that restricts the cross-border transfer of Personal Data to locations outside that jurisdiction, you shall be bound by the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 including the provisions in Modules 2 and 3, as applicable, (“SCCs”) in the capacity of “data exporter”, and Gymdesk in the capacity of “data importer” as those terms are defined therein. The SCCs will be deemed to have been signed by each Party and are hereby incorporated by reference into the Agreement in their entirety as if set out in full as an annex to this Agreement. The Parties acknowledge that the information required to be provided in the appendices to the SCCs is set out in Annex 1 below as a “Description of the Transfer” and “Security Measures” as a “Description of the Technical Organizational Measures” in Annex 2. Audits under Section 8.9 of the SCCs shall be carried out in accordance with the above Section 6. The SCCs will prevail over these Data Processing Terms or the Agreement, in the event of conflict.

8. Cooperation. We will cooperate with you to respond to requests, complaints or inquiries from data subjects, supervisory authorities, or other third parties, conduct a privacy impact assessment and prior consultation with supervisory authorities, provided that you reimburse us for all reasonably incurred costs. If we receive a data subject request relating to Personal Data, we will provide it to you. We will not respond to the data subject request unless required by applicable law.

9. Termination. Upon termination of the Agreement, we will return, delete or anonymize Personal Data except to the extent (i) we are required by applicable law to retain Personal Data or (ii) for compliance, audit or security purposes, in which case these Data Processing Terms will continue to apply to the retained Personal Data. Any certification of deletion will be provided to you only upon your written request.

ANNEX 1

DESCRIPTION OF THE PROCESSING AND TRANSFER (MODULE 2: CONTROLLER TO PROCESSOR)

ANNEX 2 SECURITY MEASURES

This Annex 2 describes the Security Measures designed to protect and secure our Services when we Process Personal Data under the Agreement. We may update or modify the Security Measures from time to time provided that such updates and modifications do not result in a material degradation of the overall security of the Services provided under the Agreement. Beta offerings may be subject to different practices.