Our company details are still being added to this document.
This agreement is part of the business terms and applies when we handle your clients' personal data for you, as GDPR Article 28 requires. It takes effect when you accept those terms and lasts as long as we handle that data.
1. Parties and roles
The business using Complete Athlete is the controller. [company name: to be added], [registered address: to be added], [company registration numbers: to be added] is the processor ("we"). Data an athlete keeps in their own account, and our own account data about your team, are outside this agreement: for those we are the controller, under our Privacy Policy.
2. What we process
- Subject: providing scheduling, client records, plans, payments, invoicing and related features.
- People: your clients and prospects, guests who book, and your team.
- Data: names, contact details, booking and payment history, invoice details, notes, plans, intake answers, and files you upload.
- Special categories: health data you or your clients enter, such as injuries or intake answers.
- Actions: storing, displaying, organising, sending notifications, and deleting.
- Duration: for as long as you use the service, plus the return and deletion period in section 8.
3. Your instructions
We process this data only on your documented instructions, which are these terms and your actions in the app, unless the law requires otherwise. If so, we will tell you first, unless the law forbids it. We will tell you if we think an instruction breaks data protection law.
4. Your responsibilities
You must have a legal basis, including explicit consent where needed for health data, give your clients a privacy notice, and put only lawful, necessary data in the app.
5. Confidentiality and security
Anyone we authorise to process this data is bound to keep it confidential. We use encrypted connections, hashed passwords, role-based access for your team, scoped API keys and error monitoring, and will maintain measures appropriate to the risk.
6. Sub-processors
You authorise these sub-processors: Railway (hosting and storage), Stripe (payments), Resend (email), SMSAPI (text messages), Anthropic (AI features, where used), Google (address geocoding), PostHog (usage analytics), Sentry (error reports).
We will give at least 30 days' notice of a new one, by email or in the app. You can object on reasonable data protection grounds, and if we cannot resolve it, you can end the contract. We bind each sub-processor to equivalent duties and remain responsible for them.
Your own Stripe connected account is your contract with Stripe, not a sub-processing arrangement of ours.
7. Helping you, and breaches
We will help you, taking into account what we know and can do, to answer requests from individuals, keep data secure, carry out impact assessments and consult authorities. If someone contacts us directly about your data, we will pass the request on.
We will notify you of a personal data breach without undue delay, and within 48 hours of becoming aware of it wherever we can, with what you need to meet your own duties.
8. Return and deletion
When you leave, you can ask for an export of your data. We then delete it, including from active systems, within 30 days, and from backups as they expire, unless the law requires us to keep it.
9. Transfers
Where a sub-processor processes data outside the European Economic Area, we rely on an adequacy decision or the European Commission's standard contractual clauses.
10. Audits
We will give you the information you need to show compliance. You can audit us, or appoint an independent auditor, on 30 days' notice, during business hours, no more than once a year unless a breach or an authority requires otherwise, and under confidentiality.
11. Liability and conflicts
The liability provisions of the business terms apply to the extent the law allows. If this agreement conflicts with those terms on data protection, this agreement prevails.