Legal
Data processing agreement
When you use OneRep, you decide what happens to your clients' data and we look after it for you. This agreement sets out how, as UK GDPR requires.
1. Who this agreement is between
This agreement is between the business that holds a OneRep account ("you", the controller) and [Company legal name, e.g. OneRep Ltd] ("we", the processor). It forms part of our terms of service and applies whenever we process personal data on your behalf. It's written to meet Article 28 of the UK GDPR.
2. What we process, and why
| Subject matter | Providing the OneRep service to you |
|---|---|
| Duration | For as long as your account is open, plus up to 90 days afterwards so you can export your data |
| Nature and purpose | Hosting, storing, organising and displaying data; sending emails and reminders you set up; taking payments through Stripe; producing reports; answering questions in Ask; support and backups |
| Whose data | Your clients and prospective clients; your coaches and staff; people your clients name, such as emergency contacts |
| Types of data | Names, contact details, dates of birth, bookings and attendance, packages and payment history, messages, terms accepted, form answers, notes |
| Special category data | Health and fitness information you choose to record, such as PAR-Q answers, injuries, body measurements, body fat and other assessment results |
3. What we promise
We will:
- process your data only on your documented instructions, which are these terms and how you use OneRep, unless the law requires otherwise, in which case we'll tell you first unless the law forbids it;
- tell you if we think an instruction breaks data protection law;
- make sure everyone who can access your data is bound by confidentiality;
- keep your data secure using the measures in section 8;
- only use sub-processors as set out in section 4;
- help you respond to your clients when they exercise their rights, for example by letting you export, correct or delete their data;
- help you meet your security, breach notification and data protection impact assessment duties, taking into account the information available to us;
- delete or return your data when your account ends, as set out in section 6;
- give you the information you reasonably need to show we're meeting this agreement, and allow audits as set out in section 7.
4. Sub-processors
You give us general permission to use the sub-processors listed below. Each is bound by a written contract with data protection terms at least as protective as this agreement. We'll tell you by email at least 30 days before we add or replace one. If you object on reasonable data protection grounds, we'll discuss it with you; if we can't resolve it, you can end your subscription and we'll refund any time you've paid for in advance but not used.
| Sub-processor | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | United Kingdom (London) |
| Vercel | Running the app | UK and EU, with a global network |
| Cloudflare | Domain, network and security | Global network |
| Stripe | Payments from your clients | UK, EU and United States |
| Resend | Booking, reminder and account emails | EU and United States |
| Crisp | Support chat | European Union |
| Sentry | Error reports | EU and United States |
| Anthropic | Answering questions in Ask | United States |
5. International transfers
Where a sub-processor handles your data outside the UK, we'll make sure the transfer is covered by a UK adequacy decision (including the UK–US data bridge where the provider is certified), or the ICO's International Data Transfer Agreement or Addendum, with any extra safeguards the transfer needs.
6. When your account ends
You can export your data at any time while your account is open and for 90 days after it ends. After that, we delete your data from the live service, and it drops out of backups within a further 30 days, unless the law requires us to keep it.
7. Information and audits
We'll answer reasonable written questions about how we protect your data. If you need to audit us, give us at least 30 days' notice; we'll agree a reasonable scope that doesn't put other customers' data at risk. Audits are at your cost, no more than once a year, unless a regulator requires one or there's been a breach.
8. Security measures
- Encryption in transit (TLS) and at rest
- Each studio's data separated by database access rules, tested so one studio can't see another's
- Two-step sign-in for coaches and staff accounts
- Access to production data limited to named people who need it, with sign-in logs
- No card or bank details stored by OneRep; payments handled by Stripe
- An activity log of changes made in each account
- Backups at least daily, kept for 30 days, with restores tested
- Monitoring and alerts for errors and unusual activity
- Security updates applied promptly, and an independent security test before launch and at least once a year
9. Personal data breaches
If we become aware of a breach affecting your data, we'll tell you without undue delay, and in any case within 48 hours. We'll explain what happened, the data and people affected, the likely consequences and what we're doing about it, and keep you updated. As controller, you decide whether to notify the ICO and your clients, and we'll help you do so.
10. Your responsibilities
You're responsible for having a lawful basis for the data you put into OneRep, including explicit consent or another valid condition for health information; for telling your clients how you use their data; and for the instructions you give us through the way you use OneRep.
11. General
Each side's liability under this agreement is subject to the limits in our terms of service, except where the law doesn't allow it. If this agreement and the terms of service conflict on data protection, this agreement wins. It's governed by the law of England and Wales.