What this document is
It is the contract required by Article 28 of the General Data Protection Regulation when someone processes personal data on someone else's behalf. It is not a statement of intent or a decorative annex: it binds both parties from the moment the gym accepts it.
- The gym is the controller of its athletes' data: it decides whom it registers, what it keeps about each person, why and for how long, and it is the one who asks for consent when consent is needed.
- We are the processor: we store that data, show it to whoever the gym authorises, and do nothing else with it.
The data of the account each person signs in with — email, name, password, sessions, notifications — is ours as controller, and that is not governed by this document but by the privacy policy. The split between the two roles is explained there, in the section "Two different roles".
This agreement is read together with the terms of use, of which it forms part. If anything here conflicts with them, this document prevails on personal data.
Who each party is
Controller: the gym. The gym registered in Brod, with the name, email and tax details its owner entered at sign-up and in the billing card of its panel. It acts through the person who created the gym or whoever that person designates.
Processor:
- Germán Ezequiel Laso Andino, sole trader (libero professionista), trading as ProfBlu.
- VAT number (Partita IVA): 04702090988.
- Italian tax code (codice fiscale): LSNGMN88S04Z600M.
- Professional activity not registered in the Italian Business Register (no REA number).
- Contact address: Via della Sega 1, 38080 Verdesina, Porte di Rendena (TN), Italia.
- Email for this contract: legal@profblu.com. For anything about data, privacidad@profblu.com.
No data protection officer has been appointed: the law does not require one for an activity of this size.
Where and when it is accepted
This agreement is accepted when the gym is created, at my.brod.profblu.com/alta, in the step "Your gym", by ticking the box that accepts the terms, the privacy policy and this agreement. Without ticking it, the gym is not created.
Of that acceptance we store three things, and only three: the date and time, the version of this document — which is its revision date, the one shown above — and who accepted it, that is, the account that created the gym. That record can be consulted later from the gym's own panel; it is the proof that the contract exists and of which text was accepted.
When we change this document we will give notice beforehand, and the new version is accepted the same way. The previous one is not erased: the record keeps which version was in force at each moment.
Subject matter, nature and duration
- Subject matter: providing Brod to the gym — planning training, delivering it to its athletes and recording what they do — and, in order to provide it, processing the personal data the gym enters in the application and in its panel.
- Nature and purpose: only the operations the tool needs in order to work. Collecting what the gym and its athletes write, storing it, organising it, showing it to whoever the gym authorises, modifying it when they modify it, copying it into the backups, extracting it when an export is requested and erasing it when an erasure is asked of us. Nothing else.
- Duration: as long as the gym has an account in Brod. It starts the day it is accepted and ends when the gym closes its account, when we stop providing the service, or when either party terminates it as set out below.
What data, and about whom
Categories of data subjects:
- The athletes the gym registers.
- The people on the gym's staff — coach, reception, whoever administers it — in so far as they appear tied to that data: who signs a plan, who writes a note, who marks a fee as paid.
Categories of data, as the application collects them:
- Identification: first and last name, email address and phone number, if the gym enters them.
- Date of birth and sex.
- Data about the body: height, body weight and the history of weigh-ins, with the notes the coach writes.
- Personal bests per exercise — the maximum of each — with date and notes.
- The training plans and their technique cues, the time the athlete said they would train, each session (status, rests, notes) and the set-by-set log: repetitions, weight, time, the note written and the moment it was finished.
- The fees the gym keeps in the "Fees" screen: in whose name the charge is, their email, the amount, the due date, whether it is pending, paid, waived or overdue, and when it was paid.
Data about the body is a special category under Article 9 GDPR. The gym processes it with the athlete's explicit consent, which the gym obtains, and we use it for nothing other than showing it to that person and to their coach. There is no diagnosis, no medical advice and no health calculation.
We do not process card payment data of the gym's athletes on its behalf: the "Fees" screen is a collections ledger, it records whether something was paid, and the money does not go through Brod.
We only do what the gym tells us
We process that data solely on the gym's documented instructions. Its instructions are this contract, the terms of use, and everything its people do in the panel and in the application: registering an athlete, editing a profile, publishing a week, deactivating the athlete, exporting their data or asking us for an erasure.
Therefore:
- We do not use the gym's data for anything of our own. No analytics, no advertising, no profiling, no business statistics, no training of models, and no transfer or sale to anyone. Nothing in the code does it.
- We do not transfer it outside the European Economic Area except as stated in the list of sub-processors below, which today amounts to the push notification relay.
- If a law of the Union or of a Member State requires us to process otherwise, we will tell the gym before doing so, unless that same law forbids it.
- If an instruction from the gym seems to us contrary to the GDPR, we will say so. We are not its legal adviser, but neither are we going to carry out in silence something we believe unlawful.
Confidentiality
Whoever has access to this data is bound by confidentiality, and that duty survives the end of this agreement. Today, technical access to the database is held by one single person, the owner. If tomorrow there are more — someone hired, a provider operating the server — they will sign confidentiality before having access, and will access only what their work requires.
Inside the gym, who sees what is decided by the gym itself through the roles it hands out to its people. We enforce that arrangement; we do not choose it for them.
Security measures
The ones that actually exist, not a catalogue list:
- All traffic travels encrypted with TLS, both the application's and the panel's.
- Passwords are stored as a bcrypt hash. We cannot read or recover them, only check whether the one typed matches.
- Access to data depends on each person's role within their gym, and gyms are isolated from one another: asking for one gym's data with another gym's session does not return the data.
- The phone's session credentials live in the phone's own secure storage.
- Daily encrypted backups, kept in Hetzner's object storage in Nuremberg and retained for 35 days. After that, the copy disappears with the rotation.
- The server logs every request and every error, to operate the service and to be able to investigate an incident.
And what we do not do, so that nobody assumes it: we do not encrypt field by field inside the database — encryption protects transport and backups — and there is no external security certification today.
Sub-processors
The gym gives us general authorisation to use other companies to provide the service. This is the complete list as of today; there is no other:
- Hetzner Online GmbH — hosting of the server and of the encrypted backups, in Nuremberg (Germany). Within the EEA.
- IONOS SE — delivery of outgoing email (invitations, account notices), from its Spanish region. Within the EEA.
- Expo, Inc. — relay of push notifications: it receives the device identifier and the text of the alert to hand it to Apple or Google. It is in the United States, and it is the only piece of daily operation outside the EEA: it runs under the safeguards of Chapter V GDPR (standard contractual clauses).
- Apple Inc. and Google LLC — as the stores distributing the application and, in Apple's case, as the provider of Sign in with Apple when someone signs in that way. They do not access the gym's database.
With each of them the same data protection obligations this contract imposes are maintained, and we answer to the gym for what they do as if we had done it ourselves.
If we are going to change the list — add a sub-processor or replace one — we will tell the gym's owner by email and inside the panel at least thirty days in advance. Within that period the gym may object in writing, stating the reason. If it objects and there is no other reasonable way to provide the service, either party may terminate this agreement: the gym exports its data and closes its account, with no cost or penalty for doing so.
Help with people's rights
An athlete's rights — access, rectification, erasure, portability, objection, restriction and withdrawal of consent — are exercised against the gym, which is the controller. Our job is to make it possible for the gym to handle them:
- The gym consults and corrects an athlete's profile from its own panel, and can deactivate the athlete. Deactivating disables them, it does not erase their profile: the data stays stored. Final erasure of a person's data is requested from us at privacidad@profblu.com and we do it.
- It can export its gym's data from the panel, in a machine-readable format, to hand it to whoever asks for it.
- The athlete themselves can, from the application, download their data and delete their account; that concerns their ProfBlu account, and the privacy policy explains it.
If an athlete's request reaches us, we do not answer it on the gym's behalf: we pass it on without undue delay and help with whatever is needed. We answer directly only the part concerning account data, for which we are the controller.
We also help the gym, with the information we hold, if it needs to carry out an impact assessment or consult the supervisory authority (Articles 32 to 36 GDPR).
If there is a security breach
If we detect a security breach affecting the gym's data, we will tell it without undue delay as soon as we become aware, at the owner's email address. We will tell it what we know: what happened, which data and how many people it affects — as far as we can tell —, what consequences we foresee and what we are doing.
The 72 hours to notify the supervisory authority run for the gym, which is the controller; our obligation is to warn it in time and to give it whatever it needs to meet that deadline and, where applicable, to inform its athletes. Breaches affecting account data, for which we are the controller, we notify ourselves.
Information and verification
The gym may ask us in writing for the information necessary to verify that we comply with this contract, and we provide it within one month. It may also request an audit; it is agreed with reasonable notice, no more than once a year unless there has been an incident, is carried out without putting other gyms' data at risk, and is at the requesting party's expense.
What happens when this ends
It would be easy here to write what one would like to happen. This is what actually happens:
- The gym takes its data itself, exporting it from its panel. It can do so throughout the agreement, and it is best done before closing the account.
- When the gym is closed, access is shut and the module is switched off: the organisation is marked as closed, its seats set to zero, and nobody can get in. The data is not erased by itself: the athletes, the plans and the sessions remain stored and inactive, as do the billing card and its invoices. Erasure is not automatic, and we are not going to say that it is.
- Final erasure happens at the gym's request. It is requested at privacidad@profblu.com from the owner's email address and it is done, except for what the law requires us to keep: the invoices and accounting entries for what the gym has paid us, for the period tax law imposes — in Italy, ten years —, and the record that this agreement and the terms were accepted, with its date and version, which is the proof that the contract existed. That is kept without being used for anything else.
- Encrypted backups are not edited one by one: they rotate, and the gym's copy disappears with them after 35 days.
What is the gym's part
As controller, the gym undertakes to:
- Have a legal basis for every piece of data it enters, and the athlete's explicit consent for data about their body — weight, height, sex, date of birth, personal bests —, which it must be able to demonstrate.
- Inform its athletes of what it keeps about them, why and with whom, and show them this information and the privacy policy.
- Enter only the data it needs, and keep it accurate and up to date.
- Answer for minors: Brod requires fourteen years of age, and if the gym registers a minor it answers for holding the authorisation of the person with parental responsibility or guardianship.
- Give its instructions through the channels of the product and of this contract, and make sure they are lawful.
- Look after its staff's access: give each person the role that corresponds, take it away when they stop working there, and not share passwords. What someone does signing in with the gym's credentials is the gym's doing.
Liability
Each party answers for its own part: the gym for what it decides to process and for the instructions it gives, and we for complying with this contract and for what our sub-processors do. Neither answers for what the other does on its own account.
Changes to this agreement
If we change this document, we change its revision date and give notice in good time, inside the panel or by email, so that it can be read or the account closed. The version accepted and the date are recorded, as stated above.
Governing law
Italian law applies, being the law of the owner's domicile, with the GDPR above it. Disputes between the gym and us fall to the courts of the owner's domicile; if the gym is a consumer — it normally will not be, but a self-employed coach may be —, it keeps the courts of its own domicile and the protection of the mandatory rules of its country.