Data processing agreement
Last updated: 2026-10-11. Version 1.0. This agreement is an integral part of the Terms of Service (clause 5.4) and applies to every Coach who processes their Clients' personal data on the Platform. It is concluded between the Coach (the Controller) and EJ Group MB, company code 308112520, Lvivo g. 91-48, LT-08104 Vilnius (the Processor, we). It is drawn up under Article 28 of the General Data Protection Regulation (EU) 2016/679 (the GDPR).
1. SUBJECT MATTER AND DURATION
1.1. The Processor processes the Controller's Clients' personal data on the Controller's behalf and instructions, to the extent the Platform needs it: the data is stored, structured, shown to the Controller and their Clients, passed between them (messages, notifications, e-mails) and copied into backups. 1.2. The agreement lasts as long as the Terms of Service between the Controller and the Processor, plus the time the Processor keeps data under section 7.
2. NATURE AND PURPOSE OF PROCESSING
2.1. The purpose is the coaching, nutrition and related services the Controller provides to their Clients. The Processor does not use Clients' data for its own purposes, except where the law requires it or for anonymised statistics about how the Platform runs. 2.2. Operations: collection through the Platform's forms, storage, structuring, viewing, transmission to the Client and the Controller, backup, erasure.
3. TYPES OF DATA
3.1. Identity and contact data: first and last name, e-mail, phone, photo. 3.2. Training data: programmes, plans, completed workouts, weights, repetitions, comments, form-check photos and videos. 3.3. Nutrition data: food diary, targets, meal plans. 3.4. Body and health data: weight, measurements, progress photos, steps, heart rate and workouts from wearables, injuries or limitations the Client states. This is special-category data (Article 9 GDPR). 3.5. Communication and organisational data: messages and attachments, bookings, membership status, documents, the Controller's notes about a Client. 3.6. Data on payments between the Controller and the Client: amounts, statuses, Stripe identifiers. Card details are never processed on the Platform.
4. CATEGORIES OF DATA SUBJECTS
4.1. The Controller's Clients, including minors whose accounts are managed by parents or guardians (Terms clause 3.1.1), and people the Controller has invited who have not yet signed in.
5. OBLIGATIONS OF THE CONTROLLER
5.1. The Controller ensures a lawful basis for processing Clients' data and, for health data, the Client's explicit consent (Article 9(2)(a) GDPR) or another Article 9 basis, and that Clients are informed about the processing. 5.2. The Controller's instructions to the Processor are: (a) use of the Platform's features the way they are built; (b) written instructions by e-mail to info@3ecoach.eu. Instructions the Platform cannot technically carry out do not bind the Processor. 5.3. The Controller is responsible for the accuracy of the data, the security of their own sign-in, and for not uploading data they have no right to process.
6. OBLIGATIONS OF THE PROCESSOR
6.1. Processes data only on the Controller's documented instructions (clause 5.2), including transfers outside the EEA, unless EU or Member State law requires otherwise; in that case the Processor informs the Controller beforehand, unless the law forbids it. 6.2. Informs the Controller without delay if, in its view, an instruction infringes the GDPR or other data-protection law. 6.3. Ensures that persons with access to the data are bound by confidentiality. Only the Processor's administrators have access to Platform data, and only as far as maintaining the Platform requires. 6.4. Implements the technical and organisational measures in Annex B and keeps them up to date with the risk. 6.5. Assists the Controller with data-subject requests: a Client can export and delete their own account on the Platform; otherwise the Processor provides the information or carries out the action within 10 working days of the Controller's request. 6.6. Assists the Controller with the obligations of Articles 32–36 GDPR (security, breach notification, impact assessment), taking into account the nature of the processing and the information available. 6.7. Notifies the Controller of a personal data breach affecting the Controller's Clients' data without undue delay and no later than 48 hours after becoming aware of it, stating the nature of the breach, the data and subjects affected, the likely consequences and the measures taken. The notice goes to the e-mail of the Controller's account. 6.8. Makes available the information needed to demonstrate compliance with this agreement and allows audits: no more than once a year, with 30 days' notice, at the Controller's expense, during working hours and without disrupting the Platform. In place of an audit the Processor may provide its sub-processors' independent audit reports or certifications.
7. RETURN AND DELETION OF DATA
7.1. The Controller can export all of their own and their Clients' data at any time in the Platform's settings (JSON). 7.2. When the Terms end or the Controller deletes their account, data is deleted or anonymised within the periods set in sections 9 and 10 of the Privacy Policy, except data the law requires us to keep (e.g. accounting records). Backups are overwritten within the period stated in section 10 of the Privacy Policy.
8. SUB-PROCESSORS
8.1. The Controller gives general authorisation for the sub-processors listed in Annex A. 8.2. The Processor gives at least 14 days' notice of a new or changed sub-processor by updating Annex A and writing to the e-mail of the Controller's account. The Controller may object on reasonable grounds within that time; if no solution is found, the Controller may terminate the Terms and the Processor refunds the unused part of the subscription. 8.3. The Processor binds every sub-processor by a contract with data-protection obligations no less strict than this agreement, and remains liable to the Controller for the sub-processor's acts.
9. TRANSFERS OUTSIDE THE EEA
9.1. The database, file storage and the Platform's servers are in the European Union (Annex A). Where a sub-processor processes data outside the EEA, the European Commission's Standard Contractual Clauses, supplementary technical measures and, where applicable, the EU-US Data Privacy Framework apply.
10. LIABILITY
10.1. Each party is liable for damage caused by its own breach of the GDPR, as set out in Article 82 GDPR. The Processor's liability to the Controller is limited as set out in section 16 of the Terms, to the extent the law allows.
11. FINAL PROVISIONS
11.1. This agreement is amended in the way section 19 of the Terms provides. Where this agreement and the Terms conflict on personal-data matters, this agreement prevails. 11.2. Lithuanian law applies. A Controller who wants a signed copy of this agreement writes to info@3ecoach.eu.
12. ANNEX A – SUB-PROCESSORS
Supabase, Inc. (USA) – database, authentication, file storage; data held in the EU region (AWS, Ireland). Hostinger International Ltd. (Cyprus) – the Platform's server (VPS) and the traffic-statistics (Umami) server; data centre in Vilnius, Lithuania. Stripe Payments Europe, Ltd. (Ireland) – payments between the Controller and Clients, and Platform subscriptions. Resend, Inc. (USA) – transactional e-mail (invitations, reminders, notices). Anthropic, PBC (USA) – food recognition from text in the AI features; only the text the user types is sent. Functional Software, Inc. (Sentry, USA) – error monitoring; personal data is stripped from reports.
13. ANNEX B – TECHNICAL AND ORGANISATIONAL MEASURES
Encryption in transit: all traffic between the user, the Platform and sub-processors goes over HTTPS/TLS only. Encryption at rest: the database, file storage and backups are encrypted in the sub-processor's (Supabase/AWS) infrastructure. Access separation: the database enforces row-level security – every Coach sees only their own Clients, every Client only their own data; server keys with wider access never reach the browser. Authentication: passwords are stored only as hashes; administrator access is protected by two-factor authentication; sign-in, sign-up and password-reset attempts are rate-limited. Abuse prevention: request rate limits, protection of public forms against automated submissions, limits on uploaded file size and type, a Content Security Policy in the browser. Logging and monitoring: action logs without passwords or keys; administrator actions in an audit log; errors monitored without personal data. Backups: taken daily in the sub-processor's EU-region infrastructure and kept for the period stated in the Privacy Policy. Data-subject rights: export and account deletion are available to the user in settings; deletion removes or anonymises the data in every Platform table and in storage. Organisational measures: only the Processor's administrators can reach the production environment; production and development are separate; changes pass automated tests before deployment.