Acuerdo de Tratamiento de Datos

This Data Processing Agreement ("DPA") is entered into between FitResa (Susanoo SAS), as data processor, and any Professional subscribed to the FitResa platform, as data controller. It is accepted electronically upon Professional account creation and forms an addendum to FitResa's Terms of Service and Terms of Sale. It is mandatory under Article 28 of the General Data Protection Regulation (GDPR — Regulation EU 2016/679).

Parties

Article 1 — Subject matter and duration

This DPA sets out the rights and obligations of FitResa as a processor of personal data that the Professional, as data controller, entrusts to it in connection with the use of the FitResa platform.

FitResa processes this data on behalf of the Professional to provide the SaaS services described in the ToS and GTS (schedule management, bookings, client database, communications).

This DPA takes effect on the date of acceptance by the Professional and remains in force for the duration of the subscription. It terminates automatically upon cancellation or expiry of the subscription.

Article 2 — Nature, purpose and characteristics of processing

Article 3 — Personal data processed

Article 4 — Sub-processors

The Professional authorises FitResa to engage the following sub-processors. FitResa undertakes to notify the Professional by email of any addition or replacement of a sub-processor with 30 days' notice, during which the Professional may object.

Article 5 — FitResa's obligations (Processor)

FitResa undertakes to:

1. Process personal data only on documented instructions from the Professional, unless required otherwise by law — the ToS and this DPA constitute the documented instructions.
2. Ensure that persons authorised to process the data are subject to appropriate confidentiality obligations.
3. Implement appropriate technical and organisational security measures as required by Article 32 GDPR (TLS/AES-256 encryption, access control, logging, backups).
4. Comply with the conditions for engaging sub-processors (see Article 4).
5. Assist the Professional, to the extent possible, in fulfilling its obligation to respond to data subject rights requests.
6. Assist the Professional in meeting its obligations regarding security, data breaches, DPIAs and prior consultation.
7. Notify the Professional without undue delay (and within 72 hours at most) upon becoming aware of a personal data breach affecting their data.
8. Delete or return all personal data to the Professional at the end of the contract, at the Professional's choice, and delete existing copies unless legally required to retain them.
9. Make available all information necessary to demonstrate compliance with this DPA, and allow for audits.

Article 6 — Professional's obligations (Controller)

The Professional undertakes to:

1. Collect their clients' personal data in compliance with the GDPR (legal basis, information notices, retention periods).
2. Only instruct FitResa to carry out lawful processing under the GDPR.
3. Inform their clients (End Users) that FitResa is used as a processor, including in their own privacy policy.
4. Obtain explicit consent from their clients for any processing of sensitive data (including health data entered in client profiles).
5. Respond to data subject rights requests forwarded by FitResa.
6. Immediately notify FitResa of any instruction that appears to violate the GDPR or other applicable regulation.

Article 7 — Transfers outside the European Union

FitResa may engage sub-processors established outside the European Union (notably Stripe and Anthropic, based in the United States). These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission or an equivalent mechanism. FitResa undertakes to keep the sub-processor list up to date and to inform the Professional of any changes (see Article 4).

Article 8 — Data security

FitResa implements the following security measures:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)

• Secure authentication via magic link (no plaintext password stored)

• Role-based access control (RBAC) — each Professional only accesses their own data

• Access logging and sensitive operation auditing

• Regular and tested backups

• Monitoring and alerts for abnormal activity

FitResa commits to maintaining these measures and adapting them to evolving risks and technologies.

Article 9 — Personal data breaches

In the event of a personal data breach within the meaning of Article 4(12) GDPR (destruction, loss, alteration, unauthorised disclosure or access), FitResa undertakes to:

1. Notify the Professional without undue delay and within 72 hours of becoming aware of the breach.

2. Provide a description of the nature of the breach, the categories of data and individuals affected, and the measures taken or planned.

3. Assist the Professional in meeting its notification obligations to the CNIL and affected individuals where necessary.

Article 10 — Data return and deletion

Upon expiry or termination of the subscription, FitResa undertakes to:

• Allow the Professional to export their data (client database, booking history) in a structured format for 30 days following the end of the subscription.

• Permanently delete all personal data of the Professional's clients after this period, unless legally required to retain them.

• Confirm deletion by email upon the Professional's request.

Article 11 — Audits and documentation

The Professional may at any time request that FitResa provide the information necessary to demonstrate compliance with this DPA. FitResa will provide available information (internal policies, certifications, audit results) within a reasonable timeframe.

On-site audits are possible upon written reasoned request, with 30 days' notice and subject to agreement on practical terms. Audit costs are borne by the Professional unless non-compliance is found.

Article 12 — Governing law and final provisions

This DPA is governed by French law and Regulation (EU) 2016/679 (GDPR). In case of conflict between the DPA and the ToS/GTS, the DPA prevails for all matters relating to personal data protection.

This DPA may be modified by FitResa to reflect legal or regulatory changes. Any material change will be notified to the Professional with 30 days' notice.

This DPA constitutes a working document compliant with Article 28 GDPR. FitResa recommends that Professionals consult their own legal counsel to verify the compliance of their data processing activities.