Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between the GymForce customer and GymForce Technologies LLP. It applies where GymForce processes personal data on the customer’s behalf. The customer is the Controller or Data Fiduciary and GymForce is the Processor or Data Processor, using equivalent terms under applicable law.

GymForce processes personal data only to provide, secure, support, and improve the contracted Service, comply with applicable law, and follow the customer’s documented lawful instructions. If an instruction appears unlawful, GymForce may suspend it and notify the customer where permitted.

• Customer administrators, staff, trainers, members, prospects, and emergency contacts
• Identity, contact, membership, attendance, billing-record, communication, device, support, and account-security data
• Health, biometric, or other sensitive data only when the customer lawfully configures and uses relevant features

The customer is responsible for the lawfulness, accuracy, transparency, notices, consents, retention choices, and access permissions relating to personal data submitted to GymForce, including instructions given through account configuration.

GymForce restricts access to authorized personnel subject to confidentiality obligations and maintains reasonable technical and organizational measures appropriate to the risk, including access controls, authentication, monitoring, backup practices, and protection of data in transit. No online system can guarantee absolute security.

The customer authorizes GymForce to use service providers needed for hosting, storage, communications, support, analytics, security, and payments. GymForce remains responsible for imposing appropriate data-protection obligations on sub-processors and will provide notice of material changes where required by law or contract.

Where GDPR, UK GDPR, or similar transfer rules apply, the parties will use a lawful transfer mechanism, such as an adequacy decision or applicable standard contractual clauses, together with supplementary measures where reasonably required.

Taking account of the nature of processing and information available, GymForce will reasonably assist the customer with data-subject requests, security obligations, impact assessments, regulator consultations, and qualifying personal-data breaches. GymForce will notify the customer without undue delay after confirming a breach affecting customer personal data, where legally required.

At the end of the Service, the customer should request any needed export. GymForce will delete or return customer personal data in accordance with the agreement and applicable law, except for data that must be retained legally or remains temporarily in protected backup rotation.

GymForce will make information reasonably necessary to demonstrate compliance available on request. Audits must be proportionate, protect other customers and security, avoid unnecessary disruption, and generally use existing reports or remote review before an on-site inspection.

Questions or legally required requests relating to this DPA may be sent to gymforcein@gmail.com.

• Phone: +91 98266 89962
• Alternate phone: +91 97234 62754
• Address: GymForce Technologies LLP, C/O SHIV SAGAR SHAH, SASAN Singrauli Colliery Sidhi Madhya Pradesh-486886