Ironstead
LearnBecome a coachLog inStart free trial
DPA template · As of September 5, 2026 ·

Data Processing Agreement

Agreement under Art. 28 GDPR between Coach and Platform for the processing of trainee data.

This page is only available in German in its legally binding version. The English text is a courtesy translation.

1. Subject matter

This agreement is concluded between the Coach (controller per Art. 4 No. 7 GDPR) and the Platform (processor per Art. 4 No. 8 GDPR):

Ironstead, Owner Jakob Seiffert
Kentroper Weg 60a, 59063 Hamm, Germany
Email: datenschutz@iron-stead.com
(hereinafter "Platform")

The Platform processes personal data of trainees on behalf of the Coach (training data, RPE, notes, photo uploads, chat content). This agreement governs the obligations of both parties under Art. 28 GDPR.

2. Data processed

  • Trainee master data: name, email, date of birth, gender, height, weight.
  • Training data: exercises, sets, repetitions, load, RPE, rest periods, notes.
  • Photo, video and audio content that users submit through available upload or chat features.
  • Chat content between coach and trainee.

3. TOMs (Technical & Organizational Measures)

Transport encryption over HTTPS. Hosting at Hetzner in the EU. Access to the operating environment is restricted to authorized administrators. Backup and retention measures follow the documented operating configuration.

4. Sub-processors

  • Hetzner Online GmbH - Hosting / infrastructure in the EU.
  • Google Cloud EMEA Ltd. - Vertex AI in a configured EU region. Only with the trainee's AI opt-in; structured identity fields are excluded from the prompt.
  • Paddle.com Market Limited - Payment processing (IE).
  • Resend Inc. - Transactional emails and contact form delivery; processing primarily in the United States, safeguarded by the EU Standard Contractual Clauses and EU-U.S. Data Privacy Framework.
  • Functional Software, Inc. d/b/a Sentry - App crash and error diagnostics (EU data region). Pseudonymous technical telemetry only; personal data is removed on-device before transmission. DPA in place.
  • Apple Inc. - Delivery of push notifications on iOS (Apple Push Notification service, APNs). A device push token and the notification content are transmitted; any transfer to the USA relies primarily on the EU-US Data Privacy Framework, complemented by the EU Standard Contractual Clauses.
  • Google LLC (Firebase / FCM) - Delivery of push notifications on Android (Firebase Cloud Messaging, FCM). A device push token and the notification content are transmitted; any transfer to the USA relies primarily on the EU-US Data Privacy Framework, complemented by the EU Standard Contractual Clauses and the Google Cloud / Firebase Data Processing Addendum.
  • 650 Industries, Inc. (Expo) - Push relay forwarding notifications to APNs and FCM (exp.host). A device push token and the notification content are transmitted; any transfer to the USA is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) as the appropriate safeguard.

5. Platform obligations

Processing only on documented instructions from the Coach. Confidentiality of personnel. Support for right-of-access and erasure requests. Notification of data breaches within 72 hours.

6. Coach obligations

Obtaining the required consent for AI Critique. Informing trainees about the processing. Ensuring the lawfulness of instructions and submitted content.

7. Deletion & Return

Upon termination, the Platform deletes all personal data within 90 days, unless a statutory retention obligation applies. A data export in JSON format can be provided on request.

Download

The legally binding PDF version is available for download here:

Download PDF
Ironstead - AVV