Ironstead
LearnBecome a coachLog inStart free trial
DPA template · As of October 19, 2026 ·

Data Processing Agreement

Agreement under Art. 28 GDPR between Coach and Platform for the processing of trainee data.

This page is only available in German in its legally binding version. The English text is a courtesy translation.

1. Subject matter

This agreement is concluded between the Coach as controller (Art. 4(7) GDPR) and the Platform as processor (Art. 4(8) GDPR):

Ironstead, Owner Jakob Michael Seiffert
Kentroper Weg 60a, 59063 Hamm, Germany
Email: datenschutz@iron-stead.com
(hereinafter "Platform")

The Platform processes personal data of trainees on behalf of the Coach in the course of coaching. The data categories are described in section 2. This agreement governs the obligations of both parties under Art. 28 GDPR. For its own processing purposes, in particular account management and billing as well as use of the app without a Coach, the Platform acts as a controller; that processing falls outside this DPA.

2. Data processed

  • Basic trainee data: name, email, date of birth, gender, height, weight.
  • Training data: exercises, sets, repetitions, load, RPE, rest periods, notes.
  • Photo, video and audio content that users submit through available upload or chat features.
  • Chat content between coach and trainee.
  • Rules, notes, plans and guidance about trainees entered by the Coach. Free-text content may contain information about injuries or other health data within the meaning of Art. 9(1) GDPR.

3. TOMs (Technical & Organizational Measures)

Transport encryption over HTTPS. Hosting at Hetzner in the EU. Access to the operating environment is restricted to authorized administrators. Backup and retention measures follow the documented operating configuration.

4. Sub-processors

  • Hetzner Online GmbH - Hosting / infrastructure in the EU.
  • Google Cloud EMEA Ltd. - Vertex AI in a configured EU region. Coach rules, both global and for individual trainees, are processed for their analysis when the Coach saves them, unassigned templates with the Coach's AI opt-in; for information about trainees contained in rules, the Coach ensures the legal basis. Other trainee-related data, such as a training plan submitted for review, only with the trainee's AI opt-in. Structured identity fields are excluded from the prompt. Global rules and unassigned templates must not contain information about individual trainees.
  • Paddle.com Market Limited - Payment processing (United Kingdom).
  • Plus Five Five, Inc. (Resend) - Transactional emails and contact form delivery; processing primarily in the United States, safeguarded by the EU Standard Contractual Clauses and EU-U.S. Data Privacy Framework.
  • Functional Software, Inc. d/b/a Sentry - App crash and error diagnostics (EU data region). Pseudonymous technical telemetry only; personal data is removed on-device before transmission. DPA in place.
  • Apple Inc. - Delivery of push notifications on iOS (Apple Push Notification service, APNs). A device push token and the notification content are transmitted; any transfer to the USA relies primarily on the EU-US Data Privacy Framework, complemented by the EU Standard Contractual Clauses.
  • Google LLC (Firebase / FCM) - Delivery of push notifications on Android (Firebase Cloud Messaging, FCM). A device push token and the notification content are transmitted; any transfer to the USA relies primarily on the EU-US Data Privacy Framework, complemented by the EU Standard Contractual Clauses and the Google Cloud / Firebase Data Processing Addendum.
  • 650 Industries, Inc. (Expo) - Push relay forwarding notifications to APNs and FCM (exp.host). A device push token and the notification content are transmitted; any transfer to the USA is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) as the appropriate safeguard.

5. Platform obligations

Processing only on documented instructions from the Coach. Confidentiality of personnel. Support for right-of-access and erasure requests. Notification of data breaches within 72 hours.

6. Coach obligations

The Coach is responsible for the lawfulness of instructions and submitted content and for entering that content carefully and accurately to the best of their knowledge. The Coach includes information about individual trainees only in trainee-specific rules and notes, not in global rules or unassigned templates. The Coach ensures a legal basis under Art. 6 GDPR for processing trainee data and, for health data, an additional condition under Art. 9(2) GDPR. This also applies to entering and storing such information in rules, notes, plans and guidance. The Coach informs trainees about the processing and ensures that the respective trainee's required explicit consent for AI Critique is in place. The Platform's own statutory and contractual obligations remain unaffected.

7. Deletion & Return

Upon termination, the Platform deletes all personal data within 90 days, unless a statutory retention obligation applies. A data export in JSON format will be provided on request.

Download

The legally binding PDF version is available for download here:

Download PDF
Ironstead - DPA