Data Processing Agreement

Last updated: 4 July 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Joel Nathan Shapcott (ABN 39 683 259 554), trading as ClubEasy App ("ClubEasy", "we", "us"), and the gym or organisation using the ClubEasy platform (the "Gym"). It applies whenever ClubEasy processes personal data on the Gym's behalf and reflects the requirements of Article 28 of the EU/UK General Data Protection Regulation (GDPR) and the Australian Privacy Act 1988 (Cth). No separate signature is required — this DPA is incorporated into the Terms automatically when the Gym uses the service. A signed copy is available on request from hello@clubeasy.app.

1. Roles

The Gym decides what member information to collect and why, and is the controller of that data. ClubEasy stores and processes it on the Gym's instructions as the processor. For data ClubEasy collects in its own right (gym-owner accounts, website visitors, billing for the ClubEasy subscription), ClubEasy is the controller and our Privacy Policy applies.

2. Subject matter and duration

Processing covers the provision of the ClubEasy gym-management platform — memberships, class scheduling and attendance, belt and grading management, communications, payments, and related features — for as long as the Gym maintains an account, plus the wind-down period described in section 10.

3. Nature and purpose of processing; data categories

• Data subjects — gym members (including minors whose records are created and controlled by a parent or guardian together with the Gym), prospective members (leads), and gym staff.
• Categories of data — names and contact details, date of birth, emergency contacts, photographs/logos uploaded by the Gym, attendance and training history, belt rank and grading records, technique progress, competition results, injury notes recorded by the member or the Gym, signed waivers, communication preferences, and payment metadata (plan, amount, status — never full card or bank numbers).
• Purpose — solely to provide the service to the Gym and its members. We do not sell personal data and do not use member data for advertising.

4. Processing on instructions

We process member data only on the Gym's documented instructions — given through the Gym's use and configuration of the platform — unless processing is required by law, in which case we will inform the Gym before processing (unless the law prevents this). We will tell the Gym if, in our view, an instruction infringes applicable data-protection law.

5. Confidentiality

Access to member data is limited to persons who need it to operate and support the service, all of whom are bound by confidentiality obligations. Role-based permissions restrict what gym staff can see within the platform.

6. Security measures

• All connections encrypted in transit (TLS); traffic protected by network-level security and rate limiting.
• Stored credentials and payment-provider keys encrypted at rest with AES-256-GCM.
• Databases are not exposed to the public internet and are accessible only from the application servers.
• Role-based access control for staff and superadmin functions; authentication handled by a dedicated provider (Clerk) with modern session security.
• Automated daily backups with a rolling retention window, stored in Australia.
• Error monitoring and audit logging to detect and diagnose incidents quickly.

7. Sub-processors

The Gym gives general authorisation for the sub-processors below. We impose data-protection obligations on each sub-processor consistent with this DPA and remain responsible for their performance. We will update this page and give at least 14 days' notice (via the app or email) before adding or replacing a sub-processor that processes member data; the Gym may object on reasonable data-protection grounds, and if we cannot resolve the objection the Gym may terminate the affected service.

• Mammoth Cloud — server hosting; all member data stored in Australia
• Cloudflare — network security, DNS and content delivery (global)
• Clerk — authentication and login (US)
• Stripe, Square, GoCardless, Pin Payments — payment processing, as selected and contracted by the Gym (the Gym has its own direct relationship with its chosen provider)
• Twilio — SMS delivery (US)
• Anthropic — AI features such as promotion-readiness summaries (US); data sent to this provider is not used to train AI models
• Sentry — error monitoring (US)
• Google — analytics and advertising measurement on our public website only, subject to visitor consent; not used inside the member portal (US)

8. International transfers

Member data is stored on servers in Australia. Some sub-processors above process limited data overseas (including in the United States). Where personal data of EU/UK individuals is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an equivalent mechanism.

9. Assistance, breach notification and data subject rights

Taking into account the nature of the processing, we will assist the Gym in responding to data subject requests (access, correction, deletion, portability, restriction, objection) — much of this is self-service in the platform and member portal. We will notify the Gym without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting the Gym's member data, and will provide the information reasonably required for the Gym to meet its own notification obligations. We also comply with the Australian Notifiable Data Breaches (NDB) scheme. We will assist the Gym, at the Gym's reasonable request, with data-protection impact assessments and consultations with supervisory authorities.

10. Deletion and return

When a Gym closes its account, its member data is available for export on request for 30 days, after which it is deleted from live systems (and thereafter ages out of backups on the rolling retention cycle), unless we are required by law to retain it. Members who transfer to another ClubEasy gym take their own records with them under the member-initiated transfer feature.

11. Audit and information

On request, we will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow and contribute to audits (including inspections) conducted by the Gym or its mandated auditor, no more than once in any 12-month period, on at least 30 days' notice, during business hours, without disrupting the service, and at the Gym's cost.

12. Precedence

This DPA forms part of the Terms of Service. If there is a conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails.

Contact

Joel Nathan Shapcott, trading as ClubEasy App (ABN 39 683 259 554), Queensland, Australia. Email hello@clubeasy.app.