Snapshot 11730
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DATA PROCESSING ADDENDUM
Effective: March 1, 2023
This Data Processing Addendum, including its appendices and the Standard Contractual
Clauses (collectively, the “DPA”), is made by and between Zappy Limited d/b/a Glofox, a private
company limited by shares, registered in Ireland with registration number 538463 and located at
23 South Williams St., Dublin 2, Ireland (“Glofox”), and the Subscriber identified in an Order
Form (“Subscriber”), pursuant to the Order Form, Terms of Service, Privacy Statement and any
other applicable Addenda (collectively, the “Agreement”), and will be effective on the date the
parties have entered into the Agreement.
This DPA forms part of the Agreement and sets out the terms that apply when Personal Data
(defined below) is processed by Glofox under the Agreement. The purpose of the DPA is to
ensure such processing is conducted in accordance with applicable laws and with due respect
for the rights and freedoms of individuals whose Personal Data is processed.
1. DEFINITIONS
Any capitalized terms used but not defined in this DPA will have the meanings provided to them
in the Agreement.
“Applicable Data Protection Laws” refers to laws and regulations applicable to Glofox’s
processing of Personal Data under the Agreement, in each case, as may be amended,
superseded or replaced.
“CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., and its
implementing regulations.
“Controller” or “controller” means the natural or legal person, public authority, agency, or
other body which, alone or jointly with others, determines the purposes and means of the
processing of Personal Data.
“Data Subject” means the individual to whom Personal Data relates.
“Europe” means, for the purposes of this DPA, the European Economic Area and its member
states (“EEA”) and United Kingdom (“UK”).
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council
of April 27, 2016 on the protection of natural persons with regard to the processing of personal
data and on the free movement of such data, and repealing Directive 95/46/EC (General Data
Protection Regulation).
1
“Glofox Account Data” means Personal Data that relates to Subscriber’s business relationship
with Glofox, including to access Subscriber’s account and billing information, maintain or
improve performance of the Platform and Purchased Services, provide support, investigate and
prevent abuse on the Platform, or to fulfill legal obligations.
“Personal Data” means any information, including personal information, relating to an identified
or identifiable Data Subject, or as defined in and subject to Applicable Data Protection Laws.
“Privacy Statement” means the Glofox Privacy Statement, as may be revised from time to time,
with the most current version available here.
“Processor” or “processor” means the entity which processes Personal Data on behalf of the
Controller.
“Processing” or “processing” (and “Process” or “process”) means any operation or set of
operations performed upon Personal Data, whether or not by automated means, such as
collection, recording, securing, organization, storage, adaptation or alteration, access to,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, blocking, erasure, or destruction.
“Restricted Transfer” means: (a) where GDPR applies, a transfer of Personal Data from the
EEA to a country outside of the EEA which is not subject to an adequacy determination by the
European Commission; and (b) where the UK GDPR applies, a transfer of Personal Data from
the UK to any other country which is not based on adequacy regulations pursuant to Section
17A of the Data Protection Act 2018.
“Security Breach” or “Security Breaches” mean(s) a breach of security leading to any
accidental, unauthorized or unlawful loss, disclosure, destruction, loss, alteration, unauthorized
disclosure of, or access to Subscriber Data transmitted, stored or otherwise processed by
Glofox. Security Breach shall not include an unsuccessful attempt or activity that does not
compromise the security of Subscriber Data, including (without limitation) pings and other
broadcast attacks of firewalls or edge servers, port scans, unsuccessful log-on attempts, denial
of service attacks, packet sniffing (or other unauthorized access to traffic data that does not
result in access beyond headers) or similar incidents.
“Standard Contractual Clauses” or “SCCs” mean either the standard contractual clauses
approved by the European Commission for the transfer of Personal Data to processors or those
for the transfer of Personal Data to controllers (as the context requires), in each case established
in third countries which do not ensure an adequate level of data protection, and current as of the
date of the transfer (or, where the UK GDPR applies, the SCCs as amended by the International
Data Transfer Addendum to the SCCs (“UK IDTA”) issued by the UK Information Commissioner
under section 119A(1) Data Protection Act 2018 or any equivalent set of clauses approved by
the UK Supervisory Authority, or other applicable authority in accordance with Applicable Data
Protection Laws).
2
“Sub-processor” or “sub-processor” means (a) Glofox, when Glofox is processing
Subscriber Data and where Subscriber is itself a processor of such Subscriber Data; or (b) any
third-party Processor engaged by Glofox or its Affiliates to assist in fulfilling Glofox’s obligations
under the Agreement and which processes Subscriber Data. Sub-processors may include third
parties or Glofox Affiliates but shall exclude Glofox employees, contractors or consultants.
“Subscriber Data” means the information, materials, data and other content (including data
belonging to End Users, which may include tokenized End User payment card data), entered,
uploaded or inputted into the Platform and tied to a Subscriber’s Glofox account or business
location. Subscriber Data may include Personal Data that Glofox processes on behalf of
Subscriber.
“Supervisory Authority” means an independent public authority which is established by
Applicable Data Protection Laws.
“Third Party Request” means any request, correspondence, inquiry, or complaint from a Data
Subject, regulatory authority, or third party.
“UK GDPR” means the GDPR as transposed into United Kingdom national law by operation of
section 3 of the European Union (Withdrawal) Act 2018, as amended by the Data Protection,
Privacy and Electronic Communications (Amendments, etc.) (EU Exit) Regulation 2019. Under
this DPA, in circumstances where the UK GDPR applies, reference to the GDPR and its
provisions will be construed as references to the UK GDPR and its corresponding provisions,
and references to EU or Member State law shall be construed as references to UK law.
2. STATUS OF THE PARTIES
2.1 Glofox as a Processor of Subscriber Data. The parties acknowledge and agree that
Subscriber is the controller of Personal Data and, except to the extent described below, Glofox
will be the processor of such Personal Data on Subscriber’s behalf.
2.2 Glofox as a Controller of Glofox Account Data. The parties acknowledge that with regard
to the processing of Glofox Account Data, Subscriber is a controller of Personal Data and Glofox
is an independent controller, not a joint controller of Personal Data with Subscriber. Glofox will
process Glofox Account Data as a controller (a) in order to manage the relationship with
Subscriber; (b) carry out Glofox’s core business operations, such as accounting and filing taxes;
(c) in order to detect, prevent, or investigate security incidents, fraud, and other abuse or misuse
of the Platform or Purchased Services; (d) to comply with Glofox’s legal or regulatory obligation
to retain Personal Data; and (e) as otherwise permitted under Applicable Data Protection Laws
and in accordance with the Agreement.
2.3 Glofox as a Controller of Subscriber’s Usage Data. The parties acknowledge that with
regard to the processing of Subscriber’s data associated with its use of the Platform (“Usage
Data”), Subscriber may act either as a controller or processor of Usage Data and Glofox is an
independent controller, not a joint controller of Usage Data with Subscriber. Glofox will process
Usage Data as a controller in order to carry out the necessary functions as a hosted gym
3
management platform to owners and operators of gyms and fitness studios, such as (a) Glofox’s
own accounting, tax, billing, audit, and compliance functions; (b) to provide, optimize, and
maintain the Platform; (c) to investigate fraud, misuse or the unlawful use of the Platform or
Purchased Services; (d) as required by applicable law or regulation; or (e) as otherwise permitted
under Applicable Data Protection Laws and in accordance with the Agreement.
3. SUBSCRIBER OBLIGATIONS
3.1 Compliance. When acting as the controller of Personal Data, Subscriber is responsible for
ensuring that (a) all notices have been given, and all such authorizations have been
obtained, as required under Applicable Data Protection Laws, for Glofox (and its Affiliates
and Sub-processors) to process Personal Data as contemplated by the Agreement and this
DPA; (b) it has complied, and will continue to comply, with all applicable laws relating to
privacy and data protection, including Applicable Data Protection Laws; and (c) it has, and
will continue to have, the right to transfer, or provide access to, Subscriber Data (including
any Personal Data) to Glofox for processing in accordance with the terms of the Agreement
and this DPA.
4. PROCESSING OF SUBSCRIBER DATA
4.1 Details of Processing. The duration of the processing, the nature and purpose of the
processing, the types of Personal Data and the categories of Data Subjects processed under
this DPA are further specified in Appendix 1 (Details of Processing).
4.2 Appointment; Subscriber Instructions. Subscriber appoints Glofox as a processor to
process Subscriber Data (including, without limitation, Personal Data) on behalf of, and in
accordance with, Subscriber’s instructions (a) as set forth in the Agreement, this DPA, and
as otherwise necessary to provide the Purchased Services to Subscriber (which may include
investigating security incidents and detecting and preventing exploits or abuse); (b) as
necessary to comply with applicable law, including Applicable Data Protection Laws; and (c)
as otherwise agreed in writing between the parties (collectively, “Permitted Purposes”).
4.3 Lawfulness of Instructions. Subscriber will ensure that its instructions comply with
Applicable Data Protection Laws. Subscriber acknowledges that Glofox is neither
responsible for determining which laws are applicable to Subscriber’s business nor whether
the Purchased Services or the Platform meet or will meet the requirements of such laws.
Subscriber will ensure that Glofox’s processing of Subscriber Data (including Personal
Data), when done in accordance with Subscriber’s instructions, will not cause Glofox to
violate any Applicable Data Protection Laws.
4.4 Additional Instructions. Additional instructions outside the scope of the Agreement or
this DPA will be mutually agreed to between the parties in writing.
5. GLOFOX PERSONNEL
4
5.1 Confidentiality. Glofox will ensure that its personnel with authorized access to Subscriber
Data have committed themselves to confidentiality or are under an appropriate statutory
obligation of confidentiality. Glofox will require all new hires at the company enter into
confidentiality agreements and that such confidentiality obligations survive the termination
of the personnel engagement.
5.2 Data Protection Officer. Glofox will appoint a data protection officer (“DPO”) where
such appointment is required by Applicable Data Protection Laws. Glofox’s DPO may be
reached at privacy@glofox.com.
6. SUB-PROCESSORS
6.1 Authorization for Sub-Processing. Subscriber agrees that (a) Glofox may continue to
engage the sub-processors identified in the List of Sub-Processors, available here, which Glofox
or its Affiliates may update from time to time; and (b) such Affiliates and sub-processors may
engage third-party processors to process Subscriber Data on Glofox’s behalf.
6.2 General Authorization for Onward Sub-Processors. Subscriber provides a general
authorization for Glofox to engage onward sub-processors provided that the following conditions
are met:(a) Glofox will restrict the onward sub-processor’s access to Personal Data only to what
is strictly necessary to provide Purchased Services and Glofox will prohibit the sub-processor
from processing Personal Data for any other purpose; (b) Glofox agrees to impose contractual
data protection obligations, including appropriate technical and organizational measures to
protect Personal Data on any sub-processor it appoints that ensure the sub-processor will not
Process Personal Data beyond the scope of processing description set out in Appendix 1
(Details of Processing), requires such sub-processor to protect Personal Data to the standard
required by Applicable Data Protection Laws and terminate automatically upon termination of
this DPA for any reason; and (c) where the engagement involves (or may involve) the cross
border transfer of Subscriber Data, incorporate into the contractual obligations referred to at (b)
above, (i) in the case of transfers from the EEA or under GDPR, SCCs, specifically Module 3
(Processor to Processor) of the SCCs, or (ii) in the case of transfers from the UK or under the
UK GDPR, Module 3 (Processor to Processor) of the SCCs, read in accordance with, and
deemed amended by, the provisions of Part 2 (Mandatory Clauses) of the UK IDTA, and, in all
cases ensure that the sub-processor has carried out a risk assessment of the arrangement that
involves any such transfer.
6.3 Objection Right for New Sub-Processors. Glofox may add or replace a sub-processor to
the List of Sub-Processors upon reasonable notice to Subscriber. Glofox will use commercially
reasonable efforts to provide Subscriber at least 15 days advance notice before appointing any
new sub-processor. If Subscriber objects to the appointment within the notice period, then Glofox
will work with Subscriber in good faith to find an alternative solution (which may include changing
the Subscriber’s configuration or use of Purchased Services to avoid processing of Personal
Data by the objected-to new sub-processor). If Glofox is unable to make available such change
within a reasonable period of time, which shall not exceed 30 days, Subscriber may terminate
the Order Form with respect only to those Purchased Services which cannot be provided by
Glofox without the use of the objected-to new sub-processor, by providing written notice to
5
Glofox. Glofox will refund Subscriber any prepaid Fees covering the remainder of the term of
such Order Form following the effective date of termination with respect to such terminated
Purchased Services, without imposing a penalty for such termination on Subscriber.
6.4 Liability. Glofox shall be liable for the acts or omissions of its sub-processors to the same
extent Glofox would be liable if performing the services of each sub-processor directly under the
terms of this DPA, unless otherwise set forth in the Agreement.
7. RIGHTS OF DATA SUBJECTS
7.1 Data Subject Requests. Glofox will, to the extent legally permitted, promptly notify
Subscriber if Glofox receives a request (including, without limitation, a Third-Party Request) from
a Data Subject to exercise the Data Subject’s rights of access, right to rectification, restriction of
processing, erasure (the right to be forgotten), data portability, object to the processing, or its
right not to be subject to an automated individual decision making (collectively, “Data Subject
Request”). Taking into account the nature of the processing, Glofox shall assist Subscriber by
appropriate technical and organizational measures, insofar as this is possible, for the fulfillment
of the Subscriber’s obligation to respond to a Data Subject Request under Applicable Data
Protection Laws. In addition, to the extend Subscriber, in its use of the Platform, does not have
the ability to address a Data Subject Request, Glofox shall upon Subscriber’s request use
commercially reasonable efforts to assist Subscriber in responding to such Data Subject
Request, to the extent Glofox is legally permitted to do so and the response to such Data Subject
Request is required by Applicable Data Protection Laws. To the extent legally permitted,
Subscriber shall be responsible for any costs arising from Glofox’s provision of such assistance.
7.2 Data Protection Impact Assessment. Upon Subscriber’s request, Glofox shall provide
Subscriber with reasonable cooperation and assistance needed to fulfill Subscriber’s obligations
under Applicable Data Protection Laws to carry out a data protection impact assessment related
to Subscriber’s use of Purchased Services, to the extent Subscriber does not otherwise have
access to the relevant information, and to the extent such information is available to Glofox.
8. RETURN OR DELETION OF SUBSCRIBER DATA
8.1 Deletion Upon Termination. Glofox shall return Subscriber Data to Subscriber and, to the
extent permitted by law, delete Subscriber Data in accordance with the procedures, fees and
timeframes as specified in the Agreement.
8.2 Retention. Notwithstanding Section 8.1 above, Glofox will use commercially reasonable
efforts to implement and maintain appropriate retention periods for Subscriber Data in accordance
with Applicable Data Protection Laws. Glofox will delete Personal Data as soon as retention of such
data is no longer necessary for the purposes of processing under this DPA, subject only to situations
where a longer period is required by Applicable Data Protection Laws.
9. SECURITY
6
9.1 Security Measures. Glofox has implemented and will maintain for the duration of the
Agreement, appropriate technical and organizational measures designed to protect Personal
Data against Security Breaches. These measures shall comply, at a minimum, with applicable
law and the measures identified here. Subscriber acknowledges that Glofox may change or
update the security measures currently in place as new threats to Personal Data are identified
or evolve.
9.2 Security Breach Notification. Upon becoming aware of a Security Breach involving
Personal Data, Glofox will, without undue delay (and in any event within 72 hours), notify
Subscriber at Subscriber’s email address associated with Subscriber’s Glofox account.
9.3 Glofox Response to Security Breach. Glofox will make reasonable efforts to identify
the source of a Security Breach, and to the extent the Security Breach is caused by Glofox’s
violation of this DPA, remediate the cause of such incident. Glofox will provide Subscriber
with such assistance and information about the Security Breach as may be reasonably
necessary for Subscriber to be able to fulfill its breach reporting obligations under Applicable
Data Protection Laws. Any Glofox notification of or response to a Security Breach shall not
be construed as an acknowledgement of fault by Glofox, or of Glofox liability with respect to
such Security Breach.
9.4 Subscriber’s Security Obligations. Subscriber is solely responsible for its and its
Authorized Users’ use of the Purchased Services, and its/their access to the Platform,
including safeguarding all log-in credentials or account passwords and otherwise ensuring
a level of security appropriate to the risks associated with its Subscriber Data .
10. AUDIT RIGHTS
10.1 Audit Rights. The parties acknowledge that Subscriber must be able to assess Glofox’s
compliance with its obligations under Applicable Data Protection Laws and this DPA insofar as
Glofox is acting as a processor of Personal Data.
10.2 Audit Process & Response. Upon Subscriber’s written request, and subject to reasonable
confidentiality controls and time intervals, Glofox will contribute to audits and make available to
Subscriber a copy of Glofox’s most current independent audit report to demonstrate compliance
with its obligations. Subscriber agrees that any audit rights granted by Applicable Data Protection
Laws will be satisfied by Glofox providing this independent audit report. To the extent that
Glofox’s provision of an audit report does not provide sufficient information or Subscriber is
required to respond to a regulatory authority audit, Subscriber agrees to a mutually agreed-upon
audit plan with Glofox that (a) ensures the use of an independent third party; (b) provides notice
to Glofox in a timely fashion; (c) requests access only during business hours; (d) accepts billing
to Subscriber at Glofox’s then-current rates; (e) occurs no more than once annually; (f) restricts
its findings to only data relevant to Subscriber; and (g) obligates Subscriber, to the extent
permitted by law or regulation, to keep confidential any information gathered that, by its nature,
should be confidential.
11. JURISDICTION-SPECIFIC PROVISIONS
7
11.1 Processing in Ireland. Subscriber acknowledges that Glofox’s primary processing facilities
are located in Ireland. Subscriber understands that Glofox and its sub-processors remain in the
EEA, however it is possible that some sub-processors may transfer and process Personal Data
to and in the United States and other locations in which Glofox, its Affiliates or its sub-processors
maintain data processing operations. Glofox shall ensure that such transfers are made in
compliance with Applicable Data Protection Laws and this DPA.
11.2 Jurisdiction Specific Terms. To the extent Glofox processes Personal Data originating
from and protected by Applicable Data Protection Laws in one or more of the jurisdictions listed
below, terms for each jurisdiction shall apply as set forth in Appendix 2 (Jurisdiction Specific
Terms).
11.3 Cross Border Data Transfer Mechanisms. Glofox utilizes Standard Contractual Clauses
(SCCs) as the transfer mechanism to any transfers of Personal Data from Europe to countries
which do not ensure an adequate level of data protection within the meaning of Applicable Data
Protection Laws. Where Glofox is the Processor of such Personal Data on Subscriber’s behalf,
for transfers from the UK or under the UK GDPR, Module 2 of the SCCs, read in accordance
with, and deemed amended by, the provisions of Part 2 (Mandatory Clauses) of the UK IDTA
(contained here) is incorporated into this DPA and will come into effect upon the commencement
of any relevant Restricted Transfer between the Subscriber (as “data exporter”) and Glofox (as
“data importer”) (or onward transfer), subject to the following changes:
a. Clause 13(a) – Supervision. The following shall be inserted: The supervisory authority
with responsibility for ensuring compliance by the data exporter with Regulation (EU)
2016/679 as regards the data transfer, shall be the UK’s Information Commissioner’s
Office.
b. Clause 17 – Governing law shall read “These Clauses shall be governed by the laws of
England and Wales.”
c. Clause 18(b) – Choice of forum and jurisdiction. The Member State shall be the courts
of England and Wales.
d. For the purposes of Table 4 in Part 1 (Tables) of the UK IDTA, the parties select the
“neither party” option.
e. Part 1 (Tables) of the UK IDTA shall be deemed to be pre-populated with the relevant
sections of this DPA.
For transfers from the EEA or under GDPR, the SCCs (contained here), specifically Module 2 of
the SCCs, is incorporated into this DPA and will come into effect upon the commencement of
any relevant Restricted Transfer, between the Subscriber (as “data exporter”) and Glofox (as
“data importer”) (or onward transfer), subject to the following changes:
a. Clause 7 – Docking clause of the SCCs shall apply.
8
b. Clause 9 – Use of sub-processors. “Option 1” shall apply and the “time period” shall be
at least 15 days.
c. Clause 11(a) – Redress. The optional language shall not apply.
d. Clause 13(a) – Supervision. The following shall be inserted: The supervisory authority
with responsibility for ensuring compliance by the data exporter with Regulation (EU)
2016/679 as regards the data transfer, as indicated in Appendix 3 (Details of Transfer) to
this DPA, shall act as competent supervisory authority.
e. Clause 17 – Governing law. “Option 1” shall apply and the “Member State” shall be
Ireland.
f. Clause 18 – Choice of forum and jurisdiction. The Member State shall be Ireland.
g. Annex 1 to the SCCs shall be deemed to be pre-populated with the relevant sections of
Appendix 1 (Details of Processing) to this DPA and the processing operations as
described in Appendix 3 (Details of Transfer) of this DPA.
h. Annex 2 to the SCCs shall be deemed to be pre-populated with the security measures
listed in Section 9.1 to this DPA.
i. Annex 3 to the SCCs shall be deemed pre-populated with the details included in the List
of Sub-Processors included in Section 6.1 to this DPA.
Where Glofox is the Controller of such Personal Data on Subscriber’s behalf, for transfers from
the UK or under the UK GDPR, Module 1 of the SCCs, read in accordance with, and deemed
amended by, the provisions of Part 2 (Mandatory Clauses) of the UK IDTA (contained here) is
incorporated into this DPA and will come into effect upon the commencement of any relevant
Restricted Transfer between the Subscriber (as “data exporter”) and Glofox (as “data importer”)
(or onward transfer), subject to the following changes:
a. Clause 13(a) – Supervision. The following shall be inserted: The supervisory authority
with responsibility for ensuring compliance by the data exporter with Regulation (EU)
2016/679 as regards the data transfer, shall be the UK’s Information Commissioner’s
Office.
b. Clause 17 – Governing law shall read “These Clauses shall be governed by the laws of
England and Wales.”
c. Clause 18(b) – Choice of forum and jurisdiction. The Member State shall be the courts
of England and Wales.
d. For the purposes of Table 4 in Part 1 (Tables) of the UK IDTA, the parties select the
“neither party” option.
9
e. Part 1 (Tables) of the UK IDTA shall be deemed to be pre-populated with the relevant
sections of this DPA.
Where Glofox is the Controller of such Personal Data on Subscriber’s behalf, for transfers from
the EEA or under GDPR, the SCCs (contained here), specifically Module 1 of the SCCs is
incorporated into this DPA and will come into effect upon the commencement of any relevant
Restricted Transfer, between the Subscriber (as “data exporter”) and Glofox (as “data importer”)
(or onward transfer), subject to the following changes:
a. Clause 7 – Docking clause of the SCCs shall apply.
b. Clause 11(a) – Redress. The optional language shall not apply.
c. Clause 13(a) – Supervision. The following shall be inserted: The supervisory authority
with responsibility for ensuring compliance by the data exporter with Regulation (EU)
2016/679 as regards the data transfer, as indicated in Appendix 3 (Details of Transfer) to
this DPA, shall act as competent supervisory authority.
d. Clause 17 – Governing law. “Option 1” shall apply and the “Member State” shall be
Ireland.
e. Clause 18 – Choice of forum and jurisdiction. The Member State shall be Ireland.
f. Annex 1 to the SCCs shall be deemed to be pre-populated with the relevant sections of
Appendix 1 (Details of Processing) to this DPA and the processing operations as
described in Appendix 3 (Details of Transfer) of this DPA.
g. Annex 2 to the SCCs shall be deemed to be pre-populated with the security measures
listed in Section 9.1 to this DPA.
h. Annex 3 to the SCCs shall be deemed pre-populated with the details included in the List
of Sub-Processors included in Section 6.1 to this DPA.
It is not the intention of either party, nor the effect of this DPA, to contradict or restrict any of the
provisions set forth in the applicable SCCs. Accordingly, if and to the extent the applicable SCCs
conflict with any provision of this DPA regarding the transfer of Personal Data outside of Europe,
the SCCs shall prevail to the extent of such conflict. In the event that the form of the SCCs are
changed, replaced or subject to additional safeguards (including but not limited to specific
technical and organizational measures) by the relevant authorities under Applicable Data
Protection Laws, the Subscriber (as Controller) should notify Glofox (as Processor) of such
change and the parties shall work together in good faith to implement any such change. Provided
that such form is accurate and applicable to Glofox (as Processor), such form shall then be
binding upon the parties when both parties have executed the revised form, subject to the
expiration of a grace period, determined by the relevant Supervisory Authorities.
10
In respect of any transfers of Personal Data to the United Kingdom, if the United Kingdom is, at
any time during the term of this DPA, no longer recognized by the European Commission as
providing an adequate level of protection for Personal Data and is not covered by an alternative
framework recognized by the relevant authorities or courts as providing an adequate level of
protection for Personal Data, then such transfer shall be considered to be a transfer from the
EEA or under GDPR and where the transfer is a transfer from Glofox to the Subscriber, or an
onward transfer to a sub-processor, the provisions governing Restricted Transfers from the EEA
or under GDPR shall apply to such transfers until the earlier of:
a. the date upon which the European Commission issues a new decision recognizing the
United Kingdom as providing an adequate level of protection for Personal Data;
b. the date upon which Glofox either adopts itself where the transfer is a transfer from Glofox
to the Subscriber or directs the Subscriber to adopt, and the Subscriber so adopts, where
the transfer is a transfer from the Subscriber to a sub-processor an alternative appropriate
safeguarding measure for transfers from the EEA to the United Kingdom under Articles
46 to 49 of the GDPR;
c. the date upon which the SCCs cease to be considered an appropriate safeguard for the
protection of Personal Data; or
d. the date upon which the Subscriber stops processing Personal Data under the DPA.
In the event that the provisions of Sections 6.2(c) or 11.3 of this DPA are not complied with by
the Subscriber in Glofox’s opinion, acting reasonably, or where the SCCs, or the UK IDTA cease
to be considered an appropriate safeguard for the protection of Personal Data by the European
Commission, the Irish Data Protection Commission, the UK ICO or court of competent authority
and no equivalent, successor mechanism is issued by the European Commission, the Irish Data
Protection Commission or the UK ICO then without prejudice to any other rights or remedies that
Glofox may have, the parties agree that (a) Glofox shall have the right to require that the transfers
of Personal Data in question shall pause and that the Subscriber shall immediately pause all
such transfers once it receives notification from Glofox to that effect and (b) where Glofox, in its
sole discretion, determines that this DPA is no longer viable due to either the non-compliance
referred to in this clause or cessation of the SCCs or the UK IDTA being considered an
appropriate safeguard / transfer mechanism then Glofox shall be entitled to terminate this DPA
(and the Agreement) with immediate effect by written notice to the Subscriber.
12. LIMITATION OF LIABILITY
12.1 Liability Limits. Each party’s and all of its Affiliates’ liability taken together in the aggregate
arising out of or related to this DPA (including the SCCs) shall be subject to the exclusions and
limitations of liability set forth in the Agreement.
12.2 Party Limitation. Any Claim made against Glofox or its Affiliates under or in connection
with this DPA (including, where applicable, SCCs) shall be brought solely by Subscriber that is
a party to the Agreement.
11
12.3 No Limitation on Individual Data Subject Rights. In no event shall any party limit its
liability with respect to any individual Data Subject’s rights under Applicable Data Protection
Laws.
13. GENERAL PROVISIONS
13.1 Conflict; Order of Precedence. If there is a conflict between the Agreement and this
DPA, the terms of this DPA will prevail. The order of precedence will be: (a) this DPA; (b)
then the Order Form; (c) then the Privacy Statement; and (d) then the Terms. To the extent
there is any conflict between the SCCs, and any other terms in this DPA, the Privacy
Statement or the Terms, the provisions of the SCCs will prevail. In the event (and to the
extent only) of a conflict (whether actual or perceived) among Applicable Data Protection
Laws, the parties (or relevant party as the case may be) shall comply with the more onerous
requirement or standard which shall, in the event of a dispute in that regard, be solely
determined by Glofox.
13.2 Modification. Notwithstanding anything else to the contrary in the Agreement, Glofox
reserves the right to make any modification to this DPA as may be required to comply with
Applicable Data Protection Laws.
13.3 Agreement. Except as amended by this DPA, the Agreement will remain in full force
and effect. Any claims brought in connection with this DPA will be subject to the terms and
conditions, including, but not limited to, the exclusions and limitations set forth in the
Agreement.
12
APPENDIX 1
DETAILS OF PROCESSING
Contact Person for Glofox as Kathleen Kruger
Processor Data Protection & Compliance Officer
privacy@abcfitness.com
Categories of Data Subjects: The categories of Data Subjects whose Personal Data is
processed include:
▪ Subscriber, including (a) Subscriber company
(i.e., the legal entity with licensed rights to access
and use the Platform and Purchased Services);
and (b) Subscriber’s Authorized Users (i.e.,
Subscriber’s employees, Subscriber’s Affiliates
employees, or Subscriber’s permitted third party
agent for whom Subscriber creates a unique
username and password under Subscriber’s
Glofox account); and
▪ End Users (i.e., Subscriber’s members, clients or
customers with authorization to create an End
User account to access and use the Platform).
Categories of Personal Data: Subscriber may upload, submit, or otherwise provide
certain Personal Data to the Platform, the extent of which
is typically determined and controlled by Subscriber in its
sole discretion, and may include the following types of
Personal Data:
▪ Identity Data includes company name, email
address, phone number, corporate office address,
business location address, tax identification
information, and company contact information
(including name, email address and phone
number);
▪ Account Data includes Subscriber’s username,
password, communication preferences, feedback
and any survey responses;
▪ Technical Data includes Subscriber’s internet
protocol (IP) address, login data, browser type and
version, time zone settings and location, browser
plug-in types and versions, type and version of
13
operating system, hardware version, device
settings, software types, device manufacturer and
model, language, and other technology on the
device Subscriber uses to access the Platform;
▪ Usage Data includes information about how
Subscriber uses the Platform;
▪ Marketing & Communications Data includes
Subscriber’s chosen preferences for receiving
marketing or other types of communications from
Glofox or its Affiliates.
▪ Transaction Data includes commercial
information such as Subscriber’s bank account,
transaction history, and tokenized card information
needed to complete a purchase or make a
transaction; and
▪ End User Data includes an End User’s name,
email, address, phone number, tokenized payment
account information, communication preferences,
bookings and purchase history, check-in logs, and
other information pertaining to an End User’s
profile or use of Subscriber’s facilities, products or
services.
Sensitive Personal Glofox does not want to, nor does it intentionally, collect
Information Processed or process any Sensitive Personal Information in
(if applicable): connection with its provision of Purchased Services to
Subscriber.
Frequency of Processing: Continuous, as determined by Subscriber and End
User.
Type of Processing: Electronically.
Subject Matter and Nature of Glofox provides a hosted club management platform to
Processing: owners and operators of health clubs and fitness studios
in the fitness industry, as more particularly described in
the Agreement.
The subject matter of the data processing under this DPA
is the Subscriber Data (which includes Personal Data).
Subscriber Data will be processed in accordance with the
14
Agreement (including this DPA) and may be subject to the
following processing activities:
▪ Storage and other processing necessary to
provide, maintain and improve the Platform and
Purchased Services provided to Subscriber
pursuant to the Agreement; and/or
▪ Disclosures in accordance with the Agreement
and/or as compelled by Applicable Data Protection
Laws.
Purpose of the Processing: Glofox shall only process Personal Data for the
Permitted Purposes, which shall include:
▪ as set forth in the Agreement, this DPA, and as
otherwise necessary to provide the Purchased
Services to Subscriber (which may include
investigating security incidents and detecting and
preventing exploits or abuse);
▪ as necessary to comply with applicable law,
including Applicable Data Protection Laws; and
▪ as otherwise agreed in writing between the parties.
Duration of Processing and Glofox will process Personal Data as outlined in Section
Period for Which Personal 8.2 (Retention) of the DPA.
Data will be Retained:
15
APPENDIX 2
JURISDICTION SPECIFIC TERMS
(a) Australia:
(i) The definition of “Applicable Data Protection Laws” shall include the Australian Privacy
Principles and the Australian Privacy Act (1988).
(ii) The definition of “Personal Data” includes “Personal Information” as defined under
Applicable Data Protection Laws.
(iii) The definition of “Sensitive Data” includes “Sensitive Information” as defined under
Applicable Data Protection Laws.”
(b) California:
(i) The definition of “Applicable Data Protection Laws” includes the CCPA.
(ii) The definition of “Personal Data” includes “Personal Information” as defined under
Applicable Data Protection Laws and, for clarity, includes any Personal Information
contained within Glofox Account Data, Subscriber Data, and Usage Data.
(iii) The definition of “data subject” includes “Subscriber” as defined under Applicable Data
Protection Laws. Any data subject rights, as described in Section 7.1 (Data Subject
Requests) of this DPA, apply to Subscriber rights. With regard to data subject requests,
Glofox can only verify a request from Subscriber and not from any of Subscriber’s End
Users or any third party.
(iv) The definition of “controller” includes “Business” as defined under Applicable Data
Protection Laws.
(v) The definition of “processor” includes “Service Provider” as defined under Applicable
Data Protection Laws.
(vi) Glofox will process, retain, use, and disclose personal data only as necessary to
provide the Purchased Services under the Agreement, which constitutes a business
purpose. Glofox agrees not to (A) sell (as defined by the CCPA) Subscriber’s Subscriber
Data (including Personal Data) or Subscriber’s End User’s Personal Data; (B) retain, use,
or disclose Subscriber’s Personal Data for any commercial purpose (as defined by the
CCPA) other than providing the Purchased Services; or (C) retain, use, or disclose
Subscriber’s Personal Data outside of the scope of the Agreement.
(vii) Glofox certifies that its sub-processors as described in its List of Sub-Processors are
Service Providers under Applicable Data Protection Laws with whom Glofox has entered
16
into a written contract that includes terms substantially similar to this DPA. Glofox
conducts appropriate due diligence on its sub-processors.
(viii) Glofox will implement and maintain reasonable security procedures and practices
appropriate to the nature of the personal data it processes as set forth in Section 9
(Security) of this DPA.
(c) Canada:
(i) The definition of “Applicable Data Protection Laws” includes the Canada Personal
Information Protection and Electronic Documents Act (“PIPEDA”).
(ii) Glofox’s sub-processors as described in its List of Sub-Processors are third parties
under Applicable Data Protection Laws with whom Glofox has entered into a written
contract that includes terms substantially similar to this DPA. Glofox has conducted
appropriate due diligence on its sub-processors.
(iii) Glofox will implement technical and organizational measures as set forth in Section 9
(Security) of this DPA.
(d) European Economic Area (EEA):
(i) The definition of “Applicable Data Protection Laws” includes the GDPR.
(ii) When Glofox engages a sub-processor under Section 6 of this DPA, it will:
(A) require any appointed sub-processor to protect Personal Data to the standard
required by Applicable Data Protection Laws, such as including the same data
protection obligations referred to in Article 28(3) of the GDPR, in particular
providing sufficient guarantees to implement appropriate technical and
organizational measures in such a manner that the processing will meet the
requirements of the GDPR, and
(B) require any appointed sub-processor to (1) agree in writing to only process
personal data in a country that the European Union has declared to have an
“adequate” level of protection; or (2) only process Personal Data on terms
equivalent to the Standard Contractual Clauses or pursuant to a Binding Corporate
Rules approval granted by competent European Union data protection authorities.
(iii) Notwithstanding anything to the contrary in this DPA or in the Agreement (including,
without limitation, either party’s indemnification obligations), neither party will be
responsible for any GDPR fines issued or levied under Article 83 of the GDPR against
the other party by a regulatory authority or governmental body in connection with such
other party’s violation of the GDPR.
17
(iv) Subscriber acknowledges that Glofox, as a controller of Usage Data, may be required
under Applicable Data Protection Laws to notify a regulatory authority of Security
Breaches involving Subscriber’s Usage Data. If a regulatory authority requires Glofox to
notify impacted data subjects with whom Glofox does not have a direct relationship (for
example, Subscriber’s End Users), Glofox will notify Subscriber of this requirement.
Subscriber will provide reasonable assistance to Glofox to notify the impacted data
subjects.
(e) Hong Kong:
(i) The definition of “Applicable Data Protection Laws” includes Hong Kong’s Personal
Data Privacy Ordinance (Ch. 486) (“PDPO”)
(ii) Glofox will process Personal Data to a standard of protection in accordance with the
PDPO by implementing adequate technical and organizational measures as set forth in
Section 9 (Security) of this DPA and complying with the terms of the Agreement.
(f) Mexico:
(i) The definition of “Applicable Data Protection Laws” includes Mexico’s Federal Law on
the Protection of Personal Data held by Private Parties (“Mexico Data Protection Law”)
and its supplementary regulation (“Mexico Data Protection Regulations”).
(ii) Glofox will process Personal Data to a standard of protection in accordance with the
Mexoci Data Protection Law and Mexico Data Protection Regulations by implementing
adequate technical and organizational measures as set forth in Section 9 (Security) of
this DPA and complying with the terms of the Agreement.
(g) New Zealand:
(i) The definition of “Applicable Data Protection Laws” includes the New Zealand Privacy
Act of 2020 (“NZ Privacy Act”).
(ii) Glofox will process Personal Data to a standard of protection in accordance with the
NZ Privacy Act by implementing adequate technical and organizational measures as set
forth in Section 9 (Security) of this DPA and complying with the terms of the Agreement.
(h) Singapore:
(i) The definition of “Applicable Data Protection Laws” includes the Singapore Personal
Data Protection Act 2012 (No. 26 of 2012) (“PDPA”).
(ii) Glofox will process Personal Data to a standard of protection in accordance with the
PDPA by implementing adequate technical and organizational measures as set forth in
Section 9 (Security) of this DPA and complying with the terms of the Agreement.
18
(i) United Kingdom (UK):
(i) References in this DPA to GDPR will to that extent be deemed to be references to the
corresponding laws of the UK GDPR.
(ii) When Glofox engages a sub-processor under Section 6 of this DPA, it will:
(A) require any appointed sub-processor to protect Personal Data to the standard
required by Applicable Data Protection Laws, such as including the same data
protection obligations referred to in Article 28(3) of the GDPR, in particular
providing sufficient guarantees to implement appropriate technical and
organizational measures in such a manner that the processing will meet the
requirements of the GDPR; and
(B) require any appointed sub-processor to (1) agree in writing to only process
personal data in a country that the United Kingdom has declared to have an
“adequate” level of protection or (2) only process Personal Data on terms
equivalent to the Standard Contractual Clauses or pursuant to a Binding Corporate
Rules approval granted by competent United Kingdom data protection authorities.
(iii) Notwithstanding anything to the contrary in this DPA or in the Agreement (including,
without limitation, either party’s indemnification obligations), neither party will be
responsible for any UK GDPR fines issued or levied under Article 83 of the UK GDPR
against the other party by a regulatory authority or governmental body in connection with
such other party’s violation of the UK GDPR.
(iv) Subscriber acknowledges that Glofox, as a controller of Usage Data, may be required
under Applicable Data Protection Laws to notify a regulatory authority of Security
Breaches involving Subscriber’s Usage Data. If a regulatory authority requires Glofox to
notify impacted data subjects with whom Glofox does not have a direct relationship (for
example, Subscriber’s End Users), Glofox will notify Subscriber of this requirement.
Subscriber will provide reasonable assistance to Glofox to notify the impacted data
subjects.
19
APPENDIX 3
DETAILS OF TRANSFER
1. LIST OF PARTIES
Data exporter(s): Identity and contact details of the data exporter(s) and, where applicable,
of its/their data protection officer and/or representative in the European Union.
Name: Subscriber and its Affiliates
Address:
Contact Name: Contact Position: Contact Details:
Activities relevant to the data transferred under these Clauses: Performance of the Purchased
Services pursuant to the Agreement.
Signature: Print Name: Date:
Role: For the purposes of the EU Controller-to-Processor Transfer Clauses, Subscriber and its
Affiliates is a Controller. For the purposes of the EU Processor-to-Processor Transfer Clauses,
Subscriber and its Affiliates is a Processor.
Data importer(s): Identity and contact details of the data importer(s), including any contact
person with responsibility for data protection.
Name: Zappy Limited d/b/a Glofox
Address: 23 South Williams St., Dublin 2, Ireland
Contact Name: Contact Position: Contact Details:
Kathleen Kruger Data Protection & Compliance Officer kathleen.kruger@abcfitness.com
Activities relevant to the data transferred under these Clauses: Performance of the Purchased
Services pursuant to the Agreement.
20
Kathleen Kruger
Data Protection & Compliance Officer
Signature: Print Name: Date:
Role: Processor
2. CATEGORIES OF DATA SUBJECTS WHOSE PERSONAL DATA IS TRANSFERRED
Subscriber may submit Personal Data to the Platform, the extent of which is determined and
controlled by Subscriber in its sole discretion, and which may include, but is not limited to
Personal Data relating to the following categories of data subjects:
▪ Subscriber’s End Users (who are natural persons);
▪ Subscriber’s prospects, business partners and vendors (who are natural persons);
▪ Subscriber’s employees, agents and representatives (who are natural persons); and
▪ Subscriber’s Authorized Users of the Purchased Services.
3. CATEGORIES OF PERSONAL DATA TRANSFERRED
Subscriber may submit Personal Data to the Platform, the extent of which is determined by
Subscriber in its sole discretion, and which may include, but is not limited to the following
categories of Personal Data:
▪ Identity Data includes company name, email address, phone number, corporate office
address, business location address, tax identification information, and company contact
information (including name, email address and phone number);
▪ Account Data includes Subscriber’s username, password, communication preferences,
feedback and any survey responses;
▪ Technical Data includes Subscriber’s internet protocol (IP) address, login data, browser
type and version, time zone settings and location, browser plug-in types and versions,
type and version of operating system, hardware version, device settings, software types,
device manufacturer and model, language, and other technology on the device
Subscriber uses to access the Platform;
▪ Usage Data includes information about how Subscriber uses the Platform;
▪ Marketing & Communications Data includes Subscriber’s chosen preferences for
receiving marketing or other types of communications from Glofox or its Affiliates.
21
▪ Transaction Data includes commercial information such as Subscriber’s bank account,
transaction history, and tokenized card information needed to complete a purchase or
make a transaction; and
▪ End User Data includes an End User’s name, email, address, phone number, tokenized
payment account information, communication preferences, bookings and purchase
history, check-in logs, and other information pertaining to an End User’s profile or use of
Subscriber’s facilities, products or services.
4. SENSITIVE DATA TRANSFERRED (IF APPLICABLE)
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take
into consideration the nature of the data and the risks involved, such as for instance strict
purpose limitation, access restrictions (including access only for staff having followed
specialized training), keeping a record of access to the data, restrictions for onward transfers or
additional security measures.
No Sensitive Data will be transferred.
5. FREQUENCY OF THE TRANSFER
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous
basis).
Continuous basis depending on the use of the Purchased Services by Subscriber.
6. NATURE OF THE PROCESSING
The nature of the Processing is the performance of the Purchased Services pursuant to the
Agreement.
7. PURPOSE OF PROCESSING, THE DATA TRANSFER AND FURTHER PROCESSING
Glofox will process Personal Data as necessary to perform the Purchased Services pursuant to
the Agreement, as further specified in the Privacy Statement and DPA, and as further instructed
by the Subscriber in its use of Purchased Services.
8. DURATION OF PROCESSING
The period for which the personal data will be retained, or, if that is not possible, the criteria
used to determine that period:
Subject to Section 8 of the DPA, Glofox will process Personal Data for the duration of the
Agreement, unless otherwise agreed upon in writing.
9. SUB-PROCESSOR TRANSFERS
22
For transfers to (sub-) processors, also specify subject matter, nature and duration of the
processing:
As per 6 above, the sub-processor will process Personal Data as necessary to perform the
Purchased Services pursuant to the Agreement. Subject to Section 8 of the DPA, the sub-
processor will process Personal Data for the duration of the Agreement, unless otherwise
agreed in writing.
Identities of the sub-processors used for the provision of Purchased Services and their country
of location are described in the List of Sub-Processors, available here.
10. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with clause 13:
Irish Data Protection Commission
11. TECHNICAL AND ORGANIZATIONAL MEASURES
Data importer will maintain administrative, physical and technical safeguards for protection of
the security, confidentiality and integrity of Personal Data uploaded to the Platform, as described
in Section 9.1 of the DPA, and accessible here, or otherwise made reasonably available by data
importer. Data importer will not materially decrease the overall security of the Platform during
the Agreement’s Term. Data Subject requests will be handled in accordance with Section 7.1 of
the DPA.
23