Data Processing Agreement

This DPA covers personal data you upload or ingest into your workspace: lead and contact records, notes, intake form answers, Instagram conversations, and booking data (together, workspace data). For this data you are the controller and TrainerCue is the processor. For your own account data (your email, login, billing state), TrainerCue is an independent controller under the Privacy Policy.

• We process workspace data only to provide the service and on your documented instructions (using the product is an instruction), never for our own purposes, never for advertising, and we do not sell it.
• Every person we authorize to process workspace data is bound by a duty of confidentiality.
• We protect it with the measures described in Security and the Privacy Policy: encryption in transit and at rest, database-enforced workspace isolation with automated adversarial testing, application-layer encryption of integration credentials, and short-lived signed links for stored files.
• We assist you, taking into account the nature of the processing, in answering data subject requests aimed at you, and in meeting your own security and assessment obligations, including making available the information reasonably necessary to demonstrate compliance and cooperating with reasonable assessments.
• If we become aware of a personal data breach affecting workspace data, we notify you without undue delay.
• At termination of the service we delete workspace data, or return it if you export first; the Terms give you a 30-day export window. Deletion follows the retention rules in the Privacy Policy.

You authorize the subprocessors listed at Subprocessors, which names each company and what it processes. When we add or replace a subprocessor we update that page promptly, before or as soon as our own vendors' notice windows allow, and the page's change log shows what changed and when. If you object to a new subprocessor on reasonable data-protection grounds and we cannot offer a workaround, you may terminate and export your data.

Each subprocessor is bound by a written agreement imposing data-protection obligations no less protective than this DPA, including confidentiality and the same flow-down duty.

TrainerCue stores and processes workspace data in the United States and is offered to United States coaches. If and to the extent any processing of personal data subject to the GDPR or UK GDPR nevertheless occurs under this DPA, the parties agree that the European Commission's Standard Contractual Clauses (Module Two: controller to processor), and for UK data the UK International Data Transfer Addendum, are automatically incorporated into this DPA by reference, with you as data exporter and TrainerCue as data importer, completed with the processing details described in Scope and the measures described in Security.

You are responsible for having a lawful basis, and any consent the law requires, for the personal data you put into your workspace and the outreach you send; for the accuracy of your instructions; and for answering the data subject requests directed at you as controller (the product's view, edit, export, and delete tools are there for that). If a request reaches us directly, we will pass it to you or coordinate through our request process.

This DPA is accepted in-app by the workspace owner; we store the acceptance (who, when, which version) as a compliance record. The liability terms of the Terms of Service apply to this DPA.