Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between CombatScore (“Processor”) and the gym owner or business entity (“Controller”) using CombatScore's gym management services.

This DPA governs the processing of personal data that the Controller submits to or collects through CombatScore on behalf of the Controller's gym members, coaches, and staff.

• Personal Data: Any information relating to an identified or identifiable natural person, including names, email addresses, phone numbers, training data, health-related information (injuries, body measurements), and payment information.
• Processing: Any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, and erasure.
• Sub-processor: Any third party engaged by CombatScore to process personal data on behalf of the Controller.

CombatScore processes personal data solely for the purpose of providing gym management services as described in the Terms of Service, including: member management, class scheduling, attendance tracking, billing, digital waivers, SMS communications, AI-powered coaching tools, and gym website hosting.

The Processor shall process personal data only on documented instructions from the Controller, unless required by applicable law.

The Controller authorizes CombatScore to engage the following sub-processors:

CombatScore will notify the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object.

CombatScore implements the following technical and organizational security measures:

• Row-Level Security (RLS) policies on all database tables ensuring data isolation between gyms
• Encryption in transit (TLS 1.3) for all API communications
• Encryption at rest for all stored data (Supabase/AWS managed encryption)
• JWT-based authentication with short-lived tokens
• Webhook signature verification (HMAC-SHA256) for all inbound integrations
• Timing-safe secret comparison to prevent side-channel attacks
• Input sanitization and XSS prevention on all user-generated content
• Rate limiting on all API endpoints
• Admin audit logging for all privileged operations

In the event of a personal data breach, CombatScore will notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach. The notification will include: the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken to address the breach.

CombatScore will assist the Controller in fulfilling data subject requests including: access, rectification, erasure, restriction of processing, data portability, and objection to processing. The Controller can export gym data (members, attendance, sessions) in CSV format from the admin panel.

Upon termination of the Controller's account, CombatScore will delete or return all personal data within 30 days, unless retention is required by applicable law. The Controller may request a data export before account termination.

Personal data is primarily processed in the United States. For data originating from the EEA, UK, or Switzerland, CombatScore relies on Standard Contractual Clauses (SCCs) as the transfer mechanism, supplemented by the security measures described in Section 5.

For DPA-related inquiries:
legal@combatscore.app