Data Processing Addendum (DPA)
1. Scope and Roles of the Parties
In providing the Uplift platform to your clients, you (the Coach or Gym Organization) act as the Data Controller, determining the purposes and means of processing athlete personal and health data. Uplift acts as the Data Processor, handling data exclusively in accordance with your documented instructions.
2. Technical and Organizational Measures (TOMs)
Uplift implements and maintains robust physical, technical, and administrative safeguards to ensure a level of security appropriate to the risk, including:
- Pseudonymization and AES-256 encryption of sensitive biometric media.
- Continuous vulnerability scanning and automated intrusion detection.
- Strict least-privilege internal employee access controls.
- Daily encrypted off-site database backups with tested point-in-time recovery.
3. Authorized Subprocessors
The Controller acknowledges and agrees that Uplift engages the following third-party subprocessors to deliver platform capabilities:
| Subprocessor | Service Provided | Entity Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, database hosting & encrypted S3 storage | US-East (N. Virginia), EU (Frankfurt) |
| Stripe, Inc. | Subscription billing & coach merchant payout processing | United States (Global PCI Level 1) |
| Twilio | Automated SMS check-in reminder notifications to athletes | United States |
| Cloudflare | DDoS mitigation, web application firewall (WAF) & edge caching | Global Edge Network |
4. Security Incident Notification
In the event of a confirmed personal data breach affecting your athlete records, Uplift shall notify you without undue delay and in any event within forty-eight (48) hours of becoming aware of the incident.