This Data Processing Agreement ("DPA") forms part of the Terms of Service between COSMIC ATMAN SRL ("Processor", "we") and the coach, club or organisation that uses Train Climb to train athletes ("Controller", "you"). It applies to personal data of your athletes that we process on your behalf, as required by Article 28 of the GDPR.
1. Subject and duration
| Subject | Hosting and processing athlete data so you can plan, assign and review training in Train Climb. |
|---|---|
| Duration | As long as you use the Service, plus the deletion period in section 9. |
| Nature and purpose | Storage, display, calculation of training statistics (for example workload and readiness), generation of reports, and messaging between you and your athletes. |
| Data subjects | Athletes you invite, including minors with the consent of a parent or guardian, and your staff who use the Service. |
| Personal data | Identification and contact data, training sessions and results, climbs and photos, notes and messages, and health and wellbeing data (heart rate variability, resting heart rate, sleep, fatigue, soreness and similar metrics). |
2. Your instructions
We process athlete data only on your documented instructions, which are these Terms, this DPA and your use of the Service's features. If we believe an instruction breaks the GDPR or other data protection law, we will tell you. We will not use athlete data for our own purposes.
3. Your responsibilities
- You have a lawful basis for the data you record, including the explicit consent of each athlete (or of a parent or guardian for athletes under 16) before recording health data.
- You inform your athletes about the processing, for example by sharing our Privacy Policy.
- You only invite people you are entitled to coach and you remove athletes who leave.
4. Confidentiality
Only staff who need access to run and support the Service can access athlete data, and they are bound by confidentiality obligations.
5. Security measures
- Encrypted connections (HTTPS) and hashed passwords.
- Role-based access: athletes see only their own data, and only coach accounts can see athlete data.
- Restricted and logged administrative access to servers and databases.
- Regular backups stored separately from the application code, with limited access.
- Security updates applied to the application and its dependencies.
6. Sub-processors
You authorise us to use sub-processors for hosting, email delivery, payments and the in-app text editor. We bind each sub-processor to data protection obligations equivalent to this DPA and remain responsible for them. We will tell you at least 30 days before adding or replacing a sub-processor, and you may object on reasonable grounds; if we cannot resolve the objection, you may end the contract.
The current list of sub-processors is available on request from office@trainclimb.com.
7. Transfers outside the EEA
We store athlete data in the European Union. We transfer it outside the European Economic Area only with the safeguards required by Chapter V of the GDPR.
8. Assistance and breaches
- We help you answer athletes' requests to access, correct, export or delete their data, and forward to you any request we receive directly.
- We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your athletes, with the information you need to meet your own obligations.
- We help you with data protection impact assessments where the processing requires one.
9. Return and deletion
When you stop using the Service you can export your data. Within 30 days after the end of the contract we delete athlete data, unless the law requires us to keep it. Backup copies are overwritten within a further 30 days.
10. Audits
We make available the information needed to show that we comply with this DPA. You may audit our compliance once a year, or after a breach, with 30 days' notice, at your own cost and without disclosing other customers' data.
11. Contact
- COSMIC ATMAN SRL
- Registered office: B-dul Dacia 18, Iași, România
- Trade Register number: J2024041140002
- Tax ID (CUI): 50880742
- Email: office@trainclimb.com
- Phone: +40740623913