Data Processing Addendum (DPA)

Last updated: September 26, 2026

This Addendum implements Article 28 of the General Data Protection Regulation (GDPR) and forms part of the Terms of Use that the trainer accepts when signing up for Trainbay. It applies only to the data of the trainer's contacts and clients (not to the trainer's own account data, for which Trainbay is the direct controller — see Privacy Policy, section 1).

1. Parties

• Data Controller: the trainer who holds the account.
• Data Processor: ZX Consulting LLC, operating as Trainbay.

2. Subject Matter, Nature, and Purpose

The processor processes the data of the controller's contacts and clients in order to provide the contracted service: lead pipeline management, the AI lead-capture and nutrition assistant, routine and diet tracking, progress and meal logging, billing, and the Platform's own automated communications (reminders, lead re-engagement, notifications). The processor does not use this data for any purpose of its own or any purpose other than the one described.

3. Duration

This Addendum remains in effect for as long as the trainer keeps an active Trainbay account, and until the data is deleted or returned in accordance with section 8.

4. Type of Data and Categories of Data Subjects

Data subjects: the trainer's contacts, leads, and clients. Data: as described in the Privacy Policy, section 2 — contact data, conversations, training profile, and health and progress data (special category data, processed only with the data subject's explicit consent, which the trainer must obtain) and payment data.

5. Processor Obligations

• Process data only on the controller's documented instructions (which are, in essence, the Platform's own configuration and normal use).
• Ensure that personnel authorized to process the data are bound by a duty of confidentiality.
• Apply the security measures required under Article 32 GDPR, appropriate to the risk — database-level access control by trainer and by client, encrypted password storage, and signed, temporary links for private files.
• Assist the controller, as far as possible, in responding to data subjects' requests to exercise their rights.
• Notify the controller without undue delay of any personal data breach it becomes aware of.
• Make available to the controller the information necessary to demonstrate compliance with these obligations, and allow for reasonable audits (including by the controller itself or an auditor it appoints).
• Delete or return, at the controller's choice, all data once the service ends, unless the law requires its retention.

6. Sub-processors

The controller generally authorizes the processor to engage the following sub-processors, currently in use on the Platform: Supabase (database, authentication, storage), Anthropic and Google Cloud (the AI models that generate the assistant's replies; Google's Gemini models are used through Google Cloud's Agent Platform with processing located in the European Union), Stripe (payments), Vercel (application hosting), Resend (sending invoice and account emails), and Google (Google Calendar, only for trainers who connect it). The processor will inform the controller with reasonable notice of any planned change to this list, giving it the opportunity to object.

7. International Transfers

Since the processor (ZX Consulting LLC) is established in the USA and some of the sub-processors above process data outside the European Economic Area, these transfers are covered by the Standard Contractual Clauses approved by the European Commission (Module 2, controller in the EU – processor in a third country; Implementing Decision (EU) 2021/914), incorporated by reference into this Addendum.

8. End of Processing

When the relationship with Trainbay ends, the controller can request deletion of their contacts' and clients' data via the "Danger zone" section of their profile, or by writing to contact@trainbay.app.