1. Parties and how this applies
This agreement is between the business that uses Amble (“you”, the controller) and [Company Name] Ltd, company number [Company number], registered office [Registered office address] (“we”, the processor).
It forms part of our Terms of Service and you accept it when you accept them. It applies to the personal data of your members, and of anyone else you record in Amble, that we process for you. If it conflicts with the Terms on data protection, this agreement wins.
2. Words we use
“Data protection law” means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003. “Personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings in the UK GDPR. A “sub-processor” is another company we use to process your personal data.
3. Details of the processing
| Details | |
|---|---|
| Subject matter | Providing Amble, the studio management and booking service, to you. |
| Duration | While the Terms are in force, and then until the data is deleted or returned under section 12. |
| Nature and purpose | Storing, organising and showing member records; taking bookings, waiting lists and attendance; recording payments, credits and fees; sending booking messages, reminders and, where you switch them on and members agree, marketing and win-back messages; checking people in; producing reports and exports; and anonymising records on the schedule in our Privacy Policy. |
| Types of personal data | Names, email addresses, phone numbers, dates of birth, home branch, membership and plan details, bookings, attendance and door visits, payment records and Stripe references, credits and fees, consents, messages sent and their delivery, push notification addresses, and anything you add to member notes. |
| Special category data | Health questionnaires and health notes, only where you use them and the member has consented; workouts from a connected watch, only where the member links one. |
| Data subjects | Your members, prospective members, people who book with you as guests and people who make an enquiry through your page. |
4. Processing only on your instructions
We process your personal data only on your documented instructions, which are the Terms, this agreement and the way you set up and use Amble, unless the law requires otherwise. If it does, we will tell you first unless the law forbids that. We will tell you straight away if we think an instruction breaks data protection law.
5. Confidentiality
Everyone we allow to process your personal data is bound by a duty of confidentiality.
6. Security
We take the technical and organisational measures Article 32 requires, including:
- access rules enforced by the database on every table, so each studio can only reach its own data and each member only their own record;
- encryption of all data in transit, and encryption at rest by our database provider;
- passwords stored only as hashes by our sign in provider;
- staff roles that limit what each of your team can see and change;
- keys that can read across studios kept on our servers only, and never in the app;
- automated tests of the access rules whenever the code changes;
- backups of the database and of uploaded files.
7. Sub-processors
You give us general authorisation to use sub-processors. The current list, with what each does and where, is in our Privacy Policy.
We will tell you by email at least 30 days before we add or replace a sub-processor. If you object on reasonable data protection grounds, we will try to resolve it with you; if we cannot, you may end the Terms and we will refund any fees you have paid for the period after that.
We put data protection terms on each sub-processor that give at least the protection in this agreement, and we remain responsible to you for what they do.
8. International transfers
We transfer your personal data outside the UK only where the UK has found the country adequate, or with appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Our Privacy Policy sets out where each provider is.
9. Helping with people’s requests
Amble lets you meet most requests yourself: you can export a member’s complete record, correct it, record or withdraw consents and erase a member. Where you need more help we will give it within a reasonable time. If a member asks us directly, we will pass the request to you and will not answer it ourselves unless you ask us to.
10. Personal data breaches
We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your personal data. We will tell you what we know: what happened, the kinds and rough number of people and records involved, the likely consequences and what we are doing about it, and more as we learn it. We will help you meet your own duty to notify the ICO within 72 hours and, where needed, the people affected.
11. Other help
Taking into account what we know, we will help you meet your duties under Articles 32 to 36 of the UK GDPR, including on security, data protection impact assessments and consulting the ICO.
12. Deletion or return at the end
When the Terms end you have 90 days to export your data, and we will return it to you as CSV files if you ask in that time. After that we delete it, unless the law requires us to keep it. Copies in backups are overwritten in their normal cycle.
13. Audits and information
We will give you the information you reasonably need to show that we meet this agreement and Article 28. We will allow audits, including inspections, by you or an auditor you appoint and who is bound by confidentiality, on at least 30 days’ notice, once a year, unless a breach or a regulator needs more. Audits are at your cost, and we may first offer documents that answer your questions.
14. Liability
Each party’s liability under this agreement is subject to the limits in the Terms of Service.
15. Governing law
This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.