GymPanel Data Processing Agreement (DPA)

1. Scope & Roles of the Parties

The Gym Operator acts as the Data Controller responsible for obtaining lawful consent from its gym members and staff to record membership and attendance details. GymPanel acts strictly as the Data Processor, handling customer data solely in accordance with the Controller’s documented instructions and software functions.

2. Nature and Categories of Data

The categories of personal data processed under this agreement include:

• Member identification details (Full name, mobile phone number, email address, profile picture).
• Membership transaction records (Plan type, purchase dates, expiry dates, payment amounts, due balances).
• Attendance telemetry (Device scan timestamps, gate direction, check-in logs).

3. Technical and Organizational Security Measures

GymPanel maintains robust technical safeguards designed to protect personal data against unauthorized access, loss, or alteration:

• End-to-end encryption in transit utilizing TLS 1.3 cryptographic protocols.
• Granular role-based access control (RBAC) preventing unauthorized staff access to financial ledgers.
• Continuous database backup replication and automated disaster recovery protocols.

4. Authorized Sub-Processors

The Controller authorizes GymPanel to engage essential infrastructure sub-processors (such as Meta Platforms for WhatsApp Business notifications and secure cloud hosting providers). All sub-processors are bound by data protection obligations consistent with this DPA.

5. Incident Notification & Termination

GymPanel agrees to notify the Controller without undue delay (and within 48 hours) upon becoming aware of any confirmed security breach impacting Controller data. Upon termination of service, all member datasets are permanently deleted or returned to the Controller upon request.