Data Processing Addendum
Last updated 2026-08-20
This Data Processing Addendum ("DPA") forms part of the Terms of Service between a gym ("Controller", "you") and Akstuudio ("Gymsly", "Processor") and applies whenever Gymsly processes personal data of your members, leads, or staff ("Member Data") on your behalf as part of the Service.
1. Roles
You are the controller of Member Data: you decide what to collect and why. Gymsly is your processor: we process Member Data only on your documented instructions, as given through your use of the Service's features (for example, adding a member, sending a broadcast, or enabling biometric attendance).
2. Subject matter, duration, nature and purpose
| Details | |
|---|---|
| Subject matter | Provision of the Gymsly gym-management Service |
| Duration | For as long as your Gymsly account is active, plus the retention period described in our Privacy Policy |
| Categories of data subjects | Your members, leads, staff, and trainers |
| Categories of data | Contact details, membership/billing records, attendance, communications, and, where you enable it, health stats, diet plans, and biometric identifiers |
| Nature of processing | Storage, retrieval, transmission (email/SMS/WhatsApp), and display within the Service |
3. Gymsly's obligations
- Process Member Data only on your instructions (as configured in the app) and not for our own purposes;
- Keep Member Data confidential and restrict access to personnel who need it to operate the Service;
- Implement appropriate technical and organisational security measures, including per-tenant access isolation;
- Assist you in responding to data-subject requests (access, deletion, export) relating to Member Data: see the export/delete tools in Settings, or contact us;
- Notify you without undue delay after becoming aware of a personal data breach affecting Member Data;
- Delete or return Member Data on termination of your account, subject to legally required retention;
- Only engage the subprocessors listed in our Privacy Policy, and remain responsible for their performance.
4. Your obligations
You are responsible for having a lawful basis for the Member Data you collect, for obtaining any consent required (including explicit consent for health or biometric data), for honoring opt-outs, and for the accuracy of instructions you give through the Service's configuration options.
5. Sub-processors & international transfers
Current subprocessors are listed in our Privacy Policy. Where a subprocessor is located outside your jurisdiction, we rely on that subprocessor's own transfer safeguards.
6. Audit
On reasonable request, we will provide the information necessary to demonstrate compliance with this DPA, including relevant subprocessor certifications where available.
7. Contact
This page is a plain-language starting point drafted from how Gymsly actually works. It is not legal advice: it has not been reviewed by a lawyer and should be before you rely on it.