6. Data Processing Agreement (DPA)

Preamble This Data Processing Agreement ("DPA") is entered into between the Gym ("Data Controller") and Waiver2.0 OÜ (registry code 17624360, Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Harju maakond, Estonia) / waiver2.com ("Data Processor") and forms an integral part of the Terms of Service governing the Gym's use of the Waiver2.0 Platform. This DPA applies only to the Gym-facing platform functions Waiver2.0 provides to the Gym — the Gym's dashboard, its list of registered Athletes, and notifications to the Gym about an Athlete's subscription status or renewal. It does not apply to: (a) the creation, sealing, or preservation of the evidentiary record itself (the sealed waiver, the cryptographic hash chain, timestamps, the Athlete's account, or the handling of legal claims relating to that record); or (b) the disclosure of the Athlete's information — including health information, under its own separate consent — that Waiver2.0 makes to the Gym for activity clearance and safety awareness. For both (a) and (b), Waiver2.0 acts as an independent Data Controller in its own right, not as the Gym's processor, as set out in Section 3; in particular, the disclosure at (b) is made based on the Athlete's own consent to an independent Data Controller (the Gym), not as processing carried out on the Gym's instructions. In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to the data processing matters within its scope. 1. Definitions 1.1 "Personal Data" means any information relating to an identified or identifiable natural person processed by Waiver2.0 on behalf of the Gym via the Platform. 1.2 "Processing" means any operation performed on Personal Data, including collection, recording, storage, retrieval, use, disclosure, erasure, and destruction. 1.3 "Data Controller" means the Gym, which determines the purposes and means of processing Athletes' personal data. 1.4 "Data Processor" means Waiver2.0, which processes personal data strictly on behalf of and under the instructions of the Gym. 1.5 "Data Subject" means the Athlete whose personal data is processed via the Platform. 1.6 "Subprocessor" means any third party engaged by Waiver2.0 to process personal data on behalf of the Gym. 1.7 "Forensic Record" means the tamper-evident, SHA-256 hashed, server-timestamped digital record generated by the Platform upon completion of the signing event. 2. Scope & Nature of Processing 2.1 Waiver2.0 processes personal data exclusively for the following purposes: Generation of digital waivers and contracts. Facilitation of e-signatures compliant with applicable electronic transactions legislation. Creation and maintenance of tamper-evident SHA-256 audit trails. Storage and retrieval of signed documents and incident reports. Technical security, access control, and platform integrity monitoring. Media Capture Documentation (MCD) processing for Premium Plan Athletes, where the MCD module is used (it is not offered at present), subject to the MCD Protocol set out in SOP-24 Section 11. 2.2 Waiver2.0 processes personal data solely on documented instructions from the Gym. The Gym's use of the Platform interface constitutes the primary set of processing instructions. 2.3 In relation to Purpose D (Section 3.5), Waiver2.0 will not process personal data for any purpose beyond the scope defined in this DPA, including marketing, profiling, resale, or any form of secondary use, without the Gym's explicit written instruction. This Section 2.3 does not govern the processing Waiver2.0 carries out as an independent Data Controller under Sections 3.2 to 3.4 and 3.7. 2.4 Processing Infrastructure: All document rendering, PDF generation, SHA-256 hashing, and forensic record creation are performed within Waiver2.0's own infrastructure hosted on Railway (EU West, Amsterdam), to which the Athlete's browser sends each submission directly over an encrypted connection (HTTPS). Outside that infrastructure, personal data is disclosed only to the Gym, in the roles described in Sections 3.3 to 3.5, to the processors and independent controllers listed in Section 6.1 (transactional email; payment processing; the archive copy, from the date Waiver2.0 starts it), and, upon a verified request the Gym confirms in writing, to the Gym's insurer or legal counsel as described in Section 3.6 of the Privacy Policy. 3. Roles & Data Sovereignty 3.1 Waiver2.0 processes Athlete information for four distinct purposes, and acts in a different capacity for each. 3.2 Purpose A — creation, sealing and preservation of the evidentiary record (the sealed waiver, the hash chain, timestamps, the Athlete's account and subscription, the /verify service, and legal claims relating to the record). This DPA does not apply to Purpose A. Waiver2.0 is an independent Data Controller for this purpose and bears sole responsibility for its lawfulness; the Gym has no instructing role over it. 3.3 Purpose B — disclosure of the Athlete's information, including health information under a separate consent, to the Gym for activity clearance and safety awareness. This DPA does not apply to Purpose B. Waiver2.0 discloses this information as an independent Data Controller, based on the Athlete's own consent; the Gym is an independent Data Controller of the information once it receives it — not a party on whose instructions Waiver2.0 is processing — and the Gym is responsible for the lawfulness of its own further use of it. 3.4 Purpose C — delivery of the executed document to both the Gym and the Athlete. This is incidental to Purpose A; Waiver2.0 acts as an independent Data Controller for this purpose as well. This DPA does not apply to Purpose C. 3.5 Purpose D — the Gym-facing platform functions: the Gym's dashboard, its list of registered Athletes, and notifications to the Gym about an Athlete's subscription status or renewal. This is the only purpose this DPA governs. Waiver2.0 acts as the Gym's Data Processor for Purpose D, processing data on the Gym's documented instructions. 3.6 The Gym bears primary responsibility for the lawfulness of any instruction it gives Waiver2.0 in connection with Purpose D, the accuracy of the data it enters into the Platform, and its own compliance with applicable data protection law in respect of the information it receives under Purpose B. 3.7 Where Waiver2.0 independently determines the purposes and means of processing for its own operational purposes not covered by Purposes A-D (e.g. platform security monitoring, hash chain integrity), it acts as an independent Data Controller for those specific processing activities and bears sole responsibility for their lawfulness. 3.8 Incident records that an Athlete keeps from the Athlete's own account against the Athlete's sealed waiver, including the statement, name and contact of an eyewitness and the image of a signature drawn for an eyewitness entry, and their two downloads, the Incident Pack and the Insurance-Ready Export (Privacy Policy, Sections 2.9 and 2.10), are not the Gym's incident reports of Section 2.1: they are processed by Waiver2.0 for the Athlete as an independent Data Controller. No function of the Gym reads them, and this DPA does not apply to them. These features are not switched on at present. 4. Gym Instructions & Compliance 4.1 The Gym warrants that all instructions given to Waiver2.0 for the processing of personal data are lawful and consistent with applicable data protection legislation in the Gym's jurisdiction. 4.2 Where Waiver2.0 reasonably believes that a processing instruction would violate applicable data protection law, Waiver2.0 shall notify the Gym in writing and may suspend compliance with that instruction until the matter is resolved. 4.3 The Gym is solely responsible for obtaining all necessary consents, providing all required privacy notices to Athletes, and ensuring the lawfulness of the personal data submitted to the Platform. 5. Forensic Security Measures 5.1 Waiver2.0 implements and maintains the following technical and organizational security measures: Security Measures: appropriate technical and organisational measures, reviewed periodically as the Platform's processing evolves, including access controls, encryption in transit (TLS 1.2 or higher on the public connections to the Platform; traffic between the Platform's services within the hosting provider's private network is carried over encrypted WireGuard tunnels, according to that provider's documentation), and the hashing/timestamping measures described below. Hashing: SHA-256 cryptographic hashing applied to every signed document (and, where the MCD module is used, to every MCD media file), creating a tamper-evident digital fingerprint. Access Control: Role-Based Access Control (RBAC) ensuring that personal data is accessible only to authorized personnel with a documented need for access. Timestamping: All processing and signing events are timestamped using the Platform's own server clock at the moment each event is received, independent of local device time. Tamper-Evident Logging: Each sealed waiver record is held in a forensic database in which an alteration of the hashed content of the record is detectable by hash verification. A Gym's access, through its signed-in account, to an Athlete's health page, contract and health annex is recorded in a separate access log, which is not covered by hash verification. The log does not state which of the three was opened. Other access to data and attempts to modify it are not recorded in these logs. Penetration Testing: Waiver2.0 conducts periodic security assessments of its infrastructure to identify and remediate vulnerabilities. 5.2 Waiver2.0 will notify the Gym without undue delay if any security measure is compromised or if Waiver2.0 becomes aware of any circumstance that may affect the integrity of the forensic record. 6. Subprocessors 6.1 The Gym provides general authorization for Waiver2.0 to engage the following approved subprocessors: SubprocessorRoleLocationRailwayHosting: API, database, PDF generation, and storage of sealed PDF filesEuropean Union (EU West, Amsterdam)ResendTransactional email delivery, including single-use sign-in links, medical alerts to the Gym, the sealed PDF delivered to the Athlete and the link to it sent to the GymSending infrastructure in Ireland; Resend Inc. is a US companyScaleway SAS (Paris, France)From the date Waiver2.0 starts the archive copy: storage of an archive copy, for recovery, of the sealed PDF files and of the daily root values of the hash chain, and of a daily backup copy of the Platform's database (each backup kept for at least 35 days, then deleted by the storage's expiry rules); each file and each database backup is encrypted by Waiver2.0 before it is sent, with a key Scaleway does not holdEuropean Union (a Scaleway region in the EU); Scaleway SAS is a company established in FranceOur payment provider (named at checkout)Payment processing (independent controller)Global 6.2 The Gym's authorization under Section 6.1 covers the subprocessors listed there at the time the Gym accepts this DPA, including Scaleway SAS for the archive copy, which is used from the date Waiver2.0 starts it. For any addition or replacement of subprocessors after the Gym has accepted this DPA, Waiver2.0 will notify the Gym of the intended change with no less than 14 days' prior written notice, providing the Gym with the opportunity to object on reasonable grounds. The notice is sent by email to the address of the Gym's account and names the subprocessor, its role, the categories of personal data concerned, the location of the processing and the date from which the subprocessor is to be engaged. The Gym may object in writing to privacy@waiver2.com within those 14 days; if Waiver2.0 and the Gym cannot resolve a reasonable objection before that date, the Gym may terminate its use of the Platform, and with it this DPA, by written notice taking effect before the date from which the subprocessor is to be engaged; the 30 days' notice of Section 12.2 of the Gym Onboarding Agreement does not apply to that termination. 6.3 Waiver2.0 ensures that all subprocessors are bound by data processing obligations equivalent to those set out in this DPA, via written agreements. 6.4 Waiver2.0 does not use third-party automation platforms (e.g. Make, Zapier, Documint, Clay). Document generation, SHA-256 hashing and forensic record creation are performed on infrastructure Waiver2.0 operates on Railway. Transactional email is sent through the processor listed in Section 6.1. 6.5 Waiver2.0 keeps a current list of its subprocessors, with the date of each change, and provides it to the Gym on request at privacy@waiver2.com. 7. International Data Transfers 7.1 Waiver2.0's primary infrastructure (Section 6.1: hosting, database, and PDF generation) is located in the European Union. Processing Athlete information from the Gym's jurisdiction on that infrastructure is not a transfer out of the EU/EEA; it is a transfer of the Gym's and its Athletes' data into the EU, where it is protected by GDPR. 7.2 Resend's sending infrastructure for Our traffic is in Ireland; because Resend Inc. is a US company, the transfer to it is conducted under the safeguards in Resend's own data processing terms, such as Standard Contractual Clauses approved by the European Commission. From the date Waiver2.0 starts the archive copy of Section 6.1, Scaleway SAS, a company established in France, stores it — the sealed PDF files, the daily root values and the database backups — in a Scaleway region in the EU and receives it encrypted. Where a subprocessor's own processing involves a transfer of personal data outside the EEA, that transfer is conducted under the safeguards set out in that subprocessor's own data processing terms. 7.3 Our payment provider acts as an independent Data Controller and publishes its own transfer safeguards; Waiver2.0 does not control how the payment provider transfers data. 7.4 A copy of the relevant transfer safeguards is available upon request at privacy@waiver2.com. 8. Data Subject Rights Assistance 8.1 Waiver2.0 will assist the Gym in fulfilling its obligations to respond to Data Subject rights requests, including requests for access, rectification, erasure, restriction, portability, and objection, to the extent technically feasible and consistent with the forensic integrity of the Platform. 8.2 Where erasure of a forensic record is requested, Waiver2.0 will advise the Gym of any legal obligation to retain the record that may conflict with the erasure request, including applicable limitation periods for personal injury claims as set out in SOP-24 Section 9.2. 8.3 Jurisdiction-Specific Data Subject Rights Assistance: 🇦🇺 Australia: Waiver2.0 assists the Gym in meeting obligations under APP 12 (access) and APP 13 (correction) of the Privacy Act 1988 (Cth). 🇨🇦 Canada (excluding Québec): Waiver2.0 assists the Gym in meeting obligations under PIPEDA Principles 9 (access) and 10 (challenging compliance). 🇺🇸 United States: Waiver2.0 assists the Gym in meeting obligations under the CCPA (California), VCDPA (Virginia), CPA (Colorado), and equivalent applicable state privacy statutes. 9. Data Breach Notification 9.1 Waiver2.0 will notify the Gym without undue delay, and in any event within 72 hours of becoming aware of a confirmed or reasonably suspected personal data breach affecting data processed under this DPA. In respect of Purpose D, the Gym, as Data Controller, decides whether a breach is notified to its supervisory authority and communicated to Data Subjects. 9.2 Breach notifications will include, to the extent available at the time of notification: Nature of the breach and categories of personal data affected. Approximate number of Data Subjects affected. Likely consequences of the breach. Measures taken or proposed to address the breach and mitigate its effects. 9.3 Jurisdiction-Specific Breach Notification Obligations: 🇦🇺 Australia: The Gym, as Data Controller, is responsible for assessing whether a breach constitutes an Eligible Data Breach under the Notifiable Data Breaches (NDB) scheme (Privacy Act 1988, Part IIIC) and for notifying the OAIC and affected individuals where required. 🇨🇦 Canada: The Gym is responsible for notifying the Office of the Privacy Commissioner and affected individuals of breaches that create a real risk of significant harm, under PIPEDA breach reporting regulations (SOR/2018-64). 🇺🇸 United States: The Gym is responsible for notifying affected individuals and relevant state authorities in accordance with applicable state data breach notification laws, including the California Consumer Privacy Act and applicable state breach notification statutes. 9.4 Where not all of the information listed in Section 9.2 is available at the time of the first notification, Waiver2.0 will provide it in phases, without undue further delay, as it becomes available. 9.5 Notifications under this Section are sent by email to the address of the Gym's account and quote a reference for the breach, which later notices repeat. 9.6 Taking into account the nature of the processing and the information available to it, Waiver2.0 will assist the Gym in meeting the Gym's obligations under GDPR Articles 33 and 34 in respect of a breach under Section 9.1, and keeps a record of each such breach — its facts, its effects and the remedial action taken — whose entries concerning the Gym it makes available to the Gym on request. 9.7 A personal data breach affecting the processing Waiver2.0 carries out as an independent Data Controller (Sections 3.2 to 3.4 and 3.7) is handled by Waiver2.0 as Data Controller under GDPR Articles 33 and 34 (see also Privacy Policy, Section 8.5). Where such a breach concerns information the Gym received under Purpose B, Waiver2.0 will also inform the Gym without undue delay, and in any event within 72 hours of becoming aware of a confirmed or suspected breach. 10. Audit & Compliance Verification 10.1 The Gym reserves the right to audit Waiver2.0's compliance with this DPA upon reasonable written notice of no less than 14 days. 10.2 Audits may be conducted by the Gym or by an independent third-party auditor appointed by the Gym, subject to reasonable confidentiality obligations. 10.3 Waiver2.0 will provide the Gym with all information reasonably necessary to demonstrate compliance with this DPA, including access to relevant forensic logs in read-only format. 10.4 Audit rights under this Section are subject to the limitation that they may not unreasonably disrupt Waiver2.0's operations or compromise the security or confidentiality of other clients' data. 11. Retention, Return & Deletion of Data 11.1 Upon termination or expiry of the Gym's subscription, Waiver2.0 will: Retain all personal data for the applicable retention period set out in the Privacy Policy (Section 5): until the limitation period applicable to the Gym's jurisdiction expires, counted from the expiry of the waiver, longer where the Waiver2.0 operator places a hold while an incident report is still open (holds are placed and lifted by the Waiver2.0 operator, not automatically). The Gym's access to the operational copy of health information used for the Gym-facing medical alert ends when the Athlete's subscription ends; the copy inside the sealed evidentiary record is preserved until the applicable limitation period expires (GDPR Art. 9(2)(f), Art. 17(3)(e)). Provide the Gym with export copies of all forensic records upon written request within 30 days of termination. Permanently delete all personal data from primary systems and subprocessor environments upon expiry of the applicable retention period, unless a longer retention period is required by law, and from backups — including the database backups of the archive copy of Section 6.1 — as those backups expire in their normal rotation. 11.2 Deletion is carried out as described in Section 11.1: from primary systems and subprocessor environments upon expiry of the applicable retention period, unless a longer retention period is required by law, and from backups as those backups expire in their normal rotation. Waiver2.0 will provide written confirmation of deletion upon request. 11.3 The cryptographic record of each signing event — hash values, timestamps, and chain position — is retained permanently, by design, and is unaffected by this Section: it contains no personal data and cannot be used to reconstruct any. 12. Liability & Indemnification 12.1 Waiver2.0 is liable to the Gym for any breach of this DPA caused by Waiver2.0's failure to fulfil its obligations as Data Processor, to the extent of direct damages actually suffered by the Gym as a result of such breach. 12.2 The Gym indemnifies Waiver2.0 against any claim, loss, or liability arising from: Inaccurate, incomplete, or unlawfully obtained personal data submitted to the Platform by the Gym or its staff. The Gym's failure to obtain valid consent from Athletes or to provide required privacy notices. The Gym's non-compliance with applicable data protection law in its jurisdiction. Any processing instruction given by the Gym that violates applicable law. 12.3 Nothing in this Section limits either party's liability for gross negligence, willful misconduct, or any non-excludable liability under applicable law. 13. Term & Termination 13.1 This DPA remains in effect for the duration of the Gym's active subscription to the Platform and continues to govern the processing of any retained personal data following termination until permanent deletion is completed. 13.2 Either party may terminate this DPA with immediate effect upon written notice if the other party commits a material breach of its obligations that is not remedied within 14 days of written notice of the breach. 14. Governing Law & Jurisdiction 14.1 This DPA is governed by the laws of Estonia, subject to the mandatory application of applicable data protection law in each jurisdiction in which the Gym operates. 14.2 Disputes arising under this DPA shall be resolved in accordance with the dispute resolution provisions of the Terms of Service, subject to the mandatory jurisdiction rights of Data Subjects and supervisory authorities under applicable data protection law. Last updated: 10 November 2026.