Data Processing Agreement

1. Parties

This Data Processing Agreement (“DPA”) is entered into between:

• Data Controller (“Controller”): The organization or individual subscribing to PerformIQ for managing athlete data (e.g., sports team, coaching organization, educational institution).
• Data Processor (“Processor”): PerformIQ, operated by Justin Sillar, with contact at [email protected].

2. Scope & Purpose

The Processor processes personal data on behalf of the Controller solely for the purpose of providing the PerformIQ sports science and performance analytics platform, including:

• Storing athlete profiles, training data, and performance metrics
• Generating AI-powered readiness scores and performance insights
• Enabling coaches to view and manage athlete data within their organization
• Providing nutrition tracking and biomechanical analysis tools

3. Categories of Data Subjects & Personal Data

Data Subjects

• Athletes (including minors aged 13+ with guardian consent)
• Coaches and trainers
• Administrative staff

Categories of Personal Data

• Identity data: Name, email address, date of birth
• Physical data: Height, weight, sport, position, ethnicity
• Performance data: Workout logs, strength metrics, movement analysis results, velocity-based training data
• Health-related data: Heart rate variability, resting heart rate, RPE scores, injury logs, readiness scores
• Nutrition data: Food logs, calorie and macro tracking, bodyweight history
• Movement data: Video-derived pose estimation and biomechanical analysis
• Usage data: Login timestamps, session activity, AI chat interactions

4. Obligations of the Processor

The Processor shall:

1. Process personal data only on documented instructions from the Controller, unless required by law.
2. Ensure that persons authorized to process personal data have committed to confidentiality.
3. Implement appropriate technical and organizational security measures, including:
   • Encryption in transit (HTTPS/TLS) and at rest
   • Password hashing using industry-standard algorithms (bcrypt)
   • Rate limiting and brute-force protection
   • Content Security Policy (CSP Level 3) with nonces
   • Audit logging of security-relevant events
   • Two-factor authentication (TOTP) availability
4. Not engage another processor without prior written authorization from the Controller. Current sub-processors are listed in the Privacy Policy.
5. Assist the Controller in responding to data subject requests (access, rectification, erasure, portability, restriction, objection).
6. Notify the Controller without undue delay (and within 72 hours where feasible) upon becoming aware of a personal data breach.
7. Delete or return all personal data to the Controller upon termination of the agreement, and delete existing copies unless storage is required by applicable law.
8. Make available all information necessary to demonstrate compliance and allow for audits by the Controller or a mandated auditor.

5. Obligations of the Controller

The Controller shall:

1. Ensure a lawful basis exists for processing personal data (e.g., consent, legitimate interest, contractual necessity).
2. Obtain appropriate consent from athletes (or their guardians for minors) before their data is entered into the platform.
3. Provide clear privacy notices to data subjects explaining how their data will be processed.
4. Designate administrators with access management responsibilities.

6. Data Transfers

The Processor primarily stores data within US-based infrastructure (Railway/AWS). For international transfers:

• Transfers from the EU/EEA are governed by Standard Contractual Clauses (SCCs) as approved by the European Commission.
• The Processor participates in commercially reasonable safeguards to protect transferred data.

7. Data Retention & Deletion

• Active account data is retained for the duration of the Controller’s subscription.
• Upon account deletion request, personal data is permanently removed within 30 days.
• Anonymized, aggregated data (which cannot identify individuals) may be retained for platform improvement.
• Backup data is purged according to the infrastructure provider’s retention schedule (typically 7–30 days).

8. Breach Notification

Upon discovering a personal data breach, the Processor will:

1. Notify the Controller within 72 hours of becoming aware of the breach.
2. Provide details of the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address it.
3. Cooperate with the Controller in notifying the relevant supervisory authority and affected data subjects as required.

9. Term & Termination

This DPA is effective for the duration of the Controller’s use of the PerformIQ platform. Upon termination:

• The Controller may request a full data export (JSON format) via the platform.
• The Processor will delete all Controller data within 30 days of termination, unless legally required to retain it.

10. Governing Law

This DPA shall be governed by the laws of the Province of Ontario, Canada, without regard to conflict of law principles. For EU data subjects, the provisions of the GDPR shall apply in addition to local law.

11. Contact

To execute this DPA or request a customized version for your organization, contact:

Justin Sillar
PerformIQ — Data Protection
Email: [email protected]