Data Processing Addendum

What this addendum covers

This addendum is between your gym (“you”) and Rotation Master, based in Seattle, Washington, USA (“we”, “us”).

Words such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” mean what data protection laws say they mean. Those laws include the UK GDPR, the EU GDPR and the privacy laws of US states; where a US law speaks of a “business” and a “service provider”, read them as controller and processor.

“Gym data” is the personal data in your gym’s workspace that we process for you, described in Annex 1. For gym data, your gym is the controller and we are its processor.

Some information we collect for our own purposes, such as security records, usage counts, website enquiries and emails with us. For that, we are the controller, and the Privacy Policy applies instead.

Your instructions

• We process gym data only on your documented instructions. Those are the Terms, this addendum, what your gym’s people do in Rotation Master, and any reasonable instructions you send us in writing.
• If a law requires us to do anything else with gym data, we’ll tell you before we do it, unless that law forbids telling you.
• We’ll tell you if we think an instruction of yours breaks data protection law.
• Your gym is responsible for having a lawful basis for the gym data it puts in, and for telling its staff about it.

Confidentiality

Everyone we allow to handle gym data is bound to keep it confidential, and has only the access they need.

Security

We protect gym data with technical and organisational measures appropriate to the risk, set out in Annex 2, and we review them as Rotation Master grows.

Other companies we use

• You authorise us to use the sub-processors listed on Data we collect. Each has data protection terms with us that protect gym data in the way this addendum requires.
• Before we add or replace a sub-processor, we’ll update that list and email your gym’s admins at least 30 days ahead. In an emergency that threatens the service, we may have to act sooner; we’ll tell you as soon as we can.
• If you object on reasonable data protection grounds, tell us. If we can’t resolve it, your gym may end the agreement.
• We remain responsible to you for how our sub-processors handle gym data.

Helping you

• If someone asks us directly to see, correct or delete gym data about them, we’ll pass the request to you rather than answer it ourselves, unless you ask us to.
• We’ll help you respond to such requests, for example by finding, exporting, correcting or deleting a person’s information.
• We’ll also help, as far as is reasonable given what we know, with keeping gym data secure, notifying breaches, data protection impact assessments and any consultation with a regulator.

If something goes wrong

If we become aware of a personal data breach affecting gym data, we’ll tell your gym’s admins without undue delay, and in any case within 72 hours. We’ll say what we know: what happened, what data and roughly how many people are affected, the likely consequences, what we are doing about it, and who to contact. We’ll add details as we learn them and take reasonable steps to contain the breach. Telling you about a breach isn’t an admission of fault.

Data stored in the United States

Gym data is stored in the United States. Our sub-processors protect their transfers with the standard contractual clauses approved for this, including the UK addendum, under their own agreements.

If your gym is in the UK, the European Union or Switzerland, tell us before you start. We’ll sign the matching transfer clauses with your gym (the EU standard contractual clauses for a controller and a processor, with the UK addendum where it applies), and they will form part of this addendum.

When your gym leaves

• For 30 days after your gym stops using Rotation Master, you can ask for a copy of gym data, and we’ll send it.
• We then delete gym data within a further 30 days, including the accounts of your people who don’t belong to another gym. Copies in our providers’ backups are overwritten within 30 days after that.
• We keep only what a law requires us to keep, protected and only for as long as required, and a minimal record that your workspace existed: its name, and when it was created and deleted.
• While your gym uses Rotation Master, it can delete things itself at any time, or ask us to.

Showing we keep to this

We’ll give you the information you reasonably need to show that we keep to this addendum, such as answers to a security questionnaire. If that isn’t enough, or a regulator requires it, you or an independent auditor bound by confidentiality may audit our compliance: once a year, with 30 days’ notice, during business hours, at your own cost, and in a way that doesn’t expose other gyms’ data. We’ll cooperate.

US state privacy laws

Where a US state privacy law applies, we act as your service provider or processor. We won’t sell or share gym data, or keep, use or disclose it for anything other than running Rotation Master for you, except as that law allows. We won’t combine it with personal information from elsewhere, except as that law allows. We’ll tell you if we can no longer meet these obligations.

Everything else

• This addendum lasts for as long as we process gym data for you.
• Each side’s liability under it is subject to the limits in the Terms, as far as the law allows.
• If this addendum and the Terms disagree about personal data, this addendum wins.
• Questions, instructions and requests go to info@rotation-master.com.

Annex 1: details of the processing

• Subject matter: providing Rotation Master, scheduling software for gymnastics gyms, to your gym.
• Duration: while your gym uses Rotation Master, and up to 60 days afterwards to return and delete gym data.
• Nature and purpose: storing, organising, showing and printing your gym’s schedule; running sign-in accounts for your staff and sending their sign-in emails; keeping a history of changes; support; keeping the service secure.
• Types of personal data: staff names, email addresses, roles and the gyms they belong to; passwords, stored only as one-way codes; the names of coaches on the schedule, with the classes and rotations they are given, which shows when they work; records of who changed what and when; anything else your gym’s people type in.
• People the data is about: your gym’s owners, admins, managers and coaches, and anyone else your gym adds.
• Sensitive data: none is expected. The Terms ask gyms not to enter athletes’ personal information, health information, or financial or government ID numbers.
• How often: continuously, while your gym uses Rotation Master.
• Sub-processors: as listed on Data we collect.

Annex 2: security measures

• Encryption. Every connection uses HTTPS. Our database provider encrypts stored data.
• Each gym kept separate. Row-level security in the database limits every read and write to the gyms a person belongs to, with permissions by role.
• Accounts. Passwords are stored only as salted one-way codes. Accounts are created by gym admins or by us. The app has no way to sign yourself up, and an account that belongs to no gym can’t see any gym’s data. People can sign in with an emailed link instead of a password.
• Bot protection. Cloudflare’s browser check runs before the app loads.
• Limited access. Behind the scenes, only Rotation Master support can reach gyms’ data, and only to run, support and secure the service. Secret keys are kept out of the code and out of browsers.
• A record of changes. Changes your gym’s people make are recorded with who made them and when, as is each time someone opens or leaves the app. A class changed by Rotation Master support shows “rm-support” as its last editor.
• Trusted providers. Gym data is held by Supabase and Cloudflare, which run their own independently audited security programs.
• Careful changes. Changes to Rotation Master are tested before they are released.
• Incidents. Handled as described in If something goes wrong.