CoachOS Data Processing Addendum (DPA)
Last updated: 2026-06-22
This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Coach", "Controller") and Beka Kokoladze ("CoachOS", "Processor"). It governs CoachOS's processing of personal data relating to the Coach's own clients ("Client Personal Data") on the Coach's behalf, and reflects Article 28 GDPR / UK GDPR.
Where there is a conflict, this DPA prevails over the Terms with respect to data protection.
1. Roles
For Client Personal Data the Coach is the Controller and CoachOS is the Processor. CoachOS processes Client Personal Data only to provide the Services and on the Coach's documented instructions (including via the Coach's use of the App's features), unless required by law.
For the Coach's own account/usage data, CoachOS acts as an independent controller under the Privacy Policy.
2. Subject‑matter & details of processing (Art. 28(3))
| Item | Detail |
|---|---|
| Subject‑matter | Provision of the CoachOS coaching‑assistant Services |
| Duration | For the term of the Terms and until deletion per Section 9 |
| Nature & purpose | Storing, organising, transcribing, summarising, scheduling, messaging, and displaying client information on the Coach's instructions |
| Types of personal data | Names, email addresses, phone numbers, bios, session history, attendance, payment status, free‑text notes, and voice transcripts relating to the Coach's clients |
| Categories of data subjects | The Coach's clients (and any contacts the Coach enters) |
| Special categories | Not intended; may incidentally appear in free‑text notes the Coach enters (e.g. health/fitness). The Coach is responsible for lawful basis under Art. 9 |
3. CoachOS's obligations
CoachOS will:
- Process on instructions — only process Client Personal Data on the Coach's documented
instructions, including for transfers, unless required by law (in which case it will inform the Coach unless legally prohibited).
- Confidentiality — ensure persons authorised to process the data are bound by confidentiality.
- Security — implement appropriate technical and organisational measures (Art. 32), described
in Annex 2.
- Sub‑processors — engage sub‑processors only under Section 5.
- Data‑subject requests — assist the Coach, by appropriate measures, to respond to data‑subject
requests, including providing export/deletion tooling in‑app.
- Assistance — assist the Coach with security, breach notification, data‑protection impact
assessments, and prior consultation (Arts. 32–36), taking into account the information available.
- Breach notice — notify the Coach without undue delay after becoming aware of a personal
data breach affecting Client Personal Data.
- Deletion/return — at the end of the Services, delete or return Client Personal Data per
Section 9.
- Audits — make available information necessary to demonstrate compliance and allow for
reasonable audits (which may be satisfied by third‑party certifications/reports), on reasonable notice and subject to confidentiality.
4. Coach's obligations
The Coach warrants that it has a lawful basis and has given the required notices/obtained consents to enter Client Personal Data, to use CoachOS to contact clients (SMS/WhatsApp/email), and to record any special‑category data. The Coach is responsible for the accuracy and lawfulness of its instructions.
5. Sub‑processors
The Coach provides general authorisation for CoachOS to engage the sub‑processors listed at https://coachos-ai.com/sub-processors. CoachOS will impose data‑protection obligations on each sub‑processor equivalent to those in this DPA and remains liable for their performance. CoachOS will give notice of intended changes (additions/replacements) of sub‑processors and allow the Coach to object on reasonable data‑protection grounds; if the parties cannot resolve the objection, the Coach may terminate the affected Services.
6. International transfers
Where CoachOS or a sub‑processor processes Client Personal Data outside the EEA/UK, the transfer is made under an appropriate Article 46 safeguard — the EU Standard Contractual Clauses (and the UK Addendum) and/or the recipient's Data Privacy Framework certification where applicable. The SCCs are incorporated into this DPA by reference; the relevant modules and roles are completed by the descriptions in this DPA and Annex 1.
7. Security measures
CoachOS maintains the measures described in Annex 2, including Row‑Level Security isolating each Coach's data, TLS encryption in transit, encrypted credential storage, access controls, and least privilege.
8. Data‑subject & regulator requests
If CoachOS receives a request directly from a Coach's client or a regulator regarding Client Personal Data, it will not respond directly (except to confirm the Coach is the controller) and will promptly forward it to the Coach, unless legally required to act.
9. Deletion & return
On termination, or on the Coach's request, CoachOS will delete Client Personal Data within 30 days and instruct sub‑processors to do the same, except where retention is required by law. Backups are purged on a rolling cycle.
10. Liability
Each party's liability under this DPA is subject to the limitations in the Terms.
Annex 1 — Processing details
As set out in Section 2 above. Controller = the Coach; Processor = CoachOS; sub‑processors per https://coachos-ai.com/sub-processors. Transfer mechanism = EU SCCs + UK Addendum and/or DPF.
Annex 2 — Technical & organisational security measures
- Per‑tenant isolation via Row‑Level Security keyed on the Coach's user ID.
- Encryption in transit (TLS); encryption at rest at the database/storage layer.
- Secrets stored in secure server‑side configuration; credentials on device stored in the OS secure
store.
- Least‑privilege access for personnel; authentication via magic link.
- Voice audio processed transiently for transcription and not retained as audio after processing.
- Logging and monitoring for security events; breach‑response procedure with 72‑hour regulator
notification where required.