Data Processing Agreement

1. Parties

• Processor: DNI Ltd, trading as DNI Analytics, a company registered in England and Wales under company number 15630271, registered office 78a Deacon Road, London NW2 5QJ ("we", "us")
• Controller: the studio or business subscribing to DNI Studios ("you")

This agreement takes effect on the date you begin using the Service and continues for as long as we process personal data on your behalf.

2. Subject matter and duration

We process personal data solely to provide the DNI Studios platform to you — hosting it, keeping it available, supporting it, and doing what you instruct through it. Processing continues for the life of your subscription and for no more than 90 days after it ends.

3. Nature and purpose of processing

• Storing and retrieving client records so your staff can manage training
• Scheduling sessions and recording attendance
• Recording workouts, body metrics, wellness and nutrition logs
• Storing media you or your clients upload — progress photos, form-check video, voice notes
• Carrying messages between your staff and your clients
• Recording payment status (never full card numbers)
• Generating AI Coach responses, where you enable that feature
• Sending transactional email and push notifications

4. Categories of data subject

• Your training clients
• Your staff — owners, trainers, managers, front-desk
• Your leads and enquiries

5. Categories of personal data

Ordinary personal data: name, email, phone, date of birth, gender, profile photo, session and attendance history, payment status, messages, community posts.

6. Your obligations as controller

You warrant that:

• You have a lawful basis for everything you record, and explicit consent (or another Article 9 condition) for health data
• You have given your clients your own privacy notice
• You have obtained parental or guardian consent for any client under 16
• Your instructions to us will not cause us to breach UK GDPR
• You will respond to your own clients' data subject requests
• You have registered with the ICO and paid the data protection fee, where required

7. Our obligations as processor

We will:

• Process only on your documented instructions, including for international transfers, unless required otherwise by law — in which case we will tell you first unless the law forbids it
• Ensure everyone authorised to process the data is bound by confidentiality
• Apply the technical and organisational measures in section 9
• Engage sub-processors only as set out in section 8
• Assist you, so far as reasonably possible, in responding to data subject requests
• Assist you with data protection impact assessments and with security, breach notification and consultation obligations
• Delete or return the data at the end of the Service, as set out in section 11
• Make available the information needed to demonstrate compliance, and allow for audits under section 12
• Tell you without undue delay on becoming aware of a personal data breach

We will not sell your data, use it to build a profile of your clients for our own purposes, or use it to train AI models.

8. Sub-processors

You give general written authorisation for us to engage the sub-processors below. We remain fully liable to you for their performance.

We will give you at least 30 days' notice before adding or replacing a sub-processor. If you reasonably object on data protection grounds, you may terminate your subscription without penalty and receive a pro-rata refund of any prepaid fees.

The current list always appears in our Privacy Policy.

9. Security measures

• All traffic encrypted in transit using TLS
• Data encrypted at rest by our hosting provider
• Passwords stored only as salted one-way hashes, never recoverable
• Role-based access control — trainers see only what you permit
• Logical separation between studios, so no studio can reach another's records
• Rate limiting and standard security headers
• Sessions expire after 30 days
• Regular automated database backups

We review these measures as the Service develops, and will not materially reduce the overall level of security during your subscription.

10. International transfers

Where a sub-processor is outside the UK, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an applicable adequacy decision. Details of the safeguards in place are available on request.

11. Deletion and return

• You can export a complete copy of any client's data at any time, as structured JSON, from within the app
• Deleting a client permanently erases them across every record — profile, sessions, workout and wellness logs, media, payments, messages, community posts and portal login
• We keep a minimal erasure record — the client id, who performed it and when, containing no personal data — so that the deletion can be evidenced afterwards
• On termination you have 30 days to export. We then delete or return all personal data within a further 60 days, unless retention is required by law

12. Audit

On reasonable written notice, and no more than once a year unless a regulator requires otherwise, we will provide the information reasonably necessary to demonstrate compliance with this agreement. Where a physical audit is genuinely required, it will be at your cost, during business hours, and must not disrupt the Service or compromise the confidentiality of other customers.

13. Liability

Liability under this agreement is subject to the limitations and exclusions in our Terms of Service. Nothing here limits either party's liability to a data subject or a regulator under UK GDPR.

14. Governing law

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

15. Signing this

These terms apply automatically through section 7 of our Terms of Service, so no signature is needed for them to bind us. If your compliance process requires a countersigned copy, email darshan.mashru@dnianalytics.com and we will provide one.