Data processing agreement

The Studio is the data controller for personal data of its clients (names, emails, phones, addresses, health/safety notes, booking history, payment history).

RPBis the data processor, processing this data solely on the Studio's instructions and for the purposes set out in the Terms of Service.

Identification (name, email, phone), location (city, postal code, country), demographic (birthday), booking and class attendance, payment and refund records, marketing-consent flags and timestamps, communications log (subjects + status of emails and push notifications we send), referral relationships, health-and-safety notes provided by the Studio about the client.

RPB engages the following sub-processors, all of which provide GDPR-compliant data processing terms:

• Supabase, Postgres database hosting (EU region).
• Vercel, application hosting and edge functions.
• Stripe, payment processing.
• Resend, transactional email delivery.
• Google Maps Platform, address suggestions when a Studio enters its own business address. No Client data is sent.
• Anthropic, the AI model behind Refi, the assistant on booking pages and in the Studio admin, and the text suggestions in the admin. Receives the messages sent to Refi and the booking context needed to answer them (such as the Studio's schedule and, for a signed-in Client, their upcoming bookings and credits). Processed in the United States. Anthropic does not use this data to train its models.
• Fathom Analytics, cookieless visitor statistics. No cookies, no cross-site tracking, and no raw IP stored alongside browsing activity. For EU visitors the IP is stripped inside the EU before reaching Fathom's US infrastructure; anonymised counts are stored in the US.

We notify Studios 30 days in advance if we add or replace a sub-processor with material data access.

Data is encrypted in transit (TLS) and at rest. Access to production data is restricted to authorised RPB personnel and requires multi-factor authentication. We maintain audit logs of administrative access. Database backups run continuously with point-in-time recovery up to 14 days.

The Studio remains responsible for handling data subject requests (access, rectification, erasure, portability, restriction of processing). RPB provides admin tooling to fulfil these requests (customer data export, customer deletion) and will assist within a reasonable time on requests that require backend access.

RPB notifies the affected Studio within 72 hours of becoming aware of a personal data breach, providing the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address it.

On termination of the Terms of Service, the Studio's client data is exported to the Studio and deleted from active systems within 90 days. Backup retention is up to 12 months. Booking and payment records may be retained longer where required by applicable tax law (7 years in the Netherlands).

RPB processes data within the European Economic Area where possible. Where data is transferred outside the EEA (to Anthropic in the United States, or to parts of Stripe's operations), the transfer relies on the EU-US Data Privacy Framework where the recipient is certified, and on Standard Contractual Clauses otherwise.

This DPA remains in force for as long as RPB processes personal data on behalf of the Studio. The Studio may, on reasonable notice, audit RPB's compliance with this DPA either directly or via an agreed third-party auditor.