Data Processing Addendum

This addendum forms part of the agreement between Coachible ("Processor") and the coach or coaching business using the platform ("Customer" or "Controller"). The Customer remains responsible for determining the purposes and lawful means of processing client personal data.

The Processor will process personal data for the duration of the Customer's use of the platform and for the limited period needed to export, return or securely delete data after termination, subject to legal retention requirements.

Processing may include hosting, storing, organising, retrieving, displaying, transmitting, backing up, securing and deleting information to provide the Coachible CRM, client hub, booking, messaging, coaching delivery, document, assessment, AI-assistance and related platform features selected by the Customer.

Data subjects may include the Customer's clients, prospective clients, team members and other contacts. Data may include names, contact details, booking and communication records, coaching goals, session notes, progress, assessments, uploaded documents and other information the Customer chooses to enter. Special-category data should not be submitted unless the Customer has established an applicable condition and the parties have agreed any additional safeguards required.

The Processor will process Customer Personal Data only on documented instructions, including instructions given through the Customer's use of configured platform features, unless required by applicable law. Persons authorised to process the data will be subject to appropriate confidentiality obligations.

The Processor will implement technical and organisational measures appropriate to the risks, and will provide reasonable assistance with data subject requests, security obligations, breach response, impact assessments and regulatory consultation, taking into account the nature of processing and information available. Details of the technical and organisational measures applied to the platform are available from Coachible on request, subject to appropriate confidentiality and security restrictions.

The Processor may use sub-processors only under the required written authorisation and subject to equivalent data protection obligations. Coachible will make current information about relevant sub-processors, their processing purposes and applicable transfer safeguards available to customers. The Processor will notify the Customer of material sub-processor changes and provide a reasonable opportunity to object on data protection grounds.

The Processor will notify the Customer of requests received directly from data subjects where appropriate and assist the Customer in responding. The Processor will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with available information to support the Customer's obligations.

At the Customer's choice, the Processor will make Customer Personal Data available for export or securely delete it after the service ends, subject to applicable legal retention requirements and backup cycles. Customers may request current information about available export formats, deletion timelines and applicable backup retention by contacting Coachible.

The Processor will make available information reasonably necessary to demonstrate compliance with this addendum and will support proportionate audits or inspections, subject to confidentiality, security and reasonable notice arrangements.

Privacy contact: hello@coachible.com. This addendum applies when the Customer accepts it as part of the Coachible service agreement. In the event of conflict, this addendum governs the processing of Customer Personal Data to the extent of that conflict.