Data Processing Agreement

This agreement is between the gym that uses KriyaCore (“the gym”) and KriyaCore (“we”). It forms part of our Terms of Service and covers the personal data of the gym’s members, staff and other people that the gym records in KriyaCore.

1. Roles

Under India’s Digital Personal Data Protection Act, 2023 (“the Act”), the gym is the Data Fiduciary: it decides what personal data to collect and why. KriyaCore is its Data Processor: we process that data only on the gym’s behalf, to provide KriyaCore.

2. What we process

People	The gym’s members, staff and trainers, and anyone else the gym records.
Data	Names, phone numbers, email addresses, dates of birth, notes; memberships, payments and invoices; attendance and entry times; staff salaries, pay terms and emergency contacts; consent records for WhatsApp and Face ID; the Face ID terminal’s member ID number. No photos or face templates: those stay on the gym’s own terminal.
Purpose	Running the gym’s membership, billing, attendance, staff and messaging through KriyaCore.
Duration	For as long as the gym uses KriyaCore, then as in section 8.

3. Our commitments

• Instructions. We process the data only to provide KriyaCore as the gym uses and configures it, and never for our own purposes such as advertising or selling data. The gym’s use of the product is its instruction to us.
• Confidentiality. Only people working on KriyaCore can reach the data, only when needed to run or support it, and they are bound to keep it confidential. When we sign in as a gym to help it, that is recorded in the audit log.
• Security. We keep reasonable security safeguards in place, including encrypted connections, hashed passwords, optional two-factor sign-in, account lockout, separation of each gym’s data, encrypted backups and an audit log of sensitive actions.
• Sub-processors. We use the service providers listed on our Sub-processors page, each bound to protect the data. We will tell the gym at least 14 days before adding or replacing one, and the gym may cancel if it objects.
• Location. The data is stored in Singapore, with encrypted backups held as described on the Sub-processors page. The gym agrees to this. If the Government of India restricts transfers to any of these countries, we will move the data.

4. Data breaches

If we become aware of a breach affecting the gym’s personal data, we will tell the gym’s owner within 72 hours by email, with what we know about what happened, the data and people affected, and what we are doing about it. We will keep the gym updated and help it meet its own duty to inform the Data Protection Board of India and the people affected.

5. Helping with people’s requests

KriyaCore includes tools for the gym to respond to members exercising their rights under the Act: exporting everything held about a member, correcting it, and erasing it. Billing records are kept where the law requires the gym to retain them. If someone contacts us directly about data the gym holds, we will pass the request to the gym rather than answer it ourselves.

6. The gym’s responsibilities

• Give members and staff a notice explaining what it records and why. KriyaCore provides a ready-made notice and consent form, which the gym should check and adapt.
• Get consent where the Act requires it, including explicit consent before enrolling anyone in Face ID and before sending them WhatsApp messages, and verifiable consent from a parent or guardian for anyone under 18.
• Record only what it needs, keep it accurate, and handle members’ requests promptly.
• Control who has a login, and remove staff who leave.

7. Information and audits

On reasonable request, we will give the gym the information it needs to show that this agreement is being followed, such as a description of our security measures or the relevant audit log entries.

8. When the gym leaves

After the gym’s account is closed, we keep its data for 30 days so the gym can ask for a full export, then delete it. Copies in our encrypted backups are gone within a further 30 days. We keep only what the law requires us to keep, such as records of what the gym paid us.

9. General

If this agreement and the Terms of Service conflict on personal data, this agreement wins. It is governed by the laws of India, and the courts at Kolkata, West Bengal have exclusive jurisdiction. Contact: info@kriyacore.in.