Data processing agreement

Roles

The gym is the controller of the personal data it puts into Tadween; Tadween is its processor, and processes that data only on the gym's documented instructions: these terms, this agreement and how the gym uses the app.

What we process

• Customers and leads: names, mobile numbers, notes, and the optional details the gym records (email, gender, date of birth, nationality, address, emergency contact, language, contact preference).
• Visits, sales, follow-ups and targets.
• Gym staff: names, emails, roles, teams and sign-in records.
• Purpose: tracking leads and sales for the gym, for as long as the gym uses Tadween.

Security

• Each gym's data is kept apart by the database itself (row-level security), not only by the app.
• Encryption in transit; passwords stored only as hashes; optional and enforceable two-step sign-in.
• Access by role; an audit log of changes and sign-ins; regular access reviews.
• Backups, monitoring and a tested incident response.

Subprocessors

We use the subprocessors listed on the subprocessors page, under written terms that protect the data at least as well as this agreement. We tell gym admins before adding or replacing one, so they can object.

Breaches

We tell the gym without undue delay after becoming aware of a personal data breach affecting its data, with what we know and what we're doing, so it can meet its own obligations.

Transfers

Some subprocessors process data outside the UAE (their regions are listed). Transfers are made under the safeguards the UAE Personal Data Protection Law allows.

Help, audits and deletion

We help the gym answer its customers' requests (access, correction, deletion) and provide information about our security on request. When the gym leaves, we delete its data within 30 days, after it has had the chance to download it, except where the law requires us to keep it.