This Data Processing Agreement describes how MUSKOX INTERNATIONAL SRL (“Processor”), operating x²coach, processes personal data on behalf of practitioners ('Controller') using the platform, in relation to the personal data of the Controller’s own clients.
As a practitioner using x²coach, you (the “Controller”) determine why and how your clients’ personal data is processed. MUSKOX INTERNATIONAL SRL (the 'Processor') processes that data only on your instructions, as enabled by the platform’s features.
The Processor processes personal data of the Controller’s clients as necessary to provide the platform’s features: client records, session notes, behavioural check-ins, motivational scores, messages, and progress reports. Processing is limited to what is necessary to operate the service as configured by the Controller.
The Processor will: process personal data only on documented instructions from the Controller; ensure persons authorized to process the data are bound by confidentiality; implement appropriate technical and organizational security measures; assist the Controller in responding to data subject rights requests; notify the Controller without undue delay after becoming aware of a personal data breach; and delete or return all personal data at the end of the relationship, at the Controller’s choice.
The Processor uses the following sub-processors to deliver the service: Supabase (database, hosted in Ireland, EU); Vercel (application hosting); Anthropic (AI assistant, USA); Resend (transactional email, USA); Stripe (online payments, only if the Controller enables online payments from their clients); Google (calendar sync, only if the Controller connects it). Each sub-processor is bound by data protection terms consistent with this DPA. The Controller authorises the use of these sub-processors. The Processor informs the Controller before adding or replacing a sub-processor, and the Controller may object.
Some platform features use an AI assistant provided by Anthropic: session preparation, draft messages and scripts, summaries, analyses and the assistant's replies in the client portal. The assistant receives only what the feature in use requires. Anthropic does not use data received through its API to train its models. The assistant does not make decisions with legal or similarly significant effects on clients: its output consists of proposals that the Controller reviews and is responsible for. Clients can give or withdraw their consent to the AI assistant from their portal.
Where sub-processors process data outside the EEA, the Processor relies on Standard Contractual Clauses or equivalent safeguards.
Each party is liable for damages caused by its own breach of this DPA or of applicable data protection law.
Questions about this DPA: office@x2coach.com.