This Data Processing Agreement describes how MUSKOX INTERNATIONAL SRL ('Processor'), operating x²coach, processes personal data on behalf of practitioners ('Controller') using the platform, in relation to the personal data of the Controller's own clients.
As a practitioner using x²coach, you (the 'Controller') determine why and how your clients' personal data is processed. MUSKOX INTERNATIONAL SRL (the 'Processor') processes that data only on your instructions, as enabled by the platform's features.
The Processor processes personal data of the Controller's clients as necessary to provide the platform's features: client records, session notes, behavioral check-ins, motivational scores, messages, and progress reports. Processing is limited to what is necessary to operate the service as configured by the Controller.
The Processor will: process personal data only on documented instructions from the Controller; ensure persons authorized to process the data are bound by confidentiality; implement appropriate technical and organizational security measures; assist the Controller in responding to data subject rights requests; notify the Controller without undue delay after becoming aware of a personal data breach; and delete or return all personal data at the end of the relationship, at the Controller's choice.
The Processor uses the following sub-processors to deliver the service: Supabase (database hosting), Vercel (application hosting), Stripe (payment processing), Resend (transactional email). Each sub-processor is bound by data protection terms consistent with this DPA. The Controller consents to the use of these sub-processors.
Where sub-processors process data outside the EEA, the Processor relies on Standard Contractual Clauses or equivalent safeguards.
Each party is liable for damages caused by its own breach of this DPA or of applicable data protection law.
Questions about this DPA: office@x2coach.com.