This version was replaced on 2026-10-27. Read the current version.

Data Processing Agreement

Last updated: 2026-10-26

This Data Processing Agreement ("DPA") is between Sweatkraft AS ("SweatStack") and the customer: the legal entity or person who registers an application on the SweatStack platform ("Developer"), or the SweatStack user who manages an account for someone else ("Manager"). It applies automatically when you register an application, call the SweatStack API or create an account for someone else, and forms part of the SweatStack Terms and Conditions.

We've kept it short on purpose. The substantive obligations are in GDPR; this document records how they apply to our relationship.

1. Scope and roles

This DPA covers personal data of end users that SweatStack processes for, or shares with, the customer.

  • Independent controllers (athlete data via the API). For personal data that the Developer pulls from the SweatStack API after a user authorizes the Developer's app, SweatStack and the Developer are each independent controllers. Each party determines the purposes and means of processing on its own side and is responsible for its own GDPR compliance.
  • SweatStack as processor (developer-controlled storage). For data the Developer writes back into SweatStack, including the app-metadata feature and any future developer-controlled storage SweatStack offers, SweatStack acts as a processor on the Developer's behalf.
  • SweatStack as processor (managed accounts). For an account the customer manages for someone else, SweatStack acts as a processor for all of that account's data. That is an account a Manager creates for an athlete in SweatStack, or an account that belongs to the Developer's application rather than to the athlete. The customer is the controller: it decides why the account exists and what happens to its data, and it is responsible for having a lawful basis, including any consent the athlete or their parent or guardian must give.

Sections 3 and 4 govern SweatStack's processing as a processor.

2. Independent-controller cooperation

For data processed under the independent-controller relationship:

  • Each party will have its own privacy notice covering its processing.
  • Each party will handle data subject requests directed to it, and will cooperate in good faith on requests that span both parties.
  • Each party will inform the other without undue delay of any personal data breach affecting shared data subjects, so the other party can meet its own notification obligations.

3. SweatStack as processor: subject matter and instructions

Where SweatStack acts as the customer's processor:

  • Subject matter and duration.
    • Developer-controlled storage: the data the Developer writes into it, for as long as the Developer's account is active.
    • Managed accounts: the account and all its data, for as long as the account exists.
  • Nature and purpose.
    • Developer-controlled storage: storing the data so the Developer's app can read it back and use it inside the Developer's product.
    • Managed accounts: providing the SweatStack service for the account: receiving data from the platforms connected to it, storing it, computing analyses, and making it available to the customer and to the people and apps the customer authorizes.
  • Categories of data and data subjects.
    • Developer-controlled storage: whatever the Developer chooses to write. Developers must not store data that the user would not reasonably expect them to keep in this storage.
    • Managed accounts: the athlete's name and, where given, email address; their health and fitness data (activities, daily measures and, if entered, reproductive health data, as described in the Privacy Policy).
  • Instructions. SweatStack will process this data only on the customer's documented instructions, which are the SweatStack Terms, this DPA, and the actions the customer takes in SweatStack or through the API. Sharing a managed account with a team, a coach or an app is an instruction. SweatStack will not access this data except as needed to provide and secure the service, and does not use it for purposes of its own: not to improve its product, not for research, and never to train AI models. If SweatStack believes an instruction infringes GDPR, it will say so before acting on it. Where EU or member state law requires SweatStack to process the data otherwise, it will inform the customer first, unless that law forbids it.

4. Processor obligations

When acting as processor, SweatStack will:

  • Confidentiality. Ensure that personnel authorized to process the data are bound by confidentiality.
  • Security. Implement the technical and organizational measures described in Appendix A.
  • Sub-processors. Use the sub-processors listed at sweatstack.no/sub-processors. SweatStack will give at least 30 days' notice before adding or replacing a sub-processor, by announcing it on that page. The customer may object on reasonable grounds; if we can't resolve the objection, the customer may terminate the affected service.
  • Assistance. Assist the customer, taking into account the nature of processing and the information available, in responding to data subject requests and in meeting the customer's obligations under Articles 32–36 of GDPR. For managed accounts, the customer answers the athlete's requests; the tools for it (export, correction, deletion) are in SweatStack and its API. A request that reaches SweatStack directly is passed on to the customer.
  • Breach notification. Notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data. For data received with the customer's own platform keys, notify within 24 hours of confirming the breach, so the customer can meet the platform's own deadline (Garmin's is 24 hours).
  • Return or deletion. On termination of the customer's account or this DPA, delete the data processed for the customer within a reasonable period, except where law requires retention. The customer can export the data before that.
  • Information and audits. Make available the information reasonably necessary to demonstrate compliance with this section. Until SweatStack has formal third-party security certifications, this takes the form of written responses to reasonable questions; once certifications exist, sharing the relevant reports will satisfy this obligation.

5. International transfers

Where personal data is transferred outside the EEA, either between SweatStack and the customer or to SweatStack's sub-processors, the parties rely on the European Commission's Standard Contractual Clauses (Module 1 for controller-to-controller transfers between the parties, Module 4 for processor-to-controller transfers to a customer outside the EEA, the appropriate modules for sub-processors) and any additional safeguards the providers offer.

6. Term

This DPA applies for as long as the Developer has an active SweatStack application or API access, or the Manager manages an account. Sections that by their nature should survive termination (confidentiality, accrued liability, return/deletion obligations) will do so.

7. Conflicts

If this DPA conflicts with the SweatStack Terms and Conditions on data protection matters, this DPA controls. For everything else, the Terms control.

Appendix A: Technical and organizational measures

SweatStack's current measures include:

  • Encryption. TLS for all data in transit.
  • Access control. Production access is limited to authorized personnel on a need-to-know basis and is individually attributable.
  • Hosting. Primary application and database hosting in Finland (EU) with Hetzner. Sub-processor list maintained at sweatstack.no/sub-processors.
  • Monitoring. Continuous error monitoring. Application and error logs are retained for a limited period (roughly 30 to 90 days) and then deleted.
  • Vulnerability management. Dependencies are reviewed and updated regularly. Security issues are triaged on discovery.
  • Backups. Regular backups of the primary database.
  • Incident response. Defined process for detection, containment, notification, and post-incident review.

These measures evolve with the service. The current version is always reflected here.

Contact

For DPA matters, email [email protected].

Sweatkraft AS, Norway.