Data Processing Agreement

Effective Date: April 16, 2026

This Data Processing Agreement ("DPA") forms part of the Coach Agreement between Gafarova Tanzilia, operating as The Art of Practice ("Platform," "we," "us"), and the independent coach ("Coach," "you") who accesses practitioner data through the Platform.

1. Definitions

• "Practitioner Data" means any personal data belonging to practitioners that the Coach accesses through the Platform, including but not limited to names, email addresses, practice logs, skill assessments, video uploads, session notes, and direct messages.
• "Processing" means any operation performed on Practitioner Data, including viewing, storing, analyzing, communicating about, or transmitting such data.
• "Data Controller" refers to the Platform, which determines the purposes and means of processing Practitioner Data.
• "Data Processor" refers to the Coach, who processes Practitioner Data on behalf of the Platform to provide coaching services.

2. Scope and Purpose

The Coach may access Practitioner Data solely for the purpose of providing coaching services requested by the practitioner through the Platform. The Coach may not process Practitioner Data for any other purpose, including but not limited to marketing, solicitation, research, or sale to third parties.

3. Coach Obligations

The Coach agrees to:

• Process Practitioner Data only as necessary to fulfill coaching services and only in accordance with this DPA and the Platform's Privacy Policy.
• Not copy, download, export, or store Practitioner Data outside the Platform unless explicitly authorized by the practitioner in writing.
• Not share Practitioner Data with any third party for any reason.
• Not contact practitioners outside the Platform using contact information obtained through the Platform, unless the practitioner has explicitly consented.
• Implement reasonable security measures to protect any Practitioner Data accessed through the Platform.
• Promptly notify the Platform (within 48 hours) of any data breach, unauthorized access, or security incident involving Practitioner Data.
• Upon termination of coaching services or the Coach Agreement, cease all processing of Practitioner Data and delete any copies stored outside the Platform.
• Cooperate with the Platform in responding to data subject access requests, deletion requests, or other rights exercised by practitioners under applicable data protection laws.

4. Practitioner Rights

Practitioners retain all rights over their personal data as described in the Platform's Privacy Policy, including the right to access, correct, delete, and export their data. If a practitioner exercises any of these rights, the Coach must comply promptly and cooperate with the Platform to fulfill the request.

5. Data Retention

The Coach may access Practitioner Data only for the duration of an active coaching relationship. Once a coaching relationship ends (whether through cancellation, completion, or termination), the Coach's access to that practitioner's data is revoked. The Coach must not retain any copies of Practitioner Data after access is revoked.

6. Sub-Processing

The Coach may not engage any sub-processor to process Practitioner Data without prior written approval from the Platform. If approved, the Coach is responsible for ensuring the sub-processor complies with obligations equivalent to those in this DPA.

The Platform itself uses a small number of third-party service providers to operate the Service, including hosting, payment processing, email delivery (Resend and Zoho Mail), AI processing (Google and Anthropic), CRM and marketing email (GoHighLevel and MailerLite), invoicing (Számlázz.hu), video delivery (Bunny.net and Wistia), and print-on-demand fulfillment (Lulu). The current list, with the purpose and data category for each provider, is published at Subprocessors. That page is updated whenever a provider is added or removed.

7. International Transfers

If the Coach is located outside the European Economic Area, the Coach acknowledges that accessing Practitioner Data from EU/EEA residents constitutes an international data transfer. The Coach agrees to implement appropriate safeguards as required by GDPR Article 46, which may include Standard Contractual Clauses provided by the Platform.

Certain of the Platform's subprocessors listed at Subprocessors are located in the United States. Where personal data is transferred to those providers, the transfer relies on an appropriate safeguard under GDPR Chapter V, namely the European Commission's Standard Contractual Clauses (or, where applicable, an adequacy decision covering the recipient).

8. Audit Rights

The Platform reserves the right to audit the Coach's compliance with this DPA. The Coach agrees to cooperate with reasonable audit requests and provide information necessary to demonstrate compliance.

9. Liability

The Coach is solely liable for any damages resulting from their breach of this DPA. The Coach agrees to indemnify and hold harmless the Platform from any claims, fines, penalties, or damages arising from the Coach's unauthorized or non-compliant processing of Practitioner Data.

10. Termination

This DPA remains in effect for as long as the Coach has access to Practitioner Data through the Platform. The Platform may terminate the Coach's access to Practitioner Data immediately upon any breach of this DPA. Sections 3, 4, 5, and 9 survive termination.

11. Governing Law

This DPA is governed by the laws of Hungary and, where applicable, the General Data Protection Regulation (EU) 2016/679. Disputes shall be resolved in the courts of Budapest, Hungary.

12. Contact

This DPA is made available to every coach who processes student (practitioner) data through the Platform, and it takes effect when the coach is granted access to Practitioner Data. See also the Impressum for the operator's full legal and contact details.

For questions about this DPA, contact:
support@theartofpractice.com
Gafarova Tanzilia
Szondi utca 2/A, 1201 Budapest, Hungary