Allfitup
-
Sign UpSign Up
Effective date: 2026-04-27
This DPA applies when AllFitUp processes Customer Personal Data on behalf of a Customer in connection with the Services. The Customer is the controller or business responsible party. AllFitUp is the processor, service provider, or equivalent role, except where AllFitUp independently processes data for its own account, billing, security, analytics, legal, or business purposes.
AllFitUp will process Customer Personal Data only according to Customer’s documented instructions, including these Terms, product settings, support requests, and lawful directions, unless required by law. If AllFitUp believes an instruction violates Data Protection Laws, it may suspend the instruction and notify Customer where appropriate.
AllFitUp’s security measures may include access controls, encryption in transit, authentication controls, logging, monitoring, backups, least-privilege access, vendor review, secure development practices, vulnerability management, and incident response processes. Specific measures may evolve over time as the Services mature.
Customer authorizes AllFitUp to engage Sub-processors to provide hosting, storage, analytics, payments, support, email, security, AI infrastructure, and other services. AllFitUp will impose data protection obligations on Sub-processors that are materially protective of Customer Personal Data. AllFitUp will provide a list of Sub-processors upon request. Where required, AllFitUp will give notice of material Sub-processor changes and allow objections based on reasonable data protection grounds.
Where Customer Personal Data is transferred internationally and transfer safeguards are required, the parties will use appropriate mechanisms such as adequacy decisions, standard contractual clauses, UK addendum, Korean transfer consent mechanisms, or other lawful safeguards. Customer authorizes AllFitUp to make such transfers as needed to provide the Services.
AllFitUp will notify Customer without undue delay after becoming aware of a confirmed personal data breach involving Customer Personal Data, as required by applicable law. The notice may include available information about the nature of the incident, affected data, likely consequences, mitigation steps, and recommended actions. Customer is responsible for notifying Clients, regulators, or other parties where required, unless law places that obligation on AllFitUp.
If AllFitUp receives a request from a Client concerning Customer Personal Data, AllFitUp may direct the requester to the Customer unless required by law to respond. AllFitUp will provide reasonable assistance for access, correction, deletion, export, objection, restriction, or consent withdrawal requests where required and technically feasible.
Upon reasonable written request, AllFitUp will provide information necessary to demonstrate compliance with this DPA, such as security summaries, policies, certifications if any, or responses to reasonable questionnaires. On-site audits require prior written agreement, reasonable scope, confidentiality protections, and reimbursement of costs unless required by law.
Upon termination, AllFitUp will delete or return Customer Personal Data according to the Data Deletion Policy, unless retention is required for legal, tax, security, backup, dispute, abuse prevention, or compliance reasons. Backup deletion may occur according to standard backup rotation schedules.
Liability under this DPA is subject to the limitations and exclusions in the Terms of Service unless prohibited by applicable law.