Terms of service and data processing agreement
Last updated: 30/10/2026
1. The service
TrainFit (TrainFit, info@trainfit.gr) provides the gym ("the customer") with an online application to manage its members, payments, attendance and bookings, and an app for its members. These terms apply from the moment the customer's owner accepts them at sign-up or in the app.
2. The customer's account
The owner keeps sign-in details secret, gives staff only the access they need, and is responsible for what is done with the gym's accounts. The customer is responsible for the lawfulness of the data it records and for informing its members (e.g. through its regulations, which the app helps members sign).
3. Availability and support
TrainFit aims for continuous availability and keeps daily backups, but does not guarantee that the service will never be interrupted. Support: info@trainfit.gr.
4. Price and term
The price and the trial period are those agreed at sign-up. Either side may end the agreement at the end of a paid period. After the end, the customer can export its data for 30 days; then it is deleted as described in the privacy policy.
5. Liability
TrainFit is liable for damage it causes intentionally or through gross negligence. Otherwise its liability is limited to the fees the customer paid in the previous 12 months. TrainFit is not liable for decisions the customer takes based on the application, nor for third-party services the customer connects (SMS, payment providers).
6. Data processing agreement (GDPR Art. 28)
Roles: the customer is the controller of its members' and leads' data; TrainFit processes it on the customer's behalf and only on its documented instructions, which are these terms and the customer's use of the application.
Subject and duration: running the service for as long as the agreement lasts. Data subjects: members, their parents or guardians, prospective members, staff. Data: as listed in the privacy policy, including health data (health certificates) when the customer records it.
Confidentiality: only people bound to confidentiality who need it to run or support the service have access, and only as far as needed.
Security (Art. 32): encrypted connections, separation of each customer's data, hashed passwords, role-based access, two-step verification for staff, throttled sign-ins, and nightly backups readable only by the server's administrators.
Sub-processors: the hosting provider (data centre in Germany, EU), the email provider, the AI provider (Anthropic) for the assistant and document reading, browser push services, and the SMS and payment providers the customer itself selects. The customer authorises them; TrainFit informs the customer of new sub-processors in advance and the customer may object. TrainFit imposes the same data protection obligations on them.
Assistance: TrainFit helps the customer answer data subjects' requests (the application includes data export, erasure and members' requests), with security, impact assessments and consultations.
Personal data breaches: TrainFit informs the customer without undue delay, and within 48 hours of becoming aware, with what is known, so the customer can notify the authority within 72 hours.
End: at the end of the agreement TrainFit deletes the customer's personal data (after the 30-day export window) unless the law requires it to keep it.
Audits: TrainFit makes available the information needed to show compliance and allows audits by the customer or an auditor it appoints, with reasonable notice.
International transfers: only with appropriate safeguards (standard contractual clauses or an adequacy decision).
7. Changes and law
TrainFit may update these terms; the customer's owner sees and accepts important changes in the app. Greek law applies; the courts of Athens have jurisdiction.