---
title: "Data processing agreement | GymSetora"
description: "The data processing agreement between a gym (Data Fiduciary) and GymSetora (Data Processor) for member data under the DPDP Act 2023."
url: https://www.gymsetora.com/dpa
updated: 2026-10-23
---

# Data processing agreement

Last updated 23 October 2026

This agreement (“DPA”) forms part of the [terms of service](https://www.gymsetora.com/terms) between the gym (“you”, the Data Fiduciary) and Sahil Afridi, trading as GymSetora (“GymSetora”, the Data Processor). It applies to personal data of your members, leads and staff that GymSetora processes on your behalf. The gym owner accepts it when creating the account.

## 1. What is processed and why

- **Purpose:** providing GymSetora to you: memberships, fee collection, check-in, receipts, invoices, messages and reports.
- **People:** your members and leads, their emergency contacts, and your staff.
- **Data:** contact details, photos, dates of birth, membership and payment history, check-ins, any health notes you choose to record, and the last four digits of Aadhaar if you record it.
- **Duration:** while your account is active, then as set out in section 7.

## 2. Your instructions

We process this data only to provide the service and on your documented instructions, which are these terms and the settings you choose in the app. We tell you if we believe an instruction breaks the law. We do not sell the data or use it for advertising.

## 3. Your responsibilities

You decide what data to collect and why, give members the notice the DPDP Act requires, obtain consent where it is needed (including verifiable parental consent for anyone under 18), and answer members’ requests about their data.

## 4. Security

- Every gym’s data is isolated by tenant; staff see only their own gym.
- Passwords are hashed with argon2id; sensitive credentials are encrypted with AES-256-GCM.
- Data is encrypted in transit (HTTPS/TLS). Staff logins support two-factor authentication and trusted-device locks.
- Staff actions and sign-ins are written to an audit log you can review.
- Our personnel with access are bound by confidentiality and get access only when needed to run or support the service.

## 5. Sub-processors

We use these sub-processors, under contracts with comparable data-protection obligations:

- Cloud hosting and database: Render (application servers), Supabase (database and file storage) and Vercel (web app and website).
- Meta Platforms (WhatsApp Business Platform): login codes and messages your gym sends.
- Razorpay and Stripe: subscription and autopay payments.
- Sentry: error monitoring, with personal data scrubbed, when enabled.

We will notify gym owners at least 30 days before adding or replacing a sub-processor, so you can object.

## 6. Personal data breaches

If we become aware of a breach affecting your data, we will tell you without undue delay and within 72 hours, with what we know, and help you meet your duty to inform affected people and the Data Protection Board of India.

## 7. Rights requests, return and deletion

- The app lets you export, correct and anonymise member records, so you can answer access, correction and erasure requests.
- The owner can export the gym’s full data at any time while the account is active.
- When the account ends we delete or anonymise your data within 90 days after the account is closed, except records the law requires us to keep (such as tax invoices).

## 8. Information and audits

On reasonable written request we will provide the information needed to show compliance with this DPA, including answering security questionnaires. See also our [security page](https://www.gymsetora.com/security) and [privacy policy](https://www.gymsetora.com/privacy).