Data processing

1.Parties and framework

This document is entered into between the operator of the space subscribing to Rummo (the «Controller») and Luís Correia, sole trader, identified in the Legal notice at rummo.app/en/legal-notice («Rummo», processor).

It forms part of the Terms and Conditions and meets article 28(3) of Regulation (EU) 2016/679.

Where this document and the Terms and Conditions diverge on personal data, this one prevails.

2.Subject matter, duration, nature and purpose

Subject matter: processing personal data of the Controller's members and other data subjects, to the extent needed to provide the Rummo service.

Duration: for as long as the subscription contract is in force, plus the retention period in clause 9.

Nature and purpose: collection, recording, organisation, storage, retrieval, use and erasure, for the sole purpose of running the space — schedules, bookings, attendance, plans, charges, communication and reporting.

• a)Categories of data subjects: current and former members of the space, drop-in athletes, the space's sales contacts, and the space's team.
• b)Types of data: identity (name, email, phone, date of birth), usage data (bookings, attendance, training results), economic data (plans, charges, payment status), notes and tags written by the team, waiver signature, and photograph where the space uses one.
• c)Special categories: Rummo neither asks for nor requires health data. Base-text fields — notes and tags — may contain whatever the Controller writes there, and the interface warns against writing clinical data. Responsibility for doing so lies with the Controller.

3.Processing on documented instructions only

Rummo processes the data only on the Controller's documented instructions. Subscribing to the service and using its features constitute those instructions.

Rummo does not use this data for its own purposes, does not sell it, does not pass it to third parties for their purposes, and does not use it to train models.

Where Rummo is required to process by Union or Member State law, it informs the Controller before processing, unless that law forbids it on important grounds of public interest.

Rummo informs the Controller whenever it considers an instruction to infringe the GDPR or other data protection provisions.

4.Confidentiality

Persons acting under Rummo's authority who have access to this data are bound by confidentiality, contractual or statutory, surviving the end of their duties.

Access is limited to those who need it to provide the service or to give support at the Controller's request.

Support access to a space is temporary, logged, and visible to the Controller.

5.Security

Rummo implements technical and organisational measures appropriate to the risk, under article 32 GDPR, including:

• a)Isolation between spaces enforced in the database itself, not only in the application: whoever does not belong to a space neither reads nor writes its data.
• b)Encryption in transit on all connections.
• c)Passwordless authentication, by single-use code or Google account.
• d)Logging of sensitive operations, with keys redacted.
• e)Periodic database backups.
• f)Automated isolation tests between spaces, run on every change, which block the release of code that breaks them.

6.Sub-processors

The Controller gives general authorisation for Rummo to use the sub-processors below. Each is bound by contract to data protection obligations no less onerous than those in this document.

For each one we state the entity, what it does and where it processes the data. Transfers outside the European Economic Area, and the basis for each, are in clause 11.

• a)Hostinger International Ltd. (Cyprus): hosting of the server that runs the application and the database, with its backups. The server is in a data centre in the European Union. Rummo itself installs and runs the database on that server, and no other database provider has access to it.
• b)Hostinger International Ltd. (Cyprus): transactional email, such as sign-in codes, notices and the messages the space sends. It processes the recipient address and the message content. Hostinger uses sub-processors of its own, listed in its data processing agreement.
• c)Stripe Payments Europe, Limited (Ireland): charges for the Rummo subscription and, when the space connects its Stripe account, members' payments to the space. In those payments Stripe also processes, as a controller in its own right, the data the law requires it to process, such as for fraud prevention, under its contract with the space.
• d)Anthropic Ireland, Limited (Ireland): the «Agent», on paid plans. It only receives a space's data after that space's owner turns it on in the app, having first read what is sent, and only when someone on the team asks it something. It receives the question and figures from the space, with people as references («Member 17»), and never names, contacts, notes or health data. It does not use this data to train models. It deletes it within 30 days, except what its safety systems flag as a usage policy violation, which it may keep for up to 2 years.
• e)Functional Software, Inc., which operates Sentry (United States): application error logging, when enabled. It receives technical error messages, with sensitive keys removed, which may contain internal identifiers.
• f)Slack Technologies Limited (Ireland): internal notices to the Rummo team, when enabled. It receives the space's name, account events and error messages with email addresses masked.

6.1.

Rummo gives at least 30 days' notice of any change to this list. The Controller may object on data protection grounds within that period; failing agreement, they may terminate the subscription without penalty and with a refund of the unused period.

6.2.

These are not Rummo sub-processors, and so are not on the list:

• a)Google Analytics, Google Ads and the Meta pixel. They load on Rummo's marketing website, with the visitor's consent. Inside the application, only Google Ads, and only on the page after creating a space. They receive no data from the Controller or its members.
• b)The notification service of the browser or phone receiving a notice (Google, Apple, Mozilla or Microsoft). The device chooses it, not Rummo. The message travels encrypted, and that service only delivers it.
• c)Google, when someone chooses to sign in with a Google account. That is a relationship between that person and Google, and Google receives no data from the space.

7.Assisting with data subject rights

Rummo gives the Controller the means to answer access, rectification, erasure and portability requests themselves: the application allows viewing, correcting, exporting and anonymising a member's data.

Where Rummo receives a request directly from one of the Controller's data subjects, it does not answer on the merits — it forwards it to the Controller without undue delay.

Where the application's means do not suffice, Rummo provides reasonable assistance, taking into account the nature of the processing.

8.Assisting with articles 32 to 36

Rummo notifies the Controller of any personal data breach without undue delay after becoming aware of it, with the information it holds, so the Controller can notify the supervisory authority within 72 hours.

Rummo provides reasonable assistance with data protection impact assessments and prior consultation of the supervisory authority, where applicable.

9.Return and erasure at the end

Cancelling the plan does not delete data: the space moves to the free Lite plan and the data stays. The Controller may export it at any time, inside the application and in a machine-readable format.

When the Controller deletes the space, under Configurações → Propriedade, Rummo erases the personal data processed on the Controller's behalf. Only what Union or Member State law requires to be kept remains, notably billing records.

Backups are recycled on their own cycle, no longer than 90 days, after which the data they contain ceases to exist.

10.Information and audits

Rummo makes available to the Controller the information necessary to demonstrate compliance with article 28.

The Controller may carry out audits, including inspections, itself or through an auditor it mandates, on 30 days' notice, at most once per calendar year, unless there has been a breach or a supervisory authority so requires.

Audits take place during business hours, without disrupting operations, and the auditor is bound by confidentiality.

11.International transfers

The service's data is stored in the European Union, on the server in clause 6.

Data is transferred outside the European Economic Area in the cases below, each with its own basis under chapter V GDPR:

• a)Anthropic: to the United States, under the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914, module 3, which form part of Anthropic's data processing addendum. It only happens with the «Agent» turned on, when someone asks it something.
• b)Stripe: to Stripe, Inc., in the United States. Basis: the EU-U.S. Data Privacy Framework (Commission adequacy decision of 10 July 2023), under which Stripe, Inc. is certified, and the standard contractual clauses in Stripe's data processing agreement.
• c)Sentry: to the United States, under the EU-U.S. Data Privacy Framework, under which Functional Software, Inc. is certified, and the standard contractual clauses in its agreement. Rummo may move error logging to Sentry's European region, in which case this item no longer applies.
• d)Slack: to the United States, under the EU-U.S. Data Privacy Framework and the standard contractual clauses in Slack's data processing agreement.
• e)Hostinger: to its sub-processors outside the European Economic Area, under the standard contractual clauses in Hostinger's data processing agreement.

11.1.

A new transfer is notified to the Controller before it begins, with the right to object in clause 6.1.

On request, Rummo gives the Controller a copy of the safeguards for each transfer.

12.Liability

Each party is liable for damage it causes by infringing the GDPR, under article 82.

The liability cap in the Terms and Conditions does not apply to fines and compensation arising from Rummo's culpable breach of the obligations the GDPR places specifically on processors.

13.Language

This English text is a translation provided for convenience. In case of divergence, the Portuguese version prevails.