Template pending legal review. The gaps highlighted in yellow must be completed before publishing.

Data processing agreement

Last updated: October 14, 2026

This English version is provided for convenience. If it differs from the Spanish version (Contrato de encargo del tratamiento), the Spanish version prevails.

This agreement governs the processing of personal data that Corelia Cloud carries out on behalf of each studio, under Article 28 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). It is accepted on sign-up and forms part of the terms of service.

1. Parties

Data controller: the studio that signs up, with the details it provides at sign-up.
Data processor: [PENDING: owner], Tax ID [PENDING: NIF], with address at [PENDING: address] and email [PENDING: email].

2. Subject matter, nature and purpose

The processor hosts and runs the studio’s booking website, app and panel. It processes the data only to provide that service: managing bookings, credits, class packs, memberships and payments, sending email and push notifications, making backups and providing support.

3. Duration

For as long as the service lasts, including the trial period and, where applicable, the 150 days in read-only mode before deletion.

4. Data and data subjects

Data subjects: the studio’s clients, people who register on its website, instructors and staff.
Types of data: identification and contact data (name, email, phone), user account, bookings, attendance, credits, class packs, memberships, coupons, notifications received and payment history. Card data is processed directly by Stripe in the studio’s own account: the processor never receives it.
Special categories: if the studio decides to record health notes (for example, injuries), it does so under its own responsibility, with the appropriate legal basis, and must keep it to the strict minimum.

5. Processor’s obligations

Process the data only on the controller’s documented instructions, which are these terms and what it configures in its panel.
Not use the data for its own purposes or disclose it to third parties, except where required by law.
Ensure the confidentiality of the people authorised to process the data.
Apply appropriate security measures (GDPR Art. 32): encryption in transit (HTTPS), hashed passwords, secrets encrypted in the database, separation of each studio’s data, access control and daily backups.
Help the controller respond to data subjects’ requests, with export and deletion tools.
Notify the controller without undue delay, and within 48 hours at the latest, of any security breach affecting its data.
Help the controller with impact assessments and consultations with the supervisory authority, where appropriate.
When the service ends, allow the data to be exported and delete it after 150 days, unless the law requires it to be kept.
Make available to the controller the information needed to demonstrate compliance and allow reasonable audits.

6. Sub-processors

The controller authorises the processor to use these sub-processors, with whom it has equivalent agreements:

Server and database hosting: [PENDING: provider and EU region].
Platform email delivery (Essential plan): [PENDING: email provider].
External backups: [PENDING: provider, if any].

The processor will give at least 30 days’ notice of any change of sub-processors, and the controller may object by cancelling. Services the studio connects on its own (its Stripe, its Gmail, its domain) are contracted directly by the studio and are not our sub-processors.

7. Place of processing

The data is hosted on servers located in the European Union. Any transfer outside the European Economic Area will only take place with the safeguards of Chapter V of the GDPR.

8. Controller’s obligations

Provide the data lawfully, with the information and, where applicable, the consent of the data subjects.
Set up the legal pages on its website with its own details (the panel includes templates).
Oversee the processing and respond to people exercising their rights.