Data Processing Agreement

1. Subject and duration

Tribvo processes members’ personal data on behalf of the School to provide the membership platform, for as long as the School uses Tribvo.

2. Nature and purpose

• Purposes: managing memberships and plans, payment status, cash confirmations, transactional reminder emails, invitations, accounting reports.
• Data subjects: members, students, learners, and parents or guardians of members under 16.
• Data categories: name, email, optional phone, language, plan, dates, status, auto-renewal choice, payment records, under-16 flag and guardian name/email/consent, email log.
• No special categories of data (e.g. health) are intended. The School must not enter such data in free-text fields.

3. Tribvo’s obligations

• Process data only on the School’s documented instructions (these terms and the School’s settings in the app).
• Ensure everyone with access is bound to confidentiality.
• Apply appropriate technical and organisational measures: encryption in transit, per-school access rules in the database, hashed passwords, least-privilege access, backups.
• Help the School answer data subject requests (export and deletion tools in the app).
• Notify the School without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach.
• Delete or anonymise data at the end of the contract or after the School’s retention period, except payment records kept 10 years for legal reasons.
• Make available information needed to demonstrate compliance and allow reasonable audits, at most once a year with 30 days’ notice.

4. Subprocessors

The School gives general authorisation to use the following subprocessors. Tribvo informs the School at least 30 days before adding or replacing one; the School may object for good reason.

• Lovable Cloud / Supabase (database, sign-in, file storage) — database hosted in [DATABASE REGION, e.g. EU – Frankfurt]
• Lovable (application hosting, delivered through a global edge network operated by Cloudflare, Inc.) — worldwide edge, origin [HOSTING REGION]
• Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA (card and TWINT payments, connected school accounts) — EU/USA
• [EMAIL PROVIDER] (transactional emails such as renewal reminders and invitations) — [EMAIL REGION]
• Google Ireland Ltd. (only if you choose “Continue with Google”) — EU/USA

5. International transfers

Transfers outside Switzerland/EEA rely on adequacy decisions, the Swiss–US / EU–US Data Privacy Framework, or the EU Standard Contractual Clauses with the Swiss amendments.

6. School’s obligations

• Have a legal basis for each member it adds or imports, and inform members (Tribvo sends a privacy notice with each invitation).
• Obtain guardian consent for members under 16.
• Choose a retention period appropriate to its needs (12–120 months after membership ends).

7. Acceptance

The School accepts this DPA in its dashboard before adding members. The date, version and accepting user are recorded.

8. Optional club features

When the School switches on optional features, the processing under this DPA also covers:

• Family links between a managing account and family members, including guardian consent records.
• Trial passes, promo code use and sibling discounts.
• Grade records (grade, date, recording staff member, note) and anniversary calculations.
• Announcements, the announcement email log and members’ news consent records.
• Product catalogue, stock and product orders (included in accounting reports).

9. School instructions for these features

• Send club news by email only to members who opted in; Tribvo enforces this automatically.
• Do not enter health or other sensitive data in grade notes, product descriptions or announcements.
• Set fair, transparent conditions for trials, promo codes, products and event cancellations, and provide the consumer information Tribvo displays.

10. Attendance and J+S data

• Additional categories: class attendance records, check-in method and time, grade requirements and certificates; for J+S courses only: date of birth, sex and nationality of participants (no AHV numbers).
• The school decides whether to enable these features and is responsible for having a legal basis, for informing members and guardians, and for submitting J+S reports to the authorities itself.
• Tribvo does not transfer data to J+S or BASPO. J+S fields are stored separately and deleted when a member is anonymised.

11. Persons authorised by the School

• The School may authorise staff (admin, coach, treasurer) with role-based access. It ensures they are bound to confidentiality (Art. 28(3)(b) GDPR) and removes access when no longer needed.
• Tribvo enforces the roles on the server, keeps a log of staff changes (who, what, when; no values) for the School, and supports the School in answering access requests.
• Pause reasons are categories; the School instructs its staff not to record health data in notes.

12. Invoices, bank files and accounting

• Additional processing on the club’s instructions: creating QR-bill invoices and instalments, queuing payment reminders, reading uploaded camt.053/054 bank files to match incoming payments, and creating accounting exports.
• From bank files the processor stores only incoming bookings (date, amount, reference, payer name, message); everything else in the file is discarded after reading. The file itself is not stored; only a fingerprint (hash) is kept to prevent double imports.
• Access is limited to the club owner, admins and treasurers. Accounting exports are downloaded by the club, which is responsible for them after download.
• Invoices, payment records, reminders and matched bookings are kept for 10 years as accounting records (Art. 958f Swiss Code of Obligations) and then deleted.

12. Push, booking and lead data

• Additional processing on the School’s instructions: storing push choices, consent records and device tokens; queuing and delivering notifications; bookings and waitlists; trial leads, notes, follow-up emails and conversion statistics.
• Additional subprocessor if push delivery is enabled: Google LLC (USA) / Google Ireland Limited — Firebase Cloud Messaging, only for clubs that switch push on and members who opt in; data: device token, notification content, technical metadata; transfers to the USA under the EU-US and Swiss-US Data Privacy Framework, with Standard Contractual Clauses as fallback.
• The School is responsible for only sending follow-up marketing to leads with recorded consent, for honouring deletion requests and for setting a lead retention period no longer than necessary. Tribvo enforces the consent check, the unsubscribe link and the automatic anonymisation.
• Coach accounts only see the class lists of classes assigned to them.