Data Processing Agreement

Annex to the terms and conditions, pursuant to Article 28 of Regulation (EU) 2016/679 — last updated: August 2026

This agreement governs the processing of personal data that Feel Good Plus S.r.l. (the “Processor”) carries out on behalf of the professional, club, federation or healthcare organisation that uses the Powerset platform (the “Controller”). It forms an integral part of the terms and conditions: accepting those conditions means accepting this annex.

It concerns only the data the Controller records in the platform about its own athletes or patients. For the data of which Feel Good Plus S.r.l. is itself the controller — website, contact form, professional accounts, billing — see the privacy policy.

1. Subject matter, duration, nature and purpose

The Processor processes personal data solely to provide the platform and the agreed services: recording and organising athlete and patient data, computing the indicators and forecasts the service offers, making the data available to the users the Controller authorises, and providing support and maintenance.

The processing lasts for the duration of the contract between the parties, and afterwards only for the period needed to return or delete the data as set out below.

2. Types of data and categories of data subjects

Data subjects: athletes and patients of the Controller, and the users the Controller authorises to access the service.

Types of data: identification and contact data; sporting profile, training calendar and activity data; questionnaire answers; physical tests and measurements; data from wearable devices and connected equipment; and — where the Controller records them — health data such as injuries, medical visits, clinical documents and medical fitness certificates, which are special categories of personal data under Article 9 GDPR.

3. Processing only on documented instructions

The Processor processes personal data only on the Controller’s documented instructions, including as regards transfers to a third country, unless required to do so by Union or Member State law; in that case the Processor informs the Controller before processing, unless the law prohibits it.

The contract, this annex and the use the Controller makes of the platform’s functions constitute those instructions. The Processor informs the Controller if, in its opinion, an instruction infringes data protection law.

4. Confidentiality

The Processor ensures that the persons authorised to process the data are bound by an appropriate obligation of confidentiality, and that access is limited to what each of them needs in order to perform their duties.

5. Security of processing

Taking into account the state of the art, the costs of implementation and the risks presented by the processing, the Processor implements the technical and organisational measures required by Article 32 GDPR, including: encryption of data in transit; access control based on personal credentials and roles; segregation between environments; logging of access and of administrative operations; backup and restore procedures; and periodic review of the measures adopted.

A description of the measures in force is made available to the Controller on request.

6. Sub-processors

The Controller grants a general authorisation to engage sub-processors. The Processor engages them only under a contract imposing the same data protection obligations set out here, and remains fully liable to the Controller for their performance.

The categories of sub-processors currently engaged are: providers of cloud infrastructure and hosting; storage and backup; authentication and identity management; transactional e-mail and push notification delivery; payment and billing services; error monitoring and technical diagnostics; and, limited to the integrations the user activates, providers of wearable devices and sports equipment.

An up-to-date list naming each sub-processor, with its role and the country of processing, is provided on request at info@mypowerset.com. The Processor informs the Controller of any intended addition or replacement of a sub-processor in reasonable time, so that the Controller may object; if the Controller objects on reasonable data protection grounds and no solution is found, the Controller may terminate the affected services.

7. Assistance with data subject rights

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests to exercise the rights under Articles 15 to 22 GDPR.

Where a data subject addresses such a request directly to the Processor, the Processor does not act on it on its own initiative: it forwards it to the Controller without undue delay.

8. Assistance with security, breaches and impact assessments

The Processor assists the Controller in ensuring compliance with Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it.

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach, providing the information available to it and the further information as it becomes available, so that the Controller can meet its own notification obligations.

9. Return and deletion

Throughout the contract the Controller may extract and export the data through the functions of the service. After termination, for whatever reason, the data remains available for export for a period of 30 days; on the Controller’s written request within that period the Processor provides reasonable assistance in retrieving it.

Once that period has elapsed the Processor deletes the data, or returns it and deletes existing copies, at the Controller’s choice, unless Union or Member State law requires its retention. The Controller remains responsible for making, in good time, the copies it needs to comply with its own retention obligations, in particular in relation to health documentation.

10. Information and audits

The Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations set out in Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Controller or by an auditor it mandates.

Audits are agreed in advance, take place during business hours, are conducted so as not to compromise the security or the confidentiality of the data of other clients, and may be satisfied by the Processor providing the results of independent assessments where these cover the scope of the request.

11. Transfers outside the European Union

Personal data is processed within the European Union. Where a sub-processor makes a transfer to a country outside the European Economic Area necessary, the transfer takes place only in the presence of one of the guarantees provided by Chapter V GDPR — an adequacy decision of the European Commission, standard contractual clauses, or another lawful instrument — together with the additional measures required by the circumstances.

12. Automated processing

The platform computes indicators and forecasts describing an athlete’s condition, which constitutes profiling within the meaning of Article 4(4) GDPR. Those indicators are decision-support tools addressed to the Controller’s qualified staff: the Processor takes no decision concerning a data subject. Where automated language-model services are used to draft training proposals, only the information strictly necessary is transmitted, without direct identifiers, processed within the European Union and not used to train third-party models.

13. Relationship with the contract, and changes

This annex prevails over any conflicting provision of the terms and conditions in matters of personal data protection. It is amended together with the terms and conditions, with the notice period and the right to terminate set out there.

Where the Controller requires a separately negotiated and signed data processing agreement, the parties may enter into one; from its effective date it replaces this annex.

14. Contact

For any matter concerning this agreement, including requests for the list of sub-processors or the description of security measures, write to info@mypowerset.com.