Data Processing Agreement

This DPA applies from 26 October 2026 and replaces all previous versions.

This Data Processing Agreement ("DPA") is incorporated into and forms an integral part of the agreement (the "Agreement") between Coach Nova Limited, a company incorporated in Republic of Ireland with the incorporation No 802869 and registered address at 60 Merrion Square South, Dublin 2, D02 HE24, Republic of Ireland ("CoachNova", "We", "Us", or "Our"), and a coaching professional acting within their trade, business, craft or profession in accessing or using our AI-powered coaching platform and using our Services ("Coach", "You", or "Your"). CoachNova and You are hereinafter jointly referred to as the "Parties" and individually as a "Party".

This DPA applies to our processing of Personal Data on your behalf in order to provide services to you pursuant to the Agreement. Where this DPA conflicts with the Agreement, this DPA shall prevail with respect to the processing of Personal Data.

The following shall form part of the DPA:

• Schedule 1: Details of Processing
• Schedule 2: List of Sub-processors
• Schedule 3: Technical and Organisational Measures

Capitalised terms that are used but not defined in this DPA shall have the meaning set out in the CoachNova Terms of Service for the Coaches.

1. Definitions and Interpretation

In this DPA, the following terms shall have the meanings set out below:

1.1"Applicable Data Protection Laws" means any nationally or internationally binding data protection laws, case law, and regulations, including those (i) applicable within the European Union (the "EU"), including the EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR"), the United Kingdom General Data Protection Regulation, which is the GDPR as incorporated into UK domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018 and amended by The Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 ("UK GDPR"), and all other privacy and data protection laws of the European Economic Area ("EEA") and the United Kingdom and (ii) the Swiss Federal Act on Data Protection of 25 September 2020 ("Swiss FADP"), as amended, superseded or replaced.

1.2"Non-Adequate Country" means a country not providing an adequate level of protection pursuant to the Applicable Data Protection Laws.

1.3"Personal Data" means Coach Content that (i) relates to an identified or identifiable natural person, or (ii) constitutes "personal data", "personal information" or any similar term within the meaning of Applicable Data Protection Laws.

1.4"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.

1.5"Standard Contractual Clauses" or "SCCs" means the Standard Contractual Clauses for the transfer of personal data to Non-Adequate Countries pursuant to Regulation (EU) 2016/679 of the European Parliament and the Council approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.

1.6"Sub-processor" means any Processor engaged by us to process your Personal Data in connection with the Services.

“Active Coachee”, “Coachee” “Coach Content”, “Coach’s Input”, “Coachee’s Input”, “Private Coach AI”, “Private Coach AI Interaction”, “Private Coach AI Output”, “Reviewed Output”, “Output”, “Platform”, “Safety Event”, “Signature Extract” and “Services” have the meanings given to them in the Terms of Service for Coaches.

The terms "Data Subject", "Processing", "Controller", and "Processor" as used in this DPA have the meanings given by Applicable Data Protection Laws.

2. Processing of the Personal Data

2.1 Roles and Responsibilities

The parties acknowledge and agree that, with regard to the Processing of Personal Data contained in Coach Content, including Private Coach AI Interactions, You are the Controller and CoachNova is the Processor. Each party shall comply with its respective obligations under Applicable Data Protection Laws.

2.2 Details of Processing

The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects in respect of the processing of Personal Data are set out in Schedule 1.

2.3 Your Instructions

Except for processing CoachNova carries out as an independent controller for the limited purposes described in the Agreement and the Privacy Policy, We shall process Personal Data only in accordance with your documented instructions and in compliance with the Applicable Data Protection Laws. If we reasonably believe that any instruction from you violates Applicable Data Protection Laws, we shall promptly inform you. We may suspend the performance of the relevant instruction until you confirm its lawfulness or modify such instruction.

2.4 Confidentiality

We shall ensure that all personnel authorised to Process Personal Data is subject to appropriate confidentiality obligations (whether by contract or statutory duty) and receive adequate training on data protection compliance. CoachNova shall ensure that CoachNova's access to Personal Data is limited to those employees and other persons performing Services in accordance with the Agreement.

3. Security Measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The technical and organisational measures implemented by us are described in Schedule 3. We may update these measures from time to time, provided that such updates do not result in the degradation of the overall security of the Services.

4. Sub-processors

4.1 General Authorisation

You grant us general written authorisation to engage Sub-processors for the processing of Personal Data, subject to the conditions set out in this Section 4. The current list of Sub-processors is set out in Schedule 2 of this DPA, which is the single source of truth for the Sub-processors engaged by CoachNova and may be updated from time to time.

4.2 Notification of New Sub-processors

You may subscribe to receive notifications by email if We make changes to the Sub-processors listed in Schedule 2 of this DPA by following the subscription instructions provided in that Schedule. If you opt in to receive such email, We will notify you at least 30 (thirty) days prior to any such change. You acknowledge that accessing Schedule 2 or subscribing to updates constitutes receipt of notice. You may object to CoachNova's appointment of a new Sub-processor on reasonable grounds relating to data protection by notifying CoachNova in writing within fifteen (15) days of receiving notice of the intended appointment. Such objections must be based on legitimate concerns regarding the Sub-processor's ability to comply with Applicable Data Protection Laws; and include sufficient detail to enable CoachNova to assess the validity of the objection. If you object to a new Sub-processor, we shall work together in good faith to find a commercially reasonable alternative solution. If no such solution can be found within thirty (30) days of CoachNova receiving your objection, either party may terminate the affected Services by providing written notice. This termination right is Your sole and exclusive remedy if You object to any new Sub-processor.

4.3 Sub-processor Requirements

We shall: (a) enter into a written agreement with each Sub-processor imposing data protection obligations that are substantially equivalent to those imposed on CoachNova under this DPA, to the extent applicable to the nature of the services provided by such Sub-processor; (b) ensure that each Sub-processor complies with the obligations to which We are subject pursuant to this DPA and Applicable Data Protection Laws; (c) remain fully liable to you for the performance of the Sub-processor's obligations.

5. Data Subject Rights

5.1 Assistance with Data Subject Requests

(a) Taking into account the nature of the Processing, We shall provide reasonable assistance to You, including through appropriate technical and organisational measures, to enable You to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Laws.

(b) Private Coach AI Interactions, and specific Personal Data within them, cannot be deleted individually during the term of the Agreement. Where You need to erase Personal Data contained in a Private Coach AI Interaction, including to respond to a Data Subject request, You may do so by deleting the Coachee concerned from Your account in accordance with Section 10.2, which deletes all Coach Content relating to that Coachees.

5.2 Forwarding Requests

If We receive a Data Subject request directly, We shall promptly forward such request to You and shall not respond to such request except on Your documented instructions or as required by Applicable Data Protection Laws. You shall be solely responsible for responding to Data Subject requests.

5.3 Coachee Contact regarding Private Coach AI Interactions

Where a Coachee contacts CoachNova directly to exercise a right in respect of the content of their own Private Coach AI Interactions, CoachNova shall promptly direct the Coachee to You as the Controller for that content. CoachNova may inform You that such contact was made, without disclosing its content to You, so that You may respond to the Coachee as You consider appropriate. A Coachee’s deletion of their own account deletes their sign-in details and notification settings and ends their access to the Platform; it does not delete Coach Content relating to them, including their Private Coach AI Interactions. CoachNova notifies You by email when a Coachee deletes their account.

6. Personal Data Breaches

6.1 Notification

We shall notify You without undue delay after becoming aware of a Personal Data Breach. Such notification shall include, to the extent available: (a) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned; (b) the likely consequences of the Personal Data Breach; and (c) a description of the measures taken or proposed to be taken to address the Personal Data Breach, including measures to mitigate its possible adverse effects. CoachNova's notification of, or response to, a Personal Data Breach will not be construed as an acknowledgement by CoachNova of any fault or liability with respect to the Personal Data Breach.

6.2 Reporting the Breach

You are responsible for informing the competent governmental authority and/or affected Data Subjects on the Personal Data Breach, insofar this is required under the Applicable Data Protection Laws.

6.3 Cooperation

We shall cooperate with you and take reasonable steps to remediate or mitigate the effects of the Personal Data Breach and shall provide You with timely information and cooperation as You may reasonably require to fulfil Your obligations under Applicable Data Protection Laws regarding Personal Data Breaches.

7. International Data Transfers

7.1 Data Transfers

(a) You authorise Us to transfer Personal Data to the Sub-processors listed in Schedule 2, including those located in a Non-Adequate Country. This authorisation constitutes Your documented instruction for the purposes of Article 28(3)(a) GDPR.

(b) We shall transfer Personal Data outside the EU/EEA only where the transfer complies with Chapter V of the GDPR and, where applicable, the equivalent provisions of the UK GDPR and the Swiss FADP, relying on:

(i) an adequacy decision of the European Commission, or the equivalent under UK or Swiss law, including the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework, where the recipient is certified under it; or

(ii) the Standard Contractual Clauses in accordance with Section 7.2, together with any supplementary measures needed to ensure an essentially equivalent level of protection, as assessed by Us before the transfer.

(iii) The transfer mechanism relied on for each Sub-processor is indicated in Schedule 2.

7.2 Standard Contractual Clauses

The parties acknowledge and agree that CoachNova will enter into SCCs Module Three (processor to sub-processor) with each Sub-processor located in a Non-Adequate Country together with jurisdiction-specific addenda to the SCCs (such as UK and Switzerland) as required by Applicable Data Protection Laws.

7.3 Precedence

To the extent that there is any conflict between the terms of this DPA, the Agreement, and the terms of the SCCs, the terms of the following documents will prevail (in order of precedence): (i) the SCCs; (ii) this DPA; and (iii) the Agreement.

8. Assistance and Cooperation

Taking into account the nature of the data processing and the information available to the parties, parties shall provide each other with all necessary assistance in complying with the obligations that rest upon them under the Applicable Data Protection Laws, in particular the obligations in relation to the security of Personal Data, Personal Data Breach notification duties, information duty and the execution of data protection impact assessments, including prior consultation of the relevant governmental authority.

9. Audits

You may at your own expenses and upon prior consultation with CoachNova perform an audit on the data processing system used by CoachNova to process Personal Data to examine whether the reasonable technical and organisational security measures that have been taken in relation to the Personal Data processed in the context of this DPA are in line with the measures described in Section 3 of this DPA. You may use the results of an audit only for the purposes of meeting your regulatory audit requirements and/or confirming compliance with the requirements of the DPA.

10. Deletion and Return of Coach Personal Data

10.1Upon Your written request, or upon Your deletion of Coach Content or Reviewed Output from the Platform during the term of the Agreement, We shall delete the corresponding Personal Data and all data derived from it that is attributable to that Coach Content, including AI embeddings and associated metadata, and shall cascade that deletion to Our Sub-processors, in each case within thirty (30) days. This Section 10.1 does not apply to Private Coach AI Interactions, which are deleted only in accordance with Sections 10.2 and 10.3. Deleted Personal Data is removed from backups as they expire, within thirty (30) days.

10.2Private Coach AI Interactions form part of Coach Content and cannot be deleted individually by You or by a Coachee, during the term of the Agreement. When You delete a Coachee from Your account, the Coach Content relating to that Coachee, including Private Coach AI Interactions and data derived from it, remains recoverable by You for thirty (30) days and is then permanently deleted, with deletion cascaded to Our Sub-processors. A Coachee’s deletion of their own account does not delete it.

10.3Upon termination or expiration of the Agreement, We shall make available to You an export of Personal Data for thirty (30) days, and at the end of that period shall delete all Personal Data and all data derived from it, including Private Coach AI Interactions, stored passages and their AI embeddings, the Signature Extract and the configuration of Your Private Coach AI, and cascade that deletion to Our Sub-processors, in each case in accordance with the Effect of Termination provisions of the Agreement.

10.4Notwithstanding Sections 10.1 to 10.3, We may retain Personal Data: (a) to the extent required by Applicable Data Protection Laws or other applicable law; (b) where necessary to establish, exercise or defend a legal claim; or (c) to the extent a Sub-processor retains Personal Data under its own terms in order to enforce its usage policies or comply with law, as described in Schedule 2.

11. Limitation of Liability

The liability provisions and limitations thereof set out in the Agreement shall apply to this DPA. Nothing in this DPA shall limit or exclude either party's liability to the extent such limitation or exclusion is prohibited by applicable law.

12. Governing Law and Jurisdiction

This DPA shall be governed by and construed in accordance with the laws specified in the Agreement. Any disputes arising from or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts specified in the Agreement.

Schedule 1: Details of Processing

1 Categories of Data Subjects

(a) Coaches registered on the Platform;

(b) Coachees (individuals receiving coaching services from the Coaches and accessing designated Platform features);

(c) Other individuals whose Personal Data is mentioned or otherwise included in the Coach’s Content and/or Coachee's Input submitted through the Platform.

2 Categories of Personal Data

(a)Identification and contact data of Coachees that You provide to invite them to the Platform and to create their access: first and last name, email address, telephone number, and any professional details You choose to record (such as role or organisation); and identification data of You, Coachees and other individuals as it appears in Coach Content (for example, names in session transcripts and messages).;

(b)Personal Data contained within Coach Content, including Coachee’s Input, Reviewed Output and Private Coach AI Interactions. This may include information relating to the Coachee’s personal and professional circumstances, goals, challenges, development needs, and other matters discussed during coaching sessions or included in the Coachee’s Input to the Private Coach AI, drafts of suggested replies and the Coach’s edits to them.

(c)Audio recordings of coaching sessions, processed to generate the transcripts and Output described in this Schedule 1. Audio is retained at rest for a limited period (currently 30 (thirty) days), by Us and by Our sub-processors, before automatic deletion; see Schedule 2 for the sub-processors involved.

(d)Special Categories of Personal Data (as defined in Article 9 GDPR): None intended. The Services are not designed or intended for processing special categories of personal data, do not solicit them, and Coachees are informed that they are not required to share them. Special categories of Personal Data may nonetheless be included incidentally where a Coachee or the Coach chooses to include them in Coach Content, for example in a Private Coach AI Interaction. CoachNova processes any such data only as part of the Services, on Your instructions.

As Controller, You are responsible for establishing and recording a valid condition under Article 9 GDPR for any special categories of personal data processed through the Services, in particular where Your coaching practice deliberately processes them.

3 Nature and Purpose of Processing

Nature of Processing: The processing operations include:

(a)Receiving, generating and storing session recordings and transcripts made through the Platform and recordings or transcripts the Coach uploads, and presenting transcripts for Coach review and approval;

(b)Processing Coach Content through AI features to generate Reviewed Output, including session summaries, insights, nudges, session preparation materials and suggested replies, for the Coach’s review and approval, and, where enabled, using Private Coach AI Interactions to prepare session preparation materials;

(c)Operating the Private Coach AI: a real-time conversational AI feature that generates and delivers Private Coach AI Output directly to a Coachee, in a style derived from the Coach’s Input, without prior review of individual responses by the Coach;

(d)Applying CoachNova’s instructed safety behaviour and Your coaching boundaries within the generation of each Private Coach AI response;

(e)Storing Coach Content in Your private workspace and generating AI embeddings from it, used solely to retrieve relevant Coach Content when generating Output. Retrieval for a Coachee’s Private Coach AI draws only on that Coachee’s own Coach Content (including, where enabled, their previous Private Coach AI Interactions) and Your practice-wide materials, never on another Coachee’s Coach Content;

(f)Generating and applying the Signature Extract from the Coach’s edits and corrections to Output, held at the Coach’s account level and applied across the Coach’s practice only, including retaining AI-drafted suggested replies alongside the message You sent;

(g)Configuring the Private Coach AI from Your questionnaire responses, materials and coaching boundaries, and applying the crisis lines You confirm for each country or region of the Coachee’s residence;

(h)Calendar synchronisation and availability management; transactional email delivery and push notifications to Coaches and Coachees;

(i)Verifying and maintaining the quality, security and integrity of the Services, and debugging to identify and repair errors.

Purpose of Processing: To provide Services.

4 Duration and Frequency

The term of the Agreement, including any renewal periods, plus the period required for deletion or return of Personal Data upon termination/expiration.

Audio recordings: deleted 30 (thirty) days after recording. Coachee deletion: thirty (30) day recovery period. Termination: 30 (thirty) day export period under the Agreement.

5 For Transfers to Sub-processors

The subject matter, nature and duration of the processing as described above.

Schedule 2: List of Sub-processors

Last updated: 26 October 2026

CoachNova engages the following Sub-processors to assist in providing the Services. This Schedule is the single source of truth for the Sub-processors engaged by CoachNova. The /legal/subprocessors page renders the same list from the same source.

Subscribe to Sub-processor Updates

We will notify subscribers at least 30 days before adding or replacing a sub-processor. To subscribe to updates of this list, email privacy@coachnova.ai with the subject line “Subscribe to sub-processor updates”.

Schedule 3: Technical and Organisational Measures

Last updated: 26 October 2026

CoachNova implements and maintains the following technical and organisational measures to protect your Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are designed to provide a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature of the Personal Data to be protected.

1 Access Control

Physical Access Control:

1.Data centers operated by certified third-party providers with 24/7 physical security;

2.Multi-factor authentication and access logging for physical access to facilities;

3.Surveillance and monitoring systems in data center facilities.

Logical Access Control:

Access to Personal Data is currently limited to named CoachNova personnel, who access it directly using database and infrastructure credentials. Such access is restricted to members of the CoachNova team who require it to provide, support and maintain the Services, on a need-to-know basis. Each person with such access is bound by the confidentiality obligations in Section 2.4. Access is granted individually, through named credentials, and is withdrawn when it is no longer required.

2 Data Encryption

Encryption in Transit:

1.Transport Layer Security (TLS) 1.2 or higher for all data transmitted over public networks;

2.Encrypted connections between all system components and Sub-processors.

Encryption at Rest:

1.AES-256 encryption for your Personal Data stored in databases and file systems;

2.Encrypted backups with secure key management;

3.Encryption keys managed by the infrastructure providers (AWS, Neon).

3 Network Security

1.Network perimeter protection and DDoS mitigation operated by the hosting providers (Vercel, AWS, Neon);

2.Separate production and development environments, including separate databases;

3.Automated vulnerability scanning of code dependencies;

4 Application Security

1.Code review and automated tests before each release;

2.Static analysis and automated testing in continuous integration;

3.Input validation and output encoding to prevent common vulnerabilities (SQL injection, XSS, etc.);

4.Regular security patching and updates of systems and dependencies;

5.Provider-level firewall (Vercel) in front of the application.

5 Data Backup and Recovery

1.Daily automated encrypted database backups, retained for thirty (30) days;

2.Documented database restoration procedure;

3. Deleted data is removed from backups as they expire.

6 Organisational Measures

Personnel Security:

Confidentiality and data protection obligations binding on all personnel with access to Personal Data.

Vendor Management:

1.Due diligence assessments of Sub-processors before engagement;

2.Written agreements with Sub-processors including data protection and security obligations;

3.Periodic review of Sub-processor terms, certifications and data processing agreements.

Incident Response:

1.Documented incident response plan and procedures;

2.Provider-level availability monitoring and application error logging;

3.Security incidents can be reported to security@coachnova.ai. Personal Data Breaches are handled in accordance with Section 6 of this DPA

Data Minimisation and Retention:

1.Processing limited to Personal Data necessary for the purposes of providing the Services;

2.Data retention policies aligned with your instructions and legal requirements;

3.Secure deletion procedures for Personal Data that are no longer required.

Workspace isolation

Logical separation of each Coach’s workspace; retrieval for a Coachee scoped to that Coachee’s Coach Content and the Coach’s practice-wide materials.

7 Compliance and Certification

1.Periodic internal review of these measures;

2.Documentation of security policies and procedures, reviewed and updated annually.

8 Updates and Improvements

CoachNova continuously reviews and updates these technical and organisational measures to ensure they remain appropriate and effective in light of evolving threats, technological developments, and regulatory requirements. We may modify these measures from time to time, provided that such modifications do not result in a material degradation of the overall security of the Services.