Data Processing Agreement

This Data Processing Agreement (“DPA”) is incorporated into and forms an integral part of the agreement (the “Agreement”) between Coach Nova Limited, a company incorporated in Republic of Ireland with the incorporation No 802869 and registered address at 71 Lower Baggot Street, Dublin 2, D02P593, Republic of Ireland (“CoachNova”, “We”, “Us”, or “Our”), and a coaching professional acting within their trade, business, craft or profession in accessing or using our AI-powered coaching platform and using our Services (“Coach”, “You”, or “Your”). CoachNova and You are hereinafter jointly referred to as the “Parties” and individually as a “Party”.

This DPA applies to our processing of Personal Data on your behalf in order to provide services to you pursuant to the Agreement. Where this DPA conflicts with the Agreement, this DPA shall prevail with respect to the processing of Personal Data.

The following shall form part of the DPA:

• Schedule 1: Specification of Data Processing
• Schedule 2: List of Sub-processors
• Schedule 3: Technical and Organisational Measures

Capitalised terms that are used but not defined in this DPA shall have the meaning set out in the CoachNova Terms of Service for the Coaches.

1. Definitions and Interpretation

In this DPA, the following terms shall have the meanings set out below:

1. 1.1 “Applicable Data Protection Laws” means any nationally or internationally binding data protection laws, case law, and regulations, including those (i) applicable within the European Union (the “EU”), including the EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”), the United Kingdom General Data Protection Regulation, which is the GDPR as incorporated into UK domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018 and amended by The Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (“UK GDPR”), and all other privacy and data protection laws of the European Economic Area (“EEA”) and the United Kingdom and (ii) the Swiss Federal Act on Data Protection of 19 June 1992; as of September 1, 2023, its totally revised version of 25 September 2020 (“Swiss FADP”), as amended, superseded or replaced.
2. 1.2 “Non-Adequate Country” means a country not providing an adequate level of protection pursuant to the Data Protection Laws.
3. 1.3 “Personal Data” means Coach Content that (i) relates to an identified or identifiable natural person, or (ii) constitutes “personal data”, “personal information” or any similar term within the meaning of Applicable Data Protection Laws.
4. 1.4 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.
5. 1.5 “Standard Contractual Clauses” or “SCCs” means the Standard Contractual Clauses for the transfer of personal data to Non-Adequate Countries pursuant to Regulation (EU) 2016/679 of the European Parliament and the Council approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
6. 1.6 “Sub-processor” means any Processor engaged by us to process your Personal Data in connection with the Services.

“Coach Content”, “Coach's Input”, “Coachee's Input”, “Coach Companion”, “Companion Interaction”, “Companion Output”, “Output”, “Platform” and “Services” have the meanings given to them in the Terms of Service for Coaches. They are not repeated here, so that there is a single definition of each.

The terms “Data Subject”, “Processing”, “Controller”, and “Processor” as used in this DPA have the meanings given by Applicable Data Protection Laws.

2. Processing of the Personal Data

2.1 Roles and Responsibilities

The parties acknowledge and agree that with regard to the processing of Personal Data under the DPA, you are the Controller and CoachNova is the Processor. Each party shall comply with its respective obligations under Applicable Data Protection Laws.

The Parties further acknowledge that CoachNova acts as an independent Controller in respect of a limited set of processing operations whose purposes and means CoachNova determines rather than You, namely: (a) the detection of indications of crisis, risk of harm or other safety concerns within Companion Interactions, and the generation of the resulting flags; (b) the configuration and enforcement of the platform-wide safety guardrails applied to the Coach Companion; and (c) the security, abuse prevention and integrity of the Platform. CoachNova processes such data in accordance with its Privacy Policy. Nothing in this Section makes CoachNova a Controller in respect of the substantive content of Coach Content or of Companion Interactions, for which You remain the Controller.

2.2 Details of Processing

The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects in respect of the processing of Personal Data are set out in Schedule 1.

2.3 Your Instructions

We shall process Personal Data only in accordance with your documented instructions and in compliance with the Applicable Data Protection Laws. If we reasonably believe that any instruction from you violates Applicable Data Protection Laws, we shall promptly inform you. We may suspend the performance of the relevant instruction until you confirm its lawfulness or modify such instruction.

2.4 No Training on Coach Content

CoachNova shall not use Coach Content, including Companion Interactions, to train any generative AI large language model or the underlying AI models, and shall not authorise or instruct any Sub-processor to do so. Where CoachNova engages a Sub-processor that Processes Coach Content, CoachNova shall use commercially reasonable efforts to engage that Sub-processor on terms that prohibit such use. Embeddings generated from Coach Content are used for retrieval only.

2.5 Confidentiality

We shall ensure that all personnel authorised to Process Personal Data is subject to appropriate confidentiality obligations (whether by contract or statutory duty) and receive adequate training on data protection compliance. CoachNova shall ensure that CoachNova's access to Personal Data is limited to those employees and other persons performing Services in accordance with the Agreement.

3. Security Measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The technical and organisational measures implemented by us are described in Schedule 3. We may update these measures from time to time, provided that such updates do not result in the degradation of the overall security of the Services.

4. Sub-processors

4.1 General Authorisation

You grant us general written authorisation to engage Sub-processors for the processing of Personal Data, subject to the conditions set out in this Section 4. The current list of Sub-processors is set out in Schedule 2 of this DPA, which is the single source of truth for the Sub-processors engaged by CoachNova and may be updated from time to time.

4.2 Notification of New Sub-processors

You may subscribe to receive notifications by email if We make changes to the Sub-processors listed in Schedule 2 of this DPA by following the subscription instructions provided in that Schedule. If you opt in to receive such email, We will notify you at least 30 (thirty) days prior to any such change. You acknowledge that accessing Schedule 2 or subscribing to updates constitutes receipt of notice. You may object to CoachNova's appointment of a new Sub-processor on reasonable grounds relating to data protection by notifying CoachNova in writing within fifteen (15) days of receiving notice of the intended appointment. Such objections must be based on legitimate concerns regarding the Sub-processor's ability to comply with Applicable Data Protection Laws; and include sufficient detail to enable CoachNova to assess the validity of the objection. If you object to a new Sub-processor, we shall work together in good faith to find a commercially reasonable alternative solution. If no such solution can be found within thirty (30) days of CoachNova receiving your objection, either party may terminate the affected Services by providing written notice. This termination right is Your sole and exclusive remedy if You object to any new Sub-processor.

4.3 Sub-processor Requirements

We shall: (a) enter into a written agreement with each Sub-processor imposing data protection obligations that are substantially equivalent to those imposed on CoachNova under this DPA, to the extent applicable to the nature of the services provided by such Sub-processor; (b) ensure that each Sub-processor complies with the obligations to which We are subject pursuant to this DPA and Applicable Data Protection Laws; (c) remain fully liable to you for the performance of the Sub-processor's obligations.

5. Data Subject Rights

5.1 Assistance with Data Subject Requests

Taking into account the nature of the Processing, We shall provide reasonable assistance to You, including through appropriate technical and organisational measures, to enable You to respond to requests from Data Subjects exercising their rights under Applicable Data Protection Laws.

5.2 Forwarding Requests

If We receive a Data Subject request directly, We shall promptly forward such request to You and shall not respond to such request except on Your documented instructions or as required by Applicable Data Protection Laws. You shall be solely responsible for responding to Data Subject requests.

5.3 Standing Instruction for Companion Interactions. You acknowledge that You do not hold a verbatim record of Companion Interactions, and that a Coachee therefore cannot exercise their rights in respect of that content through You. You accordingly give CoachNova a standing documented instruction, for the purposes of Section 5.2, to receive and give effect directly to a Coachee's request to access, export or erase the content of their own Companion Interactions, and to verify the identity of the requesting Coachee before doing so. CoachNova shall notify You that such a request has been actioned, and shall not disclose the content of the Companion Interactions to You in doing so. You may withdraw this instruction in writing, in which case CoachNova may suspend the Coach Companion for Your account, because without it the Coachee's rights cannot be given effect.

6. Personal Data Breaches

6.1 Notification

We shall notify You without undue delay after becoming aware of a Personal Data Breach. Such notification shall include, to the extent available: (a) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned; (b) the likely consequences of the Personal Data Breach; and (c) a description of the measures taken or proposed to be taken to address the Personal Data Breach, including measures to mitigate its possible adverse effects. CoachNova's notification of, or response to, a Personal Data Breach will not be construed as an acknowledgement by CoachNova of any fault or liability with respect to the Personal Data Breach.

6.2 Reporting the Breach

You are responsible for informing the competent governmental authority and/or affected Data Subjects on the Personal Data Breach, insofar this is required under the Applicable Data Protection Laws.

6.3 Cooperation

We shall cooperate with you and take reasonable steps to remediate or mitigate the effects of the Personal Data Breach and shall provide You with timely information and cooperation as You may reasonably require to fulfil Your obligations under Applicable Data Protection Laws regarding Personal Data Breaches.

7. International Data Transfers

7.1 Data Transfers

We may transfer Personal Data to Sub-processors located in a Non-Adequate Country. We will ensure that the transfer is subject to adequate safeguards as required by Chapter V of the GDPR and may for this purpose rely on the Standard Contractual Clauses, provided that the clauses, including any supplementary security measures, ensure an essentially equivalent level of protection.

7.2 Standard Contractual Clauses

The parties acknowledge and agree that CoachNova will enter into SCCs Module Three (processor to sub-processor) with each Sub-processor located in a Non-Adequate Country together with jurisdiction-specific addenda to the SCCs (such as UK and Switzerland) as required by Applicable Data Protection Laws.

7.3 Precedence

To the extent that there is any conflict between the terms of this DPA, the Agreement, and the terms of the SCCs, the terms of the following documents will prevail (in order of precedence): (i) the SCCs; (ii) this DPA; and (iii) the Agreement.

8. Assistance and Cooperation

Taking into account the nature of the data processing and the information available to the parties, parties shall provide each other with all necessary assistance in complying with the obligations that rest upon them under the Applicable Data Protection Laws, in particular the obligations in relation to the security of Personal Data, Personal Data Breach notification duties, information duty and the execution of data protection impact assessments, including prior consultation of the relevant governmental authority.

9. Audits

You may at your own expenses and upon prior consultation with CoachNova perform an audit on the data processing system used by CoachNova to process Personal Data to examine whether the reasonable technical and organisational security measures that have been taken in relation to the Personal Data processed in the context of this DPA are in line with the measures described in Section 3 of this DPA. You may use the results of an audit only for the purposes of meeting your regulatory audit requirements and/or confirming compliance with the requirements of the DPA.

10. Deletion and Return of Coach Personal Data

Upon termination or expiration of the Agreement, or upon Your written request, We shall, at Your choice, delete or return all Personal Data to you, and delete existing copies, unless applicable law requires CoachNova to retain certain Personal Data.

11. Limitation of Liability

The liability provisions and limitations thereof set out in the Agreement shall apply to this DPA. Nothing in this DPA shall limit or exclude either party's liability to the extent such limitation or exclusion is prohibited by applicable law.

12. Governing Law and Jurisdiction

This DPA shall be governed by and construed in accordance with the laws specified in the Agreement. Any disputes arising from or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts specified in the Agreement.

Schedule 1: Details of Processing

Categories of Data Subjects

1. Coaches registered on the Platform;
2. Coachees (individuals receiving coaching services from the Coaches and accessing designated Platform features);
3. Other individuals whose Personal Data is mentioned or otherwise included in the Coach Content and/or Coachee's Input submitted through the Platform.

Categories of Personal Data

1. Data of the Coachees and Coaches: first and last name, email address, telephone number, professional data;
2. Personal Data contained within the Coach Content, including Coachee's Input. This may include information relating to the Data Subject's personal and professional circumstances, goals, challenges, development needs, and other matters discussed during coaching sessions;
3. Document embeddings (vector representations generated from Coach Content and Coachee Input, including identifying metadata such as Coachee name and session references). Embeddings are used for retrieval only, not for model training or fine-tuning.
4. The content of Companion Interactions, being free text written by the Coachee and content generated in response, together with derived summaries, briefs and safety flags.

Note: The Services are not intended for processing Special Categories of Personal Data (as defined in Article 9 GDPR). The Coach is responsible for reviewing all session transcripts and Coach Content before approving them for use on the Platform, and shall remove any Special Categories of Personal Data before finalising and releasing such content. Where Special Categories of Personal Data are incidentally included in Coach Content despite this requirement, the Coach remains solely responsible for ensuring compliance with Applicable Data Protection Laws, including obtaining an appropriate legal basis for such processing. This is Clause 4.1.2 of the Terms of Service for Coaches.

Note on the Coach Companion. Companion Interactions are open ended and written by the Coachee without the Coach present. The Coachee may therefore volunteer Special Categories of Personal Data, in particular data concerning health, without having been asked for it and without the Coach knowing. The Coach Companion is configured not to solicit such data, and the safety detection described above may process it where necessary to identify a risk of harm. The review and removal obligation in the Note above therefore cannot apply to Companion Interactions. Instead, under Clause 4.1.3 of the Terms of Service for Coaches, the Coach must obtain the Coachee's explicit consent under Article 9(2)(a) GDPR, or establish another valid Article 9 condition, and record it through the Platform, before activating the Coach Companion for that Coachee.

Nature and Purpose of Processing

Nature of Processing: The processing operations include:

1. Receiving, generating and storing session recordings;
2. Transcribing audio recordings using automated speech-to-text services, and presenting transcripts for Coach review and approval;
3. Processing Coach Content through AI features to generate Output, including session summaries, insights, nudges, session preparation materials, and suggested responses for the Coach's review and approval;
4. Operating the Coach Companion, being a real time conversational AI feature that responds directly to a Coachee in a style derived from the Coach, without prior review of individual responses by the Coach;
5. Generating summaries, briefs and flags of Companion Interactions for the Coach, which do not include a verbatim record of those interactions;
6. Automated detection of indications of crisis, risk of harm or other safety concerns within Companion Interactions, and routing to crisis resources and to the Coach;
7. Storing and organising Coach Content in Coach's private knowledge repository;
8. Generating AI embeddings (vector representations) from Coach Content for contextual retrieval within the Platform's AI features, and semantic search over that content;
9. Processing Coachee's Input through the Platform's AI features, including retrieving relevant context from previous coaching sessions and earlier Companion Interactions, to generate contextualised Output;
10. Calendar synchronisation and availability management;
11. Product analytics and usage tracking;
12. Payment processing and subscription management;
13. In-app feedback collection;
14. Processing Coachee's Input, including Companion Interactions;
15. Verifying and maintaining the quality, security, and integrity of the Services;
16. Debugging to identify and repair errors.

Purpose of Processing: To provide Services.

Duration and Frequency

The term of the Agreement, including any renewal periods, plus the period required for deletion or return of Personal Data upon termination or expiration.

In respect of an individual Coachee, processing continues for as long as the Coach maintains that Coachee as an Active Coachee. Under Clause 2.8 of the Terms of Service for Coaches this is determined by the Coach's subscription and not by whether the coaching engagement is still running, so processing in respect of a Coachee may continue after their coaching engagement has ended. It ends when the Coach concludes that Coachee, or on termination of the Agreement.

For Transfers to Sub-processors

The subject matter, nature and duration of the processing as described above.

Schedule 2: List of Sub-processors

Last updated: 20 April 2026

CoachNova engages the following Sub-processors to assist in providing the Services. This Schedule is the single source of truth for the Sub-processors engaged by CoachNova. The the sub processor page page renders the same list from the same source.

Subscribe to Sub-processor Updates

We will notify subscribers at least 30 days before adding or replacing a sub-processor. To subscribe to updates of this list, email privacy@coachnova.ai with the subject line “Subscribe to sub-processor updates”.

Schedule 3: Technical and Organisational Measures

Last updated: 20 April 2026

CoachNova implements and maintains the following technical and organisational measures to protect your Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are designed to provide a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature of the Personal Data to be protected.

1. Access Control

Physical Access Control:

1. Data centers operated by certified third-party providers with 24/7 physical security;
2. Multi-factor authentication and access logging for physical access to facilities;
3. Surveillance and monitoring systems in data center facilities.

Logical Access Control:

1. Role-based access control (RBAC) limiting access to your Personal Data based on job function and need-to-know;
2. Multi-factor authentication (MFA) for access to production systems and your Personal Data;
3. Regular review and audit of user access rights and privileges;
4. Automated deprovisioning of access rights upon termination of employment or change of role;
5. Logging and monitoring of all access to your Personal Data.

2. Data Encryption

Encryption in Transit:

1. Transport Layer Security (TLS) 1.2 or higher for all data transmitted over public networks;
2. Encrypted connections between all system components and Sub-processors.

Encryption at Rest:

1. AES-256 encryption for your Personal Data stored in databases and file systems;
2. Encrypted backups with secure key management;
3. Encryption key management using industry-standard practices and hardware security modules (HSMs) where appropriate.

3. Network Security

1. Firewalls and intrusion detection/prevention systems (IDS/IPS) to protect network perimeters;
2. Network segmentation to isolate production environments from development and testing;
3. Regular vulnerability scanning and penetration testing by qualified third parties;
4. DDoS protection and mitigation services;
5. Security Information and Event Management (SIEM) system for real-time threat detection.

4. Application Security

1. Secure software development lifecycle (SDLC) incorporating security best practices;
2. Regular code reviews and static/dynamic application security testing;
3. Input validation and output encoding to prevent common vulnerabilities (SQL injection, XSS, etc.);
4. Regular security patching and updates of systems and dependencies;
5. Web application firewall (WAF) to protect against web-based attacks.

5. Data Backup and Recovery

1. Regular automated backups of your Personal Data with encryption;
2. Geographically distributed backup storage to ensure availability;
3. Regular testing of backup restoration procedures;
4. Business continuity and disaster recovery plans with defined recovery time objectives (RTO) and recovery point objectives (RPO).

6. Organisational Measures

Personnel Security:

1. Background checks for employees with access to Personal Data, where permitted by law;
2. Confidentiality agreements and data protection obligations in employment contracts;
3. Regular mandatory security awareness and data protection training for all personnel;
4. Disciplinary procedures for security policy violations.

Vendor Management:

1. Due diligence assessments of Sub-processors before engagement;
2. Written agreements with Sub-processors including data protection and security obligations;
3. Regular audits and reviews of Sub-processor security practices.

Incident Response:

1. Documented incident response plan and procedures;
2. 24/7 security monitoring and incident detection capabilities;
3. Designated incident response team with defined roles and responsibilities;
4. Regular testing and updating of incident response procedures.

Data Minimisation and Retention:

1. Processing limited to Personal Data necessary for the purposes of providing the Services;
2. Data retention policies aligned with your instructions and legal requirements;
3. Secure deletion procedures for Personal Data that are no longer required.

7. Compliance and Certification

1. Regular internal security audits and assessments;
2. Documentation of security policies and procedures, reviewed and updated annually.

8. Updates and Improvements

CoachNova continuously reviews and updates these technical and organisational measures to ensure they remain appropriate and effective in light of evolving threats, technological developments, and regulatory requirements. We may modify these measures from time to time, provided that such modifications do not result in a material degradation of the overall security of the Services.