← Coachlink · Nederlands

Data processing agreement

This data processing agreement comes with a coach's use of Coachlink. As soon as you, as a coach, use Coachlink to record or exchange data of coachees, this agreement applies between you and us. The Dutch version prevails.

1. Parties

• Controller: the coach or practice using Coachlink ("the coach").
• Processor: Appfabriek, a trade name of B.V. Geert (Chamber of Commerce 99122235, Vijverlaan 33, 7553 CC Hengelo, NL), support@appfabriek.com ("Appfabriek").

2. Subject and duration

Appfabriek processes personal data for the coach to provide Coachlink. The agreement runs as long as the coach uses Coachlink and ends when the coach's account is deleted.

3. Nature and purpose

Storing, showing and passing on messages, notes, photos, appointments and availability between coach and coachee, delivering notifications and enabling voice and video calls. Messages (including notes), photos and reactions from after 19 October 2026 are end-to-end encrypted: only the devices of coach and coachee hold the keys, and Appfabriek cannot read the content. Of these, Appfabriek processes only the encrypted content and who, when and how large. Messages from before that date are stored readable on the server, labelled "Van vóór de versleuteling" (from before encryption). Appfabriek does not use the data for its own purposes.

4. Data subjects and data

• Data subjects: the coach's coachees, and the coach.
• Data: name, email address, profile photo, practice name, messages, notes, photos, appointments and availability, device tokens, public passkey keys and public device keys for the encryption.
• Special categories: messages and notes may contain health data or other sensitive information. The coach decides what goes in and makes sure they have a legal basis for it.

5. Instructions

Appfabriek processes the data only on the coach's instructions. This agreement and the coach's use of Coachlink are those instructions. If the law requires other processing, Appfabriek tells the coach in advance, unless the law forbids that.

6. Confidentiality

Anyone with access to the data on behalf of Appfabriek is bound to confidentiality. Appfabriek only looks at the data when needed for operations, security or a question from the coach. Appfabriek cannot read the content of end-to-end encrypted messages, photos and reactions.

7. Security

Appfabriek takes appropriate technical and organisational measures, including:

• signing in with passkeys, without passwords;
• encrypted connections (TLS) between app and server;
• end-to-end encrypted messages, photos and reactions; the keys are only on the devices, and a new device reads along only after a trusted device confirms it;
• end-to-end encrypted voice and video calls through our own server, without recording;
• notifications without content and without a name;
• servers in a Hetzner data centre in Germany, within the EU;
• a daily encrypted backup (AES256), also at Hetzner in Germany, kept for 15 days;
• access to servers and data only for Appfabriek's administrator;
• timely security updates.

8. Sub-processors

The coach authorises these sub-processors:

• Hetzner Online GmbH (Germany): hosting of servers, data and encrypted backups.
• Google: Firebase Cloud Messaging for notifications (a notification holds no content and no name, only that there is something), and email to restore access.
• Apple: notifications for the ring of a call on iPhone (the caller's name travels encrypted).

Google and Apple are US companies; transfers are covered by the EU-US Data Privacy Framework. Appfabriek announces changes to this list at least 30 days in advance on this page. If the coach disagrees, they can stop using Coachlink. Appfabriek imposes the same obligations on sub-processors as in this agreement.

9. Rights of data subjects

Appfabriek helps the coach with requests from coachees for access, correction, deletion or portability. If a request reaches Appfabriek, Appfabriek forwards it to the coach.

10. Data breaches

Appfabriek reports a security breach affecting the coach's data without undue delay, and at the latest within 48 hours after discovering it. The report contains what is known at that moment about the nature, the consequences and the measures taken. The coach decides on notifying the supervisory authority and data subjects.

11. Assistance

Appfabriek gives the coach reasonable information and help with a data protection impact assessment (DPIA) and with consulting the supervisory authority.

12. End

When the agreement ends, Appfabriek deletes the data within 30 days, unless the law requires keeping it. Copies in the encrypted backups then disappear by themselves within 15 days. If the coach wants to receive the data first, they ask for it via support@appfabriek.com before deleting their account.

13. Audits

Appfabriek gives the coach the information needed to show that this agreement is complied with. An audit is possible, at the coach's expense, at most once a year and after reasonable notice.

14. Liability

Liability is governed by the terms of service, including the limitation in them, as far as the GDPR or other mandatory law allows.

15. Changes and law

Appfabriek may change this agreement; the date below shows when. This agreement is governed by Dutch law. Disputes go to the competent court in the Netherlands.

Last updated: 25 October 2026 · Appfabriek is a trade name of B.V. Geert · Chamber of Commerce 99122235 · Vijverlaan 33, 7553 CC Hengelo, NL · VAT NL868810162B01