Joint Controller Agreement (Art. 26 GDPR)

Version: 2026-08-23
Effective Date: August 23, 2026

The German version of this document is the authoritative version; this English translation is provided for convenience.

§ 1 Parties and conclusion of this Agreement

(1) This Agreement is entered into between

Gain. Fitness GmbH
Kelchweg 3
8048 Zurich
Switzerland
Data protection contact: privacy@gain-app.com

— hereinafter "Gain" —

and

the natural or legal person who accepts this Agreement during onboarding on the Gain platform and who operates a coach account there

— hereinafter "the Coach", addressed directly as "you" —

— together the "Parties", individually a "Party".

(2) Gain operates the coaching platform "Gain" (the "Platform"), through which coaches support their clients (the "Athletes").

(3) This Agreement is concluded electronically. The Coach accepts it during onboarding by way of an express affirmative action (click-accept). Acceptance is recorded by the Platform together with the version identifier (see the header of this document) and a timestamp. The Coach can view the accepted version at any time in the coach account and download it as a PDF. No signature is required (§ 15(5)).

(4) Gain may amend this Agreement. Material changes will be shown to the Coach via the Platform with reasonable advance notice; they take effect only once the Coach has accepted the new version. The version in force at any given time is available at https://gain-app.com/en/legal/joint-controller-agreement.

(5) Gain. Fitness GmbH is a Swiss company. The processing operations covered by this Agreement are subject to the General Data Protection Regulation (GDPR) — for Athletes in the EU/EEA pursuant to Art. 3(2) GDPR — and to the Swiss Federal Act on Data Protection (revFADP). References to GDPR provisions apply mutatis mutandis to the corresponding provisions of the revFADP.

§ 2 Subject matter and purpose of this Agreement

(1) For the processing described in § 3, the Parties jointly determine the purposes and means of processing. To that extent they are joint controllers within the meaning of Art. 26(1) GDPR.

(2) This Agreement determines, in a transparent manner, which Party fulfils which obligations under the GDPR, in particular the obligations to provide information to data subjects (Art. 13, 14 GDPR) and to give effect to data subject rights (Art. 15 to 22 GDPR).

(3) The joint purpose of the processing is the provision of individual training, nutrition and coaching services by the Coach to the Coach's Athletes via the Platform, including the planning, documentation, evaluation of and communication about that coaching.

(4) The joint means are the Platform provided by Gain and the functions it offers for capturing, storing, evaluating and displaying coaching data.

(5) Joint controllership for an individual Athlete begins when that Athlete is linked to the coach account (invitation accepted); imported historical data is subject to it from the moment of import, which takes place only after onboarding including the Athlete's consent has been completed (§ 7, Annex 2). It ends when the link is removed.

(6) This Agreement is not a data processing agreement within the meaning of Art. 28 GDPR. Neither Party processes the data covered by § 3 on the instructions of the other Party.

§ 3 Data subjects and categories of data

(1) Category of data subjects: the Coach's clients (Athletes) linked to the coach account.

(2) Categories of data covered (coaching data):

(3) The data listed above is predominantly health data and therefore constitutes special categories of personal data within the meaning of Art. 9(1) GDPR.

(4) The legal bases for the joint processing are:

• Art. 6(1)(b) GDPR — performance of the user relationship with the Athlete and of the coaching relationship;
• Art. 9(2)(a) GDPR — the Athlete's explicit consent to the processing of their health data (§ 7).

§ 4 Delimitation of responsibilities

(1) Gain as sole controller. Gain is the sole controller (Art. 4(7) GDPR), and this Agreement does not apply, in respect of:

• account, registration and authentication data (name, email address, profile picture, user identifier) of Athletes and Coaches;
• technical and diagnostic data (error and crash reports, performance traces, access logs);
• billing and payment data, and compliance with commercial and tax retention obligations;
• reach measurement, conversion tracking and measurement of the effectiveness of Gain's own advertising campaigns;
• security, abuse and fraud prevention for the Platform;
• all data of users without a coach (solo use), including their health data.

(2) The Coach as sole controller. The Coach is the sole controller, and this Agreement does not apply, in respect of processing outside the Platform, in particular:

• the Coach's own notes, spreadsheets, previous tools and other records kept outside the Platform;
• communication with Athletes outside the Platform (e.g. email, messengers, telephone, in-person conversations);
• the Coach's contracting, invoicing and accounting vis-à-vis their Athletes;
• the Coach's own marketing and advertising activities.

Gain is neither controller nor processor for such processing. The Coach fulfils the applicable data protection obligations in this respect on their own responsibility.

(3) Where the Coach brings data from their sole area of responsibility into the Platform (data import under Annex 2), that data becomes subject to this Agreement as of the import. The lawfulness of the collection and possession of the data prior to the import remains the Coach's sole responsibility.

§ 5 Allocation of obligations under Art. 26(1) GDPR

(1) The Parties allocate the data protection obligations as follows:

(2) The allocation under paragraph 1 is without prejudice to the statutory responsibility of both Parties. Each Party remains responsible towards the supervisory authority and towards data subjects for compliance with the GDPR within the scope of its actual influence.

§ 6 Data subject rights, point of contact and cooperation

(1) Point of contact. Gain is the point of contact for data subjects within the meaning of Art. 26(1) sentence 3 GDPR. Requests should be addressed to privacy@gain-app.com.

(2) Art. 26(3) GDPR. Irrespective of the allocation in § 5, the data subject may exercise their rights under the GDPR in respect of and against each of the two Parties. Neither Party may turn a data subject away solely by reference to this Agreement.

(3) Forwarding. If the Coach receives a request from a data subject relating to processing covered by this Agreement, the Coach shall forward it to privacy@gain-app.com without undue delay and in any event within three (3) business days of receipt, and shall inform the data subject that it has been forwarded. The Coach shall not answer such requests independently insofar as they concern processing within the Platform.

(4) Cooperation. The Parties shall assist each other in giving effect to data subject rights. The Coach shall provide Gain with the information required to answer a request within five (5) business days of being asked, so that the one-month time limit under Art. 12(3) GDPR (extendable by up to two further months) can be met.

(5) Supervisory authorities. The Parties shall cooperate in relation to enquiries, audits and proceedings of supervisory authorities and shall inform each other without undue delay of any matter concerning the processing covered by this Agreement.

(6) Documentation. Each Party shall document the data subject requests it receives and the measures taken to handle them, and shall make that documentation available to the other Party on request.

§ 7 Consent management (Art. 9(2)(a) GDPR)

(1) Collected by Gain. During onboarding, Gain obtains from every Athlete explicit consent to the processing of their health data pursuant to Art. 9(2)(a) GDPR. Consent is obtained as a separate step that is not bundled with any other declaration; it is freely given, worded in plain language and may be withdrawn at any time.

(2) Scope. The consent covers in particular:

• the processing of the health data listed in § 3(2) for coaching purposes;
• access by the coach linked to the Athlete to that data;
• historical data provided by the coach, including data imported from previous tools (e.g. Google Sheets) under Annex 2.

(3) Proof and status display. Gain documents the consent in a demonstrable manner within the meaning of Art. 7(1) GDPR (wording of the consent text, version identifier, timestamp). The Coach may rely on the consent obtained by Gain and can view the per-Athlete consent status in the Platform. The Coach does not obtain consent on Gain's behalf.

(4) Withdrawal. The Athlete may withdraw their consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

(5) Consequences of withdrawal. Upon withdrawal:

• Gain freezes and hides the health data concerned; it is no longer processed for coaching purposes;
• the Coach's access to that data is revoked;
• Gain notifies the Coach without undue delay of the withdrawal;
• final erasure follows the standard account deletion process (https://gain-app.com/en/account-deletion) or, as applicable, the retention periods set out in the athlete privacy policy.

(6) The Coach's obligation upon notification. Upon receiving the notification under paragraph 5, the Coach shall cease any further processing of the health data concerned without undue delay. This also covers copies and extracts of that data held outside the Platform; such copies must be deleted or blocked unless the Coach has a separate, continuing legal basis for them or is subject to a statutory retention obligation.

(7) No processing in advance. The Coach may enter or import an Athlete's health data into the Platform only once that Athlete has completed onboarding including the consent (§ 10(1)(d), Annex 2).

§ 8 Technical and organisational measures

(1) For processing within the Platform, Gain implements the technical and organisational measures required under Art. 32 GDPR. An overview is set out in Annex 1. Gain reviews these measures regularly and adapts them to the state of the art; the level of protection may not be reduced.

(2) The core measures include, in particular, encryption in transit (TLS 1.2 or higher), encryption at rest (AES-256), role-based access control, time-limited presigned URLs for media access (form check photos and videos) and logging of access to athlete data.

(3) The Coach implements appropriate measures in their own sphere, in particular pursuant to § 10(1)(b) and (c).

(4) Gain binds the persons involved in the processing to confidentiality and ensures that they are instructed in data protection matters.

§ 9 Personal data breaches

(1) Mutual notification. Each Party shall inform the other Party without undue delay and in any event within 24 hours of becoming aware of any personal data breach (Art. 4(12) GDPR) that affects or may affect the data covered by this Agreement. This period is set so that the 72-hour notification deadline under Art. 33(1) GDPR can be met.

(2) Content of the notification. The notification shall include, to the extent available: the nature of the breach, the categories of data affected, the approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

(3) Responsibility. For incidents affecting the Platform, Gain carries out the notification to the competent supervisory authority (Art. 33 GDPR) and, where required, the communication to the data subjects (Art. 34 GDPR). The Coach shall not make independent notifications regarding Platform incidents without first coordinating with Gain; the Coach's statutory obligations remain unaffected.

(4) Incidents in the Coach's sphere. The Coach shall report to Gain without undue delay, in particular, the loss or compromise of credentials or devices, unauthorised access to the coach account, and any unauthorised disclosure of athlete data from the Coach's sphere.

(5) Documentation. The Parties shall document all incidents including the measures taken (Art. 33(5) GDPR) and shall provide each other with the information required to fulfil the notification and communication obligations.

§ 10 Obligations of the Coach

(1) The Coach undertakes:

• a) Purpose limitation — to process athlete data exclusively for coaching purposes within the coaching relationship existing with the respective Athlete; any processing for other purposes (in particular advertising, profiling, disclosure to third parties, sale) is prohibited;
• b) Confidentiality — to treat all athlete data as strictly confidential and not to make it accessible to third parties; this obligation continues after termination of this Agreement;
• c) Credential hygiene — to keep credentials secret, not to permit account sharing, to use a strong and unique password, to enable multi-factor authentication where the Platform offers it, and to protect devices with screen locks and current security updates;
• d) No processing in advance — to enter or import an Athlete's health data into the Platform only once that Athlete has completed onboarding including the consent under § 7;
• e) No off-platform export — not to export, copy or use athlete data outside the Platform beyond the Coach's own lawful area of responsibility; the creation of bulk extracts or mass exports is prohibited;
• f) Data quality — to keep the data they enter accurate and up to date and to correct identified inaccuracies without undue delay;
• g) Legal compliance — to comply with the data protection, professional and regulatory rules applicable to them and to fulfil their own information obligations towards Athletes for their area of sole responsibility (§ 4(2));
• h) Cooperation — to support Gain in fulfilling the obligations allocated to it under § 5 (§ 6(4), § 9).

(2) If the Coach breaches material obligations under this Agreement, Gain may restrict or block access to athlete data with immediate effect and may terminate the coach account in accordance with the coach terms of use.

§ 11 Data import from previous tools

Where the Coach migrates an Athlete's historical data from a previous tool (e.g. Google Sheets) into the Platform, the provisions of Annex 2 apply in addition. For informing the Athlete before the import, Gain provides a template notice at https://gain-app.com/en/legal/migration-notice.

§ 12 Liability and internal apportionment

(1) Externally, under Art. 82(4) GDPR each joint controller is liable for the entire damage in order to ensure effective compensation of the data subject.

(2) Internally, each Party bears the share of the damage corresponding to its part of the responsibility for the damage that occurred (Art. 82(5) GDPR). A Party that has paid full compensation may claim back from the other Party the share attributable to that other Party.

(3) Recourse for administrative fines. Where a fine or sanction is imposed on one Party and the underlying infringement is wholly or predominantly attributable to the other Party, the Party concerned may claim reimbursement internally, to the extent that such a pass-on is legally permissible. There is no further-reaching claim to indemnification against administrative fines.

(4) Liability between the Parties. In all other respects, liability between the Parties is governed by § 16 of the terms of use for coaches (tiered liability: unlimited for intent, gross negligence and injury to life, body or health; for slight negligence limited to cardinal duties and the foreseeable damage typical for this type of contract). Statutory claims of data subjects remain unaffected (paragraph 1).

§ 13 Term and termination

(1) This Agreement enters into force upon acceptance by the Coach (§ 1(3)) and remains in force for as long as the coach account exists and the contractual relationship between Gain and the Coach continues.

(2) It terminates automatically upon termination of the coach account or of the underlying contractual relationship; no separate notice of termination is required.

(3) Upon termination, the Coach's access to all athlete data is revoked without undue delay.

(4) Termination of this Agreement does not affect the Athletes' rights in their data, nor their user relationship with Gain.

(5) The provisions on confidentiality (§ 10(1)(b)), on cooperation in relation to data subject requests and incidents (§ 6, § 9) with regard to matters arising before termination, and on liability (§ 12) survive termination.

§ 14 Essence of the arrangement (Art. 26(2) GDPR)

(1) The essence of the arrangement set out in this Agreement is made available to data subjects in accordance with Art. 26(2) sentence 2 GDPR. This is done via the athlete privacy policy at https://gain-app.com/en/privacy/athlete, which sets out in particular the allocation of roles, the point of contact and the allocation of obligations under § 5.

(2) This Agreement is also publicly available, in the version in force from time to time, at https://gain-app.com/en/legal/joint-controller-agreement.

§ 15 Final provisions

(1) Relationship to other agreements. This Agreement supplements the coach terms of use (https://gain-app.com/en/terms/coach) and the coach privacy policy (https://gain-app.com/en/privacy/coach). In the event of conflict on data protection matters, this Agreement prevails.

(2) Authoritative language version. The German version of this document is the authoritative version; this English translation is provided for convenience.

(3) Severability. Should any provision of this Agreement be or become wholly or partly invalid or unenforceable, the validity of the remaining provisions remains unaffected. The Parties shall replace the invalid provision with a valid provision that comes closest to the commercial and data protection purpose of the invalid provision.

(4) Governing law and jurisdiction. This Agreement is governed by Swiss law, excluding its conflict-of-law rules. The exclusive place of jurisdiction is Zurich, Switzerland. Mandatory provisions of the GDPR and the revFADP as well as the rights of data subjects remain unaffected.

(5) Form. This Agreement is provided and accepted electronically. No signature is required. Amendments and additions are made by publishing a new version in accordance with § 1(4).

(6) Annexes. Annexes 1 to 3 form an integral part of this Agreement.

Annex 1 — Technical and organisational measures (overview)

For processing within the Platform, Gain implements in particular the following measures pursuant to Art. 32 GDPR:

Gain provides the Coach with further information on the technical and organisational measures on request, insofar as no security interests preclude this.

Annex 2 — Data import from previous tools (Google Sheets)

This Annex applies to the migration of an Athlete's historical data from a previous tool used by the Coach (in particular Google Sheets) into the Platform.

1. Prerequisite: completed onboarding and consent. An import is permitted only once the Athlete concerned has accepted the invitation, completed onboarding and given the consent pursuant to Art. 9(2)(a) GDPR (§ 7). No historical data is transferred to the Platform before the consent has been given; importing "in advance" is not permitted.

2. One Athlete per sheet. Each sheet submitted for import may contain the data of exactly one Athlete. The sheet must not contain any personal data of third parties (neither of other Athletes nor of any other person).

3. Warranties of the Coach. By submitting the sheet, the Coach warrants that:

• they collected the data lawfully and are in lawful possession of it;
• they informed the Athlete concerned about the transfer to the Platform before the import; for this purpose Gain provides a template notice at https://gain-app.com/en/legal/migration-notice, the use of which is recommended;
• the data is accurate and does not contain any data whose processing the Athlete has objected to or prohibited;
• no third-party data is included.

4. Deletion of the source file. Gain deletes the source file submitted for import once the import is complete. The Coach remains solely responsible for any copies remaining in their own area of responsibility (§ 4(2)).

5. Responsibility. As of the import, the migrated data is subject to the joint controllership under this Agreement. The lawfulness of processing prior to the import remains the Coach's sole responsibility.

Annex 3 — Processors and international transfers (for information)

To deliver the Platform services, Gain engages the following processors (Art. 28 GDPR). This information is provided for the Coach's information; the selection, engagement and supervision of processors is Gain's responsibility (§ 5(1)).

International transfers. The following applies to transfers of personal data to the United States:

• Primary safeguard: All of the above providers are active participants in the EU–U.S. Data Privacy Framework (DPF) and in the Swiss–U.S. Data Privacy Framework. Transfers therefore take place on the basis of the European Commission's adequacy decision (Art. 45 GDPR) and the corresponding recognition by the Swiss Federal Council. Email delivery via Amazon SES is covered by the certification of Amazon.com, Inc.
• Fallback safeguard: Should the relevant Data Privacy Framework lapse, be suspended or not be applicable to a transfer, the transfer takes place on the basis of the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) together with supplementary technical and organisational measures and — for transfers from Switzerland — the version of those clauses recognised by the FDPIC.

Gain informs the Coach of material changes to the processors engaged via the Platform.

Related documents: Template data migration notice · Privacy Policy for Athletes · Privacy Policy for Coaches · Terms of Use for Coaches · Terms of Use for Athletes

Changelog

Gain. Fitness GmbH
Kelchweg 3
8048 Zurich
Switzerland

privacy@gain-app.com