Data Processing Addendum

1. Parties; incorporation; scope

This Data Processing Addendum (“DPA”) is between Nicholson Solutions of IL LLC (“Nicholson Solutions”) and the business customer (“Customer”) identified in the applicable Order. It supplements the Software License & Service Agreement and applies only to Customer Personal Data processed by Nicholson Solutions on Customer’s behalf in connection with the services.

If this DPA conflicts with the Agreement regarding processing of Customer Personal Data, this DPA controls for that processing issue. Capitalized terms not defined here have the meanings given in the Agreement.

2. Roles and processing instructions

Customer determines the business purposes for which Customer Personal Data is collected and used. Nicholson Solutions processes Customer Personal Data only to provide, secure, maintain, support, troubleshoot, and administer the contracted services; comply with documented Customer instructions; and comply with applicable law.

Nicholson Solutions will not sell Customer Personal Data or use identifiable Customer Personal Data for unrelated advertising, marketing, or product development without Customer authorization. Nicholson Solutions may process de-identified or aggregated information that does not reasonably identify Customer or an individual for service security, reliability, performance, and usage analysis.

3. Customer responsibilities

Customer represents that it has a lawful basis and all required notices, permissions, authorizations, and consents for the Customer Personal Data and processing instructions it provides. Customer is responsible for the legality, accuracy, and proportionality of its data collection and for its employment, visitor, surveillance, security, gym-member, and minor-related policies.

Customer must not instruct Nicholson Solutions to process biometric identifiers or biometric information, protected health information requiring a business associate agreement, complete payment-card data, or other specially regulated data unless Nicholson Solutions has expressly approved the processing in writing and the parties have implemented any required supplemental safeguards.

4. Confidentiality and personnel

Nicholson Solutions will limit access to Customer Personal Data to personnel and contractors who need access to perform the services and who are subject to confidentiality obligations or professional duties appropriate to the information they access.

5. Security measures

Nicholson Solutions will maintain reasonable administrative, technical, and organizational safeguards appropriate to the nature of Customer Personal Data and the services. The current categories of safeguards are summarized in Annex B.

Customer acknowledges that no online service can guarantee absolute security and that Customer is responsible for its own administrators, credentials, devices, local networks, user permissions, notices, and lawful use.

6. Security incidents and cooperation

If Nicholson Solutions confirms a Security Incident affecting Customer Personal Data, Nicholson Solutions will notify Customer without undue delay and, unless legally prohibited or a longer period is reasonably necessary to avoid materially impairing an active investigation, within five (5) business days after confirmation.

Nicholson Solutions will provide information reasonably available to it concerning the nature of the incident, affected information, remediation steps, and other facts reasonably needed for Customer to evaluate its own legal or contractual obligations. Nicholson Solutions will reasonably cooperate with Customer’s response, taking into account the nature of the incident, available information, security needs, and applicable law.

Notification of a Security Incident does not constitute an admission of fault or liability.

7. Subprocessors

Customer authorizes Nicholson Solutions to use subprocessors reasonably necessary to provide the services. Nicholson Solutions will require material subprocessors that process Customer Personal Data on its behalf to protect that information through contractual or legal obligations appropriate to the services they perform.

Nicholson Solutions will maintain a current documented list of material subprocessors. The initial list is set out in Annex C. Customer may raise a reasonable written data-protection objection to a newly added material subprocessor; the parties will work in good faith to address the concern, recognizing that inability to use a necessary provider may affect service availability.

8. Individual and data-subject requests

If Nicholson Solutions receives a request from an individual concerning Customer Personal Data controlled by Customer, Nicholson Solutions may direct the requester to Customer. Taking into account the nature of processing and functionality reasonably available, Nicholson Solutions will provide reasonable assistance to Customer with verified access, correction, deletion, restriction, or similar requests when required by applicable law or the parties’ contract.

Customer remains responsible for determining whether a request is valid and how to respond unless applicable law places the obligation directly on Nicholson Solutions.

9. Return, export, retention, and deletion

Customer may use available export functionality during the active service term. Unless an Order states otherwise, after the paid service term ends Customer has thirty (30) days to request a reasonable final export of Customer Personal Data that remains reasonably available to Nicholson Solutions.

After that retrieval period, Nicholson Solutions may begin deleting Customer Personal Data from active production systems and intends to complete deletion from systems under its direct administrative control within sixty (60) days, subject to legal holds, fraud prevention, security needs, technical constraints, and provider limitations.

Residual copies may remain in encrypted backups until overwritten or deleted through ordinary backup cycles. Backups are not maintained for ordinary customer access and generally are restored only for disaster recovery or security purposes. Nicholson Solutions may retain billing, legal-acceptance, security, audit, fraud-prevention, and other records for longer periods when legally required or reasonably necessary.

10. Government and legal requests

Nicholson Solutions may disclose Customer Personal Data when legally required. When legally permitted and reasonably practical, Nicholson Solutions will notify Customer of a compulsory request directed to Nicholson Solutions before disclosure so Customer may seek appropriate relief.

11. International processing and transfers

Customer acknowledges that Nicholson Solutions and its service providers may process information in the United States and other locations where applicable providers operate. If applicable law requires a specific transfer mechanism or additional contractual safeguard for a particular Customer deployment, the parties will address that requirement before the affected processing continues.

12. Information and review

Nicholson Solutions will make reasonably available information necessary to demonstrate compliance with this DPA, taking into account confidentiality, security, the sensitivity of other customers’ information, and the burden of the request. Any audit or assessment right required by applicable law should first be satisfied through current security information, questionnaires, or third-party reports where reasonably sufficient; onsite or intrusive review requires reasonable advance notice and appropriate confidentiality and security controls.

13. Liability; order of precedence; termination

The liability limitations, warranty disclaimers, indemnification framework, dispute provisions, and other risk-allocation terms of the Agreement apply to this DPA unless applicable law requires otherwise or the parties expressly agree in a signed writing.

This DPA terminates when Nicholson Solutions no longer processes Customer Personal Data on Customer’s behalf, except provisions that by their nature should survive, including confidentiality, deletion, legal retention, and liability terms.

Annex A — Processing Details

Annex B — Security Measure Categories

• Role-based and customer-scoped access controls appropriate to the application.
• Authentication, account-recovery, and administrative-access controls.
• Encrypted network communications through standard provider security mechanisms.
• Restricted service-role and administrative credentials; secrets are not intentionally embedded in public browser code.
• Customer separation and database access controls appropriate to the hosted architecture.
• Logging, diagnostic records, backups/recovery features, and incident-response procedures appropriate to the service.
• Use of established cloud, hosting, communications, and payment providers for relevant infrastructure.
• Operational change control intended to avoid unnecessary changes to production data, authentication, and customer isolation.

Annex C — Initial Material Subprocessor List