TERMS FOR BOXES AND DATA PROCESSING AGREEMENT

Last updated: October 22, 2026

These terms govern the use of WODira Boxes by boxes, gyms and sports centres (the «Box») and form part of the Terms and Conditions. They are entered into between the Box and Rubén Cid Lara, Tax ID 47431788S, with address at C-731, 176, 07800 Santa Eulalia del Río (Illes Balears), España («WODira»). The Box declares that it contracts as a professional, not as a consumer.

1. The service

WODira Boxes is software as a service to manage the Box's members, classes, bookings, memberships, payments, access and communications. WODira provides the technology; it is not a party to the relationship between the Box and its members and does not guarantee financial or occupancy results.

2. Account, administrators and lawful use

The Box designates its administrators and is responsible for their access, for activity on its account and for its staff complying with these terms. It must use the service lawfully, not compromise the platform's security or access other boxes' data, and keep its account and contact information up to date.

3. Plans, prices and billing

Plans and prices are shown before purchase and are exclusive of taxes unless stated otherwise. Payment is collected through Stripe, on a recurring basis with the frequency of the chosen plan, and renews automatically until cancelled. The Box may cancel at any time; cancellation takes effect at the end of the period already paid. WODira may change prices with 30 days' notice. Non-payment may lead to suspension of the service.

4. Relationship between the Box and its members

Memberships, rates, cancellations, refunds and facility rules are set and assumed by the Box, which is the contracting party towards its members. The Box alone is responsible for complying with the consumer, tax, employment and sports law that applies to it, for holding adequate public liability and accident insurance, for the safety of its facilities and of the physical activity it directs or supervises, and for the legal texts it publishes (including the liability waivers it has members sign, whose content and validity are the Box's responsibility).

5. The Box's obligations on personal data

The Box is the controller of the data of its members, customers and staff that it manages with WODira Boxes. In particular, it undertakes to:

Inform its members under Articles 13 and 14 GDPR and have a legal basis for each processing activity.
Not enter special-category data (health, injuries, allergies, biometric data) unless necessary, justified and backed by the member's explicit consent or another Article 9 GDPR basis.
Obtain parental or guardian authorisation before handling data of minors and not register them as independent users.
Handle its members' rights (access, rectification, erasure, etc.), with WODira's assistance.
Tell WODira without delay of any relevant instruction and not use the platform for purposes other than those agreed.

6. DATA PROCESSING AGREEMENT (Art. 28 GDPR)

6.1. Roles and subject matter. In processing the personal data of the Box's members, the Box is the controller and WODira is the processor, and processes the data on the Box's behalf only to provide WODira Boxes.

6.2. Nature, purpose and duration. Hosting, storage, retrieval, organisation, communication to the member and other operations inherent to the software, to manage members, classes, bookings, memberships, access and payments. It lasts as long as the service does.

6.3. Data and data subjects. Data subjects: the Box's members and customers, contact persons and staff. Data: identification and contact details, date of birth, gender, membership data, bookings and attendance, payments, profile photograph, health or physical data the Box chooses to record (height, weight, allergies), liability-waiver signatures and technical usage data.

6.4. WODira's obligations as processor.

Process the data only on the Box's documented instructions (this agreement and the configured use of the service), unless required by law; if an instruction infringes the rules, it will say so.
Ensure that authorised persons are bound by confidentiality.
Apply the security measures of Article 32 GDPR described in the Privacy Policy (encryption in transit and of credentials, access control, backups, among others).
Sub-processors: the Box gives general authorisation to use the infrastructure, payment, email and notification providers listed in the Privacy Policy's provider table. WODira will give 30 days' notice of any change; the Box may object on justified grounds and, if unresolved, terminate the contract. WODira imposes equivalent obligations on sub-processors and remains liable to the Box for their compliance.
Assist the Box in handling data subjects' rights, in complying with Articles 32 to 36 (security, breach notification, impact assessments and prior consultations) and in requests from authorities.
Notify security breaches affecting the Box's data without undue delay and at the latest within 48 hours of becoming aware, with the information available so the Box can comply with Article 33.
International transfers: will not transfer the data outside the EEA without adequate safeguards (adequacy decision, Standard Contractual Clauses or equivalent).
Audits: will make available to the Box the information needed to demonstrate compliance and allow reasonable audits, with 30 days' notice, once a year unless there is a breach, at the Box's expense.
On termination of the service, and at the Box's choice, will delete or return the data within 30 days (the Box may export it beforehand), unless a law requires retention, and will delete existing copies within normal rotation periods.
Keep the record of processing activities as processor (Art. 30.2).

6.5. The Box's obligations. Comply with section 5, give lawful instructions and take responsibility for the content and lawfulness of the processing it decides.

6.6. Data WODira processes as controller. WODira processes as its own controller the user account data (sign-in, security) and the Box's billing data, as set out in the Privacy Policy. When a member also uses WODira Events, Peak or other services, WODira is the controller of that data in those services.

7. Evidence of liability-waiver acceptance

When the Box uses the liability-waiver feature, WODira records the member's acceptance (typed name, date and time, text version and, where applicable, technical acceptance data) as mere technical evidence. The Box is responsible for its content, its legal validity and for deciding how long it keeps that evidence; it may export it before deleting its account.

8. Liability and indemnity

WODira is not liable for the Box's activities, facilities, services, charges or decisions, nor for damage arising from them; any claim from members or other third parties must be addressed to the Box. The Box will hold WODira harmless against claims, penalties and costs (including reasonable attorneys' fees) arising from its activity, its data-processing instructions or breach of these terms. Within the limits permitted by law, WODira's total liability to the Box is limited to the fees paid by the Box in the 12 months before the event giving rise to the claim, except in cases of wilful misconduct.

9. Duration and termination

The agreement lasts while the Box keeps the service. Either party may terminate it for a serious breach not remedied within 15 days. On termination, section 6.4 on return and deletion of data applies.

10. Governing law and jurisdiction

These terms are governed by Spanish law. The parties submit to the courts of Ibiza (Illes Balears), waiving any other jurisdiction.