Data processing agreement

Who we are

xBase360 (sole proprietorship) provides the xBase360 platform and is responsible for the processing of your data as described below.

• Postal address: Gravin Juliana van Stolberglaan 31, 2263 AB Leidschendam, Netherlands (not a visiting address)
• Chamber of Commerce (KvK) number: 42093846
• VAT number: NL005494735B95
• Email: support@xbase360.com
• Phone: +31 70 204 2081
• Privacy questions: privacy@xbase360.com

1. What this is about

You use xBase360 to coach your members. In doing so, you process personal data of your members and staff in our system. For that data you are the controller and we are the processor (GDPR Article 28). This agreement applies automatically as soon as you create a business account; on request, we will also sign it.

For a number of processing operations we are the controller ourselves: management of accounts and the platform, security and logging, invoicing to you, and the services a member purchases directly from us without your involvement. These are listed in Annex 2 and are covered by our privacy statement.

2. What we process and for what purpose

The nature, purpose and categories of data subjects and data are set out in Annex 1. We process exclusively on your documented instructions; use of the platform in accordance with the guide and the settings you choose yourself counts as an instruction. If, in our opinion, an instruction infringes the law, we will notify you and will not carry it out.

We do not process the data for our own purposes, do not sell it, and do not use it to train models.

3. Our obligations as processor

• Confidentiality. Everyone at our company who has access is bound by confidentiality. Our staff can only access member and record data via the support view feature that the member switches on for a maximum of two hours, or that you or your coach switch on for your dashboard for a maximum of 24 hours. In your dashboard we then only view: no changes, at most one hour at a time, visible to whoever switched it on, and logged.
• Security. We take the measures in Annex 3. They are derived from the way the system is built and are updated with every change.
• Sub-processors. You give general authorisation for the parties in the list on our privacy page. We announce any change at least 30 days in advance by email to the administrator address; you can object within that period, after which we will seek a solution in consultation or you may terminate the agreement. With each sub-processor we conclude an agreement with at least the same obligations.
• Transfers outside the EEA only under the standard contractual clauses of the European Commission or an adequacy decision, and only for the stated purposes. The database and file storage are located in the EU.
• Data subject rights. The platform offers access, rectification, portability and erasure directly to the member. We support requests that reach you and that you cannot handle yourself in the platform within ten working days.
• Assistance with a DPIA. We provide the information from our own data protection impact assessment and security documentation on first request.
• Data breaches. We report a breach affecting your data without undue delay and no later than 48 hours after discovery to the administrator address, with what is known about its nature, the data subjects, consequences and measures. We do not notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) on your behalf, unless you request this in writing.
• Audit. Once a year, or after an incident, you may have our compliance assessed by an independent expert bound by confidentiality, after consultation about timing and scope. We first provide our existing reports; additional assessment only follows if these are insufficient.

4. Your obligations as controller

• You ensure there is a legal basis, inform your members (for the technical part you may refer to our privacy statement) and manage which rights each member of your team has.
• Health data entered by your members is processed on the basis of their explicit consent. You do not request health data yourself outside the features intended for it: intake, consultation report and clinical nutrition.
• If a staff member is a registered healthcare provider (BIG or Kwaliteitsregister Paramedici), you record this for that staff member in the platform. Consultation reports by such a staff member count as a medical record subject to the twenty-year retention obligation under the Dutch Medical Treatment Contracts Act (WGBO), and are not included in a member’s deletion request. You are responsible for that record yourself.
• You do not use the platform as a medical device and do not present it as such to your members. See also the terms of use, under “What the app is not”.

5. Retention, return, erasure

We retain data according to the periods in our privacy statement. What a member deletes themselves is gone; what must be kept by law (financial records, medical records of registered healthcare providers) remains.

At the end of your subscription you can export your data for 30 days. After that, we erase the data linked to your organisation, except what must be kept. Members keep their own account and their own data: it belongs to them, not to you. A deletion request for a record goes through the “delete record” feature with a cooling-off period and name confirmation; that is your decision, and we carry it out.

6. Liability and term

The liability provisions of the terms of use apply. Fines imposed by the supervisory authority for an infringement attributable to the other party may be recovered from that party. This agreement lasts as long as your subscription and for as long as we retain data for you thereafter. Dutch law applies.

Annex 1. Where you are the controller and we are the processor

Annex 2. Where xBase360 is the controller

• Accounts and platform management: sign-in, sessions, security, rate limits, error reports.
• Record access log: who read what, when and on what basis; readable by the member.
• Own data of a member without a gym: everything a member records without an organisation.
• “Take your data with you” export: at the member’s request, via a link that works for 24 hours, at most three times a day.
• Support view: in the app for a maximum of two hours if the member switches it on; in the dashboard for a maximum of 24 hours if the coach switches it on, read-only, visible and logged.
• Invoicing to you: contact person and invoices.

Annex 3. Security measures

• Who may see which row is enforced in the database itself, by owner and organisation role. As a result, a bug in a screen cannot display someone else’s data. The service role has no general read or write permissions.
• Permissions can be set per team member. Two-step verification is required for our own team, for healthcare providers with consultation reports and, from 14 October 2026, for every coach and owner; anyone else can switch it on themselves.
• Health data, photos and documents in protected storage without public links, only accessible via signed, expiring URLs.
• Log of record access and exports, readable by the member.
• Encrypted connections; database and storage in the EU; backups by the hosting provider.
• Retention periods enforced automatically; files via a clean-up queue; rate limiting with hashed keys.
• Security review against OWASP ASVS 5.0; error monitoring without tracing of personal data; job secrets rotated via script.
• AI requests contain no contact details; AI output is only stored after confirmation by a human and carries a label.