Data Processing Addendum

1 Introduction and Incorporation

This Data Processing Addendum ("DPA") forms part of and is incorporated by reference into the Kahunas Business User Terms (the "Terms") between Kahunas FZE, trading as Kahunas ("Kahunas", "we", "us", or "our"), and the Business User who accepts the Terms (the "Business User", "Coach", "you", or "your"). This DPA applies wherever Kahunas processes Client personal data on the Business User's behalf through the Kahunas Platform and Services.

This DPA gives effect to the parties' obligations under applicable data protection law in respect of that processing, including where applicable the UK General Data Protection Regulation ("UK GDPR"), the EU General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR"), and UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL") (together, "Data Protection Law").

In the order of precedence set out in the Terms, this DPA ranks above the Terms and the Privacy Policy in respect of the subject matter it covers. Where this DPA conflicts with any other provision of the Terms in relation to the processing of Client personal data, this DPA governs. In the event of a conflict between this DPA and the Standard Contractual Clauses or UK Addendum incorporated under Annex 4, those clauses govern in respect of restricted international transfers.

Capitalised terms not defined in this DPA have the meaning given to them in the Terms.

2 Definitions

Client Any customer, member, patient, participant, athlete, student, or other individual whose personal data is stored, managed, or processed through the Services under the direction of the Business User, as defined in the Terms. The Client is the individual who accepts the Kahunas End User Terms as an "End User"; references to "Client" in this DPA and to "End User" in the End User Terms mean the same Data Subject.

Client Personal Data Personal data relating to Clients that Kahunas processes on behalf of the Business User in the course of providing the Services. Client Personal Data does not include personal data for which Kahunas is the Controller under Section 3.2.

Controller, Processor, Data Subject, Personal Data, Processing, Special Category Data, and Personal Data Breach each have the meaning given in Data Protection Law.

Data Protection Law As defined in Section 1.

Restricted Transfer A transfer of Client Personal Data to a country or territory that is not the subject of an adequacy decision under the applicable Data Protection Law, where such transfer would be prohibited absent an appropriate safeguard.

Standard Contractual Clauses or SCCs The standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission under Commission Implementing Decision (EU) 2021/914.

Sub-Processor Any third party engaged by Kahunas to process Client Personal Data in connection with the Services.

Sub-Processor List The Kahunas Sub-Processor List, as updated from time to time and made available at compliance@kahunas.io, which is the authoritative register of Kahunas' Sub-Processors.

UK Addendum The International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

3 Roles of the Parties

3.1 Business User as Controller, Kahunas as Processor

In respect of Client Personal Data, the Business User is the Controller and Kahunas is the Processor. The Business User determines the purposes and means of processing Client Personal Data; Kahunas processes it only on the Business User's behalf in accordance with this DPA.

The Business User is solely responsible for establishing a lawful basis for processing, obtaining any required consents (including explicit consent for Special Category Data), providing privacy notices to Clients, and responding to Data Subject requests, as set out in the Terms.

3.2 Kahunas as Controller

This DPA does not apply where Kahunas acts as Controller. As described in the Privacy Policy, Kahunas is an independent Controller of personal data it processes for its own purposes, including account administration, subscription management, billing, fraud prevention, security monitoring, platform analytics, product improvement, the development, training, and improvement of artificial intelligence and machine-learning models using anonymised data (as further described in Section 4.5), legal compliance, and marketing communications. Kahunas' processing as Controller is governed by the Privacy Policy, not this DPA.

The Client (End User) also holds a direct relationship with Kahunas under the Kahunas End User Terms, in respect of which Kahunas is an independent Controller as described in the Privacy Policy. That relationship is separate from, and not governed by, this DPA. This DPA governs only Kahunas' processing of Client Personal Data as Processor on behalf of the Business User.

4 Scope and Processing Instructions

4.1 Subject matter and details

The subject matter, duration, nature and purpose of the processing, the types of Client Personal Data, and the categories of Data Subjects are set out in Annex 1 (Details of Processing).

4.2 Documented instructions

Kahunas processes Client Personal Data only on the Business User's documented instructions, including with regard to Restricted Transfers, unless required to do otherwise by applicable law. The Business User's instructions are set out in this DPA, the Terms, and the Business User's configuration and use of the Services. The Business User may issue further reasonable written instructions consistent with the DPA and the functionality of the Services.

Where Kahunas is required by applicable law to process Client Personal Data other than on the Business User's instructions, Kahunas will inform the Business User of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest.

4.3 Notice of unlawful instructions

Kahunas will inform the Business User without undue delay if, in its opinion, an instruction infringes Data Protection Law. Kahunas is not obliged to carry out an instruction it reasonably believes to be unlawful.

4.4 Business User responsibilities

The Business User warrants that its instructions and the processing of Client Personal Data by Kahunas on its behalf comply with Data Protection Law, that it has provided all required notices, and that it has a lawful basis for the processing, including for any Special Category Data.

The Business User is the sole Controller of all Client Personal Data within its Account. The Business User warrants that any of its own Authorised Users (including team members, sub-coaches, and administrators) to whom it grants access to Client Personal Data act under the Business User's authority and instruction, and not as independent controllers of that data, and that it has bound each such person by appropriate confidentiality and data protection obligations. The Business User is responsible for the acts and omissions of its Authorised Users in respect of Client Personal Data as though they were its own.

4.5 Anonymisation, aggregated data, and AI training

The Business User instructs and authorises Kahunas to process Client Personal Data in order to create anonymised, aggregated, or de-identified data. This creation step is carried out by Kahunas as Processor on the Business User's behalf and constitutes a documented instruction for the purposes of Section 4.2.

Once data has been irreversibly anonymised so that it no longer relates to an identified or identifiable individual and cannot be re-identified, it ceases to be Client Personal Data, falls outside the scope of this DPA, and may be used by Kahunas as Controller for its own purposes — including the development, training, and improvement of artificial intelligence and machine-learning models and the Services — as described in the Terms and the Privacy Policy.

Kahunas will not use Client Personal Data that constitutes Special Category Data (including Health Data) for artificial intelligence or machine-learning training where explicit consent or another condition is required by Data Protection Law, unless that condition has been satisfied. Where such use depends on consent, Data Subjects may decline, withdraw consent, or opt out as set out in the Privacy Policy, without affecting the lawfulness of processing carried out before withdrawal.

The Business User remains responsible, as Controller, for ensuring that Clients have received appropriate notice of, and where required have provided a valid condition for, the creation and use of anonymised data as described in this Section. Where anonymisation of Special Category Data itself requires explicit consent under Data Protection Law, the parties will cooperate to ensure that condition is met before such data is processed for this purpose.

5 Kahunas' Processing Obligations

Kahunas will:

• process Client Personal Data only as set out in Section 4;
• ensure that persons authorised to process Client Personal Data are bound by an appropriate obligation of confidentiality (Section 6);
• implement and maintain the technical and organisational measures set out in Annex 2 (Section 7);
• respect the conditions for engaging Sub-Processors (Section 8);
• assist the Business User as set out in Sections 10 and 11;
• delete or return Client Personal Data as set out in Section 12; and
• make available the information and audit rights set out in Section 13.

6 Confidentiality

Kahunas ensures that any person it authorises to process Client Personal Data is subject to a binding duty of confidentiality, whether contractual or statutory, and processes Client Personal Data only on instruction. Access to Client Personal Data within Kahunas is limited to personnel who need it to provide, secure, or support the Services, and is governed by the role-based access controls described in Annex 2.

7 Security

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to Data Subjects, Kahunas implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex 2 (Technical and Organisational Measures).

The Business User is responsible for its own security obligations as Controller, including securing its own devices and credentials, managing its Authorised Users' access, and configuring the Services appropriately, as set out in the Terms.

8 Sub-Processors

8.1 General authorisation

The Business User grants Kahunas general authorisation to engage Sub-Processors to process Client Personal Data. The current Sub-Processors are set out in the Sub-Processor List, which is incorporated into this DPA by reference (see Annex 3). Kahunas remains liable to the Business User for the performance of each Sub-Processor's data protection obligations.

8.2 Flow-down obligations

Before a Sub-Processor processes Client Personal Data, Kahunas imposes on it, by written contract, data protection obligations that are materially equivalent to those set out in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures.

8.3 Changes and objection

Kahunas will notify the Business User at least 30 days in advance of any intended addition or replacement of a Sub-Processor, in accordance with the process set out in the Sub-Processor List. The Business User may object on reasonable data protection grounds before the change takes effect. Where the parties cannot resolve the objection in good faith, the Business User's sole remedy is to terminate its subscription under the Terms before the change takes effect; Kahunas is not obliged to refrain from appointing the Sub-Processor, and will not route the objecting Business User's Client Personal Data to the new Sub-Processor before that termination takes effect. Continued use of the Services after the change takes effect constitutes acceptance of the change.

9 International Transfers

Kahunas' infrastructure is hosted primarily in the United Kingdom, and certain Sub-Processors are located in the United States, the European Union, and other jurisdictions, as set out in the Sub-Processor List. Where processing of Client Personal Data involves a Restricted Transfer, the parties comply with the transfer mechanisms set out in Annex 4 (International Transfers), including the Standard Contractual Clauses and, where UK data is transferred, the UK Addendum.

10 Assistance to the Business User

Taking into account the nature of the processing and the information available to it, Kahunas provides reasonable assistance to the Business User by appropriate technical and organisational measures, insofar as this is possible, to enable the Business User to:

• Respond to Data Subject requests. Where a Client exercises a right under Data Protection Law (access, rectification, erasure, restriction, portability, objection, or rights relating to automated processing), Kahunas provides tooling within the Services to enable the Business User to locate, export, correct, restrict, or delete the relevant Client Personal Data. Where a request is made directly to Kahunas, Kahunas will, unless legally required to respond, refer the Data Subject to the Business User and notify the Business User without undue delay.
• Meet security obligations under Data Protection Law (Section 7), personal data breach notification and communication (Section 11), data protection impact assessments, and prior consultation with a supervisory authority, taking into account the information available to Kahunas.

Kahunas may charge a reasonable fee for assistance that goes materially beyond the self-service tooling made available through the Services, having first notified the Business User.

11 Personal Data Breach

Kahunas notifies the Business User without undue delay, and in any event within 48 hours of becoming aware, after becoming aware of a Personal Data Breach affecting Client Personal Data. Kahunas' internal incident response procedure targets initial notification within 24 hours of confirming a breach, so that the Business User retains adequate time within its own 72-hour regulatory notification window as Controller; the 48-hour figure in this Section is the contractual outer limit, not the operational target. The notification will describe, to the extent known and reasonably available, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where the full detail required above is not yet available within that time, Kahunas will provide the information it has and supplement it in phases without undue further delay as it becomes available.

Kahunas will cooperate with the Business User and take reasonable steps to mitigate and remediate the breach. Notification of a breach is not an acknowledgement of fault or liability. The Business User, as Controller, remains responsible for assessing whether the breach must be notified to a supervisory authority or to affected Data Subjects, and for making any such notification.

12 Deletion or Return on Termination

On termination or expiry of the Terms, and at the choice of the Business User, Kahunas will delete or return all Client Personal Data, and delete existing copies, unless retention is required by applicable law.

The Business User is responsible for exporting Client Personal Data prior to termination where export functionality is available through the Services. Following termination, deletion and retention timelines are governed by the Kahunas Data Retention Policy. Where the Business User's tenant is deleted, the Client Personal Data held in the tenant's dedicated database is deleted in accordance with that policy. Client Personal Data held in backups is deleted in line with the disaster recovery and retention schedule described in the Data Retention Policy and Annex 2.

Archived Clients. Where a Business User archives a Client through the Services, Kahunas deletes that Client's Personal Data 12 months after the date of archiving, in accordance with the Data Retention Policy, unless the Business User restores the Client before then. A Client who is already archived when this version takes effect is deleted 12 months after their original date of archiving, but no earlier than 90 days after the effective date of this version. The Business User instructs Kahunas to apply this deletion rule. Before the 12 months end, the Business User may request an export of the archived Client's Personal Data through the Services; the export is sent only to the Client and is not provided to the Business User. Kahunas notifies the Business User and the Client 30 days before the Client's Personal Data is deleted.

13 Audit and Information

Kahunas makes available to the Business User the information reasonably necessary to demonstrate compliance with this DPA and with the obligations of a Processor under Data Protection Law, and allows for and contributes to audits, including inspections, conducted by the Business User or an auditor it mandates.

To satisfy this obligation, Kahunas may make available its security documentation, certifications, and summaries of independent assessments where available. Where the Business User reasonably requires further information or an on-site audit, the parties will agree in advance the timing, scope, and cost, so as to minimise disruption to the Services and to protect the confidentiality and security of other customers' data. Audits are conducted no more than once in any twelve-month period unless required by a supervisory authority or following a Personal Data Breach.

14 Special Category and Health Data

The Business User acknowledges that the Services enable the processing of Special Category Data, including health, fitness, body-composition, sleep, nutrition, biomarker, and related data as described in the Privacy Policy and Annex 1. The Business User is solely responsible for ensuring that all explicit consents and other conditions required under Data Protection Law for the processing of such data are in place before it is uploaded to or processed through the Services. Kahunas applies the heightened security measures described in Annex 2 to such data.

15 Liability

Each party's liability arising out of or related to this DPA, whether in contract, tort, or otherwise, is subject to the limitations and exclusions of liability set out in the Terms. Any reference in those limitations to Kahunas' liability applies to the aggregate liability of Kahunas under the Terms and this DPA together. Nothing in this DPA limits either party's liability to the extent such liability cannot be limited or excluded under applicable law.

Where Kahunas is held liable for damage caused by processing that did not comply with obligations under Data Protection Law directed specifically to Processors, or where it acted outside or contrary to the Business User's lawful instructions, the parties will each bear liability to the extent of their respective responsibility for the damage. Kahunas may recover from the Business User the part of any compensation paid corresponding to the Business User's share of responsibility.

16 Acceptance and Electronic Signature

Electronic acceptance. This DPA is presented to the Business User during the Kahunas onboarding process. By clicking "I agree" or an equivalent acceptance action, providing your name where requested, and continuing to use the Services, you confirm that you have read, understood, and agree to be bound by this DPA on behalf of the Business User, and that you have authority to bind it. Where a coach signs up as an individual, the Business User is that individual; where a coach signs up on behalf of a business or organisation, the Business User is that entity.

Legal effect. Electronic acceptance constitutes a legally binding agreement with the same legal effect as a handwritten signature, and a valid electronic signature under applicable law, including the UK and EU eIDAS frameworks, the UAE Electronic Transactions and Trust Services Law, and, where applicable, the US ESIGN Act.

Record of acceptance. Kahunas maintains a record of each Business User's acceptance, including: (a) the date and time of acceptance (UTC); (b) the version of this DPA accepted; (c) the name, email address, and account associated with the accepting user; and (d) the IP address from which acceptance was recorded. This record is made available to the Business User on written request to compliance@kahunas.io.

Signable copy. A Business User whose own compliance requirements demand a countersigned document may request a signable copy of this DPA from compliance@kahunas.io; the terms of that copy are identical to this DPA.

Changes to this DPA. Kahunas may update this DPA from time to time. Where changes are material, Kahunas will notify the Business User by email or in-app notice no less than 30 days before the changes take effect. Continued use of the Services after the notice period constitutes acceptance of the updated DPA. A Business User who does not accept a material change may terminate its subscription in accordance with the Terms.

17 Governing Law and Jurisdiction

This DPA is governed by the laws of the United Arab Emirates and subject to the jurisdiction of the Dubai Courts, as set out in the Terms, except where the Standard Contractual Clauses or UK Addendum specify a different governing law or forum in respect of a Restricted Transfer, in which case those provisions apply to that transfer.

18 General

Except as expressly modified by this DPA, the Terms remain in full force and effect. If any provision of this DPA is held invalid or unenforceable, the remaining provisions continue in full force, and the invalid provision is modified to achieve as closely as possible its original intent. This DPA, together with the Terms, the Privacy Policy, the Health Data Policy, the Sub-Processor List, and the Data Retention Policy, constitutes the entire agreement between the parties in respect of the processing of Client Personal Data.

Annex 1 — Details of Processing

Subject matter of the processing. Kahunas' provision of the Kahunas Platform and Services to the Business User, and the processing of Client Personal Data necessary to provide those Services.

Duration of the processing. For the duration of the Subscription Term and until deletion or return of Client Personal Data in accordance with Section 12 and the Data Retention Policy.

Nature and purpose of the processing. Hosting, storage, organisation, retrieval, transmission, display, backup, and deletion of Client Personal Data to enable the Business User to manage Clients, deliver programmes, communicate with Clients, schedule sessions, collect forms and check-ins, track progress and health metrics, process payments, and administer the Business User's coaching business through the Services.

Categories of Data Subjects. The Business User's Clients (customers, members, participants, athletes, students, or patients), and the Business User's Authorised Users (coaches, team members, and administrators) whose data the Business User manages through the Services.

Categories of Client Personal Data. As determined by the Business User's use of the Services, and comprising the following categories maintained within the Platform:

Special category data. The processing includes health, fitness, and wellbeing data that constitutes Special Category Data under Data Protection Law. Such data is processed only where the Business User has established a valid condition for processing, including explicit consent where required.

Frequency of the transfer. Continuous, for the duration of the Subscription Term.

Annex 2 — Technical and Organisational Measures

Kahunas implements and maintains the following technical and organisational measures. These measures are subject to continuous review and may be updated to reflect changes in technology and risk, provided the overall level of security is not reduced.

Tenant isolation and data segregation. Each Business User tenant is provisioned with its own dedicated database, logically and physically separated from every other tenant. The Platform resolves tenant context on each request and fails closed where tenant scope is absent, so that a request cannot access data belonging to another tenant. Cross-tenant data segregation is enforced at the architecture level and validated in the development pipeline.

Access control. Access is governed by role-based access controls on the principle of least privilege, with layered enforcement: organisation-level feature entitlements, role classification (owner, team member, client), tenant-local staff permissions, and resource-level access grants. Every server entry point independently enforces authorisation and does not rely on client-supplied identifiers. Internal access to Client Personal Data is limited to personnel who require it to fulfil their role and is segregated between customer-support and engineering functions: production database access is restricted to the engineering team, and customer-support staff have scoped access through an administrative portal. Elevated access is held only by a limited number of authorised personnel across the engineering and support functions. Destructive operations, including data deletion, are restricted to administrator accounts.

Authentication. Authentication and identity are managed through a dedicated identity provider (WorkOS) supporting single sign-on, multi-factor authentication (MFA), role-based access control, and session management. MFA is available and offered to users during onboarding and recommended for all staff accounts accessing production systems.

Encryption. Client Personal Data is encrypted in transit using TLS 1.2 or higher across all endpoints, including API calls, webhook traffic, and browser sessions. Data at rest is encrypted by the underlying infrastructure providers: the primary database (Neon) using AES-256, media storage (AWS S3) using server-side encryption (SSE-S3), and the cache layer (Upstash Redis) at rest on managed plans.

Data subject request tooling. The Platform provides engines to support Data Subject requests, including data access and portability export (covering the primary database, stored media, and chat history), erasure (including anonymisation of user records, purging of media, and deletion of chat identities), rectification, and processing restriction. These tools enable the Business User to fulfil its obligations under Section 10.

Resilience and backups. Kahunas maintains backup procedures, object versioning on stored media to support recovery, and disaster recovery protocols. Backup data is retained in line with the disaster recovery schedule and deleted in line with primary retention timelines.

Hosting and residency. Core infrastructure is hosted in London, United Kingdom: application hosting and edge delivery (Vercel), the primary database (Neon), and media storage (AWS S3). Video and CDN delivery is provided via Bunny.net. Sub-processor regions are set out in the Sub-Processor List (Annex 3).

Monitoring and observability. Kahunas maintains platform-level monitoring across its infrastructure providers and application observability via SigNoz, in which personal data and health data are masked, together with regular security reviews and vulnerability assessments.

Incident response. Kahunas maintains incident response procedures, including breach detection, investigation, documentation, remediation, and notification in accordance with Section 11.

Personnel and offboarding. Personnel with access to Client Personal Data are bound by confidentiality obligations and receive training on data handling and security responsibilities. On staff departure, access is revoked across all connected systems through WorkOS deprovisioning.

Annex 3 — Sub-Processors

The authoritative list of Sub-Processors engaged by Kahunas to process Client Personal Data, including each Sub-Processor's service purpose, the categories of data it may process, and its processing region, is set out in the Kahunas Sub-Processor List (currently Version 2.6), which is incorporated into this DPA by reference and available at compliance@kahunas.io.

Wearable and content integrations that a Client or Business User chooses to connect directly (for example Apple Health, Google Fit, Garmin, Fitbit, Oura, Polar, Whoop, YouTube, and Vimeo) are third-party services authorised directly by the user and are not Sub-Processors engaged by Kahunas.

The process for adding or removing a Sub-Processor, for notifying customers, and for raising objections is set out in the Sub-Processor List and in Section 8 of this DPA.

Annex 4 — International Transfers

Where the processing of Client Personal Data involves a Restricted Transfer, the following mechanisms apply:

EU personal data. The Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated into this DPA by reference and apply to transfers of Client Personal Data protected by the EU GDPR to a country without an adequacy decision. Module Two (Controller to Processor) applies where the Business User is a Controller and Kahunas is a Processor, and Module Three (Processor to Sub-Processor) applies between Kahunas and its Sub-Processors. The optional docking clause applies; the audit and sub-processor provisions correspond to Sections 13 and 8; the governing law and forum are as specified in the SCCs; and the annexes to the SCCs are populated by Annexes 1, 2, and 3 of this DPA.

UK personal data. The UK Addendum is incorporated into this DPA by reference and applies to transfers of Client Personal Data protected by the UK GDPR, amending the SCCs as set out in the UK Addendum. Tables 1 to 3 are populated by the parties' details and by Annexes 1, 2, and 3 of this DPA; in Table 4, neither party may end the UK Addendum as permitted by Section 19 of it.

UAE and other jurisdictions. For Client Personal Data subject to the UAE PDPL or other Data Protection Law, Kahunas applies the appropriate safeguards required by that law, including standard contractual clauses, adequacy, or explicit consent, as applicable.

Where an onward transfer to a Sub-Processor involves a Restricted Transfer, Kahunas ensures an equivalent transfer mechanism is in place with that Sub-Processor.

Appendix A — Version History

The table below records material changes to the Kahunas Data Processing Addendum. Minor editorial corrections and formatting updates are not recorded.

For questions regarding this Addendum, contact compliance@kahunas.io