Data Processing Agreement

The User, as identified upon registration for use of the platform, the websites and the related services of 1club EOOD, in its capacity as a data Controller (“User” or “Controller”), and

1club EOOD, UIC 208644166, a company incorporated and existing under the laws of the Republic of Bulgaria, with its registered seat and management address at: 10 Tsar Osvoboditel Blvd., floor 3, Sofia, 1000, Bulgaria, acting in its capacity as a data Processor (“1club”, “we” or “Processor”),

hereinafter referred to together as the “Parties” and individually as a “Party”,

having regard to the fact that:

(A) The User uses the 1club platform (“Service”), accessible at 1club.ai and the related mobile applications, for the management of fitness/sports facilities, including the management of memberships, bookings, schedules, payments and communication with end users — members of the User;

(B) In connection with the provision of the Service, 1club processes the personal data of the end users (members) of the User on behalf of the User and in accordance with its documented instructions;

(C) The Parties wish to regulate the conditions for the processing of personal data in accordance with the requirements of Article 28 of Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and the Personal Data Protection Act of the Republic of Bulgaria;

(D) The Parties wish to conclude this personal data processing agreement (“Agreement”), governing the conditions for the processing of User Personal Data by the Processor in connection with the provision of the Service.

THE PARTIES HAVE AGREED AS FOLLOWS:

1. DEFINITIONS

In this Agreement, the following terms mean:

“Data Controller” or “Controller” means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. In the context of this Agreement, the Controller is the User.

“Personal Data” means any information relating to an identified natural person or a natural person who can be identified (data subject); a natural person who can be identified is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, psychological, economic, cultural or social identity of that natural person.

“User Personal Data” means the Personal Data processed by 1club on behalf of the User in connection with the provision of the Service, as described in Appendix 1.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Data Processor” or “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. In the context of this Agreement, the Processor is 1club EOOD.

“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

“Sub-processor” means any third party engaged by the Processor to carry out specific processing activities on behalf of the Controller.

“Applicable Data Protection Legislation” means the GDPR, the Personal Data Protection Act of the Republic of Bulgaria and all other applicable legislation of the EU and/or the EU Member States in the field of personal data protection.

“Special Categories of Personal Data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

“Data Subject” means an identified natural person or a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, psychological, economic, cultural or social identity of that natural person.

“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses approved by the European Commission that apply to the transfer of personal data to Third Countries.

“Third Country” means a country outside the European Economic Area (EEA).

“Service” means the 1club platform, accessible at 1club.ai and the related mobile applications, for the management of fitness/sports facilities, including the management of memberships, bookings, schedules, payments and communication with end users — members of the User.

2. SCOPE.

2.1. This Agreement governs the processing of User Personal Data by 1club in connection with the provision of the Service.

2.2. In the event of a conflict between the provisions of this Agreement and another contract or agreement between the Parties with respect to the protection of personal data, the provisions of this Agreement shall prevail.

2.3. This Agreement does not apply to processing in which 1club acts as an independent data Controller.

3. CONCLUSION OF THE AGREEMENT

3.1. By creating a registered profile at 1club.ai, filling in the data in the application for use of the Service for identification of the User (names and address for natural persons; name, UIC and names of the representative for legal persons) and ticking the relevant mandatory box for consent to this Agreement:

3.1.1. You (as a natural person), or the legal person represented by you, conclude with 1club a “Personal Data Processing Agreement”, which applies when we process personal data provided to us by you in your capacity as the Controller of that personal data.

3.1.2. You declare that you have due representative authority to conclude this Agreement in the name of and on behalf of a legal person – User.

4. ROLES OF THE PARTIES

4.1. With respect to User Personal Data, the User acts as the Controller, and 1club acts as the Processor.

4.2. The User confirms that it is responsible for complying with its obligations as a Controller under the Applicable Data Protection Legislation, including for ensuring a legal ground for the processing, providing information to data subjects and obtaining the necessary consents (including parental consent for persons under 14 years of age, where applicable).

5. OBLIGATIONS OF THE CONTROLLER AND INSTRUCTIONS

5.1. The Controller gives instructions to the Processor regarding the processing of User Personal Data in accordance with the Applicable Data Protection Legislation.

5.2. The Controller’s instructions to the Processor are deemed documented through: (a) this Agreement and its appendices; and (b) the Controller’s use of the functionalities of the Service.

5.3. The Controller warrants that the processing of User Personal Data for which it has instructed the Processor is lawful and has a valid legal ground.

6. OBLIGATIONS OF THE PROCESSOR

6.1. The Processor processes User Personal Data solely on the basis of documented instructions from the Controller, including with regard to the transfer of personal data to a Third Country or an international organisation, except where required to do so by EU law or the law of a Member State applicable to the Processor — in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

6.2. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Applicable Data Protection Legislation.

6.3. The Processor processes User Personal Data solely for the purposes of providing the Service, as described in Appendix 1, and does not process User Personal Data for its own purposes.

7. CONFIDENTIALITY

7.1. The Processor ensures that the persons authorised to process User Personal Data have committed themselves to confidentiality.

7.2. The Processor ensures that access to User Personal Data is limited to those employees and persons who need access in order to perform the obligations under this Agreement.

8. SECURITY OF PROCESSING

8.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

8.2. The specific technical and organisational measures applied by the Processor are described in Appendix 2 to this Agreement and are updated as necessary.

9. SUB-PROCESSORS

9.1. The Controller grants the Processor a general written authorisation for the engagement of Sub-processors for the purposes of providing the Service.

9.2. The list of approved Sub-processors as at the date of this Agreement is set out in Appendix 3.

9.3. The Processor shall notify the Controller of any intended addition or replacement of a Sub-processor no less than 30 days before the intended change, providing sufficient information about the new Sub-processor.

9.4. The Controller has the right to object to the engagement of a new Sub-processor within 30 days of receipt of the notification. The objection must be reasoned and related to the protection of personal data. In the event of a justified objection, the Parties shall make reasonable efforts to find a mutually acceptable solution. If such a solution cannot be reached, the Controller has the right to terminate the Agreement in the part affected by the change.

9.5. The Processor shall conclude a written contract with each Sub-processor imposing on the Sub-processor the same data protection obligations as those set out in this Agreement. The Processor remains fully liable to the Controller for the performance of the Sub-processor’s obligations.

10. RIGHTS OF DATA SUBJECTS

10.1. Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller’s obligation to respond to requests for exercising the rights of data subjects provided for in Chapter III of the GDPR.

10.2. The Processor shall notify the Controller without undue delay upon receipt of a request from a data subject relating to User Personal Data, and shall not respond to such a request itself unless expressly authorised by the Controller.

11. ASSISTANCE TO THE CONTROLLER

11.1. Taking into account the nature of the processing and the information available, the Processor assists the Controller in ensuring compliance with the obligations under Articles 32-36 of the GDPR, including the obligation to implement appropriate security measures (Article 32), the obligation to notify the supervisory authority of a personal data breach (Article 33), the obligation to notify data subjects in the case of high risk (Article 34), the carrying out of data protection impact assessments (Article 35) and prior consultation with the supervisory authority (Article 36), where applicable.

12. NOTIFICATION OF A PERSONAL DATA BREACH

12.1. The Processor shall notify the Controller without undue delay and no later than 24 (twenty-four) hours after becoming aware of a Personal Data Breach affecting User Personal Data.

12.2. The notification shall contain at least:

(a) a description of the nature of the breach, including, where possible, the categories and approximate number of data subjects and records concerned;

(b) a description of the likely consequences of the breach;

(c) a description of the measures taken or proposed to address the breach and to mitigate its possible adverse effects;

(d) the contact details of the person from whom further information can be obtained.

12.3. The Processor cooperates with the Controller and takes reasonable measures to assist in the investigation, containment and remediation of the consequences of the breach.

12.4. Notification or assistance by the Processor does not constitute an admission of fault or liability for non-performance of the obligations under this Agreement.

12.5. In the case of a Personal Data Breach that may give rise to a high risk to the rights and freedoms of natural persons, the Processor assists the Controller in notifying the affected data subjects in accordance with Article 34 of the GDPR, including by providing the available contact information for the affected data subjects, assistance in preparing notifications and ensuring communication channels for the purposes of notification, insofar as the Processor has such.

13. DELETION OR RETURN OF DATA

13.1. Upon termination or expiry of the contractual relationship for use of the Service, at the Controller’s choice, the Processor deletes or returns to the Controller all User Personal Data and deletes the existing copies, unless EU law or the law of a Member State requires storage of the personal data.

13.2. If the Controller does not give an express instruction within one month of the termination of the contractual relationship for use of the Service, the Processor deletes the User Personal Data, including all copies.

13.3. The obligation to delete does not apply to data whose storage is required by the applicable legislation.

14. AUDIT

14.1. The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations under Article 28 of the GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

14.2. The Controller shall notify the Processor of a planned audit no less than 30 (thirty) days in advance, except in cases where the audit is required by a supervisory authority or is in connection with a security breach.

14.3. Audits are conducted during normal business hours, in a manner that does not unreasonably disrupt the Processor’s activities, and subject to confidentiality obligations.

14.4. The Processor may satisfy audit requests by providing up-to-date certifications, third-party audit reports or other appropriate documentation, insofar as those documents cover the scope of the requested inspection. In such cases, an on-site audit at the Controller is not conducted.

15. INTERNATIONAL TRANSFER OF PERSONAL DATA

15.1. The Processor does not transfer User Personal Data to a Third Country or an international organisation unless the conditions of Chapter V of the GDPR are met, including the presence of one of the following:

(a) the existence of an adequacy decision by the European Commission with respect to the receiving country;

(b) the provision of appropriate safeguards through Standard Contractual Clauses approved by the European Commission;

(c) approved codes of conduct or certification mechanisms; or

(d) another ground permissible under Article 49 of the GDPR.

15.2. Where the transfer is based on Standard Contractual Clauses, the Processor carries out a Transfer Impact Assessment and applies additional measures, where necessary, to ensure an equivalent level of protection. The Processor informs the Controller of any new transfer of data to a Third Country before it is carried out.

16. RECORDS AND COMPLIANCE

16.1. The Processor maintains a record of the processing activities carried out on behalf of the Controller.

16.2. Upon request, the Processor provides the Controller with information regarding the security measures, the Sub-processors and other aspects of the processing necessary to demonstrate compliance with the Applicable Data Protection Legislation.

17. LIABILITY

17.1. The Processor shall indemnify the Controller for all directly incurred damages and reasonable costs, insofar as they arise from a breach by the Processor of its obligations under this Agreement or the Applicable Data Protection Legislation, or from processing outside of or contrary to the written instructions of the Controller. This clause governs solely the internal relations between the parties and does not limit the rights of data subjects and the powers of the supervisory authorities arising from the Applicable Data Protection Legislation.

18. TERM AND TERMINATION

18.1. This Agreement enters into force on the date of its conclusion, in accordance with clause 3.1. above, and remains in force for the entire period during which the Processor processes User Personal Data in connection with the provision of the Service.

18.2. Either Party may terminate this Agreement with 30 (thirty) days’ written notice to the other Party in the event of discontinuation of the use of the Service by the User. Termination is subject to the obligations for deletion or return of data and the confidentiality obligations, which remain in force after termination.

18.3. The Controller has the right to terminate this Agreement with immediate effect if the Processor materially breaches its obligations under this Agreement or the Applicable Data Protection Legislation and does not remedy the breach within 30 (thirty) days of receipt of a written notice.

18.4. Upon termination of this Agreement, the contract for the provision of the Service is also terminated.

19. FINAL PROVISIONS

19.1. The Processor may unilaterally amend or supplement the Agreement by sending a written notice to the Controller, specifying the content of the amendment, the ground for making it and the date on which the amendment enters into force, which is at least thirty (30) calendar days after the notice. In the event that the Controller does not agree with the unilateral amendment and/or supplement, it has the right to terminate the contract by written notice to the Processor, sent before the date of entry into force of the amendment. In the event that the Controller does not exercise its right of termination within this period and continues to perform or use the contract after the date of entry into force of the amendment, the amendment is deemed accepted, becomes binding on the Parties and an integral part of this Agreement.

19.2. If an individual provision of this Agreement is declared invalid or unenforceable, the remaining provisions retain their effect.

19.3. This Agreement is governed by the legislation of the Republic of Bulgaria. All disputes arising out of or in connection with this Agreement shall be resolved by the competent court in the city of Sofia, Republic of Bulgaria.

19.4. Neither Party has the right to transfer or assign its rights or obligations under this Agreement to third parties without the prior written consent of the other Party.

19.5. This Agreement, together with its appendices, constitutes the entire agreement between the Parties regarding its subject matter and supersedes all prior oral or written arrangements, negotiations and agreements between the Parties regarding the processing of personal data.

19.6. Written statements and communications under this Agreement are deemed validly made if made in the form of email messages, the pressing of an electronic button or a tick in the platform, insofar as the statement is technically recorded in a manner that allows it to be reproduced. In the relations between the Parties, the advanced and the simple electronic signature have the legal effect of a handwritten signature and bind the Parties to the electronic declarations of will made.

19.7. All notifications and communications under this Agreement are sent to the email address associated with the User’s profile for use of the Service, respectively to the email address of the Processor indicated at 1club.ai. Communications are deemed received from the moment they are sent. Each Party is obliged to ensure that the contact details associated with the profile or the platform are up to date.

APPENDIX 1

DESCRIPTION OF THE PROCESSING

1. Subject matter of the processing:

Processing of personal data of the end users (members) of the User in connection with the provision of the Service for the management of fitness/sports facilities through the 1club platform.

2. Duration of the processing:

For the entire term of the contractual relationship for use of the Service between the User and 1club, including the period for deletion of data after termination.

3. Nature of the processing:

Collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, combination, restriction, erasure and destruction of personal data by automated means.

4. Purposes of the processing:

• Management of memberships and subscriptions;
• Management of schedules and bookings;
• Processing of payments and billing;
• Sending notifications and communication with members;
• Generating reports and analytics;
• Support of the website, the customer portal and the mobile application;
• Sending marketing messages;
• AI assistants and automation;
• Technical support of the Service.

5. Categories of data subjects:

• Members (end users) of the User;
• Minors (where applicable, with parental consent);
• Employees/instructors of the User;
• Contact persons of the User.

6. Categories of personal data:

• Identification data: name, email, telephone number;
• Demographic data: age, date of birth;
• Membership data: status, subscription, account origin;
• Attendance and booking data;
• Payment data;
• Preferences, notes and profile settings;
• Technical data: IP address, device type, browser type;
• Location data;
• Data on the use of the Service.
• Special categories of personal data.

7. Processing operations:

• Creation and management of user profiles;
• Management of bookings and attendance;
• Processing of payments through integration with payment providers;
• Sending transactional emails and SMS;
• Storage of profile photos and media files;
• Generating reports and analytics;
• Provision of AI functionalities.

APPENDIX 2

TECHNICAL AND ORGANISATIONAL SECURITY MEASURES

The Processor applies the following technical and organisational measures to ensure the security of User Personal Data:

1. Access control

• Access control based on the principle of least privilege;
• Individual user accounts for employees with unique authentication;
• Policy for secure passwords and multi-factor authentication;
• Periodic review of access rights.

2. Encryption and protection during transmission

• Encryption of data in transit;
• Encryption of data at rest, where technically appropriate;
• Secure management of cryptographic keys.

3. Monitoring and logging

• Systems for real-time monitoring of access and activities;
• Logging of critical operations with personal data;
• Systems for detecting and preventing unauthorised access.

4. Backups and recovery

• Regular creation of data backups;
• Testing of recovery procedures;
• Storage of backups in a secure environment with restricted access.

5. Environment separation and testing controls

• Separation of development, testing and production environments (sandboxing);
• Restriction of automatic notifications (emails, SMS) in test environments by default or via an allowlist;
• Prohibition on the use of real personal data in test environments without express control.

6. Data minimisation

• Processing only of the data necessary for the specific purpose;
• A checklist for data minimisation and legal ground for the import functions;
• Periodic review of stored data and deletion of unnecessary records.

7. Incident management

• A documented procedure for responding to security incidents;
• A designated incident response team;
• Documentation, analysis and corrective actions after each incident.

8. Vendor management (Sub-processors)

• Assessment of the security measures of vendors before engaging them;
• Contractual data protection obligations with all Sub-processors;
• Periodic review of the compliance of vendors.
• Manual review of AI-based functionalities that process personal data (human-in-the-loop);
• Minimisation of the volume of personal data transmitted to AI models;
• Where applicable, use of an API mode without data retention;
• Prohibition on training AI models with User Personal Data;
• Use only of AI-based services for enterprise customers, where the provider of the respective service has no access to the data processed by the Processor.

9. Confidentiality and staff training

• Confidentiality obligations for all employees with access to personal data;
• Periodic training of employees on personal data protection;
• Acceptable use and information security policies.

10. Secure development

• Data protection by design and by default principles;
• Code review and security testing;
• Vulnerability management and timely application of patches.

APPENDIX 3

APPROVED SUB-PROCESSORS