Last updated November 5, 2026.
This agreement is between the coach or coaching business using Stack (“you”) and Dad with Style OÜ, Sepapaja tn 6, Tallinn 15551, Estonia (registry code 14696867) (“we”). It forms part of the coach terms and takes effect when you accept them. Terms such as “controller”, “processor” and “personal data” have their meaning in the EU General Data Protection Regulation (GDPR).
You are the controller of your clients’ coaching records, and we are your processor. We are a separate controller of your account and billing data and of the sign-in, security, analytics and error data our privacy policy describes; this agreement doesn’t cover those. Annex 1 describes the processing.
We process your clients’ records only on your documented instructions, unless the law requires otherwise, in which case we tell you first unless the law forbids it. The coach terms, this agreement and your use of Stack’s features are your instructions. You also instruct us to act on a client’s own Delete my account, and on a client’s request to carry on as a subscriber. Your notes are not carried over; we delete them. We tell you if we believe an instruction breaks data protection law. You confirm that your instructions are lawful and that you have the notices and consents they need.
Everyone we authorize to process your clients’ records is bound by a duty of confidentiality.
We keep the technical and organizational measures in Annex 2. We may improve them, but we won’t reduce the overall protection.
You authorize us to use the sub-processors in our list of service providers. We bind each to data protection duties equivalent to these, and remain responsible for their work. We give you 30 days’ notice by email of a new one. You can object on reasonable data protection grounds within that time; if we can’t resolve it, you can end the affected service and get back the unused part of your fee.
We transfer personal data outside the European Economic Area only under an adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or the European Commission’s standard contractual clauses. We send you a copy of the safeguards on request.
Stack lets you find and correct a client’s records, and we export or delete them for you on request. If a client sends a request about those records to us, we pass it to you without answering it ourselves. Where you need more, we give reasonable help with clients’ requests, impact assessments and regulators, taking into account the nature of the processing.
We tell you without undue delay, and where possible within 48 hours, after we become aware of a breach affecting your clients’ records. We say what we know: what happened, whose data and what kind, the likely effects and what we’re doing, and we send more as we learn it.
We keep the records of processing Article 30 requires, and give you the information you need to show compliance. You, or an auditor you appoint who is bound to confidentiality, may audit our compliance once in any 12 months, or after a breach or a regulator’s request, on 30 days’ notice, under confidentiality and without disturbing the service. You bear your own costs, and we can charge reasonable costs for our time.
For 30 days after your account ends we export your clients’ records for you on request. We then delete them from the service, and backup copies are gone within 14 days, unless the law requires us to keep them. A client’s own Stack account is theirs: if they choose to keep using Stack as a subscriber, we become the controller of what they keep.
The limits of responsibility in the coach terms apply to this agreement, as far as the law allows, and don’t limit what either of us owes a data subject or a regulator directly. Where this agreement and the coach terms conflict about personal data, this agreement applies. Estonian law applies.