Last updated 19 July 2026
Champ Fitness Ltd operates Repset, a gym management platform. Where we act as a data processor for the gyms using the platform (each the data controller for its own members), we engage the subprocessors below under written agreements. Transfers outside the EEA rely on the European Commission’s Standard Contractual Clauses or, where applicable, the EU-US Data Privacy Framework.
| Subprocessor | Purpose / data | Region | Safeguard |
|---|---|---|---|
| Supabase | Database, authentication, file storage — the system of record | EU (Ireland) | DPA + SCCs |
| Vercel | Application hosting and runtime logs | EU / US edge | DPA + SCCs |
| Glofox | Gym membership and booking platform (member records, bookings, attendance, billing sync) | EU | DPA |
| Meta Platforms | WhatsApp Cloud API and Instagram messaging; hashed identifiers for ad conversions | US | DPA + SCCs |
| Postmark (ActiveCampaign) | Transactional and marketing email delivery | US | DPA + SCCs |
| Twilio | SMS delivery | US | DPA + SCCs |
| Zoom Video Communications | Cloud telephony. Member and lead names and phone numbers are held in a shared external-contacts directory so inbound calls to the studio are identified by name | EU / US | DPA + SCCs |
| Stripe | Payment processing (event tickets; platform billing) | EU / US | DPA + SCCs |
| Revolut Business | Payment processing (deposits) | EU | DPA |
| Xero | Accounting (invoices and bills) | EU / global | DPA |
| Anthropic | AI assistant and document extraction — content processed transiently, not used for model training | US | DPA + SCCs |
| Upstash | Message-queue infrastructure (webhook and job payloads in transit) | EU / US | DPA + SCCs |
| Apple / Expo | Push notification delivery to staff and member devices | US | DPA + SCCs |
| Ubiquiti (UniFi) | Studio door access (door-unlock events) | EU / US | DPA |
Engaged only for gyms using the member-app module; gyms on standard plans have no data processed by these vendors.
| Subprocessor | Purpose / data | Region | Safeguard |
|---|---|---|---|
| InBody (Lookin’Body) | Body-composition scan results (member app module only) | EU / KR | DPA |
| Strava | Fitness-activity import where a member connects their own account (member app module only) | US | API terms + DPA |
We give the gyms we process for at least 30 days’ notice before a new subprocessor handles their members’ personal data, per the subprocessor-authorisation terms of our data processing agreement. Questions: privacy@un1tdublin.com.