Data Processing Agreement

Version 1.0 · 31 October 2026. This Data Processing Agreement (“DPA”) forms part of the Kula Fitness Terms of Service and the Kula Ops + Intelligence Terms of Service (each, “the Terms”), and applies to every business that uses a Kula service under them. Where this DPA and the Terms differ on the handling of personal information, this DPA prevails.

1. Parties and purpose

This DPA is between the business that holds a Kula account (the “Customer”) and Kula Holdings Pty Ltd (ABN 53 676 723 452) of Sydney, New South Wales, Australia (“Kula”). It sets out how Kula handles personal information that it processes on the Customer’s behalf when providing Kula Fitness, the Kula Tribe app, Kula Ops and Kula Intelligence (the “Services”). It is written for the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs); §9 says how it applies where other laws reach the Customer.

2. Definitions

• Personal information has the meaning in the Privacy Act, and includes “personal data” under laws that use that term. Sensitive information includes health information.
• Customer Data means the personal information Kula processes on the Customer’s behalf: the Customer’s members, staff and teachers, and the records the Customer’s team creates in the Services, as described in the applicable Privacy Policy.
• Account Information means the information about the Customer’s own users and invited staff that Kula holds as controller under the applicable Privacy Policy. It is outside this DPA.
• Privacy Policy means the Kula Fitness Privacy Policy or the Kula Ops + Intelligence Privacy Policy, whichever applies to the Service in question.
• Sub-processor means a third party Kula engages to process Customer Data on its behalf.
• Controller and processor describe the roles in §3, whatever term the applicable law uses.

3. Roles

For Customer Data, the Customer is the controller and Kula is the processor. The Customer decides why and how Customer Data is processed; Kula processes it only to provide the Services, on the Customer’s documented instructions, which are the Terms, this DPA, the configuration the Customer sets in the Services, and any further written instruction the Customer gives that is consistent with them. Kula will tell the Customer if it believes an instruction breaches the law.

For Account Information, Kula is the controller and the applicable Privacy Policy governs.

4. Details of the processing

	Kula Fitness and Kula Tribe	Kula Ops and Kula Intelligence
Subject matter	Running a fitness studio’s operations with its teachers	Running a business’s day-to-day operations with its team, and answering questions from its own data
Duration	While the Customer holds an account, then the deletion period in §8	The same
Nature and purpose	Reading the Customer’s booking and payments data, analytics and retention insight, cover and personal-training coordination, pay-run calculation, in-class cues, messages, compliance tracking	Connecting the Customer’s systems, building a model of the business, briefs, situations, work, messages, time entry corrections through Apps, answers from the Customer’s data, learning per business
Categories of personal information	Member identity, contact, membership, bookings, attendance, payments metadata (last four digits at most), health-related notes; teacher identity, contact, schedule, covers, notes, compliance documents, pay rules and calculated pay, and, when switched on, bank and tax details	Member identity, contact, membership, bookings, attendance, payments metadata, accounting contacts; staff identity, contact, role, roster and timesheets (no pay rates), job profile, captures, decisions, messages, photos, voice-note and meeting transcripts, conversations with Kula
Data subjects	The Customer’s members, teachers, coaches and staff	The Customer’s members, staff, teachers and contacts
Special categories	Health information in member notes and flags	Health information in member notes, where present in connected systems

The Privacy Policies give the current detail of what each connection reads and what each product records.

5. Kula’s obligations

Instructions. Kula processes Customer Data only as §3 permits, and not for its own purposes, except that Kula may use de-identified, aggregated information derived from the Services to improve them, as the Privacy Policies describe. Information so de-identified is no longer Customer Data.

Confidentiality. Kula limits access to Customer Data to personnel who need it to provide, support or secure the Services, and who are bound by confidentiality obligations. Nobody at Kula reads a Customer’s records to answer a Customer’s questions; the Services’ tools do, under the Customer’s credentials.

Security. Kula implements and maintains technical and organisational measures appropriate to the risk, including per-customer isolation of data, encryption in transit and at rest, encryption of provider credentials with keys held separately from the data, role-scoped access, audit records of privileged actions, and revocable access. The current measures are described in Security & data handling and the Privacy Policies. Kula may update them, but not so as to reduce the overall level of protection.

Sub-processors. The Customer authorises Kula to engage the Sub-processors listed in the applicable Privacy Policy. Kula binds each Sub-processor by written terms that impose data-protection obligations no less protective than this DPA, and remains responsible for their performance. Kula will give the Customer notice of a new or replaced Sub-processor that processes Customer Data at least 30 days before it starts, by updating the Privacy Policy and notifying account holders. If the Customer has a reasonable, data-protection-based objection, it may tell Kula within that period; if Kula cannot resolve the objection, the Customer may terminate the affected Service without penalty.

AI model providers. Where Kula sends Customer Data to an AI model provider as its Sub-processor, it does so under terms that do not permit the provider to train models on that data. Where the Customer connects its own AI client to Kula Intelligence, that provider is the Customer’s own recipient, not Kula’s Sub-processor.

Assistance. Taking into account the nature of the processing, Kula will assist the Customer, by appropriate measures and without undue delay, in responding to a request by an individual to access, correct, delete or otherwise exercise rights over their personal information, and in meeting the Customer’s security, breach-notification and privacy-impact obligations. Kula will refer any such request it receives directly to the Customer.

Data breaches. Kula will notify the Customer without undue delay after becoming aware of a data breach affecting Customer Data, give it the information reasonably needed to assess and notify under the Notifiable Data Breaches scheme, and assist with containment and remediation. Kula’s notice is not an admission of fault.

Deletion and return. Within 30 days after the Customer’s account closes, Kula will delete Customer Data, or, where the Customer asks before closure, make it available for export or transfer its database to it, except for records Kula must keep to meet a legal, tax or accounting obligation and minimal audit records, which Kula continues to protect under this DPA.

Records and audit. Kula keeps a record of its processing activities for the Customer and will make available, on request and no more than once a year unless a breach or a regulator requires otherwise, the information reasonably necessary to demonstrate compliance with this DPA, including any independent security assessment Kula holds. Where that is not sufficient and the law requires it, the Customer may conduct, or have an independent auditor bound by confidentiality conduct, an audit of Kula’s relevant facilities and records, on 30 days’ written notice, during business hours, no more than once a year, at the Customer’s cost, and without access to other customers’ data.

6. The Customer’s obligations

The Customer is responsible for:

• having a lawful basis, and the consents and notices the Privacy Act and the Spam Act require, for the Customer Data it connects or creates and for the instructions it gives, including consent for sensitive information;
• giving its staff the notice its workplace laws require before their use of the Services is recorded (a notice template is provided) and obtaining any consent the law requires before a conversation is recorded;
• the accuracy of Customer Data it supplies, and the configuration, permission levels and approvals it sets in the Services;
• responding to individuals who exercise rights over Customer Data; and
• using the Services only as the Terms permit.

7. Cross-border handling

Customer Data in a Customer’s own database is stored in the region the Customer is provisioned in; Australian Customers’ databases are in Australia. Some Sub-processors process Customer Data in the United States and other countries, as each Privacy Policy sets out. For each overseas disclosure, Kula takes reasonable steps to ensure the recipient handles the information consistently with the APPs, including by contractual data-processing terms, so that APP 8.1 is met. Kula will tell the Customer, through the Privacy Policy, where its Sub-processors are located.

8. Liability and term

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except for liability that cannot be limited at law. This DPA applies for as long as Kula processes Customer Data for the Customer, including the deletion period in §5.

9. Other laws

Where the Customer is established in, or offers services to individuals in, a jurisdiction whose law requires specific processor terms (for example the EU or UK General Data Protection Regulation, Article 28), this DPA is to be read as those terms, Kula’s obligations in §5 apply as the processor’s obligations under that law, and the parties will, on request, enter into the standard contractual clauses or equivalent transfer mechanism that law requires, which then prevail over §7 for that Customer.

10. General

This DPA is governed by the laws of New South Wales, Australia, and the parties submit to the non-exclusive jurisdiction of its courts. Kula may update this DPA to reflect changes in law or the Services; where a change is material, Kula will give the Customer reasonable notice. Notices under this DPA go to legal@kula.digital and to the Customer’s account email. Questions about data handling go to privacy@kula.digital (attn: Privacy Officer).

Kula Holdings Pty Ltd, ABN 53 676 723 452, Sydney, New South Wales, Australia.

Version 1.0 · 31 October 2026.