Terms of service

1. Definitions

• Service: the BoxTempo platform: the app of the box on a BoxTempo address, the tools for the box administrators, the app for members, and the related emails and notifications.
• Box: the training centre of the Customer in the Service.
• Staff: the owner and the administrators of the Box.
• Members: the persons who apply to the Box or are members of it.
• Member Data: the personal data of Members and Staff that the Service processes for the Box (Annex 1).
• Account: the BoxTempo account of a person. One Account works in every box of that person.

2. The Service

BoxTempo provides the Service as the website describes it on the day of the contract. BoxTempo can improve and change the Service. If a change removes a main function that the Customer uses, BoxTempo tells the Customer at least 30 days before. The Customer can then end the contract before the change, and BoxTempo refunds the fees paid for the time after the end.

Some functions can have the label early access or beta. They can change or stop at any time.

The Service does not charge Members. The Customer collects its own fees from Members.

3. Accounts and access

The owner of the Box creates the Box with an Account and can invite administrators. The Customer is responsible for the acts of its Staff in the Service. Each person signs in with a code that the Service sends to their email address. The Customer keeps the email accounts of its Staff secure, and tells BoxTempo at once about any misuse.

4. Price and payment

BoxTempo and the Customer agree in writing on the price and on any trial period for each Box before the Service starts. VAT (IVA) and any other tax that applies are added to the price.

The Customer pays by the method that BoxTempo and the Customer agree in writing. The Service has no automatic card payment yet.

BoxTempo sends electronic invoices. Late payments bear the late-payment interest of the Spanish Law 3/2004 against late payment in commercial operations.

5. Obligations of the Customer

The Customer:

• uses the Service lawfully and only for the Box;
• gives its Members the information about its own processing of their data (articles 13 and 14 GDPR), for example in the policy text of the Box;
• asks only for the data that it needs: the registration fields, the identity document and the minimum age are its decisions;
• sets a minimum age that fits the law and its activity, and gets the permission of parents or guardians where the law requires it;
• puts no health data or other special categories of data (article 9 GDPR) in names, texts or announcements;
• does not try to get access to the data of other boxes, does not test the security of the Service without written permission, and does not copy or resell the Service;
• keeps the content that it publishes (names, logo, texts, images) lawful, and has the rights to it.

6. Data protection

For Member Data, the Customer is the controller and BoxTempo is the processor. Annex 1 applies.

BoxTempo is a separate controller for the Accounts: the email address, the sign-in and security data, the account language and the profile that a person keeps in the Account. One Account serves many boxes, so BoxTempo decides about it. When a person applies to the Box, the Service shows the Box the profile values that the Box asks for, at the request of that person. The Box then uses them as its own Member Data. The privacy notice explains this to every person. BoxTempo and the Box are not joint controllers: each decides its own purposes.

BoxTempo is also the controller of the data of the contact persons of the Customer and of the billing data.

7. Intellectual property

BoxTempo keeps all rights in the Service, the software, the brand and the documentation. During the contract, the Customer has a non-exclusive and non-transferable right to use the Service for the Box.

The Customer keeps its rights in its content. It gives BoxTempo the right to store that content, to change its format and to show it, only to provide the Service. BoxTempo can use the suggestions of the Customer to improve the Service, with no obligation to the Customer.

8. Availability and support

BoxTempo makes reasonable efforts to keep the Service available and to correct errors quickly. The Service can stop for maintenance, for updates or for causes outside the control of BoxTempo. BoxTempo does not promise a minimum availability.

Support is by email at hello@boxtempo.com, in English, Spanish or Catalan, on working days in Spain.

9. Duration and end

The contract continues month by month. The Customer can end it at any time by email to hello@boxtempo.com. The end applies at the end of the current paid month.

BoxTempo can end the contract with 30 days of notice by email. BoxTempo can end or suspend it at once if the Customer seriously breaks these terms, for example if it uses the Service unlawfully.

A Box is paused only when BoxTempo and the Customer agree on the pause in writing. If a paused Box stays paused for 90 days, the contract ends at that time. BoxTempo warns the owner by email 7 days before. At the end, BoxTempo returns or deletes the Member Data as section A11 says. The Accounts of the persons stay, because they can use other boxes.

10. Liability

Each party is liable under Spanish law for the damage that it causes when it breaks these terms.

BoxTempo is not liable for indirect damage, for lost profit, or for lost data that the Customer could have avoided with its own records. The total liability of BoxTempo under this contract is limited to the fees that the Customer paid in the 12 months before the event, with a minimum of 100 €.

These limits do not apply to damage caused with intent (dolo) or with gross negligence (culpa grave), to damage to life or health, or where the law does not allow a limit.

11. Confidentiality

Each party keeps confidential the information of the other party that is not public and that it receives under the contract. It uses that information only for the contract. This duty continues for 3 years after the end of the contract. For personal data, Annex 1 applies without a time limit.

12. Changes to these terms

BoxTempo can change these terms. It tells the Customer by email at least 30 days before a change applies. If the Customer does not agree, it can end the contract before the change applies. A change that the law requires can apply sooner.

13. General provisions

• Language: these terms exist in English, Spanish and Catalan. If the texts differ, the Spanish text applies.
• Notices: by email to the address of the owner of the Box and to hello@boxtempo.com.
• Transfer: the Customer can transfer the contract only with the written agreement of BoxTempo. BoxTempo can transfer it to a company that continues the Service, and tells the Customer.
• Force majeure: no party is liable for a delay or a failure that events outside its reasonable control cause.
• Whole agreement: these terms and their annex are the whole agreement about the Service. If a clause is not valid, the other clauses stay valid.
• Online contracting: the Customer can read and store these terms before it accepts them, and can correct its data before it sends the sign-up form. BoxTempo keeps the accepted version and confirms the acceptance by email within 24 hours.

14. Law and courts

Spanish law applies. Disputes go to the courts that have jurisdiction under the law.

A1. Annex 1, data processing agreement: roles and subject

This annex is the contract under article 28(3) of Regulation (EU) 2016/679 (GDPR) and article 33 LOPDGDD between the Customer (controller) and BoxTempo (processor). It applies while BoxTempo processes Member Data, and until the return or deletion of section A11.

Subject and purpose: BoxTempo processes Member Data only to provide the Service to the Box: to store and show memberships, plans, classes, bookings, waitlists, history, notices and announcements, and to send the related emails and push notifications.

Processing operations: collection through the forms of the Service, storage, organisation, consultation, display to Staff and to the Member concerned, transmission by email and push notification, and deletion.

A2. Data and persons

• Persons: Members and applicants, the persons that the Box invites, Staff, and coaches (names only).
• Data: name and surname, email address, phone, birth date and address (when the Box asks for them), the type and number of an identity document (when the Box asks for it), membership status, plan, start and end dates, applications and their decisions, policy acceptances, bookings, cancellations and waitlist entries, notices and announcements, push subscriptions of devices, and change records with internal identifiers.
• Special categories: none. The Customer must not enter health data or other data of article 9 GDPR.

A3. Instructions

BoxTempo processes Member Data only on the documented instructions of the Customer, also for transfers of personal data to a third country. These terms, the settings of the Box and the actions of Staff in the Service are those instructions. If a law of the EU or of Spain requires other processing, BoxTempo tells the Customer first, unless that law forbids it.

BoxTempo tells the Customer at once if, in its opinion, an instruction breaks data protection law.

A4. Confidentiality

Only the persons who need access to provide the Service get access to Member Data. Each of them has a duty of confidentiality, by contract or by law. At BoxTempo, only the operator, Carlos Bertomeu Marín, has this access today.

A5. Security

BoxTempo applies the measures of article 32 GDPR that fit the risk. They include:

• the database in the EU (Ireland);
• encrypted connections (HTTPS) for every request;
• a separate data area for each box: every function checks the box and the role of the person before it reads or writes data;
• sign-in with single-use codes; codes, invitation links and similar secrets stored only as hashes;
• a check of the session on every request, and sign-out on all devices;
• limits on sign-in attempts and requests;
• identity documents shown masked to Staff, and never in emails, notices, logs or change records;
• change records with internal identifiers only;
• access to the production systems only for the persons of section A4.

BoxTempo reviews these measures and can change them, but the level of protection must not go down.

A6. Sub-processors

The Customer gives a general authorisation for the sub-processors in the sub-processor list.

BoxTempo tells the Customer at least 30 days before it adds or replaces a sub-processor, by email to the owner and on that page. In that time, the Customer can object for reasons of data protection. If the parties find no solution, the Customer can end the contract before the change, and BoxTempo refunds the fees paid for the time after the end.

BoxTempo puts data protection obligations on each sub-processor by contract, as article 28(4) GDPR requires. Where the standard contract of a provider differs from this annex, the sub-processor list says so. BoxTempo stays liable to the Customer for the acts of its sub-processors.

A7. Transfers outside the European Economic Area

BoxTempo transfers Member Data outside the European Economic Area only with a safeguard of chapter V GDPR: an adequacy decision, including the EU-US Data Privacy Framework for certified providers, or the standard contractual clauses of the European Commission. The sub-processor list gives the safeguard for each provider.

A8. Help with the rights of persons

The Service lets Staff see and correct the data of Members, and end their membership. If a person sends BoxTempo a request about Member Data, BoxTempo sends it to the Customer within 5 working days and does not answer it alone. BoxTempo helps the Customer with technical means, for example an export of the data of one person.

A9. Help with security, breaches and impact assessments

BoxTempo helps the Customer with its duties under articles 32 to 36 GDPR, with the information that BoxTempo has.

BoxTempo tells the Customer without undue delay, and if possible within 48 hours, after it learns of a personal data breach that affects Member Data. The notice gives the information of article 33(3) GDPR that BoxTempo has at that time, and the rest as soon as possible. BoxTempo takes the necessary steps to limit the breach.

A10. Information and audits

BoxTempo gives the Customer the information that is necessary to show that it meets this annex, for example answers to a written security questionnaire, once a year or after a personal data breach.

The Customer, or an auditor with a duty of confidentiality, can make an audit with 30 days of notice, during working hours, and without harm to the Service or to other customers. The Customer pays its own costs. More than one audit in a year is possible only after a personal data breach or at the request of a data protection authority.

A11. End: return and deletion

When the contract ends, BoxTempo returns or deletes the Member Data, at the choice of the Customer, within 60 days. If the Customer does not choose, BoxTempo deletes the data. For a Box that stays paused after a pause agreed in writing (section 9), the contract ends and BoxTempo deletes the Member Data 90 days after the pause; during the pause, the Customer can ask for a copy by email. A copy is in a common machine-readable format (for example CSV). BoxTempo keeps only the data that a law requires it to keep. It deletes the backup copies when they expire, at most 90 days after the deletion.

The Accounts and their profiles stay with the persons (section 6), because they serve other boxes too.

A12. Records and liability

BoxTempo keeps a record of the processing that it carries out for the Customer (article 30(2) GDPR). Liability under this annex follows section 10 of these terms and article 82 GDPR. This does not limit the rights of data subjects against either party (article 82 GDPR).