The data processing obligations of Veast coaches when handling member personal data through the Platform. Governs how member data may be processed, shared, and deleted.
| Term | Definition |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person, as defined under applicable data protection law including GDPR and PIPEDA. |
| Member Data | Personal Data of Platform members to whom you provide coaching services, made accessible to you through the Veast Platform. |
| Processing | Any operation performed on Personal Data, including collection, use, disclosure, storage, and deletion. |
| GDPR | EU General Data Protection Regulation 2016/679. |
| PIPEDA | Canada's Personal Information Protection and Electronic Documents Act. |
| Sub-processor | A third party engaged by the Coach to process Member Data on the Coach's behalf. |
| Breach | Any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data. |
This DPA applies to all processing of Member Data by the Coach through the Veast Platform, including:
The Coach may process Member Data only for the following purposes:
The Coach must not process Member Data for any other purpose, including marketing to members outside the Platform, building independent client databases, or sharing with third parties for any reason other than as permitted under Section 5.
Process Member Data only in accordance with Veast's documented instructions, applicable data protection law, and this DPA. If the Coach believes an instruction infringes applicable law, the Coach must promptly notify Veast in writing.
Ensure that all persons authorized to process Member Data are bound by confidentiality obligations at least as protective as those in this DPA, and that access is limited to those who need it to fulfill coaching duties.
Implement appropriate technical and organizational measures to protect Member Data, including:
Not disclose Member Data to any third party (including family members, colleagues, or business partners) without prior written consent from the member and notification to Veast.
Process Member Data only within the scope of the Coach's declared specialty planes. For member needs outside that scope, use the in-Platform referral suggestion tool rather than processing or advising on those areas.
Cooperate promptly with Veast to facilitate member rights requests (access, portability, erasure, rectification) within 48 hours of receiving notice from Veast.
Veast agrees to:
The Coach must not engage any Sub-processor to process Member Data without prior written consent from Veast.
Video conferencing platforms used exclusively for 1:1 Premium sessions are pre-approved, where: the Coach has disclosed their chosen tool to Veast and the member prior to the first session, and the tool is used only for real-time session delivery (no persistent Member Data storage).
Where a Sub-processor is approved, the Coach must ensure the Sub-processor is bound by data protection obligations equivalent to those in this DPA, and remains fully liable to Veast for the Sub-processor's compliance.
When a member exercises their rights under GDPR (access, portability, erasure, rectification, restriction, objection) or CCPA/PIPEDA:
In the event that the Coach becomes aware of a confirmed or suspected Breach involving Member Data, the Coach must notify Veast at veganbeast@veast.life within 24 hours of becoming aware. The notification must include:
Upon receiving notice of a Breach, Veast will investigate and contain the Breach, notify affected members and relevant supervisory authorities within 72 hours where required under GDPR Article 33 and applicable Canadian law, and coordinate with the Coach on remediation.
The Coach must not independently notify members or regulatory authorities about a Breach involving the Veast Platform without Veast's prior written consent, unless required to do so by law.
Veast reserves the right, upon reasonable written notice (minimum 10 business days), to:
The Coach will reasonably cooperate with any such audit and provide access to relevant information.
Upon termination of the Coach Agreement or this DPA for any reason:
Each party is liable for compliance with its own obligations under this DPA. If the Coach's breach of this DPA results in a GDPR fine, PIPEDA penalty, or civil claim against Veast, the Coach agrees to indemnify Veast for the damages, fines, and reasonable legal costs arising from that breach.
This DPA is governed by the laws of the Province of British Columbia, Canada. Disputes arising under this DPA shall be subject to the exclusive jurisdiction of the courts of British Columbia.
Veast may update this DPA in response to changes in applicable law or Platform operations. Material changes will be communicated to Coaches at least 14 days before the effective date. Continued use of the Platform as a Coach after the effective date constitutes acceptance of the revised DPA.
Veast X LTD — Data Protection Contact
Email: veganbeast@veast.life
Subject line: "DPA Inquiry"