GreetRep

Data Processing Addendum

Last updated 18 October 2026.

This addendum is the Article 28 agreement between the gym (the controller) and GreetRep, a sole trader based in Dublin, Ireland (the processor). It covers personal data about the gym's website visitors, enquirers, and people who message the gym's social accounts. It does not cover the gym owner's own account. GreetRep is the controller for that account, as described in the Privacy Policy.

Going live in setup records the time you tick "I agree". That tick is how you enter this addendum. Contact hello@greetrep.com.

What this covers

• Subject. Answering enquiries and passing an agreed lead to the gym or to a tool the gym connected.
• Duration. While the gym uses GreetRep, and until the data is deleted as set out below.
• People. Website visitors, people who enquire, and, if the gym connects them, people who message the gym on Facebook, Instagram, or WhatsApp. The service is not directed at under-16s. A parent may enquire about a children's class.
• Data. Chat messages; name, email, phone, and class interest after the person agrees in the chat; the time they agreed; and, when Meta is connected, Page, Instagram, and WhatsApp ids and the message text.

Instructions

GreetRep processes this data only on the gym's written instructions. Saving gym details, connecting a tool, and going live are those instructions. We will tell you if an instruction would break EU or Irish data-protection law.

The people who can see the data are limited to what is needed to run the service. They are bound to keep it confidential.

Security

We use HTTPS on the live site, salted hashes for sessions and login codes, and encryption for booking and Meta tokens. We will tell the gym without undue delay after becoming aware of a personal-data breach that affects its visitors.

Sub-processors

The gym authorises these sub-processors:

• Cloudflare, including Workers, Workers AI, and D1, for hosting, storage, and drafting replies.
• Resend, for email from hello@greetrep.com.
• When the gym enables them: Meta, PushPress, Zapier, and the booking platform whose address the gym saved.

We will tell the gym before adding a different sub-processor for this data, by email to the owner or by a notice in the product. The gym may object on reasonable data-protection grounds. If we cannot offer another option, the gym may stop using GreetRep.

Where a sub-processor is outside the EEA or the UK, the transfer uses standard contractual clauses and the EU-US Data Privacy Framework, or the UK addendum, where that provider offers them.

Rights requests and the end of the service

We will help the gym answer access, correction, deletion, and the other requests in Articles 15 to 22, taking into account how the product works. Owners can export JSON from Settings. Visitors can use the deletion page.

When the gym cancels, the data is hard-deleted 30 days later. When the owner uses Delete my account, it is deleted immediately. Disconnecting Meta deletes the tokens and the messages stored for that connection. We do not delete copies that the gym's own booking tool already accepted.

The gym may ask for information needed to show this addendum is being followed. We will answer by email within 30 days. An on-site audit is not part of the free pilot. We will not unreasonably refuse a reasonable written request.

Law

Irish law applies. If this addendum conflicts with the Terms of Service about visitor data, this addendum wins.

Home · Privacy · Terms · Data processing · Delete data · Gym login