WEBSITE ONLINE PRIVACY NOTICE (PRIVACY POLICY)

Purpose of Privacy Policy

This Privacy Policy is designed to assist you as User to understand how we collect, use, disclose or otherwise process personal information you provide to us in accordance with the relevant data privacy laws and to make informed decisions when you are using our website or any other means through which you disclose your personal data to us.

Our policy applies to personal data in our possession or under our control, including personal data in the possession of entities which we have engaged to collect, use, disclose or process personal data for our purposes.

Definition of terms

Personal data includes Sensitive Personal Information, a subset of personal data. Sensitive Personal Information means information about an individual’s race, ethnic, origin, religious or philosophical beliefs, philosophical beliefs, political affiliations, health data, disability, trade union information, genetic data or sexual life of a person, criminal records, and biometric data. 

Our policy is that we endeavor to not collect sensitive information, however, this may not always be possible. When we do collect, we will take all reasonable steps to ensure that the sensitive information is always protected and that consent is correctly obtained (if applicable).

Depending on the nature of our interaction, we may collect your name, contact information and other particulars, such as but not limited to your address, email address, or other contact information, nationality, race, gender, date of birth, marital status, photographs and other audio-visual information (such as recordings of conference calls), employment information and financial information such as credit card numbers, debit card numbers or bank account information.

What information do we collect?

We collect personal data where: (a) you provide personal data directly to us; (b) such collection is necessary for the performance of a contract, compliance with legal obligations, legitimate interests, or other lawful bases under applicable law; or (c) where otherwise permitted or required under applicable law.

We will ask for your consent before collecting any additional personal data and before using your personal data for a purpose which has not been notified to you (except when permitted or authorized by law).

You may be providing us with the following information:

How do we collect information?

We may manually or automatically collect information when you:

What do we use your personal information for?

We use your personal information on a mandatory basis:

The purposes listed above may continue to apply even in situations where your relationship with us (for example, pursuant to a contract) has been terminated or altered in any way, for a reasonable period thereafter, or until the expiration of the retention limits set by applicable laws, whichever comes later (including, where applicable, a period to enable us to enforce our rights under any contract with you).

To process your personal information under the purposes mentioned-above lawfully, we rely on one of the following lawful bases under the PDPA:

To process your sensitive personal information, we rely on one of the following lawful bases:

Will your personal information be passed on to any third parties?

We may disclose your personal data:

Will you be able to withdraw your consent earlier provided to us?

You may revoke your consent allowing us to collect, use, and disclose your personal data at any time.

To revoke your consent, please send a written request via email to our Data Protection Officer instructing us to stop using and/or disclosing your personal data for any or all of the purposes listed above.

Kindly give us sufficient time to process your request and notify you of the consequences of revoking your consent. We need at least 10 business days to process request from the date we received your request.

While we respect your decision to withdraw your consent, please note that the revocation should not prejudice pending transactions.

Please note that revoking consent does not affect our right to continue to collect, use, and disclose personal data where such collection, use and disclose without consent is permitted or required under applicable laws.

Can you access, update, correct your personal data which we hold about you?

Yes, you can update, or access, or correct personal data we recorded, subject to the requirements, conditions and exemptions under the applicable law and Data Privacy laws,

How do we protect your personal data?

To protect your personal data from unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks, we have introduced appropriate administrative, physical and technical measures including antivirus protection to secure all storage and transmission of personal data and disclosing personal data both internally and to sellers and service contractors only on a need-to-know basis. The Company will review and update its security measures from time to time to ensure an appropriate level of protection, taking into account the nature of the personal data, the purposes of processing, and the level of risk involved.

How long do we retain your personal data?

We retain your personal data for as long as it is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable laws, whichever comes later. We will delete your personal data or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected and is no longer necessary for legal or business purposes.

What else should you know about data protection?

We rely exclusively on personal data you provided. To ensure that your personal data is current, complete, and accurate, please update by sending a message by email to our Data Protection Officer in writing. We do not assume responsibility for the publication of the information due to errors during transmission or due to unauthorized access by third parties.

(1) Transfers of Personal Data. Data sharing and transfer of personal data. Data collected by Company is shared with Anytime Fitness LLC as well as its business partners and contractors (“Anytime Fitness”). In accordance with the business model, the Club collects personal and sensitive data and shares and transfers this information to Anytime Fitness and business partners, including accredited vendors, whose servers are in Malaysia, Singapore, Vietnam, Indonesia, Thailand, Taiwan, Hong Kong SAR, Macau SAR, Australia, Europe, the Philippines, and the United States, and such other territories or jurisdictions where Member accesses an Anytime Fitness center. We have taken steps and measures to ensure that your personal data is transferred to foreign country in compliance with the PDPA, with mechanisms such as adequate data protection standards, binding corporate rules, and appropriate safeguards.

In the case of franchisee information, including personal data, is collected in the country of origin and transferred to the United States, where Anytime Fitness stores data.

In the case of Members, to such other territories or jurisdictions where Member accesses an Anytime Fitness center. Anytime Fitness shares his or her personal and sensitive personal data with the Anytime Fitness center he or she accessed through reciprocity. Security videos taken by the Club’s CCTV camera may also be shared with governmental agencies and instrumentalities in accordance with law. Moreover, in case the Club is closed permanently, Member acknowledges, agrees that Anytime Fitness may transfer his or her personal data to the nearest Anytime Fitness center to allow Member to continue his or her fitness journey or to process the termination of his or her membership and facilitate refund. In such case, a survey form will be sent to Member requesting him to choose his or her preferred club and what he or she intends to do with his or her membership.

Who to contact?

You may reach out to our Data Protection Officer if you have any enquiries or feedback on our personal data protection policies and procedures, or if you wish to make any request, by email at [insert email address]

Effect of Notices and Change to Rules.

This Notice shall be read in connection with other notices, contractual clauses and consent clauses that apply in relation to the collection, use and disclosure of your personal data by Inspire Brands Asia.

You acknowledge and agree that we may revise this Notice from time to time without any prior notice. You may determine if any such revision has taken place by referring to the date on which this Notice was last updated. Your continued use of our services constitutes your acknowledgement and acceptance of such changes.

ADDITIONAL DATA PRIVACY POLICIES FOR FRANCHISEES

Member, by downloading the Anytime Fitness Mobile Application (“AF App”), acknowledges and agrees to the use, and disclosure of various personal data previously collected by Anytime Fitness LLC, Anytime Fitness Asia, and his or her home club (“Anytime Fitness”) when he or she signed up at his or her home club.

Personal data collected

Member acknowledges that AF App will collect sensitive personal information whenever he or she uses the app. These information include Member’s weight, height, activities, and other health related data. Anytime Fitness will obtain the Member’s explicit consent for such processing in accordance with the Personal Data Protection Act B.E. 2562 (2019) (as amended), and such consent will be requested separately from other terms and conditions, and may be withdrawn by you at any time.

Personal data received from third parties

Member acknowledges and agrees that Member can choose to connect our AF App with another application or service, such as but not limited to Google Fit and Apple Health, and that by connecting the AF App with the latter, the AF App may receive information from the other application or service, in accordance with their own data privacy policies. Member may also choose to grant AF App access to some, or all of the data, both personal or sensitive, from another service. Member can stop sharing the information from the other application or service to AF App by removing AF App’s access to the other service.

AF app may also partner with third parties, such as employers, third party services and organizations. AF app may also receive information about Member from such sources, in accordance with their own data privacy policies.

Personal data shared

a. Personal data. Personal data collected by Anytime Fitness include the Member’s name, residential and business addresses, contact information such as mobile numbers and email addresses and sensitive personal information such as the Member’s health and financial information.

Once Member downloads the AF App and creates an account using his or her key fob or registered email address, personal data and sensitive personal information collected by Anytime Fitness will be shared with the AF App.

b. Sensitive personal information. Should Member agree to link the AF App with Apple Health or Google Fit or similar applications, AF App will receive Member’s sensitive personal information collected by these applications.

Uses of personal data

Personal data and sensitive personal information collected by Anytime Fitness and share with AF App will be used to provide service necessary and ancillary to membership.

To process your personal information under the purposes mentioned-above lawfully, we rely on one of the following lawful bases under the PDPA:

To process your sensitive personal information, we rely on one of the following lawful bases:

Storage and security of personal data

AF App does not store personal data. It uses personal data collected by Anytime Fitness and sensitive personal information collected by Apple Health or Google Fit or similar application.

Personal data collected by Anytime Fitness is stored in the United States. Reasonable and necessary means of protecting personal data in accordance with relevant law and international standards are undertaken have been Anytime Fitness. These means include but are not limited to engaging security contractors and consultants to protect the security and integrity of the network.

Member should consult the privacy and data protection policies Apple Health or Google Fit or similar applications for the storage and security of sensitive personal information shared with the AF App.

Transfer of personal data

The AF App shares neither personal data nor sensitive personal information.

Personal data is shared by Anytime Fitness with the AF App through an API automatically providing Member’s name, contact information, birthdate, email, and gender. Similarly, Apple Health, Google Fit, and other similar applications share sensitive personal information with the AF App through an API.

Data retention

We will retain personal data only for a period of ten (10) years after the termination of your use of our services, unless a longer retention period is required or permitted by applicable law or is necessary for the establishment, exercise, or defense of legal claims.

Access and correction

Member may access or correct his or her personal data or request information on the collection and use of personal data at any time by sending a message to his or her home club or the Anytime Fitness center where he or she is a member or the data protection officer’s email address. Requests shall be acted upon within 30 days.

ADDITIONAL DATA PRIVACY POLICIES FOR FRANCHISEES

Purpose

This lays out the Company’s additional Privacy Policies in relation to its franchisees. It provides Franchisees with information on how Company collects, uses, discloses, and otherwise processes personal and sensitive data in accordance with the relevant data privacy laws.

Our policy applies to personal and sensitive data in our possession or under our control, including those shared with entities which we have engaged to collect, use, disclose or process personal data for our purposes.

Personal data

“Personal data” means data, whether true or not, whether recorded in a material form or not, from which the identity of the Franchisee is apparent or can be reasonably and directly ascertained, or when put together with other information, would directly and certainly identify Franchisee: (a) from that data; or (b) from that data and other information to which we have or are likely to have access.

Personal data includes “Sensitive Personal Information” which is a subset of personal data. Sensitive Personal Information means information about an individual’s race, ethnic origin, religious, cult, philosophical beliefs, political affiliations, health data, disability, trade union information, genetic data or sexual life of a person, criminal records, and biometric data.

Company acknowledges and agrees to collect the personal data, including sensitive personal information, Franchisee or those of its representatives in the case of corporations, only to the extent necessary for the purpose of the Franchise Agreement.

To this extent, Company collect the your name, contact information and other particulars or Franchisee or, in the case of a corporate Franchisee, it shareholders, the principal operator and other employees, their respective addresses, mobile numbers, email addresses, or other contact information, nationality, gender, date or registration or date of birth, marital status, photographs, and other audio-visual information (such as recordings of conference calls), employment information and financial information.

Collection of personal data

The following personal data including sensitive personal information will be collected from Franchisees or in the case of a franchisee, its shareholders, directors, and officers as well as their contractors or employees and guarantors while the Franchise Agreement remains in force:

Methods of collection

Prior to entering into a Franchise Agreement, Franchisee was requested to the fill up a question and provide various information which include personal data to evaluate Franchisee’s eligibility to take out an Anytime Fitness franchisee. If found to be eligible, the Franchisee’s personal data is retained and was used to prepare the Franchise Agreement.

Franchisee acknowledges and agrees to update information, including personal data, at regular interval when so requested by the Company.

Use of personal data

Company acknowledges and agrees that it must use Personal Data collected exclusively to carry out its obligations under the franchise agreement, which includes but is not limited to providing business coaching and enforcing brands standards and the terms of the Franchise Agreement.

Personal data collected may be collected in the course of training activities, business coaching sessions, conferences.

To process your personal data under the purposes mentioned-above lawfully, we rely on one of the following lawful bases under the PDPA:

To process your sensitive personal information, we rely on one of the following lawful bases:

Data sharing and transfer of personal data

Data collected by Company is shared with Anytime Fitness LLC, AFT, as well as its business partners and contractors (“Anytime Fitness”).

In the case of franchisee information, including personal data, is collected in the country of origin and transferred to the United States, where Anytime Fitness stores data.

Protection and retention of personal data

Company acknowledges and agrees to undertake all necessary measures to protect information, including personal data, including but not limited to engaging consultants and specialists.

Information including personal data, shall be retained for a minimum of two years up to the maximum period prescribed by relevant laws (such as corporate, employees, and taxation) for Company to keep records.

Access and correction

Franchisee may send a message by email to our Data Privacy Officer to access, or correct, or delete information including personal data. Company acknowledges and agrees to respond and/or act on requests within 30 days.

Consent for the Company to collect the personal data shall terminate upon the expiration or termination of the Franchise Agreement. Franchisee acknowledges and agrees to update its information on a regular basis.

ADDITIONAL DATA PRIVACY POLICIES FOR MEMBERS

Collection, use, and correction of personal data

Member acknowledges and agrees that by signing the Membership Agreement, Member consents to the collection, use, and disclosure of various personal data required by Anytime Fitness and the Club to perform its obligations under the Membership Agreement and other legitimate business purposes more particularly set out below as well as to comply with its obligations under relevant law.

Collection of personal data and sensitive personal data.

Personal data to be collected shall include the Member’s name, residential and business addresses, copy of the government-issued identification card presented, contact information such as mobile numbers, e-mail addresses and the like, financial information such as the bank account or credit card details and the like.

Sensitive personal data to be collected shall be limited to Member’s health information relevant or necessary for Member’s use of the Anytime Fitness Mobile Application and to ensure his or her safety in an unmanned fitness center

All Anytime Fitness centers are equipped with surveillance (CCTV) cameras taking security videos, thus, capturing images of Member whenever he or she accesses and uses the Club or any other Anytime Fitness center.

Club acknowledges and agrees that it may not collect personal and sensitive data other than those mentioned in this sub-paragraph.

Uses of personal data

The Club shall use personal data and sensitive personal data collected to perform its obligations under the Membership Agreement, including but not limited to ensuring 24-hour access to Member’s The Club, guaranteeing 24-hour access to other Anytime Fitness centers through reciprocity, facilitating the collection of Membership Dues as well as fines and/or penalties in case of default, and providing information relevant to the conditions of membership, data privacy, and use of the Club as well as access to other Anytime Fitness centers. Personal data collected by the Club is visible to Anytime Fitness, other Anytime Fitness centers, and designated business partners facilitating reciprocity and the performance of other obligations under the Membership Agreement. Reciprocity refers to the system developed and used by the Anytime Fitness LLC allowing Member access to all Anytime Fitness centers around the world. Subject to the consent of the Member, selected personal information may also be used to provide members with promotional materials from Club and third-party business partners.

Member acknowledges and agrees that constant surveillance is necessary the safety of the premises by ensuring that only Members and club personnel enter the Club.

Member acknowledges and agrees that the personal data collected is necessary and reasonable to ensure the safety of the Club and all other Anytime Fitness center and to prevent the abuse of the reciprocity. While reciprocity allow Member to access to all Anytime Fitness centers, Member acknowledges and agrees that the amount of Membership Dues vary across territories. Accordingly, Member should have the right to reside in the country of his or her membership and has established or intends to establish residency in the territory where the Club he or she has taken out a Membership to prevent the abuse of reciprocity.

To process your personal data under the purposes mentioned-above lawfully, we rely on one of the following lawful bases under the PDPA:

To process your sensitive personal information, we rely on one of the following lawful bases:

Storage and security of personal data

Personal data and sensitive personal data collected are stored in the Anytime Fitness Network is administered by Anytime Fitness. Reasonable and necessary means of protecting personal data in accordance with relevant law and international standards are undertaken are undertaken continually by Anytime Fitness. These include but are not limited to engaging security contractors and consultants to protect the security and integrity of the network.

Transfer of personal data

In accordance with the business model, the Club collects personal and sensitive data and shares and transfers this information to Anytime Fitness and business partners, including accredited vendors, whose servers are in Malaysia, Singapore, Vietnam, Indonesia, Thailand, Taiwan, Hongkong, Macau, Australia, Europe, the Philippines, and the United States, and such other territories or jurisdictions where Member accesses an Anytime Fitness center.

Member acknowledges and agrees that security videos taken by the Club’s CCTV camera may also be shared with governmental agencies and instrumentalities in accordance with law.

Member acknowledges and agrees that when he or she accesses an Anytime Fitness center other than the Club, Anytime Fitness shares his or her personal and sensitive personal data with the Anytime Fitness center he or she accessed through reciprocity.

Member acknowledges and agrees that sharing these personal data and sensitive personal data is reasonable and necessary to ensure his or her well-being while in the premises and to prevent an abuse of reciprocity.

Moreover, in case the Club is closed permanently, Member acknowledges, agrees that Anytime Fitness may transfer his or her personal data to the nearest Anytime Fitness center to allow Member to continue his or her fitness journey or to process the termination of his or her membership and facilitate refund. In such case, a survey form will be sent to Member requesting him to choose his or her preferred club and what he or she intends to do with his or her membership.

Access and correction

Member may access or correct his or her personal data or request information on the collection and use of personal data at any time by sending a message to the Data Protection Officer email.

‍