PERSONAL DATA PROTECTION POLICY

X Fitness Center Proposed effective date: 14 September 2026 Last updated: 14 September 2026

I. RESPONSIBLE ENTITY AND SCOPE

1.1. Công ty TNHH XYZ Việt Nam (“we”, “us” or “our”) operates X Fitness Center, determines the purposes and means of processing within the services it provides and performs the corresponding obligations under Vietnamese law.

Tax identification number: 0123456789. Legal representative: Nguyễn Văn X. Sample address: No. 123, XYZ Street, XYZ Ward, Ho Chi Minh City, Vietnam. Personal data contact: Customer Care and Data Protection Team, email xyz@gmai.com, hotline 0123456789. Illustrative website: https://xfitness.example.

1.2. This policy covers data about applicants, members, people contacting support, and website or chatbot users. Personal data means information that identifies or helps identify an individual under applicable law. Processing includes collection, storage, use, sharing, correction, deletion and related activities.

II. DATA CATEGORIES, PURPOSES AND SOURCES

2.1. Data category: Name, age eligibility information, phone number and email Specific purpose: Registration, contact, membership management and support Source: You or your lawful representative

2.2. Data category: Membership number, package, bookings and usage history Specific purpose: Deliver benefits, manage schedules and reconcile service use Source: Your activity and management systems

2.3. Data category: Transaction reference, amount, payment status and necessary invoice details Specific purpose: Payments, refunds, accounting and tax obligations Source: You and the relevant payment provider

2.4. Data category: Exercise goals, class preferences, progress measurements or movement limitations you voluntarily provide Specific purpose: Arrange classes or PT sessions, track progress and support exercise safety within your registered service Source: You, through appropriate features or forms after notice of the purpose and consent where legally required

2.5. Data category: Messages, chatbot content and supported attachments Specific purpose: Respond to requests, provide support and handle reports Source: You

2.6. Data category: IP address, browser, access times, errors and security logs Specific purpose: Operations, troubleshooting and abuse prevention Source: Systems, to the extent necessary

2.7. Data category: Consent, withdrawal and communication preferences Specific purpose: Respect choices and document the handling of requests Source: You and preference records

2.8. The website does not provide a feature for receiving or managing medical records. We do not collect identity documents, biometric data, precise location or wearable data by default. If a new membership feature requires additional data, we must assess the need, give specific notice and satisfy legal requirements before introducing it. We do not automatically collect data from social media accounts or external sources merely because it is publicly accessible.

III. PROCESSING GROUNDS AND CONSENT

3.1. We process data for specific disclosed purposes based on valid consent or a circumstance in which the law permits processing without consent. If relying on an exception, we identify and record the appropriate grounds. General business needs are not treated as an unrestricted right to process data.

3.2. Consent requests clearly distinguish purposes and provide necessary information about the data, processing, relevant parties and your rights. Optional choices are not preselected. Silence, simply browsing the website or accepting the Terms of Use does not automatically constitute consent to marketing, publication of member photographs, sensitive data processing or an additional purpose.

3.3. You may accept or refuse optional purposes separately. Receiving advertising is not a condition of using a fitness package. If you refuse or withdraw data genuinely necessary to fulfill your request, we explain the affected part of the service and appropriate alternatives, if available.

IV. EXERCISE INFORMATION, IMAGES AND ONLINE SUPPORT

4.1. Goals, progress measurements and movement limitations are used only to provide the relevant exercise services. Some of this information may reveal a health condition and require protection as sensitive data under applicable law. Calling it exercise information does not reduce that protection. Only assigned trainers or staff who need the information for their duties may access it, within the disclosed and authorized scope.

4.2. We do not use sensitive information provided for exercise safety for advertising, or use conversations, private images or personal exercise records to train AI models. If we later propose a new purpose requiring consent, we give separate notice and obtain consent in advance. Refusal does not remove your rights to existing services that do not depend on that purpose.

4.3. Progress photos, class participation photos or testimonials are not published for promotional purposes without separate permission specifying the content and scope of use. You must not provide another person's images or personal information without the necessary rights or lawful permission.

4.4. The chatbot supports enquiries about clubs, packages, class schedules and registration. AI providers may receive only the content necessary to process a request within the disclosed scope. Private training records are not automatically sent to the chatbot. The provider, processing locations and retention conditions must be identified and disclosed before real data is sent. Provider settings and agreements must meet the policy against training with user data described above.

V. MARKETING AND COOKIES

5.1. Transaction notices, schedule changes and safety messages are distinguished from advertising. Marketing is sent only according to your valid choices and applicable requirements. You may unsubscribe using the instructions in a message or by contacting support. We retain the minimum information necessary to honor an opt-out.

5.2. Cookies and similar technologies are explained in the Website Privacy and Security Policy (privacy-policy.txt). Optional analytics tools operate only after consent; the demo model does not use advertising cookies.

VI. RECIPIENTS AND DATA TRANSFERS

6.1. Data is provided only to the extent necessary to:

(i) Authorized staff managing memberships, exercise guidance, payments or support requests. (ii) Hosting, management software, messaging, AI or payment providers, according to the functions actually used and the information disclosed. (iii) Professional advisers where needed to address a specific matter, subject to appropriate confidentiality duties. (iv) Competent authorities under lawful requests, or recipients validly designated by you.

6.2. Recipients are not permitted to use data beyond authorized purposes. Engaging a provider does not remove our obligations. We do not sell or rent personal data or share membership lists or exercise information for a partner's own marketing without the necessary legal grounds and consent.

6.3. Providers and processing countries have not been determined for this demo. Before deployment, we disclose the relevant entities, transferred data, purposes and processing locations or countries as required by law. For cross-border transfers, we fulfill applicable assessment, documentation, protection, notification or consent requirements before proceeding. Mentioning the possibility of overseas providers does not create consent for every country or recipient.

VII. RETENTION AND DELETION

7.1. The following is the proposed operating retention schedule for this demo:

7.2. Data category: Enquiries that do not result in an agreement Normal retention period: Up to 12 months after the last contact

7.3. Data category: Conversations with the service support chatbot Normal retention period: Up to 30 days after creation, except content incorporated into a support case at your request

7.4. Data category: Technical and security logs Normal retention period: Up to 90 days, except events requiring an ongoing investigation or lawful preservation

7.5. Data category: Account records, goals, progress and lawfully provided exercise safety information Normal retention period: While needed for the feature; deleted when the purpose ends or upon a valid request, subject to the exceptions below

7.6. Data category: Agreements, invoices, transactions or disputes Normal retention period: For the applicable legal retention period or as reasonably necessary on documented grounds to address obligations or disputes

7.7. Data category: Consent evidence and rights requests Normal retention period: As needed to demonstrate compliance, handle requests or resolve disputes on documented grounds

7.8. We act on a valid deletion request within 30 calendar days after verification, or sooner if required by law. If some data must be retained, we explain the grounds, scope and expected duration and restrict its use.

7.9. Data removed from active systems may remain in protected backups until rotation, for up to 90 days, unless earlier deletion is legally required. Backups must not be used to exploit deleted data in ordinary operations. Deletion instructions are reapplied following a system restoration. Data whose purpose has ended is deleted, destroyed or appropriately de-identified, rather than retained indefinitely merely because an account once existed.

VIII. SAFEGUARDS AND RISKS

8.1. We apply appropriate organizational and technical measures, including access controls, secure connections, credential management, backups, necessary access logging and training for people who handle data. Specific measures must be implemented and verified before official operation.

8.2. Risks may include unauthorized access, data loss, accidental disclosure or unintended alteration, potentially affecting privacy or causing other harm. We are responsible for prevention, response, remediation and notifications under applicable law. This policy does not require you to waive complaint or compensation rights following an incident.

IX. YOUR RIGHTS AND HOW TO EXERCISE THEM

9.1. Subject to applicable legal conditions and scope, you have rights to be informed; give or withdraw consent; view, correct or request provision of data; request deletion or restriction; object to processing; complain, bring legal proceedings, seek compensation and exercise other lawful rights.

9.2. Email xyz@gmai.com with the subject “Personal data request”, or call 0123456789. Include a contact channel, enough information to locate your records and your request. We require only proportionate verification and do not routinely require identity document copies for every request.

9.3. We acknowledge requests within 02 business days and handle each type within its applicable legal deadline. If we need additional information, rely on an exception or decline a request, we explain the reason, next steps and how to raise a concern. Verification and internal response targets do not extend mandatory legal deadlines. We do not charge to receive a request.

9.4. Withdrawal does not affect the lawfulness of processing lawfully carried out before withdrawal. We stop processing based on that consent within the applicable period. We continue only processing supported by independent legal grounds and explain this where appropriate. Closing an account does not automatically delete records we must retain.

X. DATA ABOUT PEOPLE UNDER 18

10.1. Registration, package purchases and chatbot features in this model are intended for people aged 18 or over. We do not knowingly accept records of people under 18 through these features. If we discover inappropriate submissions, we restrict processing, verify where needed, and delete or otherwise handle the data under applicable law to protect the people concerned. Introducing services for minors would require a separate, appropriate policy and procedure.

XI. UPDATES AND LANGUAGE

11.1. We give at least 15 calendar days' notice of material changes, except for legal requirements or urgent safety needs, and obtain renewed consent where necessary. This policy applies while we continue processing data within its scope. The Vietnamese version prevails over the English version if they differ, to the extent permitted by law and without reducing your mandatory rights.

11.2. Support hours: 08:00–18:00, Monday to Friday, excluding public holidays, Vietnam time. Complaints are handled under the Complaint Handling Policy (complaint-handling-policy.txt).