WEBSITE PRIVACY AND SECURITY POLICY

X Fitness Center Proposed effective date: 14 September 2026 Last updated: 14 September 2026

I. SCOPE AND RESPONSIBLE ENTITY

1.1. This policy explains how Công ty TNHH XYZ Việt Nam, the operator of X Fitness Center, protects your privacy when you visit the illustrative website https://xfitness.example to explore clubs, register for a package, book a class or PT session, manage an account or contact support, including chatbot support.

1.2. Tax identification number: 0123456789. Legal representative: Nguyễn Văn X. Sample address: No. 123, XYZ Street, XYZ Ward, Ho Chi Minh City, Vietnam. Security and privacy contact: xyz@gmai.com, hotline 0123456789.

1.3. The Personal Data Protection Policy (personal-data-protection-policy.txt) details processing purposes, recipients, retention periods and your rights across service channels. That policy takes precedence on data processing matters if the documents differ. Merely visiting the website or reading this policy does not constitute consent to all collection, marketing or data sharing activities.

II. INFORMATION COLLECTED ON THE WEBSITE

(i) Information you provide: your name, contact details, package registration, support requests and content submitted through supported features. (ii) Necessary technical information: IP address, browser type, access times, errors and security events used to operate the website and detect abuse. (iii) Optional information: language preferences, experience analytics and subscriptions to communications, subject to the relevant choices and notices. (iv) Optional exercise information: goals, class preferences or information needed to arrange PT guidance that you voluntarily provide. If a form requires sensitive information to support exercise safety, we give separate notice and obtain consent where legally required. That information is not a condition of browsing the website or enquiring about a package.

2.1. Forms distinguish required and optional fields. Visiting the website does not give us access to all data on your device. We do not automatically activate your camera, microphone or precise location.

III. COOKIES AND SIMILAR TECHNOLOGIES

3.1. Cookies are small files stored in your browser. Local storage may hold preferences or session data. These technologies are used for the purposes disclosed for each category:

3.2. Category: Necessary Purpose: Maintain sessions, protect forms and record privacy choices Your choice: Used only as necessary; blocking may prevent the relevant feature from working

3.3. Category: Interface preferences Purpose: Remember language or display choices between visits Your choice: You may allow or refuse persistent storage

3.4. Category: Analytics Purpose: Measure use to improve the website Your choice: Off by default; enabled only after consent Provider: Google Analytics 4 (Google). When enabled, page URLs, page titles, and browser/device usage information may be sent to Google for measurement. The tool does not load before analytics consent. You can withdraw your choice using Cookie Preferences in the footer; further page views stop after withdrawal. The retention period is controlled in the Google Analytics property and must be disclosed here before production activation.

3.5. Category: Advertising Purpose: Measure or personalize advertising Your choice: Not used in the demo model

3.6. You may change or withdraw your choices using Cookie Preferences in the footer, or request assistance by email. You may also delete or block cookies in your browser. Refusing optional cookies does not prevent you from reading public content or using functions that do not depend on those cookies.

3.7. Before enabling another third-party embedded tool, we disclose its provider, data categories, purpose and retention period. Content involving optional tracking loads only after your appropriate choice. The actual Google Analytics retention setting and cookie inventory must be recorded before production activation.

IV. CHATBOT, FORMS AND EXTERNAL LINKS

4.1. We use submitted content to answer questions about clubs, packages, class schedules, registration and related support requests. Do not send passwords, OTPs, card details or unrelated sensitive data through support forms or the chatbot. We do not use conversations or personal exercise records to train AI. Sensitive information provided for exercise safety is not used for advertising.

4.2. If a question is processed by an AI provider, the recipient, processing locations and retention conditions must be disclosed before that feature operates with real data. An external AI service must not be assumed to be confidential or to retain no data merely because it is integrated into our website.

4.3. When you choose to open a link to an independent website, review its policy. For providers processing data on the Company's behalf, we retain our responsibilities for provider selection, oversight and data protection within our scope.

V. SECURITY MEASURES AND INCIDENTS

5.1. We apply measures appropriate to the data and risks, including access limited by job responsibilities, credential protection, secure data transmission, system updates and backup management. These commitments must be implemented and verified before official operation; they are not a claim of any specific security certification.

5.2. No system is completely secure. If we detect an incident, we investigate, contain its impact, take corrective action and notify competent authorities and affected individuals as required and within legal deadlines. Describing risks does not release the Company from responsibility.

5.3. Report suspected impersonation, unauthorized access or data exposure to xyz@gmai.com or 0123456789. Provide only what is needed to describe the incident. Do not send passwords or sensitive data through an insecure channel.

VI. YOUR RIGHTS AND REQUESTS

6.1. You may request access, correction, provision, deletion or restriction of processing, withdraw consent, object to processing and exercise other rights under applicable law. Procedures, deadlines and lawful limits are explained in the Personal Data Protection Policy (personal-data-protection-policy.txt).

6.2. Declining marketing does not remove your right to use a fitness package. Refusing necessary data affects only a feature that actually needs it. We explain the specific consequences before acting on your request.

VII. UPDATES AND LANGUAGE

7.1. We give at least 15 calendar days' notice of material changes, except where legal requirements or urgent safety needs require earlier action. A new processing purpose requiring consent is introduced only after valid consent is obtained; continued browsing does not replace that consent.

7.2. The Vietnamese version prevails if the language versions differ, to the extent permitted by law and without reducing mandatory consumer rights.