PRIVACY POLICY

Last updated:  22 August 2023

This Privacy Policy (Policy) applies to FightCloud Pty Ltd (ACN 667 156 836), and its subsidiaries, related entities, training facilities in the jurisdictions in which it operates, as well as any trust for which it or its related entities may act as trustee (collectively, FightCloud, we, our and us), the websites that we operate from time to time (including but not limited to www.fightcloud.com.au) (Website/s) and any mobile applications that we operate from time to time (Apps).

We are committed to managing personal information in accordance with applicable privacy laws.

This Policy sets out how we collect, use, disclose, store, handle and dispose of (collectively, process) personal information about our members, franchisees and employees and any other people we interact with. It also explains particular rights you have in relation to the processing of your personal information. It should be read together with any terms and conditions governing your use of the Website or Apps, our membership terms and conditions (if you are a member), and any location specific legal notice.

In this Policy, you refers to any individual about whom we collect personal information. Personal information means information or an opinion about you, whether true or not, from which you can be identified, and includes your health information.

FightCloud is a data controller for our Website and Apps, and the services provided through these platforms and in person.

If you are located in another jurisdiction or outside of Australia, by providing your personal information to us, you consent to process your personal information for the purposes set out in this Policy, in addition to any other lawful basis which we may do so.

If you have any questions or comments about this notice, or you wish to exercise the rights you have under applicable privacy laws (which are explained further below), please contact us using the methods set out below.

1. What information does FightCloud collect about you?

We only collect personal information where it is necessary to do so for our functions or activities.  The kinds of personal information we collect will depend on the capacity in which you are dealing with FightCloud, for example, whether you are a member, a business contact or applying for a job.  You can always decline to give FightCloud any personal information we request, but this may mean we cannot provide you with some or all of the services you have requested. 

The types of personal information we collect about you may include:

• Identity information including first name, last name, username or similar identifier, marital status, title, date of birth, age, gender, your job function, your employer or department, qualifications and work history;
• Contact information including billing address, postal address, email address and telephone numbers (these details may relate to your work or to you personally, depending on the nature of our relationship with you or the company for which you work) and any other details needed to complete your application form or membership agreement;
• Financial information including bank account and/or credit card details and other payment method details;
• Transaction information including details about payments to and from you, other details of services you have received from us, and records of our communications;
• Profile information including your username and password, your interests, preferences, feedback and survey responses. It also includes information you give us or that we obtain when you use our Websites or Apps, obtain or subscribe to our services, supply us with goods or services, enquire about a service, place a service request, enter a competition, or contact us to report a problem, or do any of these things on behalf of another person;
• Member information including details of your attendance rates, information about how you use our services, Website, and Apps, as well as personal information which can include Identity, Contact, Financial, Transaction and Profile information of you and/or your family members, emergency contact details, beneficiaries, employees or employers, or other third persons about whom we need to collect personal information by law, or under the terms of a contract we have with you;
• Sensitive information may include sensitive personal information where it is relevant to the services that we provide, such as health information (ie, height, weight, age, diet information (including nutritional plans), heart rate data, body scans, personal effort, strength, body photographs, health and fitness goals and achievements).  The types of sensitive information we collect may also include details of your medical history, details of any medication(s) you take, whether you smoke or are pregnant, and other relevant health-related information; 
• Marketing and communications information including your preferences in receiving marketing from us and your communication preferences. This may include information about events to which you are invited, and your personal information and preferences to the extent that this information is relevant to organising and managing those events; 
• Technical information including: 

• the internet protocol (IP) address used to connect your computer to the internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;

• information about your visit to our Website and Apps, such as the full URL, clickstream to, through and from our Website (including date and time), services viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from a page, any phone number used to call our central switchboard number, and direct dials or social media handles used to connect with our employees; and

• location information which we may collect through our Website or Apps and which provides your real-time location in order to provide location services (where requested or agreed to by you) to deliver content or other services that are dependent on knowing where you are. This information may also be collected in combination with an identifier associated with your device to enable us to recognise your mobile browser or device when you return to the Website or App; and

• Image / audio visual recordings including closed circuit television (CCTV) footage that is installed within appropriate areas in each of our fitness studios, telephone conversations with you recorded for training or quality assurance purposes and, with your express consent, your photo or video for promotional purposes (where permitted under applicable privacy laws). 

2. How does FightCloud collect your personal information?

We generally collect personal information directly from you. We may collect and update your personal information over the phone, by email, via our Website or Apps, or in person. We may sometimes collect personal information about you from other sources, including:

• publicly available information, such as public registers;
• social media, Websites or Apps which you use; 
• your employer or former employer; 
• other third parties (such as our third-party suppliers and contractors who assist us to operate our business (including CRM software or any third party payment gateway and FightCloud franchisees), with your consent. 

3. How we use and process the personal information we collect about you

FightCloud collects personal information reasonably necessary to carry out our business, to assess and manage our members’ needs, and to provide fitness programs.  We may also collect information to fulfil administrative functions associated with these services.  Depending on your interactions with us, we may use and process your personal information for the purposes set out in the table below, as well as:

• any related secondary purpose which we believe you would reasonably expect when we collected your personal information or as a result of our ongoing relationship with you;
• any purpose for which you have consented; or
• any purpose for which we are required or authorised by applicable law.

The legal basis for processing personal data by us will be one of the following: 

• you have given us consent;
• the processing is necessary for the performance of a contract you are party to, or in order to take steps at your request prior to you entering into a contract;
• the processing is necessary in order for us to comply with our legal obligations; or
• the processing is necessary for the pursuit of our legitimate business interests.

Purpose.                

1. To process and administer your dealings as a member, including without limitation to:

1. when members or prospective members enquire about membership;
2. processing payments and any direct debit requirements;
3. assessing your health and suitability for participation and membership;
4. monitoring your progress as a FightCloud member.

2. To process and administer your dealings as a user, including (without limitation):

5. when a person enquires about becoming a FightCloud client;
6. when a FightCloud client purchases equipment through us;
7. processing payments and direct debit requirements;
8. monitoring your performance as a FightCloud client;

3. To properly tailor our services to your needs, including (without limitation):

9. uploading health information to an App from time to time;
10. assessing your health and suitability for participation in fitness activities;
11. using health information to maximise the functionality our Apps;
12. enabling us to measure your progress as a FightCloud member and facilitate your participation in our challenges.

13. We only use your sensitive information for these purposes and no other purpose.  We will obtain your express consent in circumstances where it is necessary for us to collect your sensitive information.

4. To manage our relationship with you, including (without limitation):

14. notifying you about changes to our terms;

15. asking you to leave a review or take a survey;

16. defending our legal interests (if required);
17. to respond to and manage inquiries, complaints, feedback and claims.

5. To enable you to participate in an event or complete a survey, including (without limitation):

18. informing you of our activities, events, facilities and services;

19. managing, planning, advertising and administering programs and events.

6. To improve our services, training and quality assurance, as well as documenting what has been discussed and decided between you and us, including (without limitation):

20. researching, developing and expanding our facilities and services;

21. market research and analytics.

7. Carry out risk analysis, fraud prevention and risk management, including (without limitation) through:

1. investigating and protecting against fraud, theft and other illegal activities;
2. monitoring the safety and security of our studios;
3. verifying your identity, and carrying out checks with fraud prevention companies.

8. To administer and protect our business, Website and Apps, including (without limitation) by collecting personal information from individuals who are not members or employees (such as FightCloud clients or potential clients, individual service providers and contractors to FightCloud and other individuals who interact with FighCloud on a commercial basis).

9. To participate in recruitment activities, including (without limitation):

1. communications with you directly or through third parties you would expect (for example, referees you have nominated or third party recruitment agencies);

2. collecting additional details such as your tax file number and superannuation information and other information necessary to conduct background checks and determine your suitability for certain positions.

10. To deliver relevant Website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you, including (without limitation) using your image or audio-visual recordings which identify you for promotional purposes where you would reasonably expect this to occur and consent to such use (for example, where you have won a prize and where permitted under applicable laws).

11. To use our data analytics to improve our Apps, Website, products/services, marketing, customer relationships and experiences.

3. information about our services;
4. newsletters which are of interest to you;
5. upcoming promotions and events; or
6. other opportunities that may interest you.

Type of Data

• Identity information
• Contact information
• Financial information
• Transaction information
• Client information
• Sensitive personal information
• Profile information
• Marketing and communications information
• Image / audio visual recordings
• Marketing and communications information
• Technical information
• Image / audio visual recordings

Lawful basis for processing including basis of legitimate interest

• Performance of a contract with you
• Necessary for our legitimate interests, for example;

1. to recover debts due to us; or
2. to keep our records updated and to study how customers use our products and services; or
3. train our staff and ensure we are providing quality services; or
4. preventing or investigating any fraud or crime; or
5. for running our business, provision of administration and IT services, network security, to prevent fraud, and in the context of a business reorganisation, merger, disposal, or group restructuring exercise; or
6. study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy; or
7. define types of customers for our products and services, to keep our Apps and Website updated and relevant, to develop our business, and to inform our marketing strategy)

• Your consent;
• Necessary to comply with a legal obligation.

4. How does FightCloud interact with you via the internet?

FightCloud Website(s) use cookies. A cookie is a small file stored on your computer’s browser, which assists in managing customised settings of the Website(s) and delivering content that help us track your Website(s) usage and remember your preferences. We collect certain information such as the time and date of your visit, your device type, browser type, IP address, and pages you have accessed on our Website(s) and on third-party Websites. You are not identifiable from such information.

You can use the settings in your browser to control how your browser deals with cookies. However, in doing so, you may be unable to access certain pages or content on our Website.

FightCloud’s Websites may contain links to third-party Websites. FightCloud is not responsible for the content or privacy practices of Websites that are linked to our Website.  Any information you provide directly to a third party will be managed in accordance with that party’s privacy policy.

5. Can you deal with FightCloud anonymously?

You may visit our Websites without identifying yourself. If you identify yourself (for example, by providing your contact details in an enquiry), any personal information you provide to us will be managed in accordance with this Policy.

FightCloud will provide individuals with the opportunity of remaining anonymous or using a pseudonym in their dealings with us where it is lawful and practicable to do so (for example, when making a general enquiry). 

In general, it is not practicable for FightCloud to deal with individuals anonymously or pseudonymously on an ongoing basis. If you do not provide your information to us, we may not be able to:

• provide you with the services you want, or permit participation in the events, programs or activities we manage or deliver;
• respond to your requests;
• manage or administer your service;
• personalise your experience with us;
• verify your identity or protect against fraud; or
• let you know about other products or services that might better meet your needs. 

6. How does FightCloud hold and secure information?

FightCloud stores information in files or using electronic record keeping methods (including using trusted third-party storage providers based in Australia and overseas).  Personal information may be collected in paper-based documents and converted to electronic form for use or storage (with the original paper-based documents either archived or securely destroyed). We take reasonable steps to protect your personal information from misuse, interference and loss and from unauthorised access, modification or disclosure.

FightCloud maintains physical security over any paper and all electronic data stores, such as through locks and security systems at our premises. We also maintain computer and network security, for example, we use firewalls (security measures for the internet) and other security systems such as user identifiers and passwords to control access to our computer systems.

Our Websites do not necessarily use encryption or other technologies to ensure the secure transmission of information via the internet. Users of our Websites are encouraged to exercise care in sending personal information via the internet.

7. Does FightCloud use or disclose your personal information for digital or direct marketing?

In some jurisdictions, you may receive direct marketing communications. If you do not want to receive direct marketing communications, or you have provided your consent to receive direct marketing but wish to withdraw it, you can opt-out at any time by contacting us using the contact details below in section 14 or the unsubscribe facility in the emails we send to you.

If you opt-out of receiving marketing material from us, FightCloud may still contact you in relation to its ongoing relationship with you.

We may occasionally engage other organisations to provide marketing or advertising services on our behalf.  Those organisations will be permitted to obtain only the personal information they need to deliver the relevant services. If we provide those organisations with any of your personal information, it is to provide you with a better or more relevant and personalised experience and to improve the quality of those services.

8. How does FightCloud disclose personal information?

We will not sell, distribute or disclose your information or personal details to any third parties, other than in accordance with this Policy, or to those who are contracted to us to keep your information or personal details confidential.

We may disclose personal information:

• to our suppliers, franchisees, consultants, contractors or agents we engage in order to provide our services, including for payment processing and debt recovery, data processing, data analysis, customer satisfaction surveys, information technology services and support, Website and App maintenance/development, printing, archiving, mail-outs, and market research;
• via our social media pages and the App for promoting FightCloud and our services;
• via the App to provide assessment information or to announce winners of our challenges;
• if we merge with or are acquired by another entity, to that entity as a part of the merger or acquisition;
• to relevant government, federal, state and territory authorities for the purpose of investigating an incident, including a workplace health and safety matter or security incident;
• when conveying information to a responsible person (e.g. parent, guardian, spouse) if you are injured, incapable or cannot communicate, unless you have requested otherwise;
• for other administrative, management and operational purposes, such as risk management and management of legal liabilities and claims (for example, liaising with insurers and legal representatives).

We may use and disclose your personal information for other purposes explained at the time of collection, that you have consented to, or otherwise as set out in this Policy.

9. Does FightCloud disclose your personal information overseas?

Personal information will be shared with Azure. Any use of personal information will be handled in accordance with their privacy policies. Fightcloud may disclose personal information with independent third parties, including but not limited to Google, Meta, Instagram and Tik Tok and will be handled in accordance with their privacy policies available directly from those third-parties.

Otherwise, unless we have your consent, or an exception or other lawful basis under applicable privacy laws applies, we will only disclose your personal information to overseas recipients where we have taken reasonable steps to ensure that the overseas recipient does not breach applicable privacy laws in relation to your personal information and will comply with any other requirements under applicable privacy laws relating to the offshore disclosure of personal information.

The reason for disclosure to an overseas recipient depends on the nature of the services those recipients provide to us. For example, we may store your information in cloud or other types of networked or electronic storage, or where our customer relationship management system is hosted on servers located overseas. As electronic or networked storage can be accessed from various countries via an internet connection, it’s not always practicable to know in which country your information may be accessed or held.

If we or our service providers transfer any of your personal information we collect from you outside of the United Kingdom, Australia, Singapore or New Zealand, it will only be done with relevant protections in place. We will take steps to ensure that your personal information will be afforded the level of protection required of us in accordance with applicable data protection laws and current legally recognised data transfer mechanisms, such as: 

• where the country has been deemed adequate by a relevant supervisory authority; or 
• by adopting appropriate approved standard contractual clauses.

10. Your rights

How to access your information

Subject to applicable laws, you are entitled to access your personal information held by FightCloud on request. You can do this by contacting us using the contact details set out below. We will need to verify your identity before we can give you access. We will acknowledge receipt, and we will endeavour to deal with and respond to your request within a reasonable time.

You will not be charged for making a request to access your personal information but you may be charged for the reasonable time and expense incurred in compiling information in response to your request.

We may decline your request to access your personal information in certain circumstances in accordance with applicable privacy laws.  If we do refuse your request, we will provide you with a reason for our decision (including, where applicable, an alternative means of access to the information, such as supervised inspection), and how you can complain if you are not satisfied with our decision.

How to correct your personal information

We will take reasonable steps to ensure that the personal information we collect, use or disclose is accurate, complete and up-to-date. You can help us to do this by letting us know if you notice errors or discrepancies in information we hold about you and letting us know if your personal details change. If you consider any personal information we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading you are entitled to request correction of the information. After receiving a request from you, we will take reasonable steps to correct your information. If we refuse your request to correct your personal information in accordance with this procedure, we will include a statement with your personal information about the requested correction. 

Additional rights and choices applicable to individuals in the UK and Europe  In certain circumstances, and subject to applicable laws, individuals in the UK and Europe can:

• obtain information about the processing of your personal information; 
• ask us to erase your personal information, such as if you withdraw your consent and we are not otherwise legally entitled to retain it; 
• object to, and ask us to restrict, our processing of your personal information, although we may continue to process your personal information while we verify your assertion your information is inaccurate or if we are processing your information for our legitimate interests; 
• receive some personal information you have given us in a structured, commonly used and machine-readable format or ask us to transmit it to someone else if technically feasible; and 
• withdraw your consent (but we may be able to continue processing without your consent if there is another legitimate reason to do so). The withdrawal of your consent will not affect the processing of your information to which you had consented. If you withdraw your consent to any or all collection, use and/or disclosure of your personal information, depending on the nature of your request, we may not be in a position to continue to provide our products or services to you, administer any contractual relationship already in place, or perform or conclude an existing or prospective agreement. This may result in the termination of any agreements you have with us, and you being in breach of your contractual obligations or undertakings. Our legal rights and remedies are expressly reserved.

11. What happens when we no longer need your information?

We will only keep your information for as long as we require it for our purposes. We may also be required to keep some of your information for certain periods of time under applicable law. When we no longer require your information, we will take steps to securely destroy or de-identify it. We will only keep your information for as long as we have a relationship with you and for 7 years or otherwise as required for our business operations or by applicable laws. 

We may need to retain certain personal information after we cease providing you with products or services to enforce our terms, for fraud prevention, to identify, issue or resolve legal claims and for proper record keeping. We may also retain a record of any stated objection by you to receiving marketing for the purpose of ensuring we can continue to respect your wishes and not contact you further.

12. What should you do if you have a complaint about the handling of your personal information?

You may contact FightCloud at any time if you have any questions or concerns about this Policy or about the way in which your personal information has been handled or processed.  You may make a complaint to us using the contact details set out below.

In most cases, we will investigate and respond to a complaint within 30 days of receipt of the complaint. If the matter is more complex or our investigation may take longer, we will let you know.

If you still feel your issue or request has not been resolved to your satisfaction, then you have the right to make a complaint to the relevant data protection authority (for example in the place you reside or where you believe we breached your rights). We can, on request, tell you the relevant authority for the processing of your personal information.

In Australia, the relevant authority is the Office of the Australian Information Commissioner, who can be contacted by telephone on 1300 363 992 or online at: www.oaic.gov.au/privacy.

13. How changes are made to this Policy?

FightCloud may amend this Policy from time to time, with or without notice to you, subject to local law. We recommend that you visit our Website regularly to keep up to date with any changes.

14. How can you contact us?

Please contact us if you have any questions or comments about this notice or if you wish to exercise the rights you have under applicable privacy laws using the following details: 

Position: Director
Name: Christopher Leeden
Email: [email protected]
Address: C/- 201 Melbourne Road, Rippleside, Victoria 3215