Privacy Policy - Dubai

1. Scope and who is responsible

This Privacy Policy explains how personal information is handled when you visit or interact with strongpilates.ae and its associated pages (Site). It applies to the public marketing website, studio locator and forms described below. It does not replace the separate privacy notice of an individual studio, employer or booking platform.

STRONG Pilates Franchising Pty Ltd is responsible for personal information collected through the regional Site, including contact, media, Academy and franchise-opportunity submissions. Its contact details are info@strongpilates.ae and 100 Spring Street North, Port Melbourne, Victoria 3207, Australia. The Site uses a global headless content-management database owned by STRONG Pilates Franchising Pty Ltd (ABN 58 637 543 385), 100 Spring Street North, Port Melbourne, Victoria 3207, Australia. Because the regional website owner is the same entity, it manages the database and relevant HubSpot workflows directly for this Site.

STRONG Pilates Franchising Pty Ltd is also responsible for information submitted through an 'Own a STRONG' or franchise-opportunity journey on this Site, including deciding how the enquiry is assessed and followed up. It owns and administers the relevant HubSpot account directly.

2. Personal information we collect

The information collected depends on how you use the Site. We may collect the following categories:

• contact and enquiry information, including name, email address, enquiry type, message, source page and the time a consent or preference was recorded;
• Academy application information, including first and last name, email address, preferred studio, state or location, qualification selections and an optional resume in an accepted image or document format;
• franchise-opportunity information provided through an Own a STRONG form, which may include identity, contact, location, professional, experience, financial-capacity and enquiry details requested on the relevant form;
• technical and usage information, including browser and device information, user agent, referring page, pages or features used, consent state, coarse country inferred from an internet address, and advertising or analytics identifiers where enabled;
• a cryptographic hash derived from your internet address using a daily salt for rate-limiting and abuse prevention; the ordinary submission record does not retain the raw internet address;
• location information where you choose 'use my location'; precise browser location is used on your device to centre the map and is not intended to be stored with a form submission;
• communications, request-verification material and records of privacy choices, complaints or interactions; and
• public studio information used to display the locator and structured search-engine data, such as studio name, address, coordinates, contact details, opening status and links.

3. How we collect information

We collect information directly from you when you submit a form, upload a resume, contact us, select a privacy choice or communicate with a studio. We collect technical information automatically through site infrastructure, security logs and, depending on your region and choices, cookies, pixels, tags and similar technologies.

We may receive information from the selected studio, a booking or marketing platform, a STRONG group company, a franchisee, a recruitment contact, a social-media platform, a referral source, or a service provider assisting with the Site. We may also use publicly available business information where lawful and relevant.

4. Purposes and legal grounds

We process personal data with consent or another lawful basis available under applicable UAE law, including where necessary to take steps you request, perform a contract, protect interests, establish or defend legal claims, or comply with law.

We use personal information to:

• operate, display, secure, troubleshoot, measure and improve the Site and its forms;
• respond to contact and media enquiries and route them to the relevant regional team or studio;
• assess and administer Academy interest, qualifications and applications, contact applicants and match interest with relevant opportunities;
• assess and manage franchise-opportunity enquiries through STRONG Pilates Franchising Pty Ltd;
• display nearby studios and facilitate navigation, calls, email, WhatsApp or booking-provider access;
• administer consent choices and comply with legal, regulatory, recordkeeping and rights-request obligations;
• prevent spam, misuse, fraud and security incidents, enforce terms and establish or defend legal claims;
• send marketing only where you have separately opted in or another lawful basis applies, and allow you to unsubscribe; and
• measure audiences, content and campaigns and conduct advertising where the relevant tools are enabled and your regional consent or opt-out choices permit.

5. Marketing, cookies and advertising

A general contact, media or Academy submission does not by itself enrol you in marketing. A selected studio or STRONG entity may send marketing only where you have made a separate choice or applicable law otherwise permits. You can unsubscribe using the message link or the sender's contact details.

The Site uses Cookiebot or an equivalent consent-management platform. Depending on the regional configuration, the Site may use essential storage, Google Tag Manager, Google Consent Mode v2, analytics, Mapbox or Google Maps, Vimeo or YouTube, and advertising tools such as Meta technologies. Optional integrations are described because they may be used; they are not necessarily active on every Site or page.

The consent tool provides regional cookie choices. Non-essential technologies are used with consent or another lawful basis where permitted, and you can revisit the tool at any time to change available choices.

Cookie settings are browser- and device-specific. Blocking a technology may affect a feature. A legacy WordPress page may operate its own consent tool until it is migrated to the global site platform.

6. Studios, booking systems and other recipients

When you select a studio or interact with its booking, membership, payment or local-marketing function, the individual studio generally decides how to handle that information and acts as an independent controller or business. Hapana, Glofox and similar platforms process information for the studio or under their own disclosed roles. Contact the studio for its privacy notice and requests concerning its records.

We may disclose information to the STRONG entities described in section 1; the selected or relevant studio or franchisee; authorised personnel and advisers; and providers of hosting, databases, content delivery, file storage, customer relationship management, email, maps, video, consent management, analytics, security, support and advertising. Relevant providers may include Railway, Cloudflare, HubSpot, SendGrid or another SMTP provider, Cookiebot, Google, Mapbox, Vimeo, YouTube and Meta. We may also disclose information where required by law, to protect rights or safety, in connection with a corporate transaction, or with your direction or consent.

We do not sell personal information for money.

7. International handling

Personal data may be transferred outside the UAE, including to Australia, the United States, the United Kingdom, the European Economic Area and Singapore. We use adequacy mechanisms, contracts, express consent or another lawful transfer mechanism required for the relevant transfer.

No transfer method can eliminate every risk. You may contact us for further information about safeguards relevant to your information, subject to confidentiality and legal restrictions.

8. Retention

Ordinary contact, media, franchise and Academy submissions, including an associated Academy resume, are retained for no more than 24 months after submission unless a longer period is reasonably necessary to respond to an active matter, comply with law, resolve a dispute or establish, exercise or defend legal claims. A valid deletion request may result in earlier deletion, subject to lawful exceptions.

Consent records, security logs, rights-request records, transaction-related records and backups may follow different periods based on legal, evidentiary, security and system-recovery requirements. When information is no longer needed, we delete it, de-identify it or place it beyond ordinary use pending secure deletion from backups.

9. Security

We use administrative, technical and physical safeguards designed for the nature of the information, such as access controls, encrypted connections, restricted administration, provider security measures, rate limiting and monitoring. No system or transmission is completely secure. If an incident occurs, we assess it and notify affected people or regulators where required by law.

Take care when sending information through open text fields. Do not include unnecessary health, identity, financial or other sensitive information in a general message or resume.

10. Children and Academy applicants

The Site and Academy application journey are not directed to children, and we do not knowingly solicit children's personal information through them. The Academy is intended for suitably qualified applicants.

If a person cannot lawfully provide consent or submit an application independently where they live, a parent or legal guardian should assist and provide any consent required by law. If you believe a child has submitted personal information without appropriate involvement, contact us so we can assess and delete it where required.

11. Your choices and rights

Subject to applicable conditions and exceptions, you may have rights to obtain information and access, request correction or deletion, restrict or stop processing, object to direct marketing or certain automated processing, obtain data portability, withdraw consent, and complain to the competent authority. We may need to verify your identity.

To make a request, contact info@strongpilates.ae and describe the information or right involved. We will respond within the period required by applicable law. We may ask for information reasonably necessary to verify identity or authority, and an authorised agent may act where applicable law permits. We do not charge unless the law allows a reasonable fee and the circumstances justify it.

You can change cookie choices through the consent tool and can stop marketing by using the unsubscribe option. A request may be limited by legal exceptions, the rights of others, privilege, security, recordkeeping duties or the need to complete a transaction you requested. If we decline all or part of a request, we will provide the explanation and review or appeal route required by law.

12. Complaints

Send a privacy complaint to info@strongpilates.ae. Include enough detail for us to investigate. We will acknowledge and respond in accordance with applicable law and our internal process.

You may complain to the UAE Data Office or another competent UAE data-protection authority after giving us an opportunity to address your concern.

13. Third-party sites and social media

The Site may link to a studio, booking provider, social network or other third party. Those parties control their own services and privacy practices. Information you make public on social media can be viewed and used by others. Review the privacy information of the service before interacting with it.

14. Changes and contact

We may update this Policy to reflect changes in the Site, providers, data practices or law. The effective date above shows the current version. Where required, we will give additional notice or obtain consent for a material change.

Privacy enquiries and requests may be sent to info@strongpilates.ae or by post to 100 Spring Street North, Port Melbourne, Victoria 3207, Australia.