Purpose of this Privacy Policy
This Privacy Policy explains how DASH collects, uses, discloses, stores, safeguards and otherwise processes personal information when a person visits the website, creates an account, uses the Platform, books a class, interacts with a club or instructor, purchases a membership, contacts DASH or otherwise uses the services.
This Privacy Policy is intended to comply with POPIA and related South African privacy requirements.
Responsible party
DARING AUTHENTIC SUCCESSFUL HEALTHY, registration number 2018/428044/07, trading as DASH ("DASH", "we", "us" or "our").
Contact details: camerontomlin@gmail.com
Information Officer / privacy contact: Cameron Tomlin
Personal information we collect
Depending on how the Platform is used, DASH may collect the following categories of personal information:
identity and contact information, including name, surname, email address, telephone number, identity or date-of-birth information where required, profile picture and account credentials;
account and membership information, including user type, club, instructor, subscription, booking history, attendance, no-show records, cancellation history, preferences and communications;
payment and transaction information, including invoices, receipts, subscription status, payment method tokens, payment reference numbers and limited card information supplied by the payment processor;
fitness and health-related information, including fitness goals, injury notes, health declarations, emergency contacts, progress measurements, training records, activity data and any other information voluntarily supplied by the user or required by a club or instructor;
device and technical information, including IP address, device identifiers, browser type, operating system, logs, cookie identifiers, analytics information and approximate location derived from technical data;
communications, support requests, complaints, feedback, survey responses, reviews and marketing preferences;
images, videos or other content uploaded to the Platform where this functionality is enabled.
Special personal information and children
Information about a person's health, sex life, biometric information, disability, injury, medical condition or similar fitness/health information may be special personal information under POPIA. DASH will process such information only where the user has consented, where processing is necessary for a lawful right or obligation, or where another POPIA authorisation applies.
Where the personal information of a child is processed, DASH will process it only with the consent of a competent person such as a parent or legal guardian, or where another lawful authorisation applies. The sign-up flow must be configured accordingly if minors are permitted to use the Platform.
How we collect personal information
DASH may collect personal information directly from the user through registration forms, checkout pages, bookings, health questionnaires, support requests, in-app interactions, cookie tools and communications.
DASH may also collect personal information from clubs, instructors, payment providers, hosting providers, analytics providers, communications providers and other service providers involved in operating the Platform.
Purposes for processing
DASH may process personal information to:
create, verify, administer and secure user accounts;
provide bookings, membership administration, class access, platform functionality, user support and related services;
process payments, invoices, refunds, credits, failed payments, fraud prevention and subscription renewals;
communicate about bookings, classes, subscription status, service changes, safety notices, account activity and support issues;
enable clubs and instructors to deliver classes or services to users, subject to appropriate access controls;
personalise content, improve services, analyse usage, test features and develop the Platform;
send direct marketing where permitted and respect unsubscribe or opt-out requests;
comply with law, respond to lawful requests, enforce terms, prevent fraud, investigate misuse and protect rights, safety and security;
process health or fitness information for safety, class suitability, emergency-response, user-requested fitness functionality and related purposes disclosed at collection.
Legal bases under POPIA
DASH processes personal information where at least one lawful justification applies, including:
the user has consented to the processing;
processing is necessary to conclude or perform a contract with the user;
processing is necessary to comply with a legal obligation;
processing protects a legitimate interest of the user;
processing is necessary for DASH or a third party to pursue a legitimate interest, provided that the user's rights are not unlawfully infringed.
Direct marketing
DASH may send marketing communications only where permitted by POPIA, ECTA, the CPA and any other applicable law.
A user may opt out of direct marketing at any time by using the unsubscribe mechanism or by contacting camerontomlin@gmail.com. DASH will not sell personal information to unaffiliated third parties for their independent marketing without an appropriate lawful basis and notice.
Sharing personal information
DASH may share personal information with:
clubs, studios, instructors and service providers where necessary to provide bookings, classes, memberships and related services;
payment processors, banks and fraud-prevention providers for payment and billing;
hosting, cloud, analytics, development, customer-support, CRM, email, SMS, WhatsApp, accounting and security providers;
professional advisers, auditors, insurers, regulators, law-enforcement bodies and courts where required or permitted by law;
a purchaser or successor in connection with a lawful business transfer, merger, restructuring or sale, subject to appropriate safeguards.
DASH should ensure that any operator processing personal information on its behalf is bound by a written contract requiring appropriate security and confidentiality safeguards.
Cross-border transfers
DASH may transfer personal information outside South Africa where hosting, analytics, payment, development, communications, support or other service providers are located outside South Africa. DASH will do so only where permitted under POPIA, including where the recipient is subject to appropriate privacy safeguards, the data subject consents, the transfer is necessary for a contract, or another lawful basis applies.
Security safeguards
DASH will take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, unlawful access and unlawful processing.
Security measures may include access controls, password controls, encryption or secure transmission where appropriate, secure hosting, logging, backups, contractual controls over operators, staff access restrictions and incident-response procedures.
No online system is completely secure. Users must keep passwords confidential and notify DASH immediately if they suspect account compromise.
Security compromise notifications
Where DASH has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, it will notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to lawful delays needed for law-enforcement or technical containment.
Retention
DASH will retain personal information only for as long as necessary for the purposes for which it was collected, for lawful business purposes, to comply with legal obligations, to resolve disputes, to enforce rights or as otherwise permitted by law.
Where information is no longer required, DASH will delete, destroy, de-identify or restrict it, unless retention is legally permitted or required.
Data-subject rights
Subject to POPIA and PAIA, a data subject may request access to personal information, correction or deletion of personal information, objection to processing, restriction of direct marketing, and information about third parties to whom personal information has been disclosed.
Requests may be sent to camerontomlin@gmail.com. DASH may require proof of identity before acting on a request.
Complaints
A user may complain to DASH at camerontomlin@gmail.com. If the complaint is not resolved, the user may contact the Information Regulator (South Africa). Current contact details include enquiries@inforegulator.org.za, POPIAComplaints@inforegulator.org.za and 010 023 5200.
Updates to this Privacy Policy
DASH may update this Privacy Policy from time to time. The effective date should be updated when changes are made. Material changes should be communicated through the Platform, by email or by another appropriate channel.