Xplor Studio
Back

PRIVACY

Xplor Studio

Xplor Studio is a fitness studio business management service provided by TRIIB, Inc. t/a Xplor Studio (we, us, our, Xplor Studio).  Xplor Studio’s services include payment-related services , messaging (email, SMS, push), booking services, workout and nutrition planning services, and payroll and business expenses  .  

This notice

We use personal data (also known as personal information, personally identifiable information or PII) to provide, develop and promote Xplor Studio.  This notice explains in a bit more detail how and why we use personal data.  We also use this notice to give you information about data protection rights and our contact details.  

This notice was last updated April 2021.  We will periodically make further amends so please check back for updates.  

What personal data do we collect?

Xplor Studio members

Xplor Studio collects personal data relating to studio owners’ customers or members (members) to allow them to access the Xplor Studio App and to provide payment-related services, messaging (email, SMS, push), booking services, and workout and nutrition planning services .  We collect personal data directly from members when they register to use Xplor Studio.  We also collect personal data relating to members from studio owners, and banks and other financial institutions.

Where we collect and process personal data relating to members, we are generally acting only as a processor and the studio owner is the controller that is ultimately responsible for how their members’ personal data is used.

However, for the purposes of our regulatory obligations and legal rights we may be required to process the following types of members’ personal data as a controller:

• Username and password

• Sign-on information provided to third parties (where a member accesses our services through a third-party interface, such as a social media platform)

• Membership and/or account details

• Basic personal and contact details (name, address, email, telephone, date of birth)

• Fitness-related information where relevant (height, weight, nutrition, medical conditions     etc.)

• Financial details (including banking and payment information)

• Location information

• Device information (including ID, type, time zone setting and location, IP address)

• Marketing and communications data (including preferences)

• Notification alert settings

• Purchase history

• Personal data in correspondence (including call recordings, webchat and emails)    

We collect personal data directly from members when they register to use Xplor Studio.  We also collect personal data relating to members from studio owners, and (where relevant) from banks and other financial institutions.

Xplor Studio staff

Xplor Studio collects personal data relating to a studio’s staff for payroll and business expenses services.  Staff of studios are also able to manage parts of their work via Xplor Studio.  We collect personal data directly from staff when they access the Xplor Studio App.  We also collect personal data relating to staff from studio owners, and banks and other financial institutions.

Where we collect and process personal data relating to studio staff, we are generally acting only as a processor and the studio owner will be the controller that is ultimately responsible for how their staff’s personal data is used.  

However, for the purposes of our regulatory obligations and legal rights we may be required to process the following types of staff personal data as a controller:

• Username and password

• Basic personal and contact details (name, address, email, telephone, date of birth)

• Role, payroll and professional details

• Financial details (including banking and payment information)

• Device information (including ID, type, time zone setting and location, IP address)  

How we use personal data

Members

We mainly use members’ personal data as a processor to provide Xplor Studio to studio owners.  Consequently, members should check the privacy notice of the studio from which they registered to receive services.

Where we use members’ personal data as a controller it is generally to meet our regulatory obligations or to exercise our legal rights.  

We also aggregate and anonymise members’ personal data to use for developing and monitoring our services.  In addition, we collect analytical information about the use of Xplor Studio to maintain and develop our services.

Staff

We mainly use staff personal data as a processor to provide Xplor Studio to studio owners.  Consequently, staff should check their employee privacy notice.

Where we use staff personal data as a controller it is generally to meet our regulatory obligations or to exercise our legal rights.  

We also aggregate and anonymise staff personal data to use for developing and monitoring our services.  We also aggregate and anonymise members’ personal data to use for developing and monitoring our services.  In addition, we collect analytical information about the use of Xplor Studio to maintain and develop our services.

Our legal grounds to use personal data

Members

Legal obligations

We use personal data relating to members where necessary for our regulatory obligations.  

Legitimate interests

We also use personal data relating to members where necessary for the purposes of legitimate interests pursued by us or the organisations we work with.  Our legitimate interests include the operation, development and promotion of Xplor Studio.  We will not use personal data for our legitimate interests if there is an undue impact on members’ privacy or other rights.

Consent

Our legal ground for location data and non-essential Cookies or other tracking via the Xplor Studio App is consent.  Consent for non-essential Cookies may be withdrawn at any time (please see Cookies section below).    

Staff

Legal obligations

We use personal data relating to members where necessary for our regulatory obligations.  

Legitimate interests

We also use personal data relating to members where necessary for the purposes of legitimate interests pursued by us or the organisations we work with.  Our legitimate interests include the operation, development and promotion of Xplor Studio.  We will not use personal data for our legitimate interests if there is an undue impact on members’ privacy or other rights.

Consent

Our legal ground for location data and non-essential Cookies or other tracking via the Xplor Studio App is consent.  Consent for non-essential Cookies may be withdrawn at any time (please see Cookies section below).    

Automated decision-making

We do not make any decisions that have significant legal consequences solely by using automated decision-making.

Sharing personal data

Members

When we are acting as a controller, we share members’ personal data with the studio owner, banks and financial institutions, our staff and the following types of service providers:

• IT providers and developers

• Group companies and affiliates

• Business partners providing services to the same studio

• Professional service providers (for example, accountants and lawyers)

We also share personal data relating to members where necessary with:

• Regulators and other official authorities

• Law enforcement and fraud prevention agencies

• Independent adjudication services

Staff

When we are acting as a controller, we share staff personal data with the studio owner, banks and financial institutions, our staff and the following types of service providers:

• IT providers and developers

• Group companies and affiliates

• Business partners providing services to the same studio

• Professional service providers (for example, accountants and lawyers)

We also share personal data relating to members where necessary with:

• Regulators and other official authorities

• Law enforcement and fraud prevention agencies

• Independent adjudication services

Reorganisation and legal

We may share any personal data we hold with potential buyers, group companies and/or business partners where necessary and appropriate for a reorganisation, restructuring, merger, sale or transfer of assets involving Xplor Studio or our services.  

We will share personal data where necessary to establish, exercise or defend our legal rights.  

Regulatory and legal responsibilities

We will also share personal data where required by the courts, official authorities or law.

Cookies and similar technologies

Cookies and similar technologies (Cookies) allow us to track how people interact with the Xplor Studio App.  

Essential cookies

The Xplor Studio App will not work properly without essential Cookies.  For example, we and our service providers may use essential Cookies to analyse how the Xplor Studio App is used and identify and authenticate members or staff.  We also use essential Cookies to enforce our terms of use and maintain security.  

Children

We only use personal data relating to children under 13 with appropriate adult consent.  If you think that we incorrectly hold personal data relating to a child, please let us know immediately.    

International transfers

We routinely transfer personal data from the European Economic Area (EEA) and United Kingdom (UK).  Where we transfer personal data outside the EEA or UK to a country that has not been recognised as providing an adequate level of data protection, we use approved standard contractual clauses unless we have identified another appropriate safeguard or a relevant exemption.

Where other jurisdictions have similar restrictions on international transfers of personal data, we implement similar safeguards or exemptions.

Data retention

We only keep personal data relating for as long as necessary for our business purposes and for up to a further seven years where necessary to protect our legal interests.

We will only keep personal data for longer periods where necessary for our regulatory obligations or other legal purposes.  

California

California Residents’ Rights

California law grants California residents certain rights and imposes restrictions on particular business practices as set forth below.

Do-Not-Sell

California residents have the right to opt-out of the sale of their personal information. California law broadly defines “sale” in a way that may include allowing third parties to receive certain information such as cookies, IP address and/or App usage. We do not sell personal data and we do not share personal data except as explained in this privacy notice.    

Request to Delete

California residents have the right to request deletion of their personal information that we have collected about them and to have such personal information deleted, except where an exemption applies.

Request to Know

California residents have the right to request up to twice per year and subject to certain exemptions, that we disclose the following to them:

• categories of personal information collected

• categories of sources of personal information

• business and/or commercial purposes for collecting and selling their personal information

• categories of third parties/with whom we have disclosed or shared their personal information

• categories of personal information that we have disclosed or shared with a third party for a business purpose or sold

• categories of third parties to whom the residents’ personal information has been disclosed or shared with a third party for a business purpose or sold

• a copy of the specific pieces of personal information we have collected about them

Submitting CCPA Requests

California residents may submit CCPA requests to delete or know by contacting us at privacy@transactionservices.global. Please specify the type of request in your email.

When you submit a request to delete or know, we will take steps to verify your request by matching the information provided by you with the information we have in our records. You must provide your email address and zip code (or postal code). In some cases, we may request additional information in order to verify your request or where necessary to process your request. If we are unable to adequately verify a request, we will notify the requestor. Authorized agents may initiate a request on behalf of another individual contacting us as described above. Authorized agents will be required to provide proof of their authorization and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.

Your Privacy Rights Under California Shine the Light Law

Under California’s “Shine the Light” law (Cal. Civ. Code § 1798.83), California residents who provide us certain personal information are entitled to request and obtain from us, free of charge, information about the personal information (if any) we have shared with third parties for their own direct marketing use. Such requests may be made once per calendar year for information about any relevant third-party sharing in the prior calendar year. To submit a “Shine the Light” request, email us at privacy@transactionservices.global and include in your request a current California address and your attestation that you are a California resident.

Right to Non-Discrimination

The CCPA prohibits discrimination against California residents for exercising their rights under the CCPA. Discrimination may exist where a business denies or provides a different level or quality of goods or services, or charges (or suggests that it will charge) different prices, rates, or penalties on residents who exercise their CCPA rights, unless doing so is reasonably related to the value provided to the business by the residents’ data.

Financial Incentives

A business may offer financial incentives for the collection, sale or deletion of California residents’ personal information, provided the incentive is not unjust, unreasonable, coercive or usurious, and is made available in compliance with applicable transparency, informed consent, and opt-out requirements. California residents have the right to be notified of any financial incentives offers and their material terms, the right to opt-out of such incentives at any time, and may not be included in such incentives without their prior informed opt-in consent. We do not offer any such incentives at this time.

Rights

Exact rights will vary depending on jurisdiction and circumstances, but by way of example individuals present in the EEA, UK and New Zealand generally enjoy the following rights to:

• Information about how we use personal data (which is what this notice is for)

• Access to personal data

• Object to the use of personal data (including the sale of personal data to other companies)

• Erasure of personal data (also known as the “right to be forgotten”)

• Portability of personal data

• Withdraw consent where our use of personal data is based on consent

• Rectification of personal data

• Restriction of personal data

• Complain to a supervisory authority

Please be aware that these rights are not absolute and there may be some situations in which they cannot be exercised or are not relevant.

You will not be treated differently or discriminated against for exercising any of your rights.

If you do not provide personal data

Where we need personal data and it is not provided, we may not be able to provide services to you.

Our contact

If you would like to contact us or our DPO regarding any data protection issue, please email privacy@transactionservices.global