Privacy
Policy

The Grind Fitness (Pty) Ltd ("The Grind", "we", "us") is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and any applicable regulations.

This policy explains what personal information we collect, why we collect it, how we use it, and your rights regarding your data.

We collect the following categories of personal information:

• Identity and contact information: full name, email address, phone number, date of birth (optional)
• Emergency contact information: name and phone number of your designated emergency contact
• Membership and billing information: membership tier, billing dates, invoice history, payment status
• Booking and attendance data: class bookings, cancellations, attendance records
• Referral data: referral code, referral relationships, referral credits
• Technical data: IP address, browser user agent, timestamps of consent and platform interactions
• Communication records: emails sent to and received from you

Your personal information is processed for the following purposes:

• Performance of the Membership Agreement and provision of services
• Generation and delivery of invoices and payment reconciliation
• Class booking management and session cap enforcement
• Communication regarding membership, bookings, invoices, and our services
• Compliance with legal and regulatory obligations, including tax and accounting requirements
• Health and safety management, including emergency contact in case of injury
• Operation of the referral programme

Your personal information is stored on servers hosted by Microsoft Azure in the UK South region (London, United Kingdom). As the UK is a foreign country for the purposes of POPIA s.72, this constitutes a cross-border transfer. We rely on Microsoft's Data Processing Agreement and Standard Contractual Clauses as the transfer mechanism, providing protection substantially equivalent to POPIA. Data is encrypted at rest and in transit.

Email delivery is provided by Resend, operating under a data processing agreement. Your email address is shared with Resend solely for the purpose of sending transactional emails (invoices, booking confirmations, membership communications).

The Grind's digital platform is developed and maintained by The Fourths (Pty) Ltd, acting as a data operator under POPIA s.21 on behalf of The Grind solely on The Grind's documented instructions.

By accepting these Terms and joining The Grind, you confirm that you are medically fit to participate in high-intensity functional training. Where you voluntarily disclose health information (for example, through a pre-exercise health screening such as a PAR-Q questionnaire) this constitutes special personal information under POPIA ss.26–27, which attracts heightened protection.

We process health screening information solely on the basis of your explicit consent (POPIA s.26(1)) for the purpose of ensuring your safety during training and facilitating appropriate emergency response. Health screening data is not shared with any third party except emergency services in the event of a medical emergency, and is deleted on your request in terms of POPIA s.24.

We do not sell, rent, or trade your personal information. Your information may be shared with the following parties solely for the purposes described in Section 3:

• The Fourths (Pty) Ltd — platform development and maintenance (data processor)
• Resend — transactional email delivery (email address only)
• Microsoft Azure — cloud infrastructure and authentication services

No personal information is shared with third parties for marketing purposes.

Personal information is retained for the duration of your active membership plus 5 years following cancellation or termination, as required for tax, accounting, legal compliance, and dispute resolution. After the retention period, personal information will be securely deleted or anonymised.

We process your personal information on the following grounds under POPIA s.11:

• Contract (s.11(1)(b)): Identity, contact, membership, billing, booking, and attendance data — necessary to perform the Membership Agreement.
• Legal obligation (s.11(1)(c)): Financial and invoice records — required by the Income Tax Act and Companies Act.
• Consent (s.11(1)(a)): Health screening responses, emergency contact information, and marketing communications.
• Legitimate interests (s.11(1)(f)): Technical data (IP address, timestamps) — for platform security and fraud prevention.

We may send you marketing communications (for example, class updates, promotions, or new tier announcements) only if you have given separate, explicit consent to receive them. You may opt out of marketing communications at any time by emailing hello@grindfitness.co.za or clicking the unsubscribe link in any marketing email. Opting out of marketing does not affect transactional emails required to manage your membership (invoices, booking confirmations, account notices).

In accordance with POPIA, you have the following rights regarding your personal information:

• Right of access: request confirmation of whether we hold your personal information and a copy of such information
• Right to correction: request correction of inaccurate, incomplete, or misleading information
• Right to deletion: request deletion of your personal information where it is no longer necessary for the purpose for which it was collected, subject to legal retention obligations
• Right to object: object to the processing of your personal information on reasonable grounds

To exercise any of these rights, submit a written request to the Information Officer below. Requests will be responded to within 30 days. We may require verification of identity before processing a request.

In the event of a personal information breach that poses a risk to Members, The Grind will notify affected Members and the Information Regulator as required by POPIA.

When you submit an enquiry via the interest form on our website, your name, phone number, email address, and tier interest are pre-filled into a WhatsApp message that you send directly to our team. This information is not stored on our servers — it is transmitted via WhatsApp and handled according to WhatsApp's privacy policy. We process this information solely to respond to your enquiry.

By submitting the form, you consent to The Grind using your contact details to follow up regarding your membership enquiry.

Complaints regarding the processing of personal information may also be lodged with the Information Regulator (South Africa):

• Email: inforeg@justice.gov.za
• Website: inforegulator.org.za