Privacy Policy

KVZ Performance Pty Ltd (ABN 75 697 828 176), trading as KVZ Performance ("KVZ", "we", "us"), operates a gym at Unit 53, 3 Jackman Street, Southport QLD 4215, and KVZ Online, our training app for members anywhere in the world. We are committed to protecting your personal information and handling it in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). If you live in the European Union or the United Kingdom, section 11 explains the extra rights you have.

• Identity and contact details: name, email, mobile number, date of birth.
• Emergency contact: name, phone and relationship.
• Health information: your pre-exercise (PAR-Q) answers and any injury notes you give us, so we can train you safely. It also includes the answers you give when you join a program or KVZ Online: your training background, your goals, how comfortable you are with certain movements, and anything you tell us about an injury or condition. Only our coaches and management can see these answers. We use them to set your starting point and to train you safely, and we never use them for advertising.
• Membership and attendance: your plan, bookings, check-ins and results.
• Payment information: handled by Stripe. We receive confirmation of payments and your plan, but we do not see or store your full card number.
• How you heard about us: your referral source, so we can understand and thank our community.
• Marketing preferences: whether you've opted in to updates.
• Notifications: if you allow them, a code from your phone or browser so we can send you notifications. You can turn them off at any time in your settings.
• Where you train from: your country and time zone, so KVZ Online shows the right day's session and the flag next to your name. We take the country from your billing address or the one you choose, and the time zone from your phone. We do not collect your precise location.
• Crew posts and messages: what you post in Crew's group chats, messages you send to other members or your coach, including any photos or files in them, and any reports or blocks you make. Messages between members are private to the two of you and our team cannot see them in the app. The exception is a message somebody reports: we see a copy of that message so we can act on it.
• Event check-in photo: at our events, and only if you agree when you check in, a photo of your face so we can find you in the event photos. Matching faces in photos uses biometric information, which the law treats as sensitive, so we only take it with your consent and you can say no and still race.

• To set up and manage your membership and bookings.
• To keep you safe (health screening, emergency contact).
• To take payment and issue tax invoices.
• To communicate with you about classes, your account and, if you've opted in, news and offers.
• To meet our legal and record-keeping obligations.
• To keep Crew safe: reviewing reports, and removing content or members that break our terms.
• If you agreed to an event check-in photo: only to match you to the photos taken at that event, so you can find yours. Not for anything else.

We do not sell your personal information. We share it only with the providers we use to run the gym, under confidentiality:

• Supabase: secure database and app hosting.
• Stripe: payment processing (PCI-DSS compliant).
• Vercel: website and app hosting.
• Resend: sending our emails.
• Anthropic: AI tools our coaches use to help write and adapt training. Only the training details a coach needs are shared, never your payment details, and they are not used to train AI models.
• Our event photographer: if you agreed to an event check-in photo, it is shared with the photographer for that event only to match you to its photos.
• Others where required by law, or with your consent.

Your information is stored securely and encrypted in transit. We take reasonable steps to protect it from misuse, loss and unauthorised access. Some of our providers store data outside Australia, including in the United States. We only use reputable providers with appropriate protections, and we hold them to the same standard we hold ourselves.

We only send marketing if you've opted in, and you can opt out at any time using the link in our emails or by contacting us. Account and safety messages are not marketing and will still be sent.

You can ask to access or correct the personal information we hold about you. Contact us and we'll help. If you're not satisfied with how we've handled your information, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

We keep your information for as long as you're a member and for a reasonable period afterwards to meet legal, tax and safety obligations, then we remove or de-identify it.

Event check-in photos are kept privately and deleted within 60 days of the event. You can ask us to delete yours sooner at any time.

Deleting your account. You can delete your account and personal data yourself at any time from Profile → Delete account in the app, or by emailing hello@kvzperformance.com. When you delete your account we remove your profile and personal details (name, contact, health answers, emergency contact) and sign you out.

If you still have an active membership, you'll be asked to cancel it first. A membership with a notice period stays active, and is billed, until the end of that notice; you can delete your account once it has ended. Deleting your account is not a way to end a membership without notice.

We keep the records we're legally required to hold even after you delete your account, for example payment and tax records (retained by our payment provider, Stripe) for the period required under Australian law. These are kept for compliance only.

The app uses essential cookies to keep you signed in and to remember your preferences. It doesn't use them for third-party advertising.

Our public website pages use Vercel Web Analytics, which counts page views without cookies and without identifying you. They may also use Google Analytics and Microsoft Clarity to understand how visitors use the site, for example which pages are popular and where people get stuck. Those two tools may set their own cookies and record general usage such as pages viewed and clicks.

Our public pages may also use the Meta (Facebook) Pixel to measure the results of our social media advertising and to reach people who have visited our site. This shares limited information with Meta, such as the pages you viewed and whether you made a booking. Meta may use this to show you our ads and to build advertising audiences. You can manage this through your Facebook and Instagram ad settings.

We do not run any of these tools inside the logged-in app, so your membership, booking, and health information is never sent to them.

Members under 16 join with a parent or guardian, who signs their waiver. In our chats, members under 16 cannot send or receive photos, files or links, and they cannot be sent private messages by adult members. A parent or guardian can ask us about their child's information at any time.

If you live in the EU or the UK, the General Data Protection Regulation (GDPR, and the UK GDPR) also applies to how we handle your information. KVZ Performance Pty Ltd is the controller of your personal data.

Why we use your information. To provide the membership you signed up for (performance of a contract); to keep our service safe, secure and working well (our legitimate interests); to meet legal and tax obligations (legal obligation); and, for marketing, only with your consent. Your health answers are special category data, and we only use them with your explicit consent, which you give when you complete them, to train you safely.

Your rights. You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, send it to you or another provider in a portable format, or stop using it where we rely on our legitimate interests. Where we rely on your consent, you can withdraw it at any time, and that does not affect anything we did before. We will reply within one month.

Transfers outside the EU and UK. We are based in Australia and our providers store data in Australia and the United States. Where your data leaves the EU or UK, we rely on the safeguards our providers offer, such as the European Commission's standard contractual clauses and the UK addendum to them, and on the transfer being needed to provide the service you asked for.

How long we keep it. As set out in section 8.

Complaints. Please contact us first and we will do our best to fix it. You also have the right to complain to the data protection authority where you live, or in the UK to the Information Commissioner's Office (ico.org.uk).

We may update this policy from time to time and will post the current version here. Questions or requests? Email hello@kvzperformance.com or call +61 7 3473 4333.