Privacy Policy.

Information We Collect

We collect personal data only to the extent reasonably necessary to operate the club, deliver our services, comply with the law, and protect our legitimate business interests. The categories below describe what we may collect.

• IdentificationFull legal name, date of birth, gender, nationality, citizen identification card number, passport number (for foreign residents), and emergency-contact details.
• ContactEmail address, phone number (Vietnam or international), WhatsApp identifier, postal address, and preferred language.
• MembershipSelected plan, commitment term, application answers (fitness goals, length of stay, profile), referral source, member ID, access-card or fingerprint identifier.
• PaymentPayment confirmation references, transaction amount, transfer date and bank-side proof. We do not store full bank-card numbers, CVV codes, or banking credentials.
• Health & FitnessPre-participation health declaration, declared injuries or medical conditions, body-composition scan results (where used), and any information you voluntarily share with our coaches.
• ImageryPhotographs and video recordings captured at the facility for security (CCTV) and, where you have consented, for marketing.
• Website & DeviceIP address, browser type and version, operating system, pages viewed, time and date of visit, referring URL, and limited cookie data (see §12).

Sensitive Personal Data

Some of the data we collect is classified as "sensitive personal data" under Article 2 of Decree 13/2023/ND-CP and the 2026 Personal Data Protection Law. This includes, in particular: health information, biometric identifiers (such as fingerprint or facial-recognition data used for facility access), and body-composition or physical-measurement data.

We process sensitive data only for the purposes set out in §3 (membership operation, member safety, programme design, and legal compliance) and apply heightened security and access-control measures as required by law.

How We Use Your Data

We use your personal data for the following purposes only:

• To review and approve membership applications and to onboard you to the club.
• To verify payments, activate access, manage renewals and process pause or cancellation requests.
• To grant and control facility access using member ID, access-card or biometric identifiers.
• To deliver coaching, body-composition assessments and other contracted services safely and effectively.
• To respond to questions, provide customer support and send service-related notifications (membership updates, scheduled maintenance, closure notices).
• To safeguard members and staff, prevent and investigate misconduct, and operate CCTV for security.
• To improve our services, programmes and website.
• To comply with applicable laws, including tax, accounting, public-security, labour and consumer-protection obligations.
• To establish, exercise or defend legal claims.
• To send marketing communications, where you have separately consented (see §13).

We do not sell, rent or trade your personal data, and we do not use your data for automated decisions producing legal or similarly significant effects on you.

Lawful Basis for Processing

Under Vietnamese law, we rely on one or more of the following bases each time we process your personal data:

• Your consent, freely given and capable of being withdrawn, for sensitive personal data, marketing communications, and certain optional uses.
• Performance of a contract with you, including processing your application, activating your membership and providing the services you have purchased.
• Compliance with a legal obligation binding on us, including tax, accounting, anti-money-laundering and public-security record-keeping rules.
• Protection of life, health and safety of members or staff in emergencies.
• Our legitimate interests, where these are not overridden by your fundamental rights and freedoms (e.g. CCTV, facility security, fraud prevention, internal record-keeping, defending legal claims).

Storage & Security

Personal data is stored on systems operated either by EVOLVE or by carefully selected third-party processors, including database hosting providers, email and messaging providers, and accounting software. All processors are bound by written agreements requiring them to protect personal data to standards consistent with Vietnamese law.

We apply technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit (HTTPS/TLS).
• Access control on a need-to-know basis.
• Multi-factor authentication on administrative accounts where available.
• Physical security of premises and storage of paper records.
• Periodic review of access logs and security configuration.
• Staff training on confidentiality and data-handling.

No system is perfectly secure. In the event of a personal-data breach causing a risk to your rights, we will notify the competent Vietnamese authority and, where required by law, the affected data subjects, within the timeframes prescribed by the Personal Data Protection Law.

Sharing & Disclosure

We share your personal data only in the limited circumstances below:

• Service providers who process data on our behalf (hosting, payment confirmation, email and messaging, accounting, IT support). These providers are contractually required to protect your data and use it only for the purposes we instruct.
• Coaches and trainers engaged by EVOLVE, where necessary to deliver the programmes you have selected.
• Public authorities and regulators, when required by Vietnamese law, court order, or in response to a valid request from competent authorities (including the Ministry of Public Security, tax authorities and consumer-protection authorities).
• Professional advisors (lawyers, auditors, insurers) under duties of confidentiality, where reasonably necessary.
• Successors, in connection with a corporate transaction such as a merger, acquisition or transfer of the business, in which case successors will be bound by terms at least as protective as this Policy.

We do not disclose your personal data to any other third party without your prior consent.

Cross-Border Transfer

Some of our service providers operate infrastructure outside Việt Nam. Where personal data is transferred abroad, we comply with the cross-border transfer requirements of the Personal Data Protection Law and Decree 13/2023/ND-CP, including the preparation of a Transfer Impact Assessment dossier and notification to the competent authority where applicable.

By using our services and providing your data, you acknowledge that limited transfers of this kind may occur. You may contact us at any time for further information about the safeguards applied to your data.

Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including any legal, accounting or reporting requirements.

• Active members: throughout the membership and any pause periods.
• Former members: up to 24 months after the end of the last membership for service-history purposes, unless a longer retention is required by law.
• Accounting and tax records: 10 years, in accordance with the Vietnamese Law on Accounting.
• CCTV footage: typically 30 days, unless required for an ongoing investigation or legal claim.
• Marketing data: until you withdraw consent or object to receiving marketing communications.
• Sensitive personal data: deleted promptly when the underlying purpose no longer applies, unless retention is mandated by law.

When personal data is no longer needed, it is securely deleted, anonymised, or destroyed.

Your Rights

Under Vietnamese law you hold the following rights in relation to your personal data:

• Right to be informed about how your personal data is processed.
• Right of access to the personal data we hold about you.
• Right to rectification if your personal data is inaccurate or incomplete.
• Right to erasure, where the data is no longer necessary, your consent has been withdrawn, or processing is unlawful, subject to legal exceptions.
• Right to restrict processing in certain circumstances.
• Right to object to processing based on our legitimate interests, including objection to direct marketing.
• Right to data portability, where technically feasible.
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint with the competent Vietnamese data-protection authority (currently the Ministry of Public Security).

To exercise any of these rights, contact us using the details in §15. We will respond within the timeframe prescribed by law and may need to verify your identity before disclosing personal data.

Photos & Video on Premises

The facility is monitored by closed-circuit television (CCTV) cameras for security and member-safety purposes. CCTV footage is held under the retention rules in §8 and is accessible only to authorised personnel.

Separately, EVOLVE may capture photos or video at the facility for marketing or editorial use. We will obtain your consent before using any image in which you are identifiable for these purposes. You may withdraw consent at any time, in which case we will cease future use and remove the relevant content from active marketing channels within a reasonable period (note that some content already published online or in print may not be fully recoverable).

Members and guests may not photograph or record other members or staff without their explicit consent.

Children & Minors

EVOLVE is intended for adult members. Minors aged 16 and 17 may apply only with the written consent of a parent or legal guardian, who must accept this Policy and our Terms on their behalf. We do not knowingly collect personal data from children under the age of 16. If you believe we have collected such data, please contact us and we will delete it promptly.

Cookies & Analytics

Our website uses a small number of cookies and similar technologies to deliver core functionality (such as remembering your preferences) and to understand aggregate traffic patterns through privacy-respecting analytics. We do not use intrusive ad-tracking and we do not sell behavioural data.

You can disable or remove cookies in your browser at any time. Some site features may not work correctly without them.

Marketing Communications

We will only send you marketing messages (newsletters, club news, exclusive offers, events) if you have separately opted in. Each marketing message will include a clear unsubscribe link or instruction. Withdrawing marketing consent does not affect any service-related communications you receive as a member.

Changes to This Policy

We may update this Privacy Policy from time to time, in particular to reflect changes in Vietnamese law, our services or our internal practices. The "Effective" date at the top of this page indicates when the current version came into force. Material changes will be notified to active members by email or in-club posting at least fifteen (15) days before they take effect.

Contact & Complaints

If you have a question about this Policy, want to exercise one of your rights, or wish to lodge a complaint about how we have handled your personal data, please contact us first. We are committed to resolving privacy concerns promptly and fairly.

If you are not satisfied with our response, you may also contact the competent Vietnamese data-protection authority (currently the Ministry of Public Security · Cục An ninh mạng và Phòng, chống tội phạm sử dụng công nghệ cao / A05) or any other authority designated by law.