BFT Privacy Policy – Middle East & North Africa (MENA)

This BFT Privacy Policy describes how Body Fit Training (“BFT”, “we”, “us”, or “our”) collects, discloses, and uses personal information. This BFT Privacy Policy supplements the Xponential Privacy Policy and applies to personal information we collect via our website (www.bftmiddleeast.com) or any other product or service where this BFT Privacy Policy is displayed, and offline, including BFT’s physical locations and studios, and programs and events operated by or in partnership with us. For purposes of this BFT Privacy Policy, the term “personal information” has the same meaning as the equivalent term is defined under applicable laws in the MENA region. We encourage you to read this BFT Privacy Policy carefully and review it regularly for any updates to better understand how we handle your personal information.

Summary of this Privacy Policy

This section summarizes the Privacy Policy – which describes our data handling practices in more detail, below – and is intended to provide a quick reference related to our collection and use of your personal information

• What Personal Information We Collect: We may collect identifiers; characteristics of protected classifications; commercial information; internet or other electronic network activity information; payment information; biometric information; geolocation data; professional or employment-related information; and sensitive personal information.
• How We Collect and Use Your Personal Information: We typically collect personal information directly from you, including via cookies or other tracking technologies, but we may also collect information from our corporate parent, business partners, vendors, or other third parties. We use this information, consistent with this BFT Privacy Policy, to provide our products and services, improve offerings, maintain business relationships, promote our services, comply with applicable laws, or for other purposes with your consent.
• How We Protect and Retain Your Personal Information: We use reasonable security measures to protect your personal information; however, no system can be 100% secure. We retain personal information as long as necessary to fulfill the purposes for which it was collected or as required by law.
• Selling and Sharing Your Personal Information: We may share certain categories of personal information (e.g., identifiers for advertising purposes). You may opt-out by completing our online request form (Your Privacy Choices Request Form).

What Personal Information We Collect

We may collect the following categories of personal information from and about you:

• Identifiers: such as name, email address, IP address.
• Characteristics of protected classifications:such as your age and gender.
• Commercial Information: such as products or services purchased, obtained, or considered.
• Internet or other electronic network activity information: such as information regarding your interaction with our Online Services.
• Payment Information: such as credit or debit card number and other payment or financial information.
• Geolocation data: such as information collected through GPS technology.
• Sensitive personal information: as defined under applicable privacy laws and for purposes as permitted by law or with your consent, which may include exercise habits, metabolic information, consumer health data, and precise geolocation data.

How We Collect Your Personal Information

We may collect personal information from different sources, including:

• Directly from you:such as when you complete forms, register or purchase products and services, sign up to receive emails or text messages, contact us, book or attend a session, use connected equipment in our studios, make a payment, or visit our Online Services or our physical locations, studios and events.
• Indirectly from you: including when you interact with our Online Services, such as when certain information is automatically collected using online tracking technologies, such as pixels, cookies, and web beacons, or when you use Wi-Fi services provided by us in our physical locations or studios.
• From our corporate parent, franchisees, and studios: such as when you register for and attend classes or sessions, promotional events, or otherwise interact with our franchisees or studios.
• From our business partners: such as when we collaborate or co-sponsor events with other businesses with which we partner.
• From our vendors: such as our service providers that collect your personal information on our behalf, including data analytics companies.
• From third parties and other sources: such as social media platforms and online advertising networks.

How We Use or Process Your Personal Information

We endeavor to process only such personal information as is reasonably needed to fulfill the purposes for which it has been collected, which may include one or more of the following business purposes:

• To provide or improve our products and services or to fulfill the purpose(s) for which your information is collected, including providing you with information, products or services that you request.
• To process payment or financial transactions, including to facilitate new product orders or process returns.
• To analyze your use of our products and services, including how you interact with our Online Services, in order to improve the same, personalize your experience and provide recommendations, customize advertising and marketing campaigns, and otherwise to better understand your needs.
• To respond to your requests or questions, such as when you reach out to us using our “Contact Us” page and otherwise when you interact with us.
• To communicate with you, including to provide you with email alerts, event registrations, and other notices concerning our products or services, or events or news that may be of interest to you.
• To contact you regarding scheduling, class or session reminders.
• To market and advertise to you, including sending promotional communications via email, text messages, push notification, or other means, to show you advertisements on the Online Services, social media, and other platforms or websites for products and/or services tailored to your interests.
• To conduct or provide other programs, such as surveys, contests, or promotional campaigns.
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections.
• As necessary or appropriate to protect the rights, property or safety of us, our clients or others.
• To respond to requests from authorities and as required by applicable law, regulatory requirements, or court orders in the MENA region
• As described to you when collecting your personal information.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
• For any other purpose for which you provide consent, or as otherwise required or permitted by law.

To the extent we collect your sensitive personal information, we do not use or disclose such information for purposes other than those permitted under applicable MENA laws.

Our Legal Bases to Use or Process Personal Information

Some jurisdictions require that organizations have a “lawful basis” for processing or transferring any personal information. BFT MENA has several such lawful bases for processing and transferring the information outlined above. Specifically:

• When you request or purchase services from us, or submit your contact information to receive communications from us, we process your personal information to fulfill your request, perform under such contract, and/or communicate with you.
• We have a legitimate business interest in ensuring that the Website (www.bftmiddleeast.com) continues to function efficiently and effectively, and to enhance its functionality in response to how visitors use the Website, and in ensuring that our services are offered and operate as expected.
• When you direct us to disclose information to our corporate parent, business partners, or other third parties, we process your information to fulfill your request.
• To the extent that certain processing activities, or the processing of certain personal information (e.g., sensitive personal information), requires us to seek your consent, we have done so (or will do so, as necessary).
• We may need to process your personal information in order to comply with applicable legal requirements or to assert legal rights or defenses under the laws of the MENA region.

To Whom We Disclose Your Personal Information

We may disclose personal information to different persons for various purposes, consistent with this BFT Privacy Policy, which may include the following:

• Our corporate parent, affiliates, franchisees, and studios.
• Business partners or other third parties, including for promotional purposes and to serve or display advertising.
• Vendors and service providers, including to perform certain services and/or support internal or other business operations.
• Successor(s) of our business, relating to all or part of the business, to evaluate proposed transactions or conduct a sale, reorganization, merger, acquisition, or other change of control.
• Government, regulatory, or investigatory bodies, or other law enforcement entities, including for purposes of complying with applicable law, court order, or regulatory requirements in the MENA region.

Your Privacy Rights

Depending on applicable laws or the jurisdiction you reside in within the MENA region, you have certain rights regarding your personal information, which may include the right to:

• Access, know about, or confirm processing of your personal information, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, sharing, or otherwise processing personal information, the categories of third parties to whom the business discloses personal information, and the specific pieces of personal information the business has collected about you.
• Correct inaccurate personal information we maintain about you.
• Delete your personal information.
• Receive a copy of your personal information in a portable format, where technically feasible.
• Restrict, object to, or otherwise limit the use and disclosure of your information, including sensitive personal information.
• Not be subject to a decision based solely on automated processing, including profiling.
• Lodge a complaint with the relevant supervisory authority in your jurisdiction.

If you provided consent to us, you have the right (in certain circumstances) to withdraw that consent at any time; however, such withdrawal will not affect the lawfulness of the processing before your consent was withdrawn.
Some of these rights may be limited when certain exceptions are provided under applicable laws, including to complete a transaction or to comply with a legal obligation. You will not receive discriminatory treatment for exercising your privacy rights.
You may also enable the Global Privacy Control (GPC) to exercise your opt-out preferences, if your browser or browser extension supports such a signal. The GPC may apply only to a single browser or device, and you may need to turn on the GPC signal for each browser that you use. For more information about GPC, please visit https://globalprivacycontrol.org/.

How to Exercise Your Privacy Rights

To exercise your privacy rights, please submit a request by either visiting and completing our online request form (Your Privacy Choices Request Form) or contacting us at our MENA office contact points (phone and email to be provided on our website). To exercise your right to access, correct, or delete personal information, you will need to submit a verifiable request, and we may request additional information to verify your identity before we can respond to your request.
You may designate an authorized agent to submit privacy rights requests on your behalf. Authorized agents will be required to provide proof of their authority to act on your behalf by providing relevant documentation. We may contact you to confirm an authorized agent’s representation and to verify your identity.

International Transfers of Personal Information

We primarily store the information described above in the countries in which BFT MENA operates. You should only submit information to us if you are comfortable that your data may be stored in, or transferred to, jurisdictions which may have different levels of privacy protection than your country. We will use a lawful mechanism, such as standard contractual clauses or other legally recognized transfer methods, to transfer personal information across borders, consistent with this BFT Privacy Policy. By submitting your personal information through the Website (www.bftmiddleeast.com) or otherwise providing it to us, you acknowledge the possibility of such transfers for the purposes described in this BFT Privacy Policy.

Region-Specific Privacy Information

BFT MENA is committed to protecting your personal information in accordance with applicable local privacy laws in the countries where we operate. We may disclose the categories of personal information listed in “What Personal Information We Collect” for legitimate business purposes, including to our affiliates, brands, service providers, and third parties with whom you have authorized such disclosure. The categories of personal information that may be shared with business partners, service providers, or third parties include:

Categories of Personal Information	Categories of Recipients
Identifiers, including device information and other unique identifiers	Business partners, service providers, and third parties, such as advertising networks, analytics companies, and social media networks
Commercial information	Business partners, service providers, and third parties, such as advertising networks, analytics companies, and social media networks
Internet or other electronic network activity information	Business partners, service providers, and third parties, such as advertising networks, analytics companies, and social media networks
Geolocation data	Business partners, service providers, and third parties, such as advertising networks, analytics companies, and social media networks

We do not knowingly share the personal information of individuals under the age of 16. For more information, please see the section on “How to Exercise Your Privacy Rights.”

Notice of Financial Incentive

We may provide certain discounts, special offers, benefits, or other rewards as part of our voluntary loyalty program, which may be interpreted as a “financial incentive” or “bona fide loyalty program” under applicable laws in the MENA region, when we collect your personal information, which may include your name, contact information, address, or birthday. Joining this voluntary program is subject to our Terms and your opt-in consent. The value of your personal information may vary depending on the types of special offers, benefits, or other rewards that are available and you choose to participate in, and it is reasonably related to the incentives that we offer. You may withdraw from a financial incentive at any time by contacting us through the contact information provided on our website (www.bftmiddleeast.com).

How We Protect Your Personal Information

We use reasonable security measures that are designed to protect your personal information from unauthorized access and use, which may include using access controls and using Secure Socket Layer (SSL) technology to encrypt certain sensitive information. However, no system of transmission or storage of data can be 100% secure. As such, we cannot guarantee the absolute security of your information. Moreover, we are not responsible for the security of information you transmit to us over networks that we do not control.

Retention of Your Personal Information

We retain your personal information for no longer than is reasonably necessary to fulfill the purposes described in this Privacy Policy or any other notice provided to you at the time your personal information is collected, and to comply with our legal obligations under applicable MENA laws.

Children’s Privacy

Our services are not directed to or intended for use by individuals under the age of 12. We do not knowingly collect personal information from individuals under the age of 12.

Third-Party Websites

To the extent our website (www.bftmiddleeast.com) may link to a third-party website, and if you choose to use such links, we are not responsible for the content of any third-party website, nor for the data collection or handling practices of such third parties, as we do not control such sites. We encourage you to review the privacy policy of any third-party website you visit.

Cookie Policy

We use tracking technologies, such as pixels, cookies, and web beacons, to ensure that those using our Online Services have the best possible experience. For more information about our cookie practices, please refer to our Cookie Policy.

How To Contact Us

If you have any questions about this BFT Privacy Policy, how we process your personal information, or have concerns about how we have handled your prior privacy requests, please email us at privacy@bftmiddleeast.com or contact us at:

Changes To This BFT Privacy Policy

We may revise or update this BFT Privacy Policy from time to time, including as required under applicable privacy laws in the MENA region or to incorporate changes to our privacy practices. Updates to this BFT Privacy Policy will be reflected in the “last updated” date, above.

Consumer Health Data Privacy Policy

Effective Date: January 10, 2025

This Consumer Health Data Privacy Policy (the “Policy”) supplements our Privacy Policy and applies only to “consumer health data” and “consumer” as the terms are defined under applicable laws in the MENA region. If you are not a consumer of BFT MENA services, this Policy does not apply to you.

What Consumer Health Data We Collect

We may collect the following categories of consumer health data if you choose to provide such information to us:

• Individual health conditions, treatment, diseases, or diagnosis.
• Social, psychological, behavioral, and medical interventions.
• Health-related surgeries or procedures.
• Use or purchase of prescribed medication.
• Bodily functions, vital signs, symptoms, or measurements of health information.
• Diagnoses or diagnostic testing, treatment, or medication.
• Reproductive or sexual health information.
• Biometric data.
• Genetic data.
• Precise location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies.
• Data that identifies a consumer seeking health care services.
• Any inference of the categories of health data listed above derived or extrapolated from non-health information.

Note: Gender-affirming care information has been removed, as it may not be applicable or legally recognized across all MENA jurisdictions.

How We Collect Your Consumer Health Data

We may collect consumer health data from different sources, including:

• Directly from you, such as when you use our Online Services or complete a form online or in our physical locations.
• Business partners, such as persons or entities that are co-sponsors to events.
• Our affiliates and brands.
• From other third parties, such as vendors or service providers, marketing or digital advertising vendors.

Purposes for Collecting, Using, and Sharing Consumer Health Data

We may collect and use your consumer health data as described in the “How We Use or Process Your Personal Information” section of the Privacy Policy. We may primarily collect, use, and share your consumer health data to provide products or services that you request or to fulfill the reason for which your consumer health data is provided, such as to provide programs, classes, or sessions.

How We Share and Third Parties with Whom We Share Consumer Health Data

We may share the categories of consumer health data listed in “What Consumer Health Data We Collect” with the following categories of third parties:

• Business partners.
• Vendors or service providers.
• Other third parties.
• Our affiliates, brands, and franchisees operating in the MENA region.

We limit how third parties may collect your consumer health data over time and across different websites or online services when you use our Online Services.

Your Rights Regarding Consumer Health Data

Depending on applicable laws or the jurisdiction you reside in, and subject to certain limitations under applicable laws in the MENA region, you have certain rights regarding your consumer health data, which may include the right to:

• Confirm whether we collect or share your consumer health data and access such data.
• Receive a list of third parties with whom we have shared consumer health data.
• Withdraw consent regarding collection and sharing of your consumer health data.
• Delete your consumer health data.
• Appeal, if your request has been denied.

To exercise your privacy rights, please submit a request by visiting and completing our online request form (Your Privacy Choices Request Form) or contacting us via email at privacy@bftmiddleeast.com. When you submit a request, we may need to authenticate your identity, and if we are not able to authenticate your request, we may request additional information or may not be able to process your request.

Changes To This Policy

We may revise or update this Policy from time to time, including as required under applicable privacy laws in the MENA region. Updates to this Privacy Policy will be reflected in the “last updated” date above.