01 · Section
Introduction
Box N Sweat ("we", "us", "our") is committed to protecting the privacy and personal data of everyone who uses our website, books our community sessions, or participates in our schools programme. This policy explains what we collect, why we collect it, how we use it, and what your rights are.
Box N Sweat operates from the United Arab Emirates. We comply with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and, where applicable, the UK/EU General Data Protection Regulation (GDPR).
02 · Section
What Data We Collect
We collect different types of data depending on how you interact with us.
a) Website visitors
- Analytics data: IP address, browser type, device type, pages visited, time on site, referring URL. Collected via Google Analytics 4.
- Cookies: See our Cookies Policy for the full list.
b) Community session bookings
- Name, email, phone number when you complete a booking via our payment provider Ziina.
- Payment information is processed directly by Ziina. We do not store card details.
- Attendance records for the sessions you book.
c) Enquiries (corporate wellness, schools)
- Contact details and message content submitted via WhatsApp, email, or our contact forms.
d) Schools programme participants
- Pupil first name and last name, year group, class, gender, provided by the school under a Data Processing Agreement.
- Assessment scores, attendance, awards, recorded by our coaches during sessions.
- See Section 6 for how children's data is handled.
03 · Section
How We Use Your Data
We use your data only for the purpose it was collected for.
- Deliver services: confirm your booking, contact you about a session, run the schools programme.
- Improve our services: understand which parts of our website work, spot bugs, plan class capacity.
- Communicate with you: reply to enquiries, send schedule updates, follow up after a session.
- Legal and compliance: meet UAE regulatory requirements, respond to lawful requests.
We do not sell your data. We do not use your data for third-party advertising.
04 · Section
Legal Basis for Processing
Under GDPR (where applicable) and PDPL, we rely on the following legal bases:
- Contract: processing your booking, delivering the session you paid for.
- Consent: analytics cookies, marketing communications, photography.
- Legitimate interests: improving our service, security, fraud prevention.
- Legal obligation: tax records, safeguarding requirements for schools work.
Where consent is our basis, you can withdraw it at any time. See Section 8.
05 · Section
Sharing Your Data
We share data only with the following third parties, and only for the purposes described.
- Ziina (UAE payment provider): processes community session bookings and payments. Governed by their own privacy policy.
- Google Analytics 4 (Google Ireland Limited): website analytics. Data is aggregated and anonymised where possible.
- Neon (Postgres database, US/EU): stores schools programme data. Encrypted at rest and in transit.
- Vercel (US-based hosting for our schools tracker application): serves the coach dashboard. Data encrypted in transit.
- Schools we work with: pupil assessment reports are shared with the school's Director of Sport and the head teacher, under a Data Processing Agreement.
- Parents/guardians of enrolled pupils: their own child's assessment reports and certificates.
- Legal authorities: where required by UAE law.
06 · Section
Children's Data & Schools Programme
We take the handling of children's data particularly seriously.
Consent
Before any pupil is added to our schools tracker system, we require:
- A signed Data Processing Agreement (DPA) between Box N Sweat and the school.
- Parental consent for their child's data to be processed by us, secured by the school.
What we collect on pupils
Minimum necessary data only: first name, last name, year group, class, gender, and their in-class assessment scores. We do not collect: dates of birth, medical information, home addresses, or parental contact details directly (schools handle parent contact).
Photography and video
Photos or video involving pupils are only taken with explicit parental consent obtained via the school. Any imagery used publicly (social media, marketing) is subject to a separate opt-in.
Right to withdraw
A parent or guardian can request their child's data be removed at any time by contacting the school or emailing us directly at hello@boxnsweat.com. Removal happens within 30 days.
07 · Section
How Long We Keep Data
- Community booking records: 7 years, for tax and accounting compliance.
- Enquiry emails: 2 years unless you become a regular customer.
- Analytics data: 14 months (GA4 default).
- Pupil assessment data: retained for the duration of the pupil's enrolment in the programme + 1 academic year, then anonymised for aggregate reporting only.
- Certificates issued: retained indefinitely as PDFs for pupils to re-download.
When retention periods expire, data is deleted or anonymised.
08 · Section
Your Rights
Under UAE PDPL and applicable GDPR, you have the following rights:
- Right of access: ask what data we hold about you.
- Right to rectification: ask us to correct inaccurate data.
- Right to erasure: ask us to delete your data, subject to legal retention requirements.
- Right to restrict processing: ask us to pause processing while a query is resolved.
- Right to withdraw consent: where consent is the legal basis.
- Right to object: to processing based on legitimate interests.
- Right to data portability: receive a copy of your data in a machine-readable format.
To exercise any of these rights, email hello@boxnsweat.com. We respond within 30 days.
09 · Section
International Data Transfers
Some of our service providers (Google, Neon, Vercel) may store or process data outside the UAE, including in the US and EU. Where this happens:
- We use providers who commit to appropriate safeguards (Standard Contractual Clauses, or equivalent).
- Data is encrypted in transit and at rest.
- We keep transfers to what is strictly necessary for the service.
10 · Section
Security
We take reasonable steps to protect your data:
- TLS encryption for all data in transit (HTTPS).
- Encrypted database storage (schools tracker).
- Password-protected coach and admin accounts.
- Access limited to staff who need it to deliver the service.
- Regular backups.
No system is 100% secure. If a breach affecting your data occurs, we notify you and the relevant UAE authorities within 72 hours, in line with PDPL requirements.
11 · Section
Cookies
Our website uses cookies for essential functionality and analytics. Full details are in our Cookies Policy.
12 · Section
Changes to This Policy
We may update this policy from time to time. The "Last updated" date at the top will reflect the most recent revision. Material changes will be flagged prominently on the website. Continued use after a change constitutes acceptance.