Privacy Policy
Last Updated: 26 September 2026
Pilates Collective respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use, disclose, store and otherwise process personal data when you interact with Pilates Collective, including through our studios, websites, mobile applications, booking systems, memberships, customer support channels, social media accounts, events and other products or services.
This Privacy Policy is intended to be read in accordance with the Personal Data Protection Act 2010 of Malaysia ("PDPA"), as amended from time to time.
Who We Are
Pilates Collective is operated by:
Rockpool Health Sdn. Bhd.
Company Registration No.: 1384739-A / 202001028419
2-6, Verve Shop, 8, Jalan Kiara 5
Mont Kiara, 50480 Kuala Lumpur
Wilayah Persekutuan Kuala Lumpur
Malaysia
In this Privacy Policy, "Pilates Collective", "we", "us" and "our" refer to Rockpool Health Sdn. Bhd. and, where applicable, businesses or service providers acting on our behalf.
For privacy-related enquiries, you may contact us at:
Scope of This Privacy Policy
This Privacy Policy applies when you:
visit or use a Pilates Collective website or mobile application;
create an account;
purchase a membership, package, class, product or other service;
make, change or cancel a booking;
attend a Pilates Collective studio or event;
communicate with our customer support team;
communicate with us through email, telephone, SMS, WhatsApp, live chat or social media;
participate in surveys, promotions, competitions or events;
interact with advertisements or marketing relating to Pilates Collective; or
otherwise provide personal data to us.
Third-party websites, platforms and services that you access independently may be governed by their own privacy policies.
Personal Data We Collect
The personal data we collect depends on how you interact with Pilates Collective.
We may collect:
Identity and Contact Information
Such as:
full name;
date of birth;
gender;
telephone number;
email address;
residential or mailing address;
profile photograph; and
other account or identification information you choose to provide.
Account and Membership Information
This may include:
account details;
preferred studio location;
membership or package type;
membership status;
class credits;
booking history;
attendance history;
waitlist activity;
class preferences;
instructor preferences;
referrals;
promotional eligibility;
loyalty benefits; and
other information relating to your use of Pilates Collective services.
Transaction and Payment Information
We may collect:
purchase history;
billing information;
transaction records;
refunds;
payment status; and
limited payment-method information.
Payment card and banking information may be collected and processed directly by our third-party payment providers.
We generally do not store complete payment card numbers where payment is processed through an external payment provider.
Communications and Customer Support Information
When you communicate with us, we may process:
the content of your communications;
your contact details;
dates and times of communications;
booking or membership details relevant to your enquiry;
complaints or feedback;
records of customer support interactions; and
related information necessary to respond to or investigate your request.
This may include communications through WhatsApp, email, telephone, live chat, in-app messaging or social media.
Reviews, Surveys and User-Submitted Content
We may collect information that you submit through:
ratings;
feedback forms;
surveys;
testimonials;
reviews;
competitions;
promotions;
referral programmes; and
other voluntary submissions.
Please do not provide personal information about another person unless you have the authority or appropriate permission to do so.
Health and Fitness Information
Because we provide physical fitness and wellness services, you may provide information relating to:
injuries;
pregnancy;
physical limitations;
medical conditions;
mobility;
previous surgery;
allergies;
fitness history; or
other information relevant to your safe participation in our services.
Some of this information may constitute sensitive personal data under the PDPA.
We may collect and use this information where reasonably necessary to:
protect your health and safety;
understand any physical limitations relevant to participation;
modify exercises where appropriate;
respond to an emergency;
administer our services; or
comply with legal requirements.
Where required by law, we will obtain your consent before processing sensitive personal data.
Our instructors and staff are not a substitute for your doctor or other qualified healthcare professional. You remain responsible for informing us of relevant circumstances affecting your ability to participate safely.
Information We Collect Automatically
When you use our websites, mobile applications or digital services, we may automatically receive information including:
IP address;
browser type;
operating system;
device type;
device identifiers;
application version;
language settings;
approximate location, such as city or country;
pages or screens viewed;
links or buttons clicked;
search activity;
booking activity;
access dates and times;
referring website;
error logs;
session information; and
other technical and usage information.
We use this information to operate our services, improve performance, understand how our services are used, detect problems and protect the security of our systems.
Precise Location
If a feature of our mobile application uses precise device location, we will request the permissions required by your device or applicable law.
You may normally disable location permissions through your device settings. Certain location-based features may not function correctly if location access is disabled.
Information We Receive From Other Sources
We may receive personal data about you from third parties, including:
booking and scheduling platforms;
payment providers;
social media platforms;
corporate wellness partners;
referral partners;
advertising and analytics providers;
affiliated companies;
studios or business partners;
people who refer you to Pilates Collective; and
other service providers.
For example, if you book a Pilates Collective class through a third-party platform, that platform may provide information necessary for us to manage your booking and attendance.
Third parties are responsible for handling information they collect directly from you in accordance with their own privacy policies and applicable laws.
How We Use Personal Data
We may collect, use and otherwise process personal data for the following purposes.
Providing Our Services
Including to:
create and administer your account;
register your membership;
process bookings;
manage class credits;
maintain attendance records;
process payments and refunds;
administer waitlists;
provide classes and other services;
manage cancellations and no-shows;
provide customer support; and
communicate with you about your account or bookings.
Safety and Studio Operations
Including to:
help provide classes safely;
understand relevant health or physical limitations that you choose to disclose;
manage incidents;
maintain studio security;
protect customers and staff; and
respond to emergencies.
Communications
We may communicate with you through channels including:
email;
SMS;
telephone;
WhatsApp;
push notifications;
in-app messages; and
other messaging services.
Communications may include booking confirmations, reminders, schedule changes, membership information, payment information, security notices and customer support responses.
Personalisation
We may use information about your activity and preferences to:
remember your preferences;
recommend studios, classes or services;
personalise your digital experience; and
improve the relevance of communications and promotions.
Marketing
Subject to the PDPA and other applicable requirements, we may use personal data to:
send promotional communications;
tell you about new studios or services;
advertise promotions and events;
administer referral programmes;
measure campaign effectiveness;
personalise marketing; and
show advertising that may be relevant to your interests.
Where consent is required, we will obtain it.
Analytics and Service Improvement
We may use personal data to:
understand customer behaviour;
analyse attendance and booking patterns;
measure service performance;
improve studio operations;
improve our websites and applications;
develop new classes, services or features;
conduct internal research;
test new functionality; and
prepare reports and business analytics.
Where practicable, we may use aggregated or anonymised information for these purposes.
Security and Fraud Prevention
We may process information to:
verify accounts;
detect suspicious activity;
prevent fraud;
investigate violations of our terms;
protect our systems;
protect our customers, instructors and employees; and
establish, exercise or defend legal claims.
Business Administration and Legal Compliance
We may process information for:
accounting;
audit;
taxation;
insurance;
legal compliance;
regulatory requirements;
record keeping;
corporate governance;
dispute resolution; and
business transactions.
We may also process your personal data for another purpose disclosed to you at the time it is collected or otherwise permitted by law.
Consent and Withdrawal of Consent
Where required under the PDPA, we may rely on your consent to collect, use or disclose your personal data.
You may withdraw your consent by contacting us at:
support@pilatescollectivegroup.com
Withdrawal of consent will not affect any processing that lawfully occurred before the withdrawal.
Depending on the nature of the information concerned, withdrawing consent may affect our ability to provide certain services to you.
Marketing Preferences
You may opt out of promotional communications from Pilates Collective at any time.
Depending on the communication channel, you may do so by:
selecting the unsubscribe link in an email;
following the opt-out instructions provided in a message;
changing your notification preferences where available; or
contacting support@pilatescollectivegroup.com.
If you opt out of marketing, we may still send non-promotional communications necessary for the operation of your membership or account, including:
booking confirmations;
class reminders;
cancellations;
receipts;
billing notices;
account notices;
security notifications; and
important legal or service-related communications.
We may retain limited information necessary to record and honour your marketing preference.
Cookies and Similar Technologies
Our websites and applications may use cookies and similar technologies, including:
cookies;
pixels;
web beacons;
local storage;
mobile advertising identifiers; and
software development kits ("SDKs").
These technologies may be used for:
Essential Functions
To provide core functionality, maintain sessions, remember settings and operate our services.
Analytics and Performance
To understand how people use our services, identify technical issues and measure performance.
Functionality and Personalisation
To remember preferences and provide more relevant experiences.
Marketing and Advertising
Where permitted, to measure marketing campaigns, understand interactions with advertisements and provide more relevant advertising.
Some technologies may be provided by third parties.
Where required by law, we will request consent before using non-essential tracking technologies.
You may also be able to control cookies through your browser, device settings or any consent management tools that we make available.
Disabling certain technologies may affect the functionality of our services.
CCTV and Studio Security
Pilates Collective locations may use closed-circuit television ("CCTV") or other security systems in appropriate areas.
CCTV footage may be processed for:
safety;
security;
access control;
loss prevention;
investigation of incidents;
protection of customers, employees and property; and
establishment or defence of legal claims.
CCTV will not be intentionally placed in areas where individuals reasonably expect a high level of privacy, such as toilets or changing areas.
Footage will be retained only for an appropriate period unless it is required for an investigation, legal claim or other legitimate reason.
When We Share Personal Data
We may disclose personal data where reasonably necessary for the purposes described in this Privacy Policy.
Service Providers
We may engage service providers for services including:
booking and scheduling;
payment processing;
customer relationship management;
customer support;
communications;
WhatsApp or messaging infrastructure;
cloud hosting;
information technology;
cybersecurity;
accounting;
analytics;
marketing;
advertising;
surveys;
data storage; and
professional services.
These providers may process personal data on our behalf or for specified purposes.
Some technology providers may use artificial intelligence or machine-learning systems as part of the services they provide. Where such services process personal data on our behalf, we expect them to handle that data in accordance with applicable contractual and legal requirements.
Booking and Business Partners
Where you access our services through a third-party booking service, corporate programme, wellness platform or other partner, we may exchange information with that partner where reasonably necessary to:
confirm your eligibility;
process a booking;
verify attendance;
administer payment;
resolve disputes; or
provide the relevant service.
Professional Advisers
We may disclose data to:
lawyers;
accountants;
auditors;
insurers;
consultants; and
other professional advisers.
Authorities and Legal Disclosures
We may disclose personal data where required or permitted by law, including to:
courts;
regulators;
government authorities;
law enforcement agencies; or
other legally authorised parties.
We may also disclose data where reasonably necessary to establish, exercise or defend legal rights or protect the safety of individuals.
Business Transactions
If Pilates Collective or any relevant part of our business undergoes or considers a:
merger;
acquisition;
financing;
restructuring;
reorganisation;
sale of assets;
investment;
insolvency; or
similar corporate transaction,
personal data may be disclosed to relevant parties, advisers and potential counterparties where permitted by law.
If responsibility for your personal data is transferred to another organisation, we will comply with applicable notification and data protection requirements.
International and Cross-Border Transfers of Personal Data
Pilates Collective may use service providers, technology platforms and business partners located outside Malaysia.
As a result, personal data may be transferred to, accessed from or stored in countries outside Malaysia.
This may occur, for example, where we use:
cloud-hosting providers;
payment providers;
customer support platforms;
booking and scheduling systems;
messaging and communications providers;
analytics providers;
marketing platforms; or
other technology service providers with international infrastructure.
Where personal data is transferred outside Malaysia, we will take reasonable steps to ensure that the transfer is carried out in accordance with the PDPA and applicable requirements relating to cross-border transfers.
Depending on the circumstances, this may include:
assessing whether the receiving country provides an adequate level of protection;
imposing contractual obligations on recipients;
implementing appropriate technical and organisational safeguards;
obtaining consent where required; or
relying on another transfer mechanism permitted by law.
Data Security
We use reasonable administrative, organisational, physical and technical measures designed to protect personal data against:
unauthorised access;
unauthorised disclosure;
loss;
misuse;
alteration;
destruction; and
other unauthorised processing.
Measures may include, where appropriate:
access controls;
authentication;
staff access restrictions;
secure communications;
vendor management;
backups;
system monitoring; and
internal security procedures.
No method of electronic transmission or storage is completely secure, and we therefore cannot guarantee absolute security.
Personal Data Breaches
We maintain procedures intended to identify, assess and respond to personal data breaches.
Where required under the PDPA or applicable regulatory requirements, we will notify the relevant authority and/or affected individuals of a personal data breach within the required timeframe.
Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected or as required for legitimate business or legal purposes.
The appropriate retention period may depend on:
the type of information;
why we collected it;
whether you continue to have an account or membership;
legal limitation periods;
accounting and tax requirements;
contractual requirements;
safety considerations; and
regulatory requirements.
When we no longer have a legitimate reason to retain personal data, we will take reasonable steps to:
securely delete it;
destroy it;
anonymise it; or
restrict it from further processing until deletion is practicable, such as where information remains temporarily in secure backup systems.
Anonymised and Aggregated Information
We may convert information into aggregated, statistical or anonymised form so that it no longer reasonably identifies an individual.
We may use such information for purposes including:
analytics;
research;
service improvement;
business planning;
reporting;
operational analysis; and
understanding fitness and booking trends.
Where information has been properly anonymised so that it is no longer personal data, this Privacy Policy may no longer apply to that information.
Your Rights Under the PDPA
Subject to the PDPA and any applicable exceptions, you may have the right to:
request access to personal data that we hold about you;
request correction of personal data that is inaccurate, incomplete, misleading or outdated;
withdraw consent where we rely on your consent;
request that we cease certain uses of your personal data where provided by law;
opt out of direct marketing communications; and
exercise any other rights available under the PDPA.
To exercise a privacy right, contact:
support@pilatescollectivegroup.com
Please describe your request clearly.
We may request information necessary to verify your identity before fulfilling your request.
We will respond in accordance with the timelines and requirements prescribed by applicable law.
Children and Minors
Our standard memberships and digital services are primarily intended for adults.
Where Pilates Collective permits a minor to participate in a class or use a service, we may require consent or authorisation from a parent or legal guardian where appropriate.
We may process limited information concerning the minor for:
registration;
booking;
safety;
emergency contact;
payment; and
administration of the relevant service.
If you believe that a minor has provided personal data to us without appropriate authorisation, please contact:
Third-Party Services
Our websites, applications or communications may contain links to or integrations with third-party services.
These may include:
booking platforms;
payment services;
social media platforms;
map services;
messaging services;
app stores;
analytics providers; and
corporate wellness platforms.
When you interact directly with a third party, that party may independently collect and process personal data.
Their handling of your information is governed by their own privacy policies and is outside our control, except where they process information on our behalf.
We encourage you to review the privacy practices of third-party services that you use.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to:
our business;
our studios;
our services;
our technology;
our data practices; or
applicable laws and regulatory requirements.
The Last Updated date at the top of this Privacy Policy indicates when it was most recently revised.
Where appropriate, we may provide additional notice of material changes through our website, application, email or other communication channels.
Contact Us
Questions, requests or complaints about this Privacy Policy or the way Pilates Collective handles personal data may be directed to:
Pilates Collective
Rockpool Health Sdn. Bhd.
Company Registration No.: 1384739-A / 202001028419
Headquartered at:
2-6, Verve Shop, 8, Jalan Kiara 5
Mont Kiara, 50480 Kuala Lumpur
Wilayah Persekutuan Kuala Lumpur
Malaysia
Email: support@pilatescollectivegroup.com
Please include sufficient information for us to understand and respond to your request.
Where applicable, you may also have the right to lodge a complaint with the relevant Malaysian personal data protection authority.
