Personal Data Processing Policy

1. Who is responsible for processing

The controller of the personal data collected through the Tribe app and website ("Tribe") is A Plus Fitness LLC, a company organized under the laws of the State of New York, United States of America, which operates Tribe ("we"). Contact for anything related to personal data: info@tribelatam.com, subject "Personal data".

2. Who this policy applies to

It applies to every natural person who uses Tribe, creates an account, books or publishes a session, claims a digital pass or contacts us (the "data subject"). Tribe is intended for people aged eighteen (18) or older. We do not knowingly collect data from minors; if a parent or legal guardian informs us that a minor has given us data, we will delete it.

3. What data we collect

We collect only the data needed to provide the service:

• Account data: name, email address, phone or WhatsApp number, profile photo (optional), city or approximate area, disciplines of interest and, for instructors, the professional information the instructor chooses to publish; how you arrived at Tribe (the link, campaign or referral code you used) and, if someone invited you, who invited you.
• Digital pass data: name, WhatsApp number, email address, class preferences (for example type and time of day), the partner the pass is claimed with, the campaign or printed-material code of origin, and the date, time and text of the consent given.
• Usage data: sessions created, booked or attended, communities joined, messages sent inside the app.
• Technical data: IP address, device and browser type, device identifiers needed for notifications, access and error logs.
• Payments: where paid sessions exist, payment is processed by a specialized third party. Tribe does not store card numbers or banking credentials.

We do not request sensitive data (health, ethnic origin, sexual orientation, beliefs, biometric data). If a data subject chooses to include such information in a free-text field, they do so voluntarily and may remove it at any time.

4. What we use the data for

• To operate Tribe: create and manage the account, display instructors, gyms and sessions, and allow bookings and attendance.
• To connect the data subject with partner instructors, gyms and studios, including sending their contact details to the partner they choose when claiming a digital pass, so that partner can contact them and schedule their class.
• To send transactional communications: confirmations, reminders, passes, security notices and service changes.
• To send Tribe marketing communications about new sessions, instructors, partners and news. The data subject may opt out at any time via the link in each message or by writing to us.
• To prevent fraud and abuse, protect the security of the platform and its users, and comply with legal obligations.
• To measure how the service and our campaigns perform (for example, how many people arrived from a printed material), using aggregated data wherever possible.
• To run our referral program: when you join through someone's invitation link, we record that connection so we can credit the person who invited you.

5. Who we share data with

Partners (instructors, gyms and studios). When the data subject claims a digital pass or books a session, we share with the corresponding partner the data needed to contact them and deliver the class: name, WhatsApp number, email address and stated preferences. The data subject expressly authorizes this transmission by ticking the consent box on the pass or by booking. Each partner is an independent controller of its use of that data from that point on, within the authorized purpose. Tribe requires its partners to use the data only to contact the data subject about the requested class.

Processors. We use providers that process data on our behalf and under our instructions: hosting and database (Supabase, Inc., United States), web application hosting (Vercel, Inc., United States), transactional email (Resend, Inc., United States), product analytics (PostHog, Inc., United States), app stores (Apple and Google) and, when the data subject uses a WhatsApp button, WhatsApp LLC (Meta). These providers may not use the data for their own purposes.

Authorities. We will share data where a law, court order or competent authority requires it.

Tribe does not sell personal data and does not hand it to third parties for third-party advertising.

6. International data transfer

Data is stored and processed on servers located in the United States of America through the processors listed in section 5. By accepting this policy and giving consent, the data subject expressly and unequivocally consents to the international transfer and transmission of their personal data to that country for the purposes described here. We adopt contractual and technical measures so the data receives an adequate level of protection at its destination.

7. Rights of the data subject

Under article 8 of Law 1581 of 2012, the data subject has the right to:

• Know, update and rectify their personal data.
• Request proof of the consent given, except where the law does not require it.
• Be informed, upon request, of the use that has been made of their data.
• File complaints with the Superintendencia de Industria y Comercio for breaches of the law.
• Revoke consent and request deletion of their data where no legal or contractual duty requires keeping it.
• Access their personal data free of charge.

The data subject may exercise these rights personally, through their successors, through a representative or attorney-in-fact, or by stipulation in favor of another.

8. How to exercise these rights: inquiries and claims

Channel: info@tribelatam.com with the subject "Personal data", or from the app via the delete account option. The request must state the data subject's name, the registered email or WhatsApp number, a description of what is requested and, where applicable, supporting documents.

Inquiries. We will answer within a maximum of ten (10) business days from receipt. If that is not possible, we will explain why and state the date on which the inquiry will be answered, which will not exceed five (5) business days after the first term expires.

Claims. If the data subject believes their data should be corrected, updated or deleted, or that the law has been breached, they may file a claim. If it is incomplete, we will ask the claimant within five (5) days to complete it; after two (2) months without a response, the claim is deemed withdrawn. Once a complete claim is received, we will mark the record "claim in progress" and resolve it within a maximum of fifteen (15) business days, extendable by eight (8) additional business days with an explanation of the delay.

The data subject may only file a complaint with the Superintendencia de Industria y Comercio after exhausting the inquiry or claim process with Tribe.

9. How consent is given and kept

Consent is given when creating the account, booking a session, ticking the consent box on a digital pass, or through any unequivocal conduct that reasonably shows the data subject gave it. Tribe keeps proof of consent: the exact text the data subject accepted, the date and time, and the channel used.

10. Security

We apply reasonable technical, human and administrative measures to prevent alteration, loss, unauthorized or fraudulent access to or use of the data: encryption in transit, role-based and row-level access control in the database, least privilege, access logging and periodic review. No system is infallible; if an incident affecting personal data occurs, we will inform the affected data subjects and the authority where the law requires it.

11. Data retention

• Account data: while the account is active and up to twelve (12) months after deletion, unless a legal obligation requires longer retention.
• Digital pass data: up to twenty-four (24) months from creation, or earlier if the data subject requests deletion.
• Technical and security logs: up to twelve (12) months.
• Proof of consent: for the duration of processing and any additional period the law requires to evidence it.

12. Local storage and cookies

Tribe uses device or browser local storage to keep you signed in, remember preferences and avoid duplicate form submissions. We do not use third-party advertising cookies.

13. Changes to this policy

We may update this policy. We will publish the current version at tribelatam.com/legal/tratamiento-de-datos with its effective date and, where the change is material, communicate it through the usual channels before it applies.

14. Contact

A Plus Fitness LLC (Tribe) · info@tribelatam.com · Subject: Personal data