Privacy Policy

1. Introduction

find.fit ("we," "our," or "us") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our marketplace platform.

This policy complies with the Singapore Personal Data Protection Act 2012 (PDPA) and applies to all users of our Service, including coaches and consumers.

2. Data Controller

find.fit is the data controller responsible for your personal data. For questions about this Privacy Policy or your personal data, please contact us at [email protected].

3. What Personal Data We Collect

3.1 For All Users

• Contact Information: Full name, email address, WhatsApp phone number
• PDPA Consent: Consent acknowledgment with timestamp and version number
• Device & Usage Data: IP address, browser type, device information, pages visited, time spent on platform

3.2 For Coaches

• Verification Documents: Government-issued ID (NRIC, passport, or employment pass), child-safety training certificates, first-aid/CPR certificates, professional credentials, liability insurance documents
• Professional Information: Sport category, years of experience, coaching specializations, bio, profile photos
• Pricing Information: Session rates, package pricing
• Banking Information: Bank account details for weekly payouts (processed securely through Stripe)
• Document Metadata: Issuer names, expiry dates for certifications

3.3 For Consumers

• Purchase Information: Package selections, payment method preference (card or PayNow), transaction history
• Session Data: Session completion status, reviews, ratings

3.4 For Purchases Involving Minors

• Guardian Information: Legal guardian's full name
• Emergency Contact: Emergency contact person and phone number
• Waiver Consent: Timestamp of waiver acknowledgment

This information is collected only when you indicate that coaching services are for a minor (under 18 years of age) and is used solely for safety and emergency purposes.

4. How We Use Your Personal Data

We process your personal data for the following purposes:

• Service Delivery: To operate the marketplace, match coaches with consumers, process bookings, and facilitate coaching sessions
• Payment Processing: To process payments via Stripe, hold funds in our Protected Payments system, and release payouts to coaches
• Verification: To verify coach credentials, review documents, and maintain platform trust and safety standards
• Communication: To send transactional notifications via WhatsApp (booking confirmations, session tracking, payment updates, expiry warnings, review requests, dispute notifications)
• Dispute Resolution: To investigate and resolve disputes between coaches and consumers
• Platform Improvement: To analyze usage patterns, improve our Service, and develop new features
• Legal Compliance: To comply with applicable laws, regulations, and legal processes
• Safety & Security: To protect minors, prevent fraud, and maintain platform integrity

5. Legal Basis for Processing (PDPA)

Under the Singapore PDPA, we process your personal data on the following grounds:

• Consent: You provide explicit consent when you check the PDPA consent checkbox during registration or checkout. We track the timestamp and version of consent.
• Contractual Necessity: Processing is necessary to perform our contract with you (providing marketplace services).
• Legal Obligations: We process data to comply with Singapore laws, tax regulations, and financial reporting requirements.
• Legitimate Interests: We process data for fraud prevention, platform security, and service improvement, balanced against your privacy rights.

6. Data Sharing & Third-Party Services

6.1 WhatsApp Business API (Meta)

We use WhatsApp Business API to send transactional messages. When you provide your WhatsApp number, your phone number and message content are shared with Meta Platforms, Inc. (WhatsApp's parent company) for message delivery.

WhatsApp's privacy policy applies to messages sent through their platform: https://www.whatsapp.com/legal/privacy-policy

6.2 Stripe (Payment Processing)

We use Stripe to process payments and payouts. Payment information (card details, PayNow transactions) is processed directly by Stripe and is not stored on our servers.

Stripe's privacy policy: https://stripe.com/privacy

6.3 Other Service Providers

We may share your data with trusted service providers who assist us with:

• Cloud hosting and data storage
• Email delivery
• Analytics and performance monitoring
• Customer support tools

All third-party service providers are contractually required to protect your data and use it only for specified purposes.

6.4 Sharing Between Coaches & Consumers

When a booking is made, we share necessary contact information (name, WhatsApp number) between the coach and consumer to facilitate session coordination.

7. Data Retention

We retain your personal data for as long as necessary to provide our Service and comply with legal obligations:

• Active Accounts: Data is retained while your account is active
• Transaction Records: Payment and transaction data is retained for 7 years to comply with Singapore tax and financial regulations
• Verification Documents: Coach verification documents are retained while the coach profile is active and for 2 years after account closure
• Dispute Records: Dispute-related data is retained for 3 years after resolution
• Minor Data: Guardian and emergency contact information is retained for the duration of the purchased package validity plus 1 year

After the retention period, personal data is securely deleted or anonymized.

8. Data Security

We implement industry-standard security measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Secure authentication and access controls
• Regular security audits and vulnerability assessments
• Restricted access to personal data on a need-to-know basis
• Secure storage of verification documents

While we take reasonable steps to protect your data, no system is completely secure. You are responsible for maintaining the confidentiality of your account credentials.

9. Your Rights Under PDPA

Under the Singapore Personal Data Protection Act, you have the following rights:

9.1 Right to Access

You may request a copy of the personal data we hold about you. We will respond within 30 days of your request.

9.2 Right to Correction

You may request correction of inaccurate or incomplete personal data. You can update most information directly through your account settings.

9.3 Right to Withdraw Consent

You may withdraw your consent for marketing communications or WhatsApp notifications at any time. Note that withdrawing consent may affect our ability to provide certain services.

9.4 Right to Data Portability

You may request a copy of your personal data in a commonly used, machine-readable format.

9.5 Right to Deletion

You may request deletion of your personal data, subject to legal retention obligations. We will delete your data within 30 days unless we are required to retain it for legal, tax, or dispute resolution purposes.

To exercise any of these rights, please contact us at [email protected] with your request.

10. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to:

• Maintain your session and login state
• Remember your preferences
• Analyze platform usage and performance
• Improve user experience

You can control cookies through your browser settings, but disabling cookies may affect platform functionality.

11. Protection of Minor Data

Our Service is not intended for use by children under 18 without parental consent. When coaching services are purchased for a minor, we:

• Require legal guardian information and consent
• Collect only necessary information (guardian name, emergency contact, waiver acknowledgment)
• Apply enhanced security measures to protect minor-related data
• Limit access to this data to essential personnel only
• Delete minor data within 1 year after package expiry

If you believe we have collected data from a minor without proper parental consent, please contact us immediately.

12. International Data Transfers

Your personal data may be transferred to and processed in countries outside Singapore, including:

• United States (for Stripe payment processing and WhatsApp/Meta services)
• Other jurisdictions where our cloud service providers operate

We ensure that adequate safeguards are in place to protect your data when transferred internationally, including standard contractual clauses and data processing agreements with service providers.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes via email or WhatsApp at least 14 days before the changes take effect.

The "Last updated" date at the top of this policy indicates when it was last revised. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact Us & Data Requests

If you have questions about this Privacy Policy, want to exercise your PDPA rights, or have a data protection concern, please contact us:

• Email: [email protected]
• Subject Line: "PDPA Data Request" or "Privacy Inquiry"
• WhatsApp: +6591096011 (for general inquiries)

We will respond to all data requests within 30 days as required by the PDPA.

15. Complaints to PDPC

If you are not satisfied with our response to your data protection concerns, you have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore:

• Website: www.pdpc.gov.sg
• Email: [email protected]