1. Introduction

At KARVE KSA, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how ALF MILE Co. (“Company”, “we”, “us”, or “our”), a Saudi Arabian company (CR: 4030501656) with its registered address at Midtown Plaza, Prince Sultan Road, Ar-Rawdah, Jeddah 23435, Kingdom of Saudi Arabia, as the operator of KARVE KSA, collects, uses, shares, and safeguards information in connection with our services. It also describes your rights and choices regarding your personal data and how you can contact us about our privacy practices. We ensure that our data handling practices comply with the laws and regulations of the Kingdom of Saudi Arabia, including the Personal Data Protection Law and other applicable regulations. By using the KARVE KSA website, mobile application, or any services we provide (collectively, the “Service”), you agree to the collection and use of information in accordance with this Privacy Policy.

If we provide an Arabic version of this Privacy Policy, both language versions are intended to convey the same information. In case of any discrepancy between the English and Arabic versions, the Arabic version will prevail to the extent allowed by law.

2. Information We Collect

We may collect personal data from you in a variety of ways when you interact with our Service. “Personal Data” means any information that relates to an identified or identifiable individual. The types of personal data we collect include:

2.1 Information You Provide Directly

Contact Information: Such as your full name, email address, phone number, postal address, and other similar contact details when you create an account, sign up for our newsletter, or contact us.
Account Details: Information you provide when registering an account or filling out your profile, such as username, password (stored in encrypted form), date of birth, gender, emergency contact, and any health or fitness information you choose to share (for example, if you voluntarily inform us of an injury, pregnancy, or medical condition for workout modifications or safety).
Booking and Transaction Information: Records of classes you have booked or attended, purchase history of Packages or memberships, dates and times of bookings, and any cancellations or modifications. If you purchase services, we (or our payment processor) collect payment details such as credit/debit card information or other payment data. Note: Payment card information is typically processed by third-party payment providers and not stored in our systems beyond perhaps the last four digits or a transaction ID for reference.
Communication Contents: Copies of your communications with us, including emails, chat messages, feedback, or inquiries you send to customer support. This also includes any responses you provide to surveys or participation in promotions.

2.2 Information We Collect Automatically

Usage Data: When you use our website or app, we automatically collect technical information about your device and how you interact with our Service. This data may include your device’s Internet Protocol (IP) address, device type, operating system version, browser type, and browser language. We may log the pages or screens you view, the dates/times of visits, the time spent on each page, crash logs, and other diagnostic information.
Cookies and Similar Technologies: We use cookies and similar tracking technologies on our website to enhance user experience, analyze site usage, and for security. Cookies are small text files stored on your device. They help us remember your preferences (like language or login session) and understand how you use our site. We may also use web beacons, pixels, or local storage as applicable. You can manage cookie preferences through your browser settings — for example, you can refuse or delete cookies. However, note that if you disable certain cookies, parts of the Service (like login or booking features) may not function properly. For detailed information on cookies we use, you can refer to our cookie notice (if available) or contact us.
Analytics Data: We use third-party analytics tools (like Google Analytics) that employ cookies and device identifiers to help us measure traffic and usage trends. These tools collect information such as the pages you visit, the time spent on pages, how you arrived at our site (e.g., via a search engine or link), and other usage patterns. This information is aggregated and does not directly identify you, but some of it (like IP address) might be considered personal data in certain contexts. We use this information to better understand user behavior and improve our Service.

2.3 Information from Third Parties

JoinIn2 Platform: As mentioned, our booking and class management system runs on JoinIn2. When you use our KARVE KSA app or site, some of your data is collected and stored via the JoinIn2 platform on our behalf. For example, your account data, class bookings, and attendance records may reside on JoinIn2’s servers. JoinIn2, as a service provider, will process that data under our instructions and in accordance with this Privacy Policy and applicable law. We ensure that JoinIn2 is contractually bound to protect your information and to use it only for providing services to KARVE KSA.
Payment Processors: If you make payments online, your payment details are handled by third-party payment gateways (such as a credit card processor or Apple App Store/Google Play for in-app purchases). These third parties may share with us limited information such as a confirmation of payment, your name or email, and the amount paid. We do not receive or store your full credit card number or bank account information from these processors (aside from possibly a transaction reference).
Social Media or Sign-In Services: If we enable sign-in or account linking via social networks (e.g., signing up with Apple, Google, or Instagram), we may receive basic profile information from those services with your consent. Similarly, if you tag us or interact with us on social media, we may see your public profile information, but we do not collect personal data from social media systematically unless it’s part of a specific campaign or you grant permission.
Other Sources: We might receive your information from other sources, for example, if someone refers you to our studio through a referral program, they might provide your name and contact details. In such cases, we will inform you as required by law and give you the opportunity to confirm or reject further communications.

2.4 Children’s Data

Our Service is not intended for use by children. We do not knowingly collect personal data from individuals under the age of 18 without appropriate parental or guardian consent. If you are under 18, please do not provide any personal information through the Service without consent from a parent or guardian. If we learn that we have inadvertently collected personal data from a child under 13 years of age without verified parental consent, we will delete that information as soon as possible. Parents or guardians who believe their child may have provided us with personal data can contact us to request its removal.

3. How We Use Your Information

We use the collected information for various legitimate business and operational purposes, in accordance with Saudi laws. The primary uses include:

3.1 To Provide Services

We process your personal data to operate the KARVE KSA services. For example, we use your information to create and manage your user account, allow you to book and attend classes, and to fulfill purchases of Packages or memberships. We will use your contact details to send you booking confirmations, reminders for your classes, updates on class schedules, or any changes/cancellations.

3.2 For Communication

Service and Transactional Communications: We may contact you by email, SMS, phone call, or in-app notifications to deliver important information related to your use of the Service. This includes confirmation of bookings, membership renewals, receipts for payments, alerts about waitlists or class changes, and responses to any inquiries or support requests you have made. Such communications are considered part of our service to you.
Customer Support: If you reach out with questions, feedback, or issues, we will use your provided information to respond and resolve your inquiries. We may also follow up to ensure your issues are resolved to your satisfaction.
Marketing & Promotional Communications: With your consent (opt-in), we may send you promotional messages about new classes, special offers, studio events, satisfaction surveys, or newsletters. These communications will be sent via channels you approve, such as email, SMS, or push notifications. You have the right to opt-out of marketing messages at any time (see Section 6 on Marketing Communications). We will ensure any marketing communication provides a clear method to unsubscribe (for example, an “unsubscribe” link in emails or instructions to reply “STOP” for SMS).

3.3 Improvement and Personalization

We use data analytics to understand how our Service is used and to improve our offerings. For example, we might analyze attendance patterns to add more classes during popular times, or use feedback to improve our instructors’ training. We may also use cookies or similar technologies to remember your preferences (such as language or class type preferences) and personalize your experience (for instance, showing you classes at your usual location or time).

3.4 Safety and Security

We are dedicated to keeping our environment safe. We may use your data to ensure security of our systems and premises. For instance, we monitor for suspicious activity on user accounts (like multiple failed logins) and have measures to detect and prevent fraudulent or malicious behavior. If you visit our studio, please be aware that CCTV cameras may be in operation in certain areas for security purposes; the footage is recorded to help us prevent or investigate incidents like theft or accidents. Any CCTV recordings are securely stored and only accessed by authorized personnel or law enforcement when legally permitted.

3.5 Legal Compliance and Enforcement

We may process and retain personal data to comply with our legal obligations under Saudi law or other applicable regulations (for example, maintaining transaction records for accounting and auditing, or fulfilling obligations to report certain information to authorities if required). If needed, we will use and disclose information to enforce our Terms & Conditions, to protect our rights, privacy, safety or property, and/or that of our customers or others, and to respond to legal requests (such as court orders or government demands).

3.6 Business Operations and Transfers

In the course of running our business, we may use your information for activities such as training our staff, performing accounting, billing for services, or other routine business functions. Additionally, if we undergo a business transaction such as a merger, acquisition, corporate restructuring, or sale of assets, your personal data may be transferred to a successor or affiliate as part of that transaction. If such a transfer occurs, we will ensure the new entity continues to respect your personal data in accordance with this Privacy Policy or notifies you of any changes.

We will not use your personal data for purposes that are incompatible with the above, unless we obtain your consent or as required/allowed by law. Where required by law, we rely on appropriate legal bases to process your data, such as your consent (for marketing), performance of a contract (providing the services you requested), compliance with legal obligations, or our legitimate interests (such as improving our services or ensuring security), balanced against your rights and expectations.

4. How We Share Your Information

We treat your personal data with care and confidentiality. We do not sell your personal data to third parties. However, in order to run our operations, we may need to share your information with certain parties, as detailed below, always in line with applicable laws:

4.1 Service Providers (Processors)

We share information with third-party companies and individuals who provide services on our behalf and under our instruction (commonly known as “data processors”). These include:

JoinIn2: As described, JoinIn2 hosts and manages our class booking platform. They have access to personal data necessary to perform these functions (like your profile and schedule) and are contractually obligated to keep it secure and use it only for our purposes.
Payment Providers: To process payments, we use payment gateway services (for example, bank merchant services or online payment processors). These providers receive your payment details and process transactions securely. They may also handle recurring billing for memberships if applicable. We share only the information that is necessary (such as your user ID or email and the amount to charge) for the payment to be completed.
Email/SMS Communications Providers: We might use third-party platforms to send out emails, SMS, or push notifications (for example, an email marketing service or an SMS gateway). These platforms will handle your contact information and message content on our behalf to send communications. They are not allowed to use your data for any other purpose.
Analytics and Advertising Partners: We may share certain usage data or device identifiers with analytics providers (like Google Analytics) to help us understand usage patterns (as mentioned in Section 2). If we engage in any online advertising or remarketing campaigns, we might work with advertising networks or social media platforms, which could involve sharing hashed or anonymized portions of your data (for instance, an encrypted version of your email to find matches on a platform) – but we will do so only with proper legal basis (e.g., consent if required) and in compliance with Saudi regulations.

All our service providers are selected carefully and we require them to implement appropriate technical and organizational measures to protect personal data. They are given only the minimum information necessary and are prohibited from using personal data for any purpose other than providing services to us.

4.2 Affiliates and Partners

We may share your information with our affiliated companies (for example, any subsidiaries of ALF MILE Co. or other fitness brands under our parent company) for operational or administrative purposes consistent with this policy. We may also share limited information with Karve International (the franchisor/ licensor of the KARVE brand) if necessary, such as aggregated attendance figures or feedback, to ensure quality and brand standards. If Karve International or any other partner is given access to personal data (for instance, if an international trainer is reviewing class performance), we will ensure such sharing complies with applicable data protection requirements and, if needed, secure appropriate agreements.

4.3 Legal Requirements and Protection

We may disclose your personal data if required to do so by Saudi law, or if we in good faith believe that such action is necessary to (a) comply with a legal obligation, such as a lawful subpoena, court order, or governmental request; (b) enforce our Terms & Conditions or other agreements; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of our company, our users, our staff, or the public. This may include exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction, as permitted by law.

4.4 Business Transfers

As noted, if we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, your information may be transferred as part of that transaction. We will endeavor that any new holder of your personal data continues to honor the commitments we have made in this Privacy Policy, or we will notify you if your data will become subject to a different privacy policy so you can exercise your rights accordingly.

Other than the situations outlined above, we will treat your personal data as private and will not share it with third parties without your knowledge and (where legally required) your consent.

5. Data Storage and Security

5.1 Data Security

We implement a variety of security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes technical measures (such as encryption of data in transit via SSL/TLS, encryption of sensitive data at rest, firewalls, and secure access controls) and organizational measures (such as restricting access to personal data to employees and contractors who need to know it for their duties, and training our staff on data protection). The JoinIn2 platform and our other service providers also employ robust security protocols to safeguard data. While we strive to use commercially acceptable means to protect your information, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee absolute security. In the unfortunate event of a data breach that affects your personal data, we will notify you and the relevant authorities as required by law.

5.2 Data Storage and Transfer

Your personal data is primarily stored on secure servers located within the Kingdom of Saudi Arabia or other jurisdictions that have adequate data protection (for example, our cloud or service providers might store data in data centers within the region or in the EU or US, depending on their infrastructure). We recognize that Saudi law places conditions on transferring personal data outside the Kingdom. If it is necessary to transfer or store your data on servers in another country (for instance, if our cloud service provider’s servers are overseas or if we share limited data with Karve International outside KSA), we will ensure such transfer is done in compliance with the Saudi Personal Data Protection Law and other relevant regulations. This means we will seek to ensure the foreign country has adequate privacy measures, or we will implement additional safeguards such as data transfer agreements or obtain the required regulatory approvals or individual consents, as applicable. We remain responsible for the protection of your personal data, regardless of where it is processed.

5.3 Data Retention

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, as outlined in this Privacy Policy, or as required or permitted by applicable laws. For example, as long as you have an active account or an ongoing relationship with us (e.g., you attend classes or have an active membership), we will keep your information on file. Even after you stop using our services or delete your account, we may retain certain data for a period of time. Typical reasons for retention after you cease to be active include:

To maintain accurate financial and transaction records for auditing/tax purposes (e.g., we may keep purchase and payment records for a number of years as required by law).
To handle any disputes or complaints that may arise (e.g., retaining communication records or injury reports for a certain statute of limitation period).
To enforce our agreements or to protect our legal rights (for instance, keeping data about account bans to prevent misuse).
If you opted out of marketing, to maintain your contact in a suppression list so we don’t accidentally send you further communications.

When personal data is no longer needed for the purpose it was collected, and we are not legally required to keep it, we will anonymize or securely delete it. Where data can be archived for historical or statistical purposes, we may do so in a way that no longer identifies you personally.

6. Your Rights and Choices

We strive to give you control over your personal data. Subject to Saudi Arabian law, you have certain rights regarding the personal data we hold about you. These rights may include:

6.1 Access and Correction

You have the right to request access to the personal data we hold about you and to obtain information about how we process it. You also have the right to request that we correct or update any inaccurate or incomplete personal data. Much of your basic information can be reviewed and edited by you directly through your account profile on our app or website (e.g., you can update your contact info or change your password). For any details not accessible online, you can contact us to make an access or correction request. We may need to verify your identity before releasing data to you. We will respond to such requests within the time frame required by law (and aim to do so as promptly as possible). Please note, in some cases we might not be able to provide certain data if it involves the personal data of another individual or if it is subject to legal privilege, but we will explain such limitations if applicable.

6.2 Deletion

You may request that we delete your personal data. For example, if you decide to withdraw completely from our services, you can ask us to remove your information from our records. We will honor deletion requests to the extent required by law. However, please note that we must retain certain information for legal or legitimate business purposes – as described in the Data Retention section above. If we must keep data for a period of time (for instance, financial records), we will inform you. Otherwise, we will proceed to erase or anonymize the personal data you requested to be deleted. Also note that deletion of your data may result in closing your user account and you will not be able to recover that account later.

6.3 Objection or Restriction

You have the right to object to certain processing of your personal data or ask us to restrict processing. For instance, you can object to processing that is based on our “legitimate interests” (if you believe it impacts your rights) or request restriction if you contest the accuracy of the data or the lawfulness of processing. You can also object to any direct marketing (as noted below). We will evaluate such requests and comply with them if required by law. Where we cannot comply, we will provide an explanation (for example, if we have compelling legitimate grounds to continue processing, or if the data is needed for legal claims).

6.4 Data Portability

To the extent provided by law, you may have the right to receive certain personal data you provided to us in a structured, commonly used, and machine-readable format, and to request that we transmit it to another service provider if technically feasible. This typically applies to data processed by automated means and based on your consent or a contract. If you need such assistance, let us know.

6.5 Withdrawal of Consent

If we rely on your consent to process any personal data (such as for sending marketing emails or processing certain sensitive data), you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing done before the withdrawal. For marketing communications, you can easily withdraw consent by using the unsubscribe mechanism provided (see next section). For other consents, you can contact us to communicate your withdrawal.

6.6 Managing Communication Preferences

Marketing Opt-Out: If you have opted in to receive marketing communications, you can opt out at any time. As mentioned, each marketing email from us will include an “unsubscribe” link. You can click that to stop receiving future emails. For SMS or WhatsApp messages, you may be instructed on how to stop (for example, replying with “STOP” or following a provided link). You can also manage your preferences through your account settings if that feature is available (such as toggling off promotional notifications). You may always contact us directly at our email/phone to request removal from marketing lists. We will process your opt-out request as soon as possible, and in all cases within the timeframe required by law. After you opt out, you may still receive transactional or service-related messages from us (like class reminders or payment receipts), as these are not promotional.
Cookies: As described earlier, you can control cookies through your browser settings. You can also use tools or plug-ins to opt out of certain analytics or advertising cookies (for example, Google offers a browser add-on to opt out of Google Analytics tracking). For mobile apps, you can control interest-based ads by adjusting your device’s advertising ID settings (usually under privacy or ads settings on your device).

6.7 Complaints

We are committed to resolving any concerns you have about your privacy. You have the right to lodge a complaint with a data protection regulatory authority if you believe we have infringed your rights. In Saudi Arabia, the competent authority for personal data protection is the Saudi Data & AI Authority (SDAIA) (or any authority that might be designated under the Personal Data Protection Law). We encourage you to contact us first, so we have the opportunity to address your concerns directly and find a solution.

To exercise any of your rights or if you have any privacy-related questions, you can contact us using the contact details in Section 9 (Contact Us). Please be aware that for security reasons, we may need to verify your identity (for example, by asking you to provide information associated with your account) before we can fully respond to certain requests.

7. Marketing Communications and Consent

As a fitness service provider, we would like to keep you informed about news, events, special offers, and updates from KARVE KSA. However, we are mindful of your preferences and the laws regulating electronic marketing communications in Saudi Arabia (such as anti-spam regulations).

7.1 Opt-In Consent

We will only send you marketing or promotional communications (such as newsletters, special discount offers, or announcements about new classes and services) if you have affirmatively opted in to receive them. This may occur, for example, when you sign up for an account and tick a box to receive news and offers, or when you subscribe to our newsletter via the website, or explicitly give consent in your mobile app settings. We will not use the contact information you provided us for marketing purposes without your consent.

7.2 Content of Marketing Messages

If you opt in, our messages will be tailored to inform you about our services. They may include: upcoming workshops or events at KARVE, new instructors or class types being introduced, membership promotions, loyalty rewards, or general wellness tips. We aim to provide value in our communications and not to overwhelm you with too frequent messages. Typically, we might send newsletters or promotions periodically (e.g., a few times a month), and we will clearly identify ourselves as the sender.

7.3 Third-Party Marketing

We do not share your personal contact information with third-party companies for their own marketing use without your explicit consent. If we ever partner with another brand for a joint event or promotion and need to share information, we will inform you and obtain consent as required. For instance, if there’s a co-hosted fitness event with another studio and you sign up, we would clarify which information might be shared. By default, all marketing from KARVE KSA will be about our services, or services of our direct affiliates (like a new studio under ALF MILE Co.), not unrelated third parties.

7.4 Right to Unsubscribe

As detailed in Section 6, you have the right to withdraw your consent and unsubscribe from marketing communications at any time. We make this process straightforward: each promotional email contains an unsubscribe link at the bottom; for SMS, we’ll provide a clear opt-out mechanism. Once you opt out, we will stop sending you marketing messages. Please note there might be a short delay (a few business days) to fully remove you from all distribution lists, so you might receive a message that was already in process, but we will strive to honor your request promptly. Opting out of marketing will not affect your receipt of transactional communications related to the Service (such as class reminders or billing notices).

By choosing to opt in to our marketing, you agree to receive messages as described. But you remain in control and can change your mind at any time. We abide by the relevant Saudi communications regulations and strive to ensure our practices meet the standards for consent and respectful communication.

8. International Data Transfers

KARVE KSA primarily serves customers within Saudi Arabia, and we aim to store and process data within the Kingdom whenever feasible. However, as part of using global technologies and services, some of your personal data may be transferred to, and processed in, countries outside of Saudi Arabia. For example:

The JoinIn2 platform or cloud services we use might host data on servers in a country outside KSA (such as in the European Union or the United States).
Our email service provider might route messages through servers located abroad.
Karve International (our franchisor based outside KSA) might receive limited data if needed for franchise oversight (as mentioned earlier).

We understand that different countries have different data protection laws. When we transfer personal data out of Saudi Arabia, we take steps to ensure that appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and Saudi Arabian law. These steps may include:

Transferring only to countries that the Saudi authorities deem as having adequate data protection laws, or
Implementing contractual clauses (data transfer agreements) approved by regulators to ensure the recipient of the data protects it to Saudi standards, or
Obtaining your explicit consent for certain cross-border transfers (if required by law or if other mechanisms are not available), or
Relying on other permitted legal bases for transfer as per applicable law (for instance, if the transfer is necessary for performing our contract with you, such as using an international SMS gateway to send you a booking confirmation you requested).

By using the Service or by engaging with us and providing your information, you acknowledge that your information may be transferred to our facilities and those third parties with whom we share it as described in this policy, which could be in countries outside your own. We will always strive to protect your data regardless of where it is processed. If you have questions about international data transfer or want more information about the safeguards in place, please contact us.

9. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make an update, we will change the “Last Updated” date at the top of this Policy. If changes are significant, we will provide a more prominent notice of the update — for example, by posting a notice on our website or app, or by emailing you if we have your email on file.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. If we make material changes to how we handle personal data, we will notify users in advance and, where required by law, may seek your consent or give you the opportunity to opt-in to the new practices. By continuing to use the Service after such revisions are in effect, you agree to the revised terms (to the extent permitted by law). If you do not agree with any changes to this Privacy Policy, you should stop using our services and you may request that we delete your personal data (as per Section 6).

10. Contact Us

If you have any questions, comments, or requests regarding this Privacy Policy or your personal data, please do not hesitate to contact us. We are here to help and address any concerns you may have about your privacy.

Contact Information:

Company: ALF MILE Co. (Operator of KARVE KSA)
Address: Midtown Plaza, Prince Sultan Road, Ar-Rawdah District, Jeddah 23435, Kingdom of Saudi Arabia
Email: [email protected]
Phone: +966 50 800 2291

You may also reach out to us in person at our KARVE KSA studio location during business hours for assistance. Our staff will direct you to the appropriate contact for privacy and data inquiries. We will do our best to respond to your inquiry as soon as possible and within any timeframes set by law.

By using KARVE KSA’s services, you acknowledge that you have read this Privacy Policy and understand its contents. Protecting your personal data and ensuring your trust is of utmost importance to us. Thank you for being a part of the KARVE community and for placing your confidence in our privacy practices.