Privacy

Effective 24 September 2026.

Rise Collective ("we", "the studio") is a yoga, pilates, and sculpt studio at 2 York Road, Muizenberg, Cape Town. This notice explains what personal information we collect when you use risecollective.co.za and the studio, why, who sees it, how long we keep it, and what you can ask of us. We are the responsible party under the Protection of Personal Information Act, 2013 (POPIA). Our Information Officer is the studio owner, reachable at [email protected].

What we collect

• Your account: your name, e-mail address, phone number if you give it, your password (stored only as a one-way hash), and any passkey you register.
• Sign in with Google: if you choose it, Google gives us your name, your e-mail address, and a Google account identifier so we can recognise you next time. We ask for nothing else: no access to your contacts, calendar, or files. Google's own privacy policy covers what Google does.
• Bookings and attendance: which classes you book, cancel, or attend, how many places, and the waiting lists you join. Teachers see who is on their class.
• Purchases and payments: what you buy (a class, a package, a membership), the amount, the date, and a payment reference. Card details go straight to our payment provider; we never see or store your card number.
• The waiver: the liability waiver you accept before your first class, with your name and the time you accepted it, and any health note you choose to give us.
• Guest bookings: if you book a single class without an account, your name and e-mail address for that booking.
• Technical information: your IP address, browser, and the cookies below, and the messages you send us.

Why we use it

• To run your bookings, hold your place, and take your payment (performing our agreement with you).
• To send you what you asked for: booking confirmations, receipts, reminders, waiting-list offers, and password or sign-in e-mails (our agreement with you). We only send news or offers if you have said yes, and every such e-mail has an unsubscribe link (your consent).
• To keep the class register, so teachers know who is in the room and we can act in an emergency (our legitimate interest in a safe studio).
• To keep our books: receipts and payment records as South African tax law requires (a legal obligation).
• To answer your questions and resolve problems with a booking or a payment.

Who sees it

We do not sell or rent personal information. We share it only with the people and services that make the studio work, each bound to use it only for us:

• Our teachers and front desk, for the classes they run.
• Our payment provider, to take card payments and process refunds.
• Our e-mail delivery service, to send the e-mails above.
• Our hosting and network providers, on whose servers the site and its database run, with the data encrypted in transit and at rest.
• Google, when you sign in with Google.
• Our bookkeeper and accountant, for the studio's financial records.
• A court, regulator, or the police, if the law requires it.

Some of these providers keep servers outside South Africa. Where they do, they are bound by contract and by laws that protect your information at least as well as POPIA does.

Cookies

The site sets a session cookie so you stay signed in as you move between pages, a security cookie that protects forms against forgery, a "remember me" cookie if you tick that box, and a small setting that remembers whether you prefer the timetable as a list or a calendar. We set no advertising or tracking cookies.

How long we keep it

• Your account, bookings, and waiver: while your account is active, and for two years after your last class, unless you ask us to delete it sooner.
• Receipts and payment records: five years from the end of the tax year, as the Tax Administration Act requires.
• Guest bookings: the booking and its receipt, for the same five years; nothing else.
• Server logs: thirty days.

Your rights

Under POPIA you may ask us, at any time and free of charge, to tell you what personal information we hold about you, to correct it, to delete it where we no longer need it, to stop using it for a particular purpose, or to withdraw a consent you gave. You can change your name, e-mail address, and password yourself under Account. For anything else write to [email protected]; we answer within thirty days. You may also complain to the Information Regulator (South Africa) at [email protected] or inforegulator.org.za.

Children

People under eighteen may attend with a parent's or guardian's consent, and the parent or guardian accepts the waiver and holds the account. We do not knowingly collect a child's information without that consent.

Security

The site is served only over HTTPS. Passwords are hashed and never stored in the clear. Access to bookings and payments is limited to the staff who need it, and every change to money, credits, or a class is recorded with who made it and why. If we ever learn that your personal information has been accessed without authorisation, we will tell you and the Information Regulator as POPIA requires.

Changes

If we change this notice we will update the date at the top and, where the change matters, tell you by e-mail or on the site.