ANATOLY FZCO, a company registered under the laws of the United Arab Emirates, with its registered address at Dubai Silicon Oasis, DDP, Building A1, Dubai, United Arab Emirates, and license number: 33037 (hereinafter referred to as the "Company") is the controller of your personal data.

Personal data that you provide when you create your account on the Platform or communicate with technical support.

• Information related to your account: When you register an account on the Platform, we collect information related to your account, including your first name, last name, contact details (phone number), email, payment details (transaction history without card details), sex, age, weight, height, and your image (profile picture)¹.
• User content: When you use the Platform, we receive certain Personal Data, such as the information you enter, the files you upload, and the comments or reviews you leave.
• Communication information: If you communicate with us (including technical support), we collect information such as your full name, contact details, email address, and the content of the messages you send.
• Other information you provide: We collect other information you provide to us, such as in connection with your participation in surveys or other activities, as well as information you provide to us to establish your age or identity.

Personal data that we automatically receive when you use the Platform (Technical Information):

• Log data: Information that the Platform automatically sends when you use it. Such data may include your IP-address, browser type and settings, the date and time of your request, and information about your interaction with the Platform.
• Usage data: We may automatically collect information about your use of the Platform, such as the type of content you view or interact with, the features you use, the actions you take, as well as your time zone, country, date and time of access, device type, and device connection.
• Device information: the name of the device and operating system, identifiers of the device you are using. The type of information collected may depend on the type of device you use to access the Platform and its settings, push token.
• Cookies and similar technologies: we use cookies and similar technologies to ensure the Platform works and to manage it, as well as to improve your experience of using it. For example, your password for logging into your Platform account. Detailed information about cookies is available in the Cookie Policy posted on the Platform.
• Social networks, messengers: Your nicknames on social networks, messengers (Facebook, Telegram, Instagram).

Health and fitness-related data: information provided by you or generated through your use of the Platform in connection with your fitness profile, goals, training, nutrition, body measurements, progress tracking, workouts, activity history, weight, height, sex or gender, age, body images, photos, videos, information about injuries, physical limitations, wellbeing, dietary preferences or other health- or fitness-related information that you voluntarily provide.

Support Data: information related to Remote Online Support, feedback and service communications, including support requests, dates and channels of communication, support status, responses provided by the Company, Telegram or other messenger usernames, and information necessary to resolve your support request.

Billing, payment and location-related data: billing country, billing address where provided, payment status, transaction ID, payment amount, payment date, subscription status, refund status, limited payment metadata received from payment providers, approximate location derived from IP address, country selected during registration or checkout, and other information reasonably necessary to process payments, prevent fraud, comply with accounting and legal obligations and determine the applicable treatment of the Services.

Personal data that we receive from other sources:

• We may receive information about you from other sources, including publicly available information on the Internet, particular for the purposes described in this Policy.

  We also receive information from our trusted partners, such as security partners, to protect against fraud, abuse, and other security threats to the Platform, or from marketing service providers who provide us with information about potential customers for our services.

Certain Health and Fitness Data may constitute special categories of personal data under Article 9 GDPR where such data reveals or may reveal information about your health, physiological condition, physical limitations, injuries, body characteristics or other health-related information.

We process such special categories of personal data only where you have provided explicit consent, unless another exception under Article 9 GDPR applies. You may withdraw your explicit consent at any time by contacting us or by using the functionality available on the Platform, where available.

Please note that certain Health and Fitness Data may be necessary to provide core Platform functionality, including generating training or nutrition plans, tracking progress and providing Remote Online Support. If you withdraw consent to the processing of such data, some features of the Platform or Services may become unavailable or may no longer function properly.

Where required, we will request your explicit consent to the processing of Health and Fitness Data through a separate, unticked checkbox or another clear affirmative action at registration, checkout or before the relevant functionality is used. Such consent will be separate from your general acceptance of the Terms of Use.

The Platform collects payment history: We do not collect or save bank details or complete payment details. All payments are processed by our partner Stripe. We receive only limited transaction information (date, amount, status, identifier) to give you access to your purchase history, ensure the service is running and meet our legal obligations (such as accounting and tax). The processing of such data is carried out in accordance with Art. 6(1)(b) GDPR (execution of the contract) and Art. 6(1)(c) GDPR (fullfilment of legal obligations).

If you have won a Contest operated by the Company in connection with the Platform, the Challenge, a Paid Subscription or another Service, we may request information from you that is necessary to award you the prize and to properly report the transfer of the prize to you to state and local government authorities.

This information includes your full name, tax identification number, date of birth, nationality, residential address, passport/ID number, email address, phone number, and bank details. This information is collected in accordance with Article 6(1)(b) of the GDPR (performance of a contract) by sending you, as the Winner, the Prize Acceptance Form, which you must complete.

The procedures for conducting the Contest are governed by Contest Rules for APS Services.

We may use Personal Data for the purpose of:

• providing and ensuring the operation of the Platform, authentication and authorization: we use personal data for your secure login to the account on the Platform, as well as for the possibility of effective and uninterrupted use of all functions of the Platform;
• improvement and development of the Platform and new functions, conducting research, as well as for personalizing the user experience;
• communicating with you, including to send you information and marketing materials about the Platform and other services, products and events and push notifications: we use personal data to contact you on matters related to your account, Platform, security alerts or alerts, and to properly deliver push notifications to your device;
• providing you with feedback, adding you to our Telegram channel: we use personal data to communicate with you while providing you with services;
• preventing fraud, criminal activity or misuse of the Platform, as well as to maintain the security of our systems and the Platform: for example, we may use multifactorial authentication (including by phone numbers) to strengthen security;
• formalizing the results of the Contest, we may list your username on the Platform and publicly display your username to announce the Contest results.
• complying with legal obligations and protecting the rights, privacy, safety, or property of our users (you), ourselves, our affiliates, or third parties.

Aggregated or Anonymized Information. We may aggregate or anonymize personal data in such a way that it no longer allows your identity to be determined. Such information is used to analyze the performance of the Platform, improve and expand its functionality, conduct research, and for other similar purposes.

This data is collected through the Platform, cookies, and other tools described in this Privacy Policy. We will store and process such data exclusively in aggregated or anonymized form and will not attempt to re-identify it.

We do not use identifiable Personal Data, Health and Fitness Data, photos, videos, Support Data, private communications or data relating to minors to train artificial intelligence or machine learning models unless you provide a separate, explicit and specific opt-in consent for that purpose.

We may use aggregated or anonymized information that does not identify you and cannot reasonably be used to re-identify you to improve the Platform, analyse performance, develop features and improve user experience.

We may use Your personal data, namely Your images, name, surname, sex, weight, and age, for marketing purposes only if You provide Your explicit consent in accordance with Article 6(1)(a) and Article 9(2)(a) of the GDPR by checking the box "I agree to the use of my photos and videos for marketing purposes". The use of personal data for marketing purposes is governed by Informed Consent for the Processing and Use of Photo and Video Materials.

Under certain circumstances, we may disclose your Personal Data to the following parties:

• Vendors and service providers. If necessary for our business activities and to provide certain services or functions, we may disclose Personal Data to vendors and service providers, including hosting providers, customer service providers, cloud services, data storage, technical support and security monitoring, email communication software, online information analytics services, payment and transaction processing providers, and other information technology providers, the messengers and social networks that we use to communicate with you. In accordance with our instructions, these parties only access, process, or maintain Personal Data in the course of performing their duties to us;
• Business transfer parties. If we engage in strategic transactions, reorganizations, bankruptcy proceedings, external management, or the transfer of services to another provider (collectively, hereinafter referred to as the "Transaction"), your personal data and other information may be disclosed during due diligence to counterparties and other parties assisting with the Transaction, and may be transferred to a successor or affiliated entity as part of such a Transaction, together with other assets;
• Government authorities and other third parties. We may disclose your Personal Data, including information about your interaction with the Platform, to government authorities or third parties in accordance with the law, (i) if required by law or if we believe in good faith that such action is necessary to comply with a legal obligation, (ii) to protect our rights or property; (iii) if we determine, in our sole discretion, that there has been a violation of our terms, policies, or legal requirements; (iv) to detect or prevent fraud or other illegal activities; (v) for the purposes of security, protection, and maintenance of the integrity of our products, employees, users, or the public; or (vi) to protect against legal liability;
• Affiliated entities. We may disclose personal data to our affiliated entities, meaning entities that control the Company, are controlled by it, or are under common control with it. Our affiliated entities may use the personal data provided to them solely in accordance with the terms of this Privacy Policy;
• Corporate Account Administrators. When you join a corporate account, its administrator may have access to your account, manage it, and provide you with technical support if needed.

Where you use Telegram or another third-party messenger to communicate with the Company or participate in the Challenge, your use of that messenger is also governed by the terms and privacy policy of the relevant third-party provider. The Company may process your messenger username, messages, support requests and related communication data for the purpose of providing the Services, Remote Online Support, moderation, safety, compliance and dispute resolution.

If you post information in a group channel or chat, such information may be visible to other participants. You should not post highly sensitive information, medical records, payment information, government identification documents or other confidential information in group communication channels.

We will store your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including providing you with access to the Platform, ensuring its uninterapted operation, protecting our legitimate interests, fulfilling legal obligations or resolving potential disputes.

If your account on the Platform remains inactive for 30 calendar days, or if you participated in a Challenge that has since ended, we have the right to remove or anonymize your Personal Data, unless otherwise required by law or justified by the need to protect our rights and legitimate interests.

Platform Data and Support Data necessary to review a Money-Back Guarantee application may be retained until the expiry of the period for submitting such application, the completion of the review process and, where necessary, for the period required to establish, exercise or defend legal claims.

Transaction, payment, refund, accounting and tax-related records may be retained for the period required by applicable accounting, tax and legal obligations.

Health and Fitness Data that is no longer necessary for providing the Services, reviewing a Guarantee Application, complying with legal obligations or protecting legitimate interests will be deleted or anonymized within a reasonable period after account deletion or termination of the relevant service, unless the User requests earlier deletion and such deletion is legally and technically possible.

The retention period for personal data depends, in particular, on:

• the purposes for which we process the data (e.g., to provide access to the Platform or communicate with you);
• the type of data, including whether it falls into the category of sensitive data;
• potential risks associated with unauthorized access or disclosure;
• statutes of limitation or other legal requirements applicable to us.

We implement appropriate technical and organizational measures to ensure the secure storage of your personal data, including:

• Encryption: personal data is encrypted both at rest and during transmission using modern cryptographic algorithms;
• Access control: only authorized employees and contractors have access to Personal Data, exclusively for the performance of specified tasks. All of them are required to comply with the privacy and rules of the Policy;
• Cloud storage and databases: We use secure databases and cloud services that comply with international security standards and apply data protection measures against loss, unauthorized access, alteration or destruction;
• Monitoring and Auditing: We periodically review our security procedures and conduct technical audits to minimize the risk of privacy breaches;
• Pseudonymization and Anonymization (where it is possible): Sensitive categories of data may be processed in a de-identified form to reduce the risk of unauthorized use.

You have the following statutory rights regarding your Personal data:

• the right to access your personal data and information about how it is processed;
• the right to have your personal data deleted from our records and to cease its processing (the "right to be forgotten");
• the right to correct or update your personal data;
• the right to transfer your personal data to a third party;
• the right to restrict the ways in which we process your personal data;
• the right to withdraw your consent to the processing of your personal data at any time.

Due to the processing of your sensitive personal data, you may withdraw your consent at any time by contacting us via email or through the form available on the Website and/or the Platform;

• the right to complain to a local data protection authority;
• You have the right to object to:

1. the processing of your personal data for direct marketing purposes;
2. the processing of your personal data where it is based on our legitimate interests.

You can exercise some of these rights through your account on the Platform. If you are unable to exercise your rights through your account, please send an email request to technical support.

If the withdrawal of Personal data makes it impossible to provide all or part of the services we offer under the Terms of Use, we reserve the right to notify you of the consequences of such withdrawal and offer one of the following options:

• deletion of Personal data, resulting in the termination of all or part of the services;
• retention of Personal data to the extent necessary for the continued provision of services.

Please keep in mind that these rights may be limited, for example, if fulfilling your request would reveal Personal Data of another person or if you ask us to delete information that we are required to keep by law or for our compelling legitimate interests.

We hope we can answer your questions or concerns.

The Platform is not intended for children under the age of 13.

Users under the age of 18 may use the Platform only with the consent and supervision of a parent or legal guardian, unless applicable law requires a higher age or a different form of consent.

For users in the European Union or European Economic Area, where the User is below the age at which they may lawfully consent to the processing of their Personal Data under applicable local law, the consent of a parent or legal guardian is required.

We may take reasonable steps to verify such consent. If we become aware that a child has provided Personal Data without the required consent, we will delete such Personal Data where required by applicable law.

Paid Subscriptions, participation in the Challenge, participation in any Contest, and any functionality involving physical training, performance testing, nutrition plans or submission of health, fitness or body-related information may be purchased or used by a minor only with the consent and supervision of a parent or legal guardian.

For the processing of your personal data for the purposes described above, we rely on the following legal bases:

The type of Personal Data processed, depending on the processing actions:

Providing access to and ensuring the operation of the Platform, including authentication and account authorization

• Information related to your account;
• User content;
• Communication information;
• Other information you provide;
• Log data;
• Usage data;
• Device information;
• Cookies and similar technologies;
• Sensitive personal data.

When it is necessary to fulfill the terms of a contract with you (including the APS Terms of Use).

Sensitive Personal data is processed solely on the basis of your explicit consent. You may withdraw your consent at any time by contacting us via our technical support email or through the form available on the Website and/or the Platform.

Improving and developing the Platform and new features, conducting research, and personalizing the user experience:

• Information related to your account;
• User content;
• Communication information;
• Other information you provide;
• Personal data we receive from other sources;
• Log data;
• Usage data;
• Device information;
• Social media;
• Cookies and similar technologies;
• Sensitive personal data.

When it is necessary to pursue our legitimate interests, the interests of third parties, or the public interest, including the development, improvement, or promotion of the Platform.

Sensitive Personal data is processed solely on the basis of your explicit consent. You may withdraw your consent at any time by contacting us via our technical support email or through the form available on the Website and/or the Platform.

Communicating with you, including sending information and marketing materials about our Platform and/or other services, products, offerings, or events (push notifications):

• Information related to your account;
• Communication information;
• Other information you provide;
• Personal data we receive from other sources;
• Log data;
• Usage data;
• Device information;
• Cookies and similar technologies.

When it is necessary to fulfill the terms of a contract with you, for example, to process your contact information for sending technical notifications about the Platform.

Your consent is required when we ask you to provide it for processing your personal data for a specific purpose that we communicate to you, for example, to process your contact information in order to send you certain types of marketing communications.

Preventing fraud, criminal activity, or unauthorized use of the Platform, and maintaining the security of our systems and the Platform:

• Information related to your account;
• User content;
• Communication information;
• Other information you provide;
• Personal data we receive from other sources;
• Log data;
• Usage data;
• Device information;
• Cookies and similar technologies.

When it is necessary to comply with a legal obligation.

If there is no specific legal obligation, processing may be necessary to pursue our legitimate interests and those of third parties, including protecting the Platform from abuse, fraud, or security risks, such as processing data from security partners to prevent fraud, misuse, and security threats to the Platform.

Complying with legal obligations and protecting the rights, privacy, safety, or property of our users, ourselves, our affiliates, or third parties:

• Information related to your account;
• User content;
• Communication information;
• Other information you provide;
• Personal data we receive from other sources;
• Log data;
• Usage data;
• Device information;
• Cookies and similar technologies;
• Sensitive personal data.

When necessary to comply with legal obligations, such as retaining transaction information to meet accounting or record-keeping requirements.

If there is no specific legal obligation, processing may be necessary to pursue our legitimate interests, the interests of third parties, or the public interest, including protecting our rights, safety, and property, or the rights, safety, and property of our affiliates, users, or third parties, such as analyzing log data to detect fraud and misuse on the Platform.

Sensitive personal data is processed solely on the basis of your explicit consent. You may withdraw your consent at any time by contacting us via our technical support email or through the form available on the Website and/or the Platform.

The Company is established in the United Arab Emirates. Your Personal Data may be accessed from, transferred to, processed or stored in countries outside the European Union and the European Economic Area, including the United Arab Emirates, the United States and other countries where the Company, its service providers, payment providers, hosting providers, analytics providers, communication providers, email providers, customer support tools or other vendors operate.

Where Personal Data is transferred outside the European Union or the European Economic Area, the Company implements appropriate safeguards in accordance with Chapter V of the GDPR. Such safeguards may include an adequacy decision, Standard Contractual Clauses approved by the European Commission, transfer impact assessments and supplementary technical and organizational measures where required.

The Company takes reasonable steps to ensure that Personal Data transferred outside the EU/EEA remains protected in a manner consistent with this Privacy Policy and applicable data protection law.

You may contact us to request additional information about the safeguards used for international transfers of your Personal Data.

Where Article 27 GDPR requires the Company to designate a representative in the European Union, the Company will make the representative's contact details available in this Privacy Policy.

Until such details are published, GDPR-related requests may be sent to privacy@anatolyfit.com.

We may send you push notifications to inform you about important events related to your account and use of the Platform (e.g., subscription confirmations, activity reminders, Platform update notifications). Such notifications are part of the provision of our services and are sent based on contract performance or our legitimate interests.

Additionally, with your separate consent, we may send you marketing or informational messages (e.g., offers, special promotions, or reminders aimed at supporting your engagement). You may withdraw your consent to receive such messages at any time through your browser/device settings or via the provided "Unsubscribe" link.

If it is not possible to withdraw your consent via your browser/device settings or the "Unsubscribe" link, you may contact us by sending an email.

We process your device's technical data (e.g., browser ID, push token) to send push notifications. This data is used exclusively for the delivery of notifications and is not shared with third parties, with the exception of partner services that provide technical delivery.

We may update this Privacy Policy to reflect current data processing practices, changes in legislation or regulatory requirements, as well as updates to the Platform's functionality.

All amendments are published by posting the updated version of the Policy on this page with the date of "effective date." In cases where the changes are significant, we may additionally notify you of them (for example, by email or a message on the Platform).

We recommend periodically reviewing this Policy to stay informed about how we protect your Personal Data.

If you have any questions regarding this Privacy Policy or wish to exercise any of your rights under the GDPR (including the right to access, rectify, erase, restrict processing, object, or data portability), please contact us by email at: privacy@anatolyfit.com.

We will review your request and respond without undue delay, and in any event, no later than one month from receipt. If necessary, this period may be extended by an additional two months, in which case we will inform you separately.