1. Introduction
This Privacy Policy explains how Private Fitness Co for Sports, operating The Enclave by LifeLab, collects, uses, stores, shares, and protects personal data when you use theenclavelife.com, the Enclave mobile application, our booking flows, events, appointments, facilities, sports courts, tent/room bookings, membership services, WhatsApp communications, customer care channels, and on-site services.
This Policy is designed to support compliance with the Saudi Personal Data Protection Law and its Implementing Regulations (PDPL) and, where applicable, the EU/UK General Data Protection Regulation (GDPR). If a mandatory legal requirement gives you greater rights than this Policy, that legal requirement prevails.
2. Who We Are
The controller of your personal data is Private Fitness Co for Sports. Customer care and privacy requests should be sent to hello@theenclavelife.com.
For GDPR purposes, where GDPR applies to a specific interaction, we act as the controller for data we collect and determine how to use. Certain third-party service providers may act as independent controllers or processors depending on the service and their own terms.
3. Scope
- Visitors to the website and users of the mobile app.
- Members, prospective members, LifeLab-linked members, guests, shared household users, and invitees.
- People who book or enquire about tents/rooms, events, appointments, sports courts, recovery services, facilities, corporate experiences, private gatherings, or brand activations.
- People who communicate with us by WhatsApp, web forms, email, phone, CRM, social media, or on-site channels.
- People whose data is provided by a member or booking holder, such as guest names, phone numbers, household users, dependents, or emergency contacts.
4. Personal Data We Collect
4.1 Account, identity, and contact data
- Full name, mobile/WhatsApp number, email address, language preference, member ID, unique member code, profile details, country/city, and communication preferences.
4.2 Booking, reservation, and access data
- Booking type, selected experience, tent/room selection, event registrations, sports court reservations, appointment data, dates/times, guest count, household users, guest invitations, guest pass history, QR codes, check-in/check-out data, cancellation/rescheduling history, attendance, no-shows, access logs, and member credit usage.
4.3 Membership and CRM data
- Membership tier, Enclave add-ons, credit balances, household/shared users, guest pass credits, payment status, sales and support notes, enquiry type, lead source, CRM history, and follow-up tasks in Livwell CRM.
4.4 Payment and transaction data
- Transaction amount, currency, booking reference, payment status, refund/credit status, partial payment/deposit information, and payment method type. Stripe processes payments. Supported payment methods may include cards, mada, Apple Pay, Google Pay, Samsung Pay, and Tabby where available. We do not store full card numbers or full payment credentials on our systems.
4.5 Health, safety, waiver, and special-category data
- Waiver confirmations, declared limitations, safety acknowledgements, recovery/sports risk acknowledgements, emergency notes, incident reports, injury reports, medical red flags disclosed for safety reasons, pregnancy or health-related warnings if voluntarily provided, and age/dependent details where relevant. This may be sensitive personal data under PDPL and special category data under GDPR.
4.6 Website, app, device, and analytics data
- IP address, device type, browser/app version, operating system, pages/screens viewed, clicks, form starts/submissions, booking funnel events, crash logs, diagnostics, cookies, consent preferences, and analytics identifiers. We use Google Analytics subject to consent and applicable settings.
4.7 Communications and media
- WhatsApp messages, email correspondence, customer care notes, call notes, reviews, feedback, photographs, videos, event media, and social media interactions where relevant.
4.8 Children and dependents
- We may process limited data about children or dependents when a parent or guardian includes them in a booking, household membership, guest pass, event registration, or safety waiver. Children and dependents must be supervised by a parent or guardian at all times.
5. How We Collect Data
- Directly from you when you register, enquire, book, pay, check in, sign waivers, attend events, use facilities, or contact us.
- From a member, parent, guardian, employer, event organiser, or booking holder who provides your details for a legitimate booking, guest pass, household access, corporate/private event, or safety purpose.
- Automatically through the website, mobile app, cookies, analytics, QR access, booking systems, and operational systems.
- From service providers such as Hostaway, Livwell, Stripe, WhatsApp, Google Analytics, Storyblok, and related technology tools where they support our services.
6. Purposes and Legal Bases
We process personal data only where we have a lawful basis under applicable law. The table below summarises our main processing purposes. Some processing may rely on more than one basis depending on context.
| Purpose | Examples | Legal basis under PDPL/GDPR where applicable |
|---|---|---|
| Provide bookings and services | Tent/room bookings, events, appointments, facilities, sports courts, QR access, credit redemption, guest passes, check-in. | Contract performance, consent where required, legitimate interests, legal obligations. |
| Process payments | Deposits, card transactions, mada, digital wallets, Tabby, refunds, failed payments, chargebacks. | Contract performance, legal obligation, legitimate interests. |
| Manage membership and access | Membership tiers, Enclave credits, LifeLab-linked access, household users, shared members, guest pass balances. | Contract performance, legitimate interests, consent where required. |
| Health, safety, and waivers | Sports/recovery waivers, incident reports, medical limitations voluntarily disclosed, emergency response. | Explicit consent where required, contract, vital interests, legal claims, health and safety obligations. |
| Customer care and CRM | Responding to requests, routing enquiries, complaints, follow-up, service recovery. | Contract performance, legitimate interests, consent where required. |
| Marketing and communications | Newsletters, WhatsApp updates, events, promotions, retargeting where consented. | Consent where required, legitimate interests subject to opt-out and local rules. |
| Analytics and improvement | Google Analytics, app/website usage, conversion tracking, performance, bugs, product development. | Consent where required, legitimate interests, contract performance for necessary diagnostics. |
| Legal, compliance, and security | Fraud prevention, access control, disputes, regulatory requests, policy enforcement. | Legal obligation, legitimate interests, legal claims. |
7. Systems and Service Providers
We use service providers to deliver and manage The Enclave experience. They may process personal data only as necessary to provide their services and according to applicable agreements, terms, privacy notices, and security controls.
| Provider/System | Purpose |
|---|---|
| Hostaway | Tent/room booking, stay availability, reservation management, guest communication, check-in/check-out support. |
| Livwell | Events, appointments, facility booking including sports courts, member access, credits, QR/check-in, CRM, sales/support routing, and operational records. |
| Storyblok CMS | Website and app content management, page content, translations, media/content publishing. Not intended for payment or sensitive customer records. |
| Stripe | Payment processing for supported payment methods, including cards, mada, Apple Pay, Google Pay, Samsung Pay, and Tabby where available/configured. |
| WhatsApp / WhatsApp Business tools | Guest and customer communications, booking support, operational updates, concierge messages, and enquiry follow-up. |
| Google Analytics | Website/app analytics, usage measurement, conversion analysis, and service improvement subject to consent settings. |
| App stores and device platforms | App installation, updates, crash diagnostics, device-level permissions, and platform services. |
8. Cookies, Analytics, and Tracking
We use necessary cookies and similar technologies to operate the website and app. With your consent where required, we may use analytics and marketing technologies such as Google Analytics to understand usage, improve performance, measure campaigns, and improve booking journeys.
- You can manage cookie preferences through the cookie banner or “Manage Cookies” link where available.
- You can adjust device-level app permissions through your iOS or Android settings.
- We do not intentionally send sensitive health, waiver, or medical information to advertising or analytics platforms.
- If analytics or marketing cookies are rejected, necessary booking and security functions may still operate.
9. Marketing, WhatsApp, and Communications
We may contact you about bookings, confirmations, service notices, payments, safety, changes, refunds, guest passes, event updates, and customer care. These operational communications are necessary for service delivery.
We may send promotional communications about memberships, events, programmes, offers, or partner experiences where permitted by law and your preferences. You can opt out of marketing communications at any time using the available unsubscribe, opt-out, WhatsApp instruction, or by contacting us at hello@theenclavelife.com. Opting out of marketing does not stop necessary service messages.
10. Sharing and Disclosure
- Service providers listed above and other vendors who support hosting, security, payments, booking, communications, analytics, and operations.
- LifeLab/Livwell teams and authorised Enclave personnel who need access to perform their roles.
- Corporate/private event organisers or booking holders where necessary to manage attendance and service delivery.
- Payment providers, banks, wallet providers, and buy-now-pay-later providers as necessary to process payments and prevent fraud.
- Legal, regulatory, law enforcement, insurance, and professional advisers where required or reasonably necessary.
- A successor entity in connection with a merger, acquisition, restructuring, or transfer of business, subject to appropriate protections.
11. International Transfers
Some service providers, cloud systems, analytics providers, payment processors, communications tools, and support systems may process data outside Saudi Arabia or outside your country of residence. Where required, we will use appropriate safeguards, contractual protections, transfer assessments, consent mechanisms, or other lawful transfer bases under PDPL, GDPR, and applicable law.
12. Data Retention
We retain personal data only as long as reasonably necessary for the purposes described in this Policy, including service delivery, legal compliance, accounting, tax, dispute resolution, safety, fraud prevention, and legitimate business records.
| Data category | Typical retention approach |
|---|---|
| Bookings, reservations, events, facility usage | Retained for operational, accounting, customer care, and dispute-resolution periods. |
| Payment records | Retained as required for accounting, tax, audit, fraud prevention, refunds, and chargeback handling. Full card details are not stored by us. |
| Waivers, incident reports, safety records | Retained for the period necessary to manage risk, insurance, legal claims, and safety obligations. |
| Marketing preferences and consent records | Retained while active and for a reasonable period after opt-out to honour preferences. |
| Analytics data | Retained according to tool settings and consent configuration. |
| CRM/support records | Retained as necessary for relationship management, service history, complaints, and follow-up. |
13. Security
We use reasonable technical, administrative, and organisational measures to protect personal data, including access controls, restricted internal permissions, secure service providers, payment tokenisation through Stripe, QR/access controls, and staff confidentiality expectations. No system can be guaranteed completely secure, but we work to protect data proportionately to its sensitivity and operational risk.
14. Your Rights
Depending on where you are located and which law applies, you may have rights to:
- request access to personal data we hold about you;
- request correction of inaccurate or incomplete data;
- request deletion where legally available;
- withdraw consent where processing is based on consent;
- object to or restrict certain processing;
- request data portability where GDPR applies;
- request information about processing and sharing;
- object to direct marketing;
- complain to the relevant data protection authority where applicable.
To exercise rights, contact hello@theenclavelife.com. We may need to verify your identity before responding. We may refuse or limit a request where permitted by law, for example to protect another person’s rights, comply with legal obligations, preserve necessary records, or manage legal claims.
15. Children and Dependents
The website and app are not directed to children. Parents and guardians may provide limited child/dependent data for family access, guest passes, event registration, tent/room bookings, or safety purposes. Children and dependents must be supervised at all times. We may require guardian consent for waivers, event participation, media consent, household access, or other activities involving minors.
16. Event Media and Image Data
Photos and videos taken at events or on site may contain personal data. Event media use is governed by the Event Media Consent section in our Terms of Use and event-specific notices. Where required, we will seek consent or provide a clear opt-out process. We will not intentionally use close-up identifiable images of children for marketing without appropriate guardian consent.
17. Automated Decision-Making
We do not intend to make solely automated decisions that produce legal or similarly significant effects for you. Some automated tools may support pricing display, availability checks, fraud prevention, booking recommendations, segmentation, analytics, and operational routing. You may contact us if you have questions about automated processing affecting your experience.
18. Third-Party Links and Services
The website, mobile app, WhatsApp messages, booking flows, or event communications may link to third-party platforms such as payment providers, Hostaway, Livwell, Stripe, Tabby, maps, social media, or app stores. Those providers may have their own terms and privacy policies. We are not responsible for their independent processing except where applicable law makes us responsible.
19. Updates to This Policy
We may update this Policy from time to time. The updated version will be posted on the website and/or app with a new “Last updated” date. Material changes may be notified through reasonable channels, such as app notice, email, WhatsApp, or website banner where appropriate.
20. Contact
For customer care and privacy requests, contact hello@theenclavelife.com.
Legal entity: Private Fitness Co for Sports. Website and mobile app: theenclavelife.com.