LOADING XFITNESS...
LOADING XFITNESS...
> Last Updated: 20 October 2026
> This Privacy Policy (the "Policy") is issued by X FITNESS GYM SDN. BHD. (Registration No.: 202601032434 (1694529-U)) ("the Company," "we," "us," or "our"). This Policy describes our practices regarding the collection, usage, and protection of your personal information across our Services, which include our website (https://www.xfitness.my), the X Fitness App, and our physical facilities.
> In compliance with the Personal Data Protection Act 2010 ("PDPA") of Malaysia, this notice informs you of your rights and our obligations regarding your personal data.
This Privacy Policy (the "Policy") is issued by X FITNESS GYM SDN. BHD. (Registration No.: 202601032434 (1694529-U)) ("the Company," "we," "us," or "our"). This Policy describes our practices regarding the collection, usage, and protection of your personal information across our Services, which include our website (https://www.xfitness.my), the X Fitness App, and our physical facilities.
In compliance with the Personal Data Protection Act 2010 ("PDPA") of Malaysia, this notice informs you of your rights and our obligations regarding your personal data.
To provide a seamless fitness experience, we collect and process the following categories of data:
Full name, NRIC/Passport number (for verification), date of birth, gender, residential address, and emergency contact details.
A photo of your face (JPEG image), from which the face-recognition door readers at our gym create facial templates. It is used for gym entry and shown as your profile picture to our staff and trainers. See Section 2 (Face Data).
Transactional data processed securely via Revenue Monster. Note: We do not store full credit card details on our local servers; all processing is PCI DSS compliant.
Gym access logs, personal-training session history, IP addresses, device identifiers, and operating system information stored via Supabase.
Temporary IC images for verification and 24-hour CCTV surveillance footage within our facilities for safety and security.
Under the PDPA, biometric data is classified as Sensitive Personal Data. This section explains what face data we collect and how we use, share, store, retain and delete it.
We collect a photo of your face (a JPEG image). You take or choose this photo in the App, or our staff take it at the gym's front counter, which also allows members who do not use the App to enrol. We also record the status of your face enrolment.
Using your face to enter the gym is optional, and your membership does not depend on it. Nothing you buy in the App requires a face photo. If you prefer not to use face recognition, check in at the gym's front desk and our staff will let you in.
Your face photo is sent to the face-recognition door readers installed at our gym. Each reader stores the photo and creates its own facial template (a mathematical representation of facial features) from it. When you arrive at the entrance, the reader compares your face with the templates it holds to identify you. All face matching takes place on these readers at our premises. We do not use any third-party or cloud face-recognition service, and the App does not perform face recognition.
Your face photo is also shown as your profile picture in the gym's staff and trainer systems, so that our staff and trainers can recognise you. We do not use your face data for advertising or marketing, and we do not sell it.
Your face photo can be viewed only by our gym staff (the Owner, Managers and front-desk Staff) and our personal trainers, through the gym's staff and trainer systems, which require a staff login. Other members cannot see your face photo.
We do not share your face data with any third party for that party's own purposes. The only external company that stores your face photo is Cloudflare, Inc., which provides our cloud storage (Cloudflare R2) as a service provider acting on our behalf (see Section 4). The door readers and the access-control computer are located at our premises and operated by us.
Your face photo is stored in three places: (1) Cloudflare R2 cloud storage located in the Asia-Pacific region, in private storage that is not publicly accessible; Cloudflare encrypts stored data at rest. (2) The gym's on-premise access-control computer, which runs the door-access software. (3) The face-recognition door readers at the gym. Our member database stores only a reference to the photo and the enrolment status, not the image itself. Photos are transferred between the App, our servers and Cloudflare over encrypted (HTTPS) connections.
We keep your face photo for as long as your account exists, unless you remove it sooner as described under Deletion. If your membership expires, your face is removed from the door readers, but the photo is kept in cloud storage and on the access-control computer so that entry can be restored when you renew.
You can remove your face photo at any time without deleting your account, in the App (Settings > Remove My Face Photo). You keep your membership, enter through the front desk, and can enrol your face again later. You can also delete your account at any time in the App (Settings > Delete Account) or by asking our staff at the gym. When you remove your face photo in the App or your account is deleted, we delete every copy of your face photo. The copy in Cloudflare R2 and the reference to it in our member database are deleted at once. The copies on the gym's access-control computer (including the working copy kept by our door-access software) and on the door readers, together with the facial templates, are deleted automatically by our door-access system shortly afterwards, as soon as that system is online. If any of these deletions cannot be completed at first, for example because a system is offline, it is retried automatically until it succeeds. If you ask our staff to remove your face photo instead, they start the removal for you, and the cloud copy is deleted within one day.
We ask for your explicit consent before we collect your face photo. In the App, you give it by ticking the consent box on the face-capture screen; your photo cannot be uploaded until you do, and we record that you gave it. If you enrolled with an earlier version of the App that did not show this box, you gave your consent by agreeing to this Privacy Policy when you registered. At the gym's front counter, our staff take your face photo only while you are present, and by allowing them to take it you give your explicit consent. You may withdraw this consent at any time as described in Section 6.
We implement a strict "Data Minimization" policy regarding identity documents:
IC/Passport images are collected solely for the purpose of identity verification and are stored temporarily in Cloudflare R2.
In compliance with PDPA principles, these images are deleted from our cloud storage as soon as our staff complete the verification (approval or rejection). We only retain the record that the verification was successful.
We utilize high-tier technical partners to maintain our Services. Your data may be shared with or processed by:
Our primary database hosting provider.
Our payment processing partner.
Our infrastructure and security provider, and our cloud storage provider (Cloudflare R2), which stores members' face photos and identity-document images on our behalf.
MoceanAPI (SMS verification codes), Expo Push Notification Service (booking, payment and expiry reminders) and Google Workspace (email verification codes and receipts). They receive only the phone number, email address or device push token needed to deliver the message. They do not receive your face photo.
You acknowledge and agree that your data may be hosted on secure servers located in Singapore. We ensure that all cross-border transfers comply with Malaysian data protection standards.
Your data is retained for the duration of your membership to facilitate the 12-month commitment and rolling subscription terms.
When your membership ends, your face is removed from the door readers; your face photo is kept and then deleted as described in Section 2 (Face Data). We retain historical transaction data for up to seven (7) years to comply with Malaysian tax and audit regulations, after which it is permanently purged.
Under the PDPA, you are entitled to the following rights, which X Fitness will fulfill within 21 days of a written request:
Request a copy of the personal data we hold about you.
Request the update of inaccurate or incomplete information.
You may withdraw your consent for biometric or marketing processing at any time. To withdraw your consent for your face data, remove your face photo in the App (Settings > Remove My Face Photo) or ask our staff at the gym. Your face photo and its copies are then deleted as described in Section 2 (Deletion). You keep your membership and enter the gym through the front desk, and you can enrol your face again at any time.
You can delete your account at any time in the App (Settings > Delete Account) or by asking our staff; your face photo and its copies are then deleted as described in Section 2 (Deletion). Some other records, such as transaction history, are retained as required by law and under your membership contract (see Section 5).
We reserve the right to amend this Policy. Any material changes will be communicated with at least seven (7) days' notice via the App or our website. Continued use of the Services after such notice constitutes your acceptance of the updated Policy.
If you wish to exercise your rights, report misconduct, or have any inquiries regarding your privacy, please contact us:
33A, 33B, Jalan Bestari 12/2,
Taman Nusa Bestari,
Iskandar Puteri 79150,
Johor, Malaysia