Privacy policy

1. Who we are

The Studio Hub builds club software: Dojo Hub for martial arts clubs, PT Hub for personal trainers, and Dance Hub and Gymnastics Hub (coming soon). We are based in Centurion, South Africa.

The Studio Hub is the trading name of The Studio Hub Systems (Pty) Ltd, registration number 2026/813997/07. Street and postal address: 120 Edison Crescent, Hennopspark, Centurion, 0172, South Africa.

Our Information Officer is Brett Clarke, director. For anything about your information, email [email protected], or phone or WhatsApp 082 226 0215 (+27 82 226 0215).

Our Information Officer registration number with the Information Regulator: pending. Our PAIA manual, which explains how to ask for records we hold, is at thestudiohub.co.za/paia/.

2. Two kinds of information

Information about you and your club. When you visit our websites, fill in a form, book a demo, sign up or pay us, we decide how that information is used. Under POPIA we are the responsible party. Under the GDPR and Vietnam's law we are the controller.

Information your club keeps in its hub. Your members' details, bookings, payments and gradings belong to your club. Your club is the responsible party (or controller). We are the operator under POPIA, the processor under the GDPR, and the personal data processor under Vietnam's law. We store and process it only to run the hub for your club, and only as your club instructs. We sign a data processing agreement with every club (file 03 in this pack, the Data Processing Agreement).

If you are a member of a club that uses one of our hubs, your club is your first point of contact. Each club shows its own privacy notice at its hub address, for example warriorsports.dojohub.co.za/#privacy. We help the club answer you.

3. What we collect

From people who contact us or sign up:

• Your name, club name, email and WhatsApp number.
• Your club's style, size and city.
• Where you came from, like the ad or page you clicked.
• Messages you send us, and notes from calls and demos.
• Billing details for your plan. Your payment provider holds your full bank or card details, not us.

What clubs keep in their hub (each club decides):

• Member and family details, including children's details added by a parent or guardian.
• Memberships, bookings, check-ins, belts, gradings and report cards.
• Invoices, payments and arrears.
• Signed contracts, waivers, debit order mandates and consents, with the version signed and when.
• Health information a member chooses to give, like medical notes on a waiver.
• Photos, if the member or parent agrees.
• Messages between the club and its members, by email, WhatsApp, SMS and app notifications.

From our websites: see section 6.

4. Bank and card details

The hubs do not store full bank account numbers or card numbers. Each club connects its own payment providers, and only the ones the club switches on: Netcash (debit orders), Yoco, Ozow, Paystack and PayFast (South Africa), Stripe and PayPal (international), and 9Pay (Vietnam, not live yet). You type card details on the provider's own page. For debit orders, your bank details go straight to Netcash and the hub keeps only the last 4 digits. The hub keeps what it needs to match payments, like a reference, the amount and the bank name.

5. Why we use it (our lawful reasons)

In South Africa, where we rely on our legitimate interest, it is under POPIA section 11(1)(f), and you can object at any time (section 13). Vietnam's law has no general "legitimate interest" reason, so there we rely on your consent or our contract.

We do not sell personal information. We never use a club's member information for our own marketing. We do not make decisions about anyone by automated means alone that have legal or similar effects on them.

Since the 2025 changes to the POPIA Regulations, we never treat silence or a missed opt-out as consent to marketing.

6. Websites, cookies and the Meta pixel

On thestudiohub.co.za, dojohub.co.za and pthub.co.za we use:

• Basic visit information, like the pages you view and the link or ad you came from (for example the campaign name in the link). Your browser keeps this note for the visit only (session storage) so a form can say which ad brought you.
• The Meta pixel (only if you say yes, see Cookies below). A small piece of code from Meta (Facebook and Instagram). It tells Meta that someone viewed a page, and that a form was sent, so we can see which of our ads work and show them to people likely to be interested. Meta may link this to your Facebook or Instagram account if you have one.
• Meta Conversions API (only if you say yes). When you send one of our forms, our server tells Meta a form was sent. It sends your name, email address and phone number only in a scrambled (hashed) form, plus your internet address and browser type. Meta uses it to match the form to the ad you saw. We never send your club's details or what you wrote.
• Spam check. Our forms use Cloudflare Turnstile to check that a person, not a bot, is sending the form.

Cookies. We ask first, for every visitor in every country. When you first open one of our sites, a banner asks you to Accept, Decline or open Settings. There are two groups:

• Essential (always on). Cloudflare's security cookies and the spam check on our forms, a cookie that remembers whether you see rand or dollar prices (sh_cur), and a cookie that remembers your cookie choice (sh_consent). The sites need these to work safely.
• Marketing and Analytics (off until you say yes). The Meta pixel and Meta's advertising cookies (_fbp, and _fbc when you arrive from a Meta ad), and the Conversions API message our server sends when you send a form.

Nothing in the Marketing and Analytics group loads until you click Accept, or turn it on in Settings. If you decline, or never answer, your form still reaches us, but nothing about you or your visit is sent to Meta. We keep your choice for 12 months in the sh_consent cookie, then ask again. You can change your mind at any time with the "Cookie settings" link at the bottom of every page. Turning it off later stops the pixel and removes Meta's cookies from your browser. The club hubs and the member app do not use advertising cookies.

You can also ask us by email to stop sending your form details to Meta, block cookies in your browser, or change your ad settings in your Facebook or Instagram account.

For the pixel, Meta and we can be joint controllers under the GDPR for collecting the data and sending it to Meta, under Meta's Business Tools Terms and its Controller Addendum. After that, Meta uses the data as its own controller under its own policy: facebook.com/privacy/policy.

Club websites. Clubs can add the Meta pixel or Google tags to their own websites on our platform. The hub then shows the same kind of banner, with the same two groups, and asks first by default for every club. A South African club may still choose "tell, with No thanks", but the hub warns that this may not meet POPIA. A club can also switch tracking off. The club is responsible for its own website choices.

7. AI features

Some features use AI from our provider, Anthropic (United States):

• "Ask Dojo", the office assistant that helps club staff find answers and draft replies.
• AI club onboarding, which pre-fills a new club's setup from the information the club owner gives us.
• The demo builder, which builds a sample hub for a club that is thinking of joining, from that club's public information.

When a feature is used, only the information needed to answer is sent to Anthropic to produce the reply. We use Anthropic under its commercial API terms, and under those terms Anthropic does not use this information to train its models. We have not joined any feedback or development programme. Anthropic keeps API inputs and outputs for a limited period under its commercial terms and data processing agreement, and then deletes them. Health notes are never sent to the AI. Every AI call has a limit on how much it can send. Anthropic processes the data under its data processing agreement, which includes the EU Standard Contractual Clauses.

Admin jobs the AI suggests wait for a person to confirm them, and every job is logged. Clubs choose whether WhatsApp replies send by themselves or wait for approval. The WhatsApp assistant is set up to pass money, cancellations, complaints, injuries and anything about a child's safety to a person. It uses two checks: its own judgement, and a net of keywords. This lowers the risk a lot, but it is not a guarantee, so club staff still read the inbox. The keyword net is English only today (it has only a handful of basic Afrikaans, isiZulu and Vietnamese words, so we treat it as English only), and we will widen it. Anyone can type "person" to reach a human, and a member can say no to AI replies in the member app. Messages from an under 18 member's own number are never answered by the AI. The AI does not make decisions about members on its own.

The demo builder uses only a prospect club's public information (which can include coaches' names) and made up sample members, never another club's member data. We rely on our legitimate interest in showing a club what the hub would look like, and anyone named can ask us to remove it. For Vietnamese clubs we only build a demo after the club says yes.

8. Who we share it with

Only with the service providers we need to run the hubs, under written agreements that keep it confidential and secure. The full list, with what each one does and where, is Annex 3 of our Data Processing Agreement (file 03) and the public sub-processor list (file 03b), and we send it to any club or person who asks. The public list is at thestudiohub.co.za/subprocessors/. We email our clubs at least 30 days before we add or replace a provider that handles their members' data, and a club can object.

We do not use Google to hold member data. We also share information if the law requires it, for example a court order.

9. Where your information is stored

Our main database is in the European Union, in Paris, France (Supabase on Amazon Web Services). This means:

• South African clubs and people: your information is sent outside South Africa. Cross-border transfers are governed by Data Processing Agreements with our US sub-processors that give an adequate level of data protection under section 72 of POPIA. Our EU database provider is covered in the same way by its own data processing agreement, and the EU is also covered by the GDPR. Because these agreements give adequate protection, no prior authorisation from the Regulator is needed for children's or health information (POPIA section 57).
• Vietnamese clubs and people: your information is sent outside Vietnam, to the EU. See section 15.
• EU and UK clubs and people: your information is stored in the EU. Our team works from South Africa, and some providers are in the United States. See section 14.

Our team reaches club data from South Africa only to give support or fix problems. Daily encrypted backups (AES-256) are kept for 30 days on our own computer in South Africa, with the newest 7 copies in a private GitHub repository in the United States. Nobody can read them without our key. Supabase also keeps 7 days of its own backups in the EU.

10. How we keep it safe, and what we do if something goes wrong

• All traffic to the hubs and our websites is encrypted.
• Each club can only see its own information. The database blocks one club from another on every table, and an automatic security check runs after every database change.
• Staff and coaches only see what their role allows. Two-step sign-in for club owners and admins is being built and is not live yet.
• Changes to members, money and memberships are logged.
• We keep only the last 4 digits of bank accounts and never store card numbers.
• Passwords and keys for connected services are kept in an encrypted vault.
• Backups are encrypted (AES-256) and we have tested restoring them.
• Only the people on our team who need it can reach club data, and only to give support or fix problems.

If something goes wrong. If we find that personal information may have been reached by someone without permission:

• When the information is in a club's hub, we phone or WhatsApp the club owner as soon as we have reasonable grounds to believe there was a breach, and send written notice without undue delay and within 48 hours, even if we do not have all the facts yet, with updates after that. We help the club notify the regulator and the people involved. The club is the one that notifies them, because it is the responsible party (POPIA sections 21(2) and 22), the controller (GDPR article 33) or the controller under Vietnam's law. We give the club the facts it needs, in time for its deadlines. We notify the regulator or members on a club's behalf only if the club asks us to in writing.
• Only when the information is our own (for example our leads, club owners' accounts and our billing) do we notify the regulator and the people affected ourselves: the Information Regulator in South Africa as soon as reasonably possible (through its eServices portal); the EU or UK regulator within 72 hours where the GDPR requires it; and Vietnam's Ministry of Public Security (A05) within 72 hours where Vietnam's law requires it.

11. Children and health information

Our own websites are for club owners and coaches, not children. We do not knowingly collect children's information there.

Clubs hold children's records, often from about age 4. A parent or guardian signs a child up and gives consent for them. In Vietnam, for a child aged 7 or older, the law needs both the child and the parent or guardian to agree. The hub records the parent's or guardian's consent; it does not yet ask for the child's own agreement as a separate step, so a Vietnamese club collects and keeps that itself. The hub stores which consents were given, by whom and when.

Health information, like medical notes on a waiver, is special personal information under POPIA, special category data under the GDPR, and sensitive data under Vietnam's law. A member (or parent) gives it only by choice, with consent, so coaches can keep them safe. Only the club's staff with the right role can see it.

The hub does not use face recognition or fingerprints.

12. How long we keep it

• Club data: while your club uses our hubs. When your plan ends, you can ask for an export of your club's data for 30 days. After that we delete it, except records the law makes us keep. Deleted data leaves our backups within 30 days.
• Our own records: invoices, payment and accounting records for 7 years (Companies Act section 24, which also covers the 5 years tax law asks for).
• Enquiries that do not turn into a club: deleted after 2 years (24 months) without contact.
• Website visit records: 13 months at most.

Each club sets its own retention for its members. The hub offers each club a clean-up that, once the club switches it on, removes old enquiries after 24 months, people who left after 3 years, and website visit records after 13 months. When a member's account is deleted, the hub keeps only invoices, payments, memberships, attendance and signed contracts, because clubs need these for tax and legal claims.

13. Your rights, and how to use them

You can:

• Ask what information we hold about you, and get a copy.
• Ask us to correct it, or to delete it.
• Object to us using it, and opt out of marketing at any time.
• Take back your consent at any time. This does not undo what we did before.
• Complain to a regulator (see below and sections 14 and 15).

How. Email [email protected] or WhatsApp us. We may ask you to confirm who you are. We answer within 30 days (sooner in Vietnam, see section 15). We do not charge for this, unless a request is clearly unfounded or repeated. For records other than your own personal information, see our PAIA manual at thestudiohub.co.za/paia/, which sets out the forms and any prescribed fees.

If you are a member of a club, use your member app: Account, then Privacy and my data. There you can see what you agreed to, change your marketing and photo choices, and ask for "Download my data" or "Delete my account". Your club's office approves the request. If you write to us instead, we pass your request to your club and help them deal with it.

South Africa. You can complain to the Information Regulator: inforegulator.org.za, [email protected], 010 023 5200, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.

14. People in the EU and the UK (GDPR)

This section applies when you are in the European Union or the United Kingdom, for example as the owner or staff of an EU or UK club, or a visitor to our websites.

Our lawful reasons are in section 5: contract, legal obligation, legitimate interests (answering enquiries, a safe service), and consent (marketing, the Meta pixel and advertising cookies). When we rely on legitimate interests, you can ask us how we weighed them against your rights.

Your extra rights. As well as the rights in section 13, you can ask us to restrict how we use your information, and to give you your information in a format another service can read. You can object at any time to us using your information on the basis of legitimate interests, and always to direct marketing.

Transfers. Our database is in the EU. Our team reaches it from South Africa, and some providers are in the United States. South Africa has no EU adequacy decision. We protect these transfers with the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914): Module 2 between an EU club and us, and Module 3 between us and our providers. For the UK we use the UK International Data Transfer Addendum. Where a US provider is certified under the EU US Data Privacy Framework, that also applies. You can ask us for a copy of the clauses.

We have no EU or UK club today. Before the first EU or UK club's data is loaded, we complete the transfer impact assessment that Clause 14 of the clauses asks for.

Breaches. Where a club is the controller, we tell the club without undue delay and help it notify the regulator within its 72 hours. Only where we are the controller do we tell the regulator ourselves, within 72 hours of finding a breach unless it is unlikely to put anyone at risk, and tell you without undue delay if the risk is high.

Complaints. You can complain to the data protection authority in the EU country where you live, work, or where the problem happened. In the UK, that is the Information Commissioner's Office (ico.org.uk).

EU and UK representative. We are not established in the EU or the UK. We will appoint a representative under article 27 of the GDPR (and of the UK GDPR) before the first EU or UK club starts using a hub, and add their name and address here.

15. People in Vietnam

This section applies when you are in Vietnam, for example as the owner or staff of a Vietnamese club, a member of one, or a visitor to our websites. It follows the Law on Personal Data Protection (No. 91/2025/QH15) and Decree 356/2025/ND-CP.

Consent, one purpose at a time. We ask for your consent separately for each purpose, and we never make one a condition of another. We never use pre-ticked boxes, and silence is not consent. We keep a record of what you agreed to, when and how. You can take back your consent at any time.

Sensitive data. Health information and banking details are sensitive data under Vietnam's law. We tell you when we ask for them, and we only process them with your consent.

Children. For a child aged 7 or older, both the child and a parent or guardian must agree. The hub records the parent's or guardian's consent, and the club collects and keeps the child's own agreement.

Transfer abroad. Your information is stored outside Vietnam, in the European Union (Paris, France). Our team reaches it from South Africa, and some providers are in the United States (section 8). The cross-border transfer impact assessment is filed with the Ministry of Public Security within 60 days of the transfer starting. For members' information, each Vietnamese club files the dossier as the controller, and we help. For our own Vietnamese leads and club owners, we file our own.

Deadlines. We confirm we have your request within 2 working days. We give you a copy or correct your information within 10 days, act on taking back consent within 15 days, and delete your information within 20 days.

Breaches. Where a Vietnamese club is the controller, we tell the club straight away and help it notify the Department of Cyber Security and High Tech Crime Prevention (A05), Ministry of Public Security, within 72 hours. Only for our own data do we notify A05 ourselves, within 72 hours of finding a breach that the law covers.

Complaints. You can complain to the Department of Cyber Security and High Tech Crime Prevention (A05), Ministry of Public Security, through its national personal data protection portal.

Licence and data protection person. Our position today is that we fall under the small business and startup exemption in Decree 356, so we have not applied for a licence as a personal data processing service or named a data protection person for Vietnam. We will take Vietnamese legal advice before the first Vietnamese club's member data goes live, and update this section.

16. Changes to this policy

If we change this policy, we update the date at the top. If the change is big, we tell our clubs by email first.