Privacy Policy for Progressing Ballet Technique (PBT)

1. Who we are and what this policy covers

This policy covers personal information collected through pbt.dance and the PBT mobile apps, including our China app, teacher-certification platform, workshops, PBT Connect, online store, and customer communications. "PBT", "we", and "us" mean PBT FIT Pty Ltd (ACN 644 717 108), trading as Progressing Ballet Technique and PBT Connect, of 3 Danks Street, Waterloo NSW 2017, Australia.

We operate a parallel version of our platform for mainland China using different local technology partners. Section 6 explains how information is handled for that platform.

Contact us about this policy or your personal information at customerservice@pbt.dance.

Our representative in the EU, EEA, UK and Switzerland

PBT FIT Pty Ltd has appointed Data Protection Representative Limited (trading as DataRep) as its data protection representative in the European Union and European Economic Area under the GDPR, in the United Kingdom under the UK GDPR and the Data Protection Act 2018, and in Switzerland under the Federal Act on Data Protection (FADP).

You can contact us directly using the details above. If you are in one of these places, you can also contact our representative, DataRep, with questions or requests about how we process your personal information:

• by email to datarequest@datarep.com. To help DataRep route your message, please include "Progressing Ballet Technique; PBT Connect" in the subject line;
• using DataRep's online form at www.datarep.com/data-request; or
• by post to DataRep at the address for your country listed below.

When writing, address your letter to "DataRep", not to PBT, or it may not reach them. Please mention Progressing Ballet Technique or PBT Connect in your letter. We may ask you to confirm your identity before acting on a request.

For questions about our classes, products, bookings or membership, please contact us directly at customerservice@pbt.dance rather than DataRep.

DataRep's own privacy notice is at www.datarep.com/privacy-policy.

• Austria: DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria
• Belgium: DataRep, Rue des Colonies 11, Brussels, 1000
• Bulgaria: DataRep, 25 Vitosha blvd. Fl. 2, office 4, 1000, Sofia, Bulgaria
• Croatia: DataRep, Ground & 9th Floor, Hoto Tower, Savska cesta 32, Zagreb, 10000, Croatia
• Cyprus: DataRep, Victory House, 205 Archbishop Makarios Avenue, Limassol, 3030, Cyprus
• Czech Republic: DataRep, Platan Office, 28. Října 205/45, Floor 3&4, Ostrava, 70200, Czech Republic
• Denmark: DataRep, Lautruphøj 1-3, Ballerup, 2750, Denmark
• Estonia: DataRep, 2nd Floor, Tornimae 5, Tallinn, 10145, Estonia
• Finland: DataRep, Luna House, 5.krs, Mannerheimintie 12 B, Helsinki, 00100, Finland
• France: DataRep, 72 rue de Lessard, Rouen, 76100, France
• Germany: DataRep, 3rd and 4th floor, Altmarkt 10 B/D, Dresden, 01067, Germany
• Greece: DataRep, Ippodamias Sq. 8, 4th floor, Piraeus, Attica, Greece
• Hungary: DataRep, 1054 Honved street, 8 1/2, Budapest, Hungary
• Iceland: DataRep, Laugavegur 13, 101 Reykjavik, Iceland
• Ireland: DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland
• Italy: DataRep, Viale Giorgio Ribotta 11, Piano 1, Rome, Lazio, 00144, Italy
• Latvia: DataRep, 4th & 5th floors, 14 Terbatas Street, Riga, LV-1011, Latvia
• Liechtenstein: DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria
• Lithuania: DataRep, 44A Gedimino Avenue, 01110 Vilnius, Lithuania
• Luxembourg: DataRep, BPM 335368, Banzelt 4 A, 6921, Roodt-sur-Syre, Luxembourg
• Malta: DataRep, Tower Business Centre, 2nd floor, Tower Street, Swatar, BKR4013, Malta
• Netherlands: DataRep, De Nieuwe Erven 3 Unit - 15162, 5431 NV Cuijk, Netherlands
• Norway: DataRep, C.J. Hambros Plass 2c, Oslo, 0164, Norway
• Poland: DataRep, Budynek Fronton ul Kamienna 21, Krakow, 31-403, Poland
• Portugal: DataRep, Torre de Monsanto, Rua Afonso Praça 30, 7th floor, Algès, Lisbon, 1495-061, Portugal
• Romania: DataRep, 15 Piaţa Charles de Gaulle, nr. 1-T, Bucureşti, Sectorul 1, 011857, Romania
• Slovakia: DataRep, Apollo Business Centre II, Block E / 9th floor, 4D Prievozska, Bratislava, 821 09, Slovakia
• Slovenia: DataRep, Trg. Republike 3, Floor 3, Ljubljana, 1000, Slovenia
• Spain: DataRep, Calle de Manzanares 4, Madrid, 28005, Spain
• Sweden: DataRep, S:t Johannesgatan 2, 4th floor, Malmo, SE - 211 46, Sweden
• Switzerland: DataRep, Leutschenbachstrasse 95, ZURICH, 8050, Switzerland
• United Kingdom: DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom

2. Information we collect

Account and profile: name, email, phone number, a securely hashed password, profile photo, and school or location information.

China account holders: if you sign in or pay through WeChat, we receive your WeChat identity, such as a unique ID, nickname, avatar, and general location. For phone-based sign-in, we receive your mobile number through SMS verification.

Teacher certification: certifications and awards, assessment video submissions, certification renewal responses, and training or viewing history.

Workshops: purchaser and attendee contact details, country or region, registration, attendance, transfer, refund and payment records. Booking-claim information may include date of birth, address, teaching details and an emergency contact's name and telephone number. Waivers or support reports may include health-related or other sensitive information; provide only what is needed.

Payments: Stripe and, for some Latin American customers, EBANX process payments. We do not see or store your full card number. We keep a reference ID, invoices, and subscription or membership status.

Shopping: Shopify processes merchandise orders and holds information including your name, shipping and billing address, order history, and payment details under its own privacy terms.

Technical information: IP address, approximate location, device and browser information, and standard web server logs.

Correspondence: messages you send to us and the information needed to respond and keep appropriate records.

PBT Connect teacher profiles and lesson offerings: name, biography, languages, profile and lesson images, teaching location, lesson descriptions, tax and payout setup details, and records showing the terms and notices you accepted, including versions, time and security metadata. Public profile and lesson information is visible to people using PBT Connect. Private tax and screening information is not part of the public profile. Clearance submissions may involve private supporting documents, review outcomes and audit information; they are separate from public qualification or check badges.

PBT Connect lessons: booking schedules, payment and payout records, receipts, messages between participants, lesson feedback and ratings, and technical connection information for live video. Live PBT Connect lessons are carried by Tencent Cloud from Singapore and are not recorded by PBT.

Planned supervised under-18 lessons: this service is not yet in use. Before it starts, a parent or guardian will control the account and receive a separate family privacy notice. The planned information is the child's preferred name, age in years and location, the parent's contact and consent records, adult-verification results and security references, phone verification, per-child consent and withdrawal, per-lesson approval, document versions, receipt delivery and safety records. A link to an existing PBT member does not remove that separate member record. New child-profile intake does not ask for a surname, date of birth, child contact details or identity documents. The verification provider explains its own collection separately. Read the Family Privacy Notice before providing child information.

Cookies and advertising: the information described in Section 7.

3. How and why we use your information

We use your information to:

• create and manage your account and membership;
• process certification submissions and issue certifications;
• run and manage workshops you register for;
• process payments and manage subscriptions through providers including Stripe and EBANX;
• fulfil merchandise orders through Shopify;
• send service communications and, where you have opted in, marketing communications;
• provide customer support;
• operate PBT Connect teacher profiles, lesson offerings, bookings, payments, payouts, messages, lesson feedback, and live video lessons;
• prepare internal support and certification-review drafts using AI tools, with staff retaining responsibility for every response and decision;
• translate website and app content into other languages;
• measure and improve our website, apps, and advertising; and
• detect and prevent fraud and abuse and comply with our legal obligations.

EU and UK legal bases

Where European Union or United Kingdom data protection law applies, we rely on one or more of these legal bases:

• Contract: processing needed to provide a membership, workshop, purchase, certification, or other service you request.
• Legitimate interests: operating, securing, supporting, and improving our services, preventing fraud, and measuring our business and advertising, where those interests are not overridden by your rights.
• Consent: activities such as optional marketing or non-essential cookies where consent is required. You may withdraw consent at any time.
• Legal obligation: processing needed to meet tax, accounting, regulatory, or other legal requirements.

Required information and separate choices

For PBT Connect, account, requested listing and booking administration use information necessary to provide that service. Security, safety, abuse prevention and dispute handling involve our interests in protecting people and the service, subject to their rights. Financial records and disclosures also meet applicable legal requirements. Missing required account, payment, verification or child-consent information can prevent the relevant booking, payout or supervised lesson.

Optional profile content, marketing and reminder choices are separate. Consent can be withdrawn without making earlier lawful processing unlawful. Health or other sensitive information and criminal-record screening require additional conditions where applicable; a booking contract is not blanket permission to use them. We obtain information from you and, where relevant, the parent, other booking participant, payment/verification provider or staff review. We use only the information needed for the stated purpose.

4. AI and automated processing

Content translation: we use Google Gemini to help translate content written by our team. Personal information is not intended to be included in that work. The translation tool is not used to make decisions about you or your account.

Certification review drafts: staff may use an AI model provider to prepare an internal draft review of a certification submission, including submitted video and transcript content. A staff member reviews the work and makes every certification decision. The draft is not sent automatically to the teacher.

Support and help reports: messages and PBT Connect help reports may be processed by PBT's internal AI-assisted operations tools using providers including Anthropic and OpenAI. These tools help staff organise and draft work. PBT staff remain responsible for responses and actions.

Lead and engagement scoring: our customer relationship system uses fixed, human-authored rules, such as recent email engagement or membership status, to help our marketing team prioritise follow-up. These rules do not affect pricing, access, eligibility, or another legal or similarly significant outcome.

Video and content processing: video-hosting providers may use standard automated delivery and playback tools. These are not AI decisions about you.

We do not currently use AI to decide account status, certification eligibility, pricing, or access. If that changes, we will update this policy and provide any notice, choice, or human review required by law.

5. Who we share your information with

China-specific providers are described in Section 6. We do not sell personal information to third parties.

6. International data transfers and China

PBT is based in Australia. Our infrastructure includes Amazon Web Services and database/application services in the United States, with Hong Kong infrastructure for China-facing traffic. PBT Connect video uses our international Tencent Cloud account based in Singapore. Parent adult verification involves Kids Web Services in the United Kingdom. A selected teacher may receive lesson information in another country; other providers may process information where they and their subprocessors operate.

Transfer arrangements depend on the recipient, destination and applicable law. Relevant safeguards can include an applicable adequacy decision, the European Commission Standard Contractual Clauses, the UK Addendum or IDTA, and any required Swiss adaptations. Contact customerservice@pbt.dance for information about the arrangements applicable to your information and how to obtain a copy of relevant safeguards. Using a service or accepting this policy does not waive your transfer rights.

Mainland China: our parallel platform uses providers including WeChat for sign-in/payment, Alibaba Cloud for file storage and SMS, and Tencent Cloud for video hosting. China-facing information and any transfer outside mainland China are subject to the applicable local requirements. Google Analytics, Google Ads and Meta Pixel are not intended for the China platform. The Singapore PBT Connect video service is distinct from China training-library delivery.

7. Cookies and online advertising

Outside China, our tools include Google Analytics, Google Tag Manager, Google Ads, Meta Pixel and Conversions API, OpenAI advertising measurement, Microsoft Clarity, Pinterest and Cookiebot. They support usage measurement, advertising attribution, audiences, interaction analysis and privacy choices. Some providers also use information under their own terms.

Browser events may include page activity and device or advertising identifiers. Meta server conversion events can include hashed contact details, IP address, browser/device and country information, attribution identifiers and transaction events. OpenAI server events can include a subscription- or purchase-linked identifier, event type, time and source page. Hashing does not make linkable information anonymous.

Browser cookie choices do not by themselves stop server-side conversion disclosures. To object to advertising-related sharing for an account or guest purchase, contact customerservice@pbt.dance with enough information to identify it. Do not send card details. Optional marketing choices are separate from accepting a contract or reading a privacy notice.

Read our Cookies and Advertising Choices for purposes, duration information and a button to reopen available cookie settings.

8. Your rights

European Union, EEA and United Kingdom: you may have rights to access, correct, delete, restrict, or object to processing and to receive a portable copy of your information. Where we rely on consent, you may withdraw it at any time. You may complain to your local data protection authority, including the ICO in the United Kingdom. You can also contact our representative, DataRep (see section 1).

Switzerland: under the Federal Act on Data Protection, you may have rights to access your information, have it corrected or deleted, object to processing, and in some cases receive a copy of it in a portable format. You may complain to the Federal Data Protection and Information Commissioner (FDPIC). You can also contact our representative, DataRep (see section 1).

California: you may have rights to know, delete, and correct personal information and to opt out of its sale or sharing. We do not sell personal information. You will not be discriminated against for exercising applicable privacy rights.

Australia: you can request access to and correction of your personal information under the Australian Privacy Principles. If we cannot resolve a concern, you can contact the Office of the Australian Information Commissioner.

Other locations, including Canada: contact us and we will handle your request consistently with applicable local law.

To exercise a right, email customerservice@pbt.dance. We may need to verify your identity and locate the relevant records. EU/UK requests normally receive a response within one month, subject to lawful extensions and other applicable rules. You may complain directly to your relevant authority without first complaining to PBT. You can also contact DataRep as explained above.

9. Data retention

We retain information according to its purpose and the applicable safety, tax, accounting, dispute and legal requirements. We review whether information remains necessary and whether identifying details can be removed or reduced. Closing an account, withdrawing consent or a verification result expiring does not automatically delete every associated record.

• Account, profile and listing information: while needed to provide the account or listing, then as necessary for outstanding requests, disputes or justified evidence.
• Bookings, payments and payouts: for applicable financial and legal record-keeping requirements and unresolved refunds, disputes or claims; keep only the details required for those purposes.
• Messages, reviews and support: while needed to provide the communication, resolve the enquiry and handle justified safety or dispute records. Public visibility and storage are separate questions.
• Child profiles: while needed for the parent-managed service, followed by a privacy review when consent is withdrawn or the profile is no longer needed. Consent, lesson approval and incident evidence have separate retention needs.
• Verification and security: for current eligibility, fraud prevention and appropriate audit evidence. The validity of a proof or phone challenge is not itself its deletion period.
• Marketing and consent records: while needed for the stated choice or relationship and to evidence or honour withdrawal, unsubscribe or objection. Limited suppression information may be kept to avoid contacting you again.
• Backups and provider copies: according to their retention/lifecycle and recovery purposes, with access restricted; a restoration must not defeat an applicable deletion or suppression request.

Ask us for the retention information applicable to a particular record. Where a request cannot remove information because a lawful retention reason still applies, we will explain the relevant limitation. PBT does not retain a recording of a PBT Connect lesson.

10. Children's privacy

The supervised under-18 PBT Connect service is not yet open. It is being prepared as a parent-managed service: the parent or guardian controls contact, provides the required consent and lesson approval, and remains present during the lesson. A child profile does not create a child login or private teacher-child messaging. Child-profile information is not used for advertising to a child.

Before child information is supplied, parents should read the PBT Connect Family Privacy Notice. It explains minimum child information, adult and mobile verification, teacher/provider access, live video, withdrawal, retention and rights. The young person can also contact us about their own information or a concern.

Workshop bookings and merchandise purchases require an adult purchaser. If you believe a child has provided information outside the intended process, contact customerservice@pbt.dance so we can investigate.

11. Data security

We use technical and organisational measures designed to protect information, including encryption in transit, access controls, and secure storage of payment information with Stripe or EBANX rather than on our own servers. No system is completely secure, and we cannot guarantee absolute security.

12. If something goes wrong

We assess a personal data breach against the requirements that apply to the affected information. Under EU or UK GDPR, we notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a reportable breach. Where a breach is likely to create a high risk to people's rights and freedoms, we inform affected people without undue delay unless a lawful exception applies.

Other applicable duties, including Australia's Notifiable Data Breaches scheme and its serious-harm test, also continue to apply. Contact customerservice@pbt.dance promptly about suspected unauthorised access or disclosure.

13. Changes to this policy

We may update this policy from time to time. We will post the current version here with a new effective date and take reasonable steps to notify you before a material change takes effect.