Your Privacy Matters

This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it and what you can do about it. We have written it to be read, not to be survived.

1. Who we are

Plug In ApS ("Plugin", "Plugin Heat Club", "we", "us", "our") is the data controller for the personal data described in this policy.

• Plug In ApS, CVR no. 41297034
• Vasbygade 10A, 2450 København SV, Denmark
• Email: connect@pluginheatclub.com
• Website: pluginheatclub.com

We operate two locations, which we call zones:

• Sydhavn - Vasbygade 10A, 2450 København SV
• Amager - Kløvermarksvej 70, 2300 København S

We are not required to appoint a Data Protection Officer under Article 37 GDPR and have not appointed one. Anything to do with this policy goes to connect@pluginheatclub.com.

2. What this policy covers

This policy applies when you:

• book, buy or attend a session, event, course or programme
• hold a Plugin membership or account
• visit pluginheatclub.com or use the Plugin app
• sign up to our emails or text messages
• enter a competition or giveaway
• contact us, or book a private or corporate event
• visit one of our zones

It sits alongside our Terms of Trade. "Personal data" means any information relating to an identified or identifiable person. That includes things like your IP address, device identifiers and cookie IDs, even where we cannot put a name to them.

3. The personal data we collect

Account and booking

Name, email address, phone number, date of birth where we need it for age verification, booking and attendance history, waitlist entries, class preferences, membership tier and status, account balance, clips and credits

From you, and generated as you use our services

Payment

Billing name and address, payment method type, the last four digits and expiry date of your card, transaction amounts, invoices and receipts. We do not store full card numbers - these go directly to our payment provider

From you, through our payment provider

Marketing

Email address, mobile number, marketing preferences, records of consent and opt-out, engagement data such as opens, clicks and unsubscribes, and the segments you fall into

From you, and generated as you interact with our messages

Website and app

IP address, device and browser type, operating system, referring page, pages viewed, time on page, approximate location derived from IP, cookie and advertising identifiers

Collected automatically, subject to your cookie consent

Communications

The content of emails, contact form messages, social media direct messages and text messages you send us, and our replies

From you

Competitions

Name, email address, mobile number where relevant, entry details, and records of any marketing opt-in

From you

Private and corporate events

Contact name, company name, business email and phone number, CVR number, billing details and event requirements

From you

CCTV

Video images captured at our zones

Collected automatically - see section 10

Content capture

Photographs and video recorded on announced content days and at events where capture has been declared

Collected at the session - see section 11

We do not ask for your CPR number and we will never need it.

4. Health information

Heat, sauna and cold exposure are not right for everyone. Some conditions and some medications make participation risky, which is why our Terms of Trade ask you to assess your own fitness to take part and to speak to a doctor if you have a pre-existing condition.

We do not collect or store health information about our guests. Facilitators may talk to you about how you are feeling before or during a session, and you are always welcome to tell us anything that helps us look after you. That conversation stays a conversation - it is not written down, not entered into your profile and not kept anywhere.

We therefore do not hold medical questionnaires, waivers containing health details, or contraindication screening records, and we do not process special categories of personal data under Article 9 GDPR.

When you book, you confirm that you consider yourself fit to participate. We record only that you made that confirmation. We do not record anything about why, or about your health.

5. Why we use your data, and our legal basis

What we do

Legal basis

Take and manage your bookings, run your membership, give you access to sessions

Performance of a contract - Art. 6(1)(b)

Take payment, issue invoices and receipts, handle refunds and chargebacks

Contract - Art. 6(1)(b), and legal obligation for accounting records - Art. 6(1)(c)

Send service messages: booking confirmations, reminders, waitlist alerts, schedule changes, cancellations, membership and account notices

Contract - Art. 6(1)(b)

Send marketing emails and text messages about offers, events and news

Consent - Art. 6(1)(a), and the Danish Marketing Practices Act § 10

Group members by activity and interest so that what we send is relevant

Consent for the sending - Art. 6(1)(a); legitimate interests in relevance - Art. 6(1)(f)

Advertise on social and search platforms and measure whether it worked

Consent, given through our cookie banner - Art. 6(1)(a)

Run, maintain and secure the website and app

Legitimate interests in a working, secure service - Art. 6(1)(f); consent for non-essential cookies

Understand how our website and services are used

Consent, given through our cookie banner - Art. 6(1)(a)

Answer your questions and handle complaints

Legitimate interests in responding to you - Art. 6(1)(f); contract where it concerns your booking

Run competitions and giveaways

Contract for the competition itself - Art. 6(1)(b); consent for any marketing opt-in - Art. 6(1)(a)

Keep our zones, guests, team and property secure, and document incidents

Legitimate interests - Art. 6(1)(f), within the Danish TV Surveillance Act

Use photographs and video of you in our marketing

Consent - Art. 6(1)(a)

Establish, exercise or defend legal claims

Legitimate interests - Art. 6(1)(f)

Meet our obligations under bookkeeping, tax, consumer and safety law

Legal obligation - Art. 6(1)(c)

Where we rely on legitimate interests, we have weighed our interests against your rights and concluded that our use of your data does not override them. You can ask us about that assessment, and you can object - see section 12.

You do not have to give us your personal data, but we cannot sell you a session, run your membership or let you into a zone without the basics. Marketing and cookie consents are always optional and are never a condition of buying anything.

6. Text messages

If you give us your mobile number, we may send you two different kinds of text message.

• Service texts - booking confirmations, reminders, waitlist notifications, cancellations and schedule changes, and membership or account alerts. These are part of the service you have bought.
• Marketing texts - offers, events, new sessions and campaigns. These only ever go to people who have specifically opted in, and consent is never a condition of any purchase.

You can stop text messages at any time by replying STOP to any message we send you. Reply HELP for help, or contact us at connect@pluginheatclub.com. Message and data rates may apply. The full programme terms are in our Terms of Trade.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We keep a record of when and how you opted in, and of any opt-out, so that we can demonstrate we had your consent. We use a messaging provider to deliver these texts on our behalf; they act only on our instructions and never for their own marketing purposes.

7. Who we share your data with

We do not sell your personal data. We do not share your mobile number or SMS opt-in data with anyone for marketing purposes, as set out in section 6.

We use service providers who process personal data on our behalf under written data processing agreements. They act only on our instructions, and they are required to keep your data confidential and secure.

Provider

What they do for us

Where data is processed

Xplor / Mariana Tek

Booking platform, member accounts, the Plugin app

EU and USA

Shopify

Website and online store

EU, Canada and USA

Stripe

Payment processing

EU and USA

Klaviyo

Email and text message marketing, member segmentation

USA

Twilio

Text message delivery

USA

Cookiebot (Usercentrics)

Cookie consent management

EU

Meta, Google, TikTok

Advertising and analytics, where you have consented

EU and USA

Google Workspace

Email, files and internal collaboration

EU and USA

ManyChat

Automated replies and flows in social media direct messages

USA

We also share personal data:

• with our accountants, auditors and lawyers, where they need it to advise us
• with our insurers and their claims handlers, where an incident or a claim requires it
• with public authorities, courts and the police where the law requires it, or where it is necessary to establish, exercise or defend a legal claim
• with a buyer or successor, if we sell or restructure the business, subject to the same protections

Some platforms also act as independent or joint controllers for their own purposes - the advertising platforms in particular, for audience building and measurement. Where that is the case, their own privacy terms apply alongside this policy.

8. Sending data outside the EU and EEA

Several of the providers above are based in, or store data in, the United States. Where personal data leaves the EU or EEA, we make sure one of the following is in place:

• the provider is certified under the EU-US Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection, or
• we have entered into the European Commission’s Standard Contractual Clauses with them, together with any additional technical and organisational measures the transfer requires.

You can ask us which safeguard applies to a specific provider, and request a copy, by emailing connect@pluginheatclub.com.

9. How long we keep your data

Account and booking records

While your account is active, and for 3 years after your last booking or interaction

The Danish limitation period for claims

Accounting records - invoices, receipts, payment records

5 years from the end of the financial year the transaction falls in

The Danish Bookkeeping Act

Marketing data and consent records

Until you unsubscribe or withdraw consent. We keep the record of your consent and opt-out for 2 years afterwards

To document that we had your consent

Suppression list - addresses and numbers that have opted out

Indefinitely, as a minimal record

So that we do not contact you again by mistake

Competition entries

For the competition plus 30 days for winner verification. Any marketing opt-in continues until withdrawn

Running the competition fairly

CCTV footage

Deleted no later than 30 days after recording, unless needed for a specific incident, claim or police matter

The Danish TV Surveillance Act

Photographs and video from content capture

While the consent stands and the material is in use

Consent, withdrawable at any time

Contact form and email enquiries

12 months after the matter is closed

Handling your enquiry and any follow-up

Website and cookie data

As set out in the cookie declaration on our website

Varies by cookie

When these periods end we delete the data, or anonymise it so that it can no longer be linked to you.

10. CCTV at our zones

We use video surveillance at our zones for the security of our guests, our team and our property, and to help resolve incidents.

• Signage is posted at every entrance and in every area under surveillance, as Danish law requires.
• We do not have cameras in changing rooms, showers, toilets, saunas or bathing areas.
• Footage is stored securely and access is limited to the small number of people who need it.
• Footage is deleted no later than 30 days after it was recorded, unless it is needed for a specific incident, insurance claim or police report.
• We may pass footage to the police or to our insurers where the law allows or requires it.
  

11. Photography and filming

We do not film or photograph guests during normal sessions.

On days when we are capturing content, we say so clearly in the session description, in your booking confirmation and again in the room before we begin. If you would rather not appear, tell us or the facilitator and we will keep you out of shot. There is no pressure and it makes no difference to your session.

At events, collaborations and takeovers where a photographer or videographer will be present, this is stated in the event listing and signposted on the day.

Where you are identifiable in material we use for marketing, we rely on your consent. You can withdraw it at any time by emailing connect@pluginheatclub.com. We will stop using the material going forward, although we cannot always retrieve it from places others have already shared or reposted it.

If you tag us or send us your own content, we will ask you before we repost it.

12. Your rights

Under the GDPR you have the right to:

• Access - get a copy of the personal data we hold about you, and information about how we use it.
• Rectification - have inaccurate or incomplete data corrected.
• Erasure - have your data deleted where there is no longer a good reason for us to keep it. We may have to retain some records, such as accounting records we are legally required to keep.
• Restriction - ask us to pause our use of your data while a correction or a dispute is resolved.
• Data portability - receive the data you gave us in a common, machine-readable format, and have it transmitted to another provider where that is technically feasible.
• Objection - object to processing based on our legitimate interests. You can object to direct marketing at any time, for any reason, and we will stop.
• Withdrawal of consent - at any time, for anything we do on the basis of consent. This does not affect what we did before you withdrew it.
• Freedom from automated decision-making - we do not make decisions that have legal or similarly significant effects on you by automated means alone.

We use profiling in a limited way: grouping members by activity and interests so that our emails and texts are relevant. This does not have legal or similarly significant effects on you, and you can object to it at any time.

To exercise any of these rights, email connect@pluginheatclub.com. We will respond within one month. If your request is complex, or you have made several, we may extend that by up to two further months - we will tell you within the first month if we need to, and why. There is no charge, unless a request is manifestly unfounded or excessive.

We may need to verify your identity first, so that we do not disclose your data to someone else.

13. How we protect your data

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access. These include access controls and role-based permissions, encryption in transit, multi-factor authentication on business-critical systems, vetted suppliers under written data processing agreements, and limiting access to the people who actually need it.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay. Where required, we will report the breach to the Danish Data Protection Agency within 72 hours.

14. Cookies and similar technologies

The short version: when you first visit pluginheatclub.com you get a consent banner. Nothing other than strictly necessary cookies is set until you make a choice, and you can change or withdraw that choice at any time.

What cookies are

A cookie is a small text file stored on your computer, phone or tablet when you visit a website. Similar technologies - pixels, tags, SDKs, local storage and device fingerprinting - do comparable things. In this policy, "cookies" covers all of them.

Cookies and similar identifiers are personal data under the GDPR where they can be linked back to a device or a person, even without your name attached. We treat them that way.

The categories we use

Category

What it does

Consent needed

Strictly necessary

Makes the site work: page navigation, security, load balancing, your basket and checkout, and remembering your cookie choice

No - cannot be switched off

Preferences

Remembers choices such as language, zone and display settings

Yes

Statistics

Helps us understand how the site is used, which pages work and where people drop off

Yes

Marketing

Tracks visits across websites so we can show relevant advertising and measure whether it worked. Involves third parties such as Meta, Google and TikTok

Yes

Your consent

We ask for your consent before setting anything other than strictly necessary cookies. Consent has to be a clear, affirmative action. Continuing to browse is not consent, and we do not treat it as such.

You can change or withdraw your consent at any time using the cookie settings link in the footer of every page. Withdrawing consent stops further use, but does not delete cookies already stored on your device - you can remove those in your browser.

Managing cookies in your browser

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies will break parts of the site, including booking and checkout.

• Google Chrome - support.google.com/chrome/answer/95647
• Safari on Mac - support.apple.com/guide/safari/sfri11471/mac
• Safari on iPhone and iPad - support.apple.com/en-gb/HT201265
• Mozilla Firefox - support.mozilla.org/kb/clear-cookies-and-site-data-firefox
• Microsoft Edge - support.microsoft.com/microsoft-edge
• Chrome on Android - support.google.com/chrome/answer/114662

These are the browser makers’ own help pages. We cannot be responsible for their accuracy or availability.

In Denmark, the rules on cookies are supervised by the Danish Agency for Digitalisation (Digitaliseringsstyrelsen), alongside the Danish Data Protection Agency.

15. Children

Our services are for adults. Under our Terms of Trade, participants must be at least 16 years old, and anyone under 18 needs the consent of a parent or guardian.

We do not knowingly market to children. Under Danish law a child must be at least 13 to consent to an online service in their own right; below that age we would need a parent or guardian’s consent. If you believe a child has given us personal data, email connect@pluginheatclub.com and we will delete it.

16. Changes to this policy

We update this policy when our services, our systems or the law change. The current version is always published at pluginheatclub.com with its effective date at the top. If we make a change that materially affects how we use your data, we will tell you directly - by email or in the app - before it takes effect.

17. Contact and complaints

Questions, requests or concerns go to connect@pluginheatclub.com.

Plug In ApS, CVR no. 41297034, Vasbygade 10A, 2450 København SV, Denmark.

We would like the chance to put things right first, but you can complain to the Danish Data Protection Agency at any time:

• Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark
• Telephone +45 33 19 32 00
• dt@datatilsynet.dk
• datatilsynet.dk