1. Who We Are

Max Perform Lab is an elite personal training and performance coaching facility located in the An-Narjis District, Riyadh, Saudi Arabia.

Address: An-Narjis District, Riyadh, Saudi Arabia
Phone: +966 55 791 0574
Email: frontdesk001@maxperformlab.com

2. Data We Collect

We collect the minimum data needed to provide our services:

Category	Examples	Source
Identity & Contact	Full name, phone number, email address	Booking form, WhatsApp
Health & Fitness	Fitness goals, injury history, InBody & VALD assessment results	Booking wizard, on-site assessment
Payment	Transaction reference, card type, last 4 digits	Tap Payments (payment processor)
Booking Activity	Program selected, session dates/times, attendance history	Our booking system
Technical	IP address, request time, requested page, browser and device type	Hosting and content-delivery request logs
Website analytics Cookieless	Pages viewed, approximate location derived from IP, device and browser type, and referring site — used only as aggregated, anonymous usage data. We also count a few actions taken on the site: that a booking, consultation or callback form was submitted, that a payment was started or completed (its amount and the currency, SAR, only), and that a WhatsApp or phone link was selected. These counts never include your name, phone number, email address, booking reference or payment status code. No cookie or other identifier is stored on your device.	Google Analytics, running in cookieless mode (section 9)

We do not store full card numbers, CVVs, or banking credentials. All payment processing is handled by Tap Payments — a PCI-DSS compliant processor.

This website is a static site. It runs no WordPress or PHP application, keeps no server-side session for you, and sets no cookie of its own. See section 9 for exactly what is stored in your browser.

3. Legal Basis for Processing

Under the Saudi PDPL, we process your data on the following bases:

Contractual necessity — to book sessions, process payments, and send session confirmations.
Consent — for health and fitness data provided voluntarily during assessments.
Legitimate interest — for service improvement, including cookieless, aggregated website analytics (section 9), and fraud prevention.
Legal obligation — to comply with Saudi financial and consumer protection regulations.

4. How We Use Your Data

Process and confirm bookings and payments
Communicate session reminders and updates via WhatsApp or email
Generate invoices and receipts
Design personalised training and nutrition programs
Track progress over time using assessment data
Respond to enquiries and support requests
Comply with legal or regulatory requirements

We do not use your data for automated decision-making that produces legal effects about you, and we do not sell your data to third parties for marketing purposes.

5. Data Sharing

We share your data only where necessary:

Tap Payments — to process card, mada, Apple Pay, stc Pay, Tabby, and Tamara transactions. Governed by their own privacy policy.
Amazon Web Services — hosting and content delivery for this website. AWS receives the technical request data described in section 2 in order to serve the page.
IDS Fitness — operator of the booking and membership platform behind this site, reachable at mpl-api.idsfitness.com. Every page of this website asks that platform for its current published content as the page loads, and the booking wizard sends your booking details to it when you confirm. It processes that data on our instructions, as our platform provider. Section 9 sets out exactly what the automatic request contains.
Google (Google Analytics) — Google acts as our analytics processor and receives the website-analytics data described in section 2, which it uses to give us aggregated, anonymous usage reports. It runs in cookieless mode: no cookie or other identifier is stored on your device, and the data is not used for advertising. Google processes it on infrastructure outside the Kingdom of Saudi Arabia, including in the United States and the European Union.
Google (Google Fonts and Google Maps) — separate from analytics. These are needed to display the page itself. Section 9 sets out what each one is, when it loads and what Google receives.
WhatsApp Business (Meta) — used for booking confirmations and client communication. Messages are end-to-end encrypted.
Legal authorities — only when required by Saudi law, a court order, or a regulatory body.

Where a processor handles your data outside the Kingdom, the transfer conditions required by the PDPL and its implementing regulations apply. The specific safeguards for each processor are being confirmed as part of our data-protection review.

6. Data Retention

Booking & payment records — retained for 5 years to comply with Saudi commercial and VAT regulations.
Health & assessment data — retained for the duration of your membership plus 12 months, then deleted unless you request otherwise.
Website logs — retained for 90 days, then automatically purged.
Marketing communications — until you opt out.
Website analytics data — held by Google under the retention period configured for our Google Analytics property. Because that data sits with Google rather than with us, deletion requests for it are made through Google; contact us and we will pass the request on.

7. Data Security

We protect your data using:

TLS/HTTPS encryption for all data transmitted via our website
Password-protected admin access with role-based permissions
Regular security audits and software updates
Restricted staff access — only personnel who need your data to deliver services can access it

In the event of a data breach that poses a risk to your rights, we will notify the relevant Saudi authority and affected individuals as required by the PDPL.

8. Your Rights Under the PDPL

As a data subject under Saudi Arabia's Personal Data Protection Law, you have the right to:

Access Request a copy of the personal data we hold about you
Correct Ask us to update inaccurate or incomplete data
Delete Request deletion of your data where we no longer have a legal basis to retain it
Restrict Ask us to stop processing your data in certain circumstances
Withdraw Consent Withdraw consent for optional processing at any time, without affecting past processing
Object Object to processing carried out on the basis of legitimate interests

To exercise any of these rights, contact us at frontdesk001@maxperformlab.com. We will respond within 30 days.

9. Cookies, Browser Storage & Analytics

This website sets no cookies of its own. What it keeps is stored in your browser by the site itself and never sent to us:

What	Where	Why
`mpl_checkout`	Local storage	Set only when you start a payment: the booking reference, a status token, the payment method, the program name and the amount shown to you, so the page you return to from the payment provider can show the result and our analytics can count the completed payment once. It contains no name, contact detail or card data.
`mpl_sstrip`, `mpl_consult_dropped`, `mpl_pt_…`	Session storage	Remembers that you dismissed the promotional strip, that a consultation prompt was already answered, and that a completed payment has already been counted (a short code derived from the payment status token, which does not contain it), so reloading the confirmation page does not count the payment twice. None of these is sent to us or to Google. Cleared when you close the tab.

Google Analytics — cookieless

Purpose. We use Google Analytics to understand how this website is used — which pages people visit, on what kind of device, where visits come from, and which of a few key actions are taken (a booking or contact form submitted, a payment started or completed, a WhatsApp or phone link selected) — so we can improve the site. These action counts carry no name, phone number, email address or booking reference: only the kind of action and, for a payment, its amount in SAR. We do not use it for advertising, remarketing or profiling, and we do not use advertising or cross-site tracking trackers of any kind.

No cookies, no identifiers. Google Analytics runs on this site in a cookieless mode. Each page loads Google's tag from www.googletagmanager.com with every storage permission set to “denied” (Google's Consent Mode), and this site never changes that setting. In that mode Google documents that its analytics code does not set or read cookies; this site's own code stores no analytics identifier in your browser's cookies or storage. Your browser sends the website-analytics data listed in section 2 to Google (google-analytics.com, analytics.google.com), which Google uses to give us aggregated, anonymous usage reports. Advertising features are switched off and the data is not used for advertising. See section 5 for the transfer position.

Google Fonts and the Google Maps embed on the home page are separate from analytics; they are described in the next subsection.

Your choices. Because Google Analytics stores nothing on your device (the only thing this site itself keeps for measurement is the payment-count marker listed above, which is never sent anywhere), this site shows no analytics consent banner. If you prefer that Google Analytics is not loaded at all, you can block it with your browser's privacy settings or a content blocker; with JavaScript disabled it does not run.

You can also block or delete cookies and site storage in your browser settings at any time. Doing so will not stop you booking a session.

The request every page makes to our platform

As each page loads, your browser asks our booking and content platform — mpl-api.idsfitness.com, operated by IDS Fitness — for the site's current published content: prices, coach profiles, opening hours, offers and the like. This happens on every page, before and independently of analytics, because it is how the page knows what to show.

What it sends. A read-only request naming this gym. It carries no name, phone number, email address or booking of yours. Like any web request it necessarily reveals your IP address, the time, and your browser and device type.
What comes back. Published content only — the same content every visitor sees.
Media. Images and videos referenced by that content are fetched too. They may only come from a short, reviewed list of origins — our platform and this website — so a change in the content system cannot cause your browser to fetch media from somewhere else. Anything outside that list is ignored and the built-in image is kept.
Booking. Separately, when you confirm a booking the wizard sends the details you entered to the same platform. That is described in sections 2 and 4.
Where it is processed. IDS Fitness processes this on our instructions as our platform provider. The transfer position in section 5 applies; the specific safeguards are being confirmed as part of our data-protection review.

Other Google services this site loads

Two Google services are used to display the page itself. They are not analytics, and they load on the pages described below regardless of analytics. We list them here because loading them means your browser contacts Google, and you should not have to read our source code to find that out.

Service	Purpose & when it loads	What Google receives
Google Fonts `fonts.googleapis.com` `fonts.gstatic.com`	Supplies the typefaces this site is designed in. Requested by your browser on every page, as the page loads.	The request itself: your IP address, the time, which font files were requested, the page that requested them, and your browser and device type. It sets no cookie for this purpose, and we send it no name, contact detail or booking information.
Google Maps (embedded map) `www.google.com/maps/embed`	Shows where the gym is. Loaded on the home page only, where the map appears. The embed is display-only — it is marked inert and cannot be interacted with; the “open in Google Maps” link next to it goes to Google only if you activate it.	The same request data as above, plus the map location being displayed. Google may set its own cookies for the embed under its own policies.

Both are Google services, so the transfer position in section 5 applies to them as well. If you would rather your browser did not contact Google for fonts or maps, a content blocker or your browser's tracking-protection settings will prevent it; the site remains usable, with a system typeface and without the map preview.

Instagram reels (Meta) — only when you tap Play

Service	Purpose & when it loads	What Meta receives
Instagram (Meta), embedded reel player `www.instagram.com`	Plays our Instagram reels on the home page. It loads only when you tap Play on a reel. Until then each reel is just a cover image served by this website or our platform, and your browser makes no request to Instagram or any other Meta service. Tapping Play opens Instagram's player for that one reel; closing it removes the player.	The request itself: your IP address, the time, which reel was played, your browser and device type, and that it was played from this website (our address, not the specific page). Instagram may set or read its own cookies under Meta's policies, and if you are logged in to Instagram in the same browser, Meta may link the view to your account. We send Meta no name, contact detail or booking information. Meta processes this outside the Kingdom of Saudi Arabia, so the transfer position in section 5 applies. See Instagram's privacy policy. If you never tap Play, Meta receives nothing from this site.

10. Children's Privacy

Our services are intended for individuals aged 16 and above. We do not knowingly collect personal data from children under 16 without verifiable parental consent. If you believe a minor's data has been collected without consent, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of the page. Material changes will be communicated via email or a notice on our website.

12. Contact Us

For any privacy-related questions, data requests, or complaints, please reach out:

Max Perform Lab

An-Narjis District, Riyadh, Saudi Arabia

frontdesk001@maxperformlab.com

+966 55 791 0574

If you are unsatisfied with our response, you may lodge a complaint with the Saudi Authority for Data and Artificial Intelligence (SDAIA).