Privacy Policy

AG Power Fitness (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy describes how we handle information about you when you use our mobile application, membership card, loyalty programme and related services (together, the “Services”), in accordance with the Personal Data Protection Act 2010 of Malaysia (“PDPA”) and other applicable laws.

1. Who we are

The AG Power Fitness app and membership services are operated in Malaysia. For the purposes of the PDPA, we are the data user responsible for your personal data. If you have any questions about this policy, you can reach us at support@agpower.com.

2. Information we collect

We collect the following categories of personal data, most of which you provide directly when you register and use your membership:

Information you provide

• Account & identity details — your name, email address, mobile phone number and the password you set (stored only in encrypted/hashed form).
• Profile details — date of birth, gender, fitness goals and your preferred branch or outlet, where you choose to provide them.
• Membership records — your membership plan, status, start and end dates, and any registration or promotional offer applied to your membership.
• Communications — feedback, ratings, support enquiries and any other information you send to us.

Information generated as you use the Services

• Membership QR & check-in data — a unique membership code is used to generate your QR card; when you check in at a gym it records the date, time and branch of your visit.
• Loyalty programme data — your points balance, lifetime points, membership tier, points transaction history and reward redemptions.
• Referral data — your referral code and, where applicable, the member who referred you.
• Device & technical data — a push-notification token for your device (if you enable notifications), device type, app version, IP address and basic usage/log data used to keep the Services secure and working.

3. How we use your information

We use your personal data to:

• create and manage your account, membership and digital membership card;
• verify your identity and record your attendance when you scan your QR code at a branch;
• operate the loyalty programme — awarding, adjusting and redeeming points and calculating your tier;
• send you service messages about your membership, check-ins, points and reward redemptions;
• send you promotions, announcements and offers where you have agreed to receive them;
• administer referrals and any associated rewards;
• respond to your feedback, questions and support requests;
• protect the Services, prevent fraud or abuse, and enforce our terms;
• understand how the Services are used so we can improve them; and
• comply with our legal, tax and regulatory obligations.

4. Legal basis & consent

We process your personal data on the basis of your consent (which you give when you register and agree to this policy), to perform the membership agreement between us, to pursue our legitimate business interests such as securing and improving the Services, and to comply with legal obligations. Where we rely on consent — for example to send marketing messages — you may withdraw it at any time (see Your rights & choices). Providing certain data is necessary to deliver the Services; if you choose not to provide it, we may be unable to offer you membership or specific features.

5. How we share information

We do not sell your personal data. We share it only in the following circumstances:

• Gym staff and branch operators — authorised staff access your data as needed to service your membership, process check-ins and administer loyalty rewards.
• Service providers — trusted vendors who process data on our behalf and under our instructions, such as cloud hosting, email delivery, and push-notification delivery (see below). They may only use the data to provide services to us.
• Legal and safety — where required by law, regulation, legal process or an enforceable governmental request, or to protect the rights, property or safety of our members, staff or the public.
• Business transfers — in connection with a merger, acquisition, financing or sale of assets, in which case we will require the recipient to honour this policy.

6. Push notifications

If you enable push notifications, we register a device token so we can deliver messages to your device. Delivery is handled by the operating-system push services — Google Firebase Cloud Messaging (FCM) on Android and, where applicable, the Apple Push Notification service (APNs) on iOS — which process the device token to route the message. You can turn off push notifications at any time in your device settings; this does not affect essential service messages we may send by other means.

7. Data retention

We keep your personal data for as long as your account is active and for as long afterwards as is necessary to fulfil the purposes described in this policy — including to meet legal, accounting or reporting requirements, resolve disputes and enforce our agreements. When your data is no longer needed, we will securely delete it or irreversibly anonymise it. Some records (for example transaction records required for tax or accounting) may be retained for the period required by law even after your account is closed.

8. How we protect your data

We use appropriate technical and organisational measures to protect your personal data, including encryption of data in transit (HTTPS/TLS), hashing of passwords, and role-based access controls that limit staff access to what they need. While we work hard to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately.

9. Your rights & choices

Subject to the PDPA and applicable law, you have the right to:

• Access the personal data we hold about you and request a copy;
• Correct data that is inaccurate, incomplete or out of date;
• Withdraw consent or opt out of marketing communications at any time;
• Limit or object to certain processing of your data; and
• Request deletion of your account and associated personal data.

You can exercise most of these rights directly from the Manage account page, or by emailing us at support@agpower.com. We may need to verify your identity before acting on a request, and we will respond within the timeframe required by law.

10. Account & data deletion

You can request deletion of your AG Power Fitness account and personal data at any time through our Manage account page. That page explains what is deleted, what may be retained for legal reasons, and how long the process takes.

11. Children’s privacy

The Services are intended for adults. We do not knowingly collect personal data from children under 18 without the consent and supervision of a parent or legal guardian. If you believe a minor has provided us personal data without appropriate consent, please contact us and we will take steps to remove it.

12. International transfers

Your personal data is primarily processed in Malaysia. Some of our service providers may store or process data on servers located outside Malaysia. Where data is transferred across borders, we take reasonable steps to ensure it receives a level of protection consistent with this policy and applicable law.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Effective” date at the top of this page and, where changes are material, provide additional notice through the app or by email. Your continued use of the Services after an update means you accept the revised policy.

14. Contact us

If you have questions, concerns or requests regarding this policy or your personal data, please contact us:

You also have the right to make a complaint to the Personal Data Protection Commissioner of Malaysia if you are not satisfied with how we handle your personal data.