Privacy notice

1. Who we are

ASCEND, with its place of business at Bonifacio High Street, H22X+8V2, 7th Ave, Taguig City, 1635 Metro Manila, is the Personal Information Controller responsible for the personal data described in this notice.

Our Data Protection Officer can be reached at support@ascend-performance-ph.com or +63 917 837 8475.

2. What we collect

Through this website, we collect only what the membership application asks for:

• —Your name
• —A mobile number, with the country it is dialled from
• —An email address
• —What you are training for, in your own words
• —Optionally, how you heard about us — picked from a short list, and skippable

The website does not collect payment card details, bank details or government identification numbers, and it has no payment gateway. It sets no advertising or analytics cookies of its own and does not build a profile of you; the three third parties the site loads are described in section 8.

At the club, not on the website: CCTV. The entrance and the training floor are covered by cameras, so if you come to the club your image is recorded. There are no cameras in the changing rooms, the showers or the toilets — the National Privacy Commission places those rooms out of bounds, and we would not put them there in any case. The cameras record picture only. Section 3 says what we use the footage for and section 5 says how long we hold it.

One more line in that email. When you submit an application we also note the address of the page you followed a link from, if there was one, and any campaign tags on that link — so we can tell whether people are finding us through Instagram or somewhere else. It is written into the same single email as your answers and nowhere else. We remove the query string first, which is the part of a web address that can carry a share token or an identifier belonging to someone other than you. Nothing here sets a cookie, nothing follows you between visits, and if you typed our address in directly there is nothing to note.

What happens when you press Submit. Your answers are sent to a small program running on this site’s own domain, which checks them and emails them to us. They are not stored in any database — this website has none. The only lasting copy is the message in our mailbox. The providers that carry it are named in section 4.

At the gym, before your first session, we also collect information about your health — injuries, medical conditions, and anything else that affects how we should scale your training. Health information is sensitive personal information under RA 10173. We collect it only on a separate, signed waiver and health questionnaire, only with your written consent, and we use it for nothing but your safety while training.

3. Why we collect it, and on what basis

• —To assess and respond to your membership application — on the basis of the consent you give when you tick the box on the application.
• —To administer your membership and confirm payments once you have joined — on the basis of our contract with you.
• —To keep you safe while training and to scale sessions appropriately — on the basis of your separate written consent to the health questionnaire.
• —To meet tax, accounting and other legal obligations — on the basis of legal obligation.
• —To keep the club, the people in it and the equipment secure, and to establish what happened if someone is hurt or something is taken — this is the CCTV, and it runs on our legitimate interests, not on your consent.

Because the CCTV runs on our legitimate interests rather than your consent, you can object to it, and we have to weigh your objection against the reason we film. We do not use the footage to monitor how you train, how long you stay, or how often you come.

We do not use your details for marketing unless you separately opt in, and any marketing message we send will let you opt out.

4. Who we share it with

We do not sell personal information and we do not share it for anyone else’s marketing. We share it only with:

• —Cloudflare, Inc., which hosts this website and runs the small program that receives your application. Your submission passes through their network.
• —Resend (Plus Five Five, Inc.), which delivers the application to our mailbox as an email. Everything you typed is in that email, and Resend keeps a copy of it in their own dashboard for 30 days before deleting it. We cannot make that window shorter on our plan.
• —Our email provider, which stores the message once it arrives.
• —Our accountant and bank, for payment reconciliation once you are a member.
• —Government authorities, where we are legally required to disclose.

Each processor is bound by a written agreement to process your data only on our instructions and to keep it secure. Where a provider stores data outside the Philippines, we remain accountable for it and use providers that offer a comparable level of protection.

5. How long we keep it

• —Applications that do not become memberships: 12 months from your application, then deleted from our mailbox. Because applications arrive as email and are not kept in a database, deleting the message is what deletion means.
• —The delivery copy at Resend: 30 days, automatically, whatever we do. It is the one copy we cannot delete on request — if you ask us to erase your application before then, we delete our mailbox copy immediately and theirs expires on its own.
• —Member records: for the duration of your membership and 5 years afterwards, to meet tax and accounting requirements.
• —Health questionnaires and waivers: for the duration of your membership and 3 years afterwards.
• —Payment receipts you send us: 5 years, as required for tax records.
• —CCTV footage: only as long as we need it for the security purpose in section 3, after which it is overwritten. If footage is pulled because of an incident or a claim, that copy is kept until the matter is closed.

6. How we protect it

We apply organisational, physical and technical measures proportionate to the data we hold: access limited to staff who need it, encrypted transmission, locked storage for paper waivers, and staff briefed on their confidentiality obligations. If a personal data breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the affected individuals within seventy-two (72) hours of knowledge of the breach, as required by law.

7. Your rights

Under the Data Privacy Act you have the right to:

• —Be informed whether your personal data is being processed, and how.
• —Access the personal data we hold about you.
• —Object to processing, including withdrawing consent at any time.
• —Have inaccurate or outdated data corrected.
• —Have your data erased or blocked where it is incomplete, outdated, false, unlawfully obtained, or no longer necessary.
• —Data portability — receive your data in a commonly used, electronic format.
• —Be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your data.
• —Lodge a complaint with the National Privacy Commission.

To exercise any of these, email support@ascend-performance-ph.com. We respond within fifteen (15) working days. Withdrawing consent does not affect processing already carried out, and may mean we can no longer provide a class safely.

8. Cookies and third parties

ASCEND sets no advertising, analytics or tracking cookies of its own, and we do not build a profile of you. If we later add analytics, this notice will be updated and a consent banner added before any such cookie is set.

Loading this site contacts three third parties: Google, on the map, and Cloudflare, twice — the application form’s spam check, and the visitor counter. This section is about what your browser fetches while you read the page. It is a different question from who handles your application once you press Submit — that is section 4, and the answer there is Cloudflare and Resend. All three load on their own — you do not have to press anything, and there is no way to view the page with any of them switched off. Everything else you see is served from our own host.

When the map loads, your browser contacts Google directly. Google receives your IP address and your browser’s user agent, and may set its own cookies, under Google’s privacy policy (opens in a new tab), which we do not control and are not party to. We send Google nothing about you ourselves, and we get nothing back from them — we cannot see who looked at the map, or when.

The map is loaded lazily, which means the request is made as you scroll the location section into view rather than when the page opens. If you never scroll that far, Google is never contacted. Your browser’s own controls — blocking third-party frames or cookies — will stop the map loading without breaking anything else: the written address and the directions links beside it are ours and work regardless.

The spam check. The application form carries a Cloudflare Turnstile box — the check that tells a person apart from a script, so the form cannot be used to flood our mailbox with fake applications. It is loaded from Cloudflare when the front page opens, and it does its work whether or not you go on to fill anything in. Your browser contacts Cloudflare directly, and Cloudflare receives your IP address, your browser’s user agent, a fingerprint of the connection itself, and the address of the page the box sits on. Cloudflare may set its own cookies in the process, under Cloudflare’s Turnstile privacy policy (opens in a new tab), which we do not control and are not party to. Cloudflare states that Turnstile does not read what you type into the form, and that it is not used for advertising.

When you press Submit, our program asks Cloudflare whether the box was genuinely passed, and sends your IP address with that question so the answer can be matched to the right visit. We get back yes or no and nothing else — no score, no name, no history. Your IP address is not written into the email we receive, and we do not keep it anywhere ourselves.

The visitor counter. Every page loads Cloudflare Web Analytics, which counts how many people visit, which pages they open, roughly where in the world they are, and what kind of device and browser they used. Your browser fetches a small script from Cloudflare and then reports those figures back to an address on this site rather than to Cloudflare directly. Cloudflare states that it sets no cookies and uses no other browser storage for this, and that it does not fingerprint individual visitors. We see totals and trends. We cannot see you, we cannot follow you from one visit to the next, and there is nothing here that could be matched against an application you send us.

9. Children

Membership is 18+, so we do not knowingly collect personal information from anyone under 18 — not through this website, and not at the club. If you believe we hold information about a child, tell us and we will delete it.

10. Complaints

Please raise any concern with us first at support@ascend-performance-ph.com. If you are not satisfied, you may complain to the National Privacy Commission, 5th Floor, Delegation Building, PICC Complex, Roxas Boulevard, Pasay City, Metro Manila — privacy.gov.ph (opens in a new tab).

11. Changes to this notice

We will post any change on this page and update the date at the top. Material changes affecting how we use data you have already given us will be notified to you directly.

12. The ASCEND member app

This section covers the ASCEND member app, which is separate from this website. Sections 1 to 11 above are about the website and the membership application; this one is about the app.

12.1 What the app stores

The app holds only what it needs to show you your training:

• —Your name
• —The email address you sign in with
• —Which coach you are assigned to
• —The year your membership started
• —The sessions your coach writes for you
• —What you log against them — sets, weights, times, distances
• —Your notes on a session, and whether you marked it done
• —Your coach's comments on your sessions
• —Race times you enter — the finish time, the race, the city and date, the category, any partners' first names, and a link to the official result if you add one
• —Your app settings, including whether you turned AI summaries on and the date you did
• —Messages you send in the app — to your coach, in a group, or privately to another member — and any photographs you attach to them
• —A profile photograph, and photographs posted in a group, if you add them
• —Classes you book, join the waitlist for, or are checked in to, and whether you did not turn up
• —Your class package — how many are left, when it expires, and every change made to it, with who made it
• —Groups and activities you join, events you say you are going to, and reactions you leave on club announcements
• —Training partner requests you send, accept or decline, and anybody you hide from the board
• —Anybody you block, and any message you report to the club, with the reason you gave
• —Status your coach sets about you — paused, injured, travelling, or a week marked as rest — which stops the app chasing you
• —When a coach last checked on you, and a record of staff actions on your account: what changed, from what to what, and who did it

It does not store your address, your phone number, your date of birth, or your payment details. It holds no medical record, no diagnosis, and nothing from a doctor. Where a coach marks you injured or a week as rest, that is their own note so the app stops chasing you for a session — it is not a health record and nobody clinical has seen it.

12.2 Your login email

You sign in with an email address. Two copies of it exist: one held by the sign-in provider so it can recognise you, and one in your member record so your coach knows which account is yours. It is used to identify you and to write to you about your training or your membership. It is not used for marketing, and it is not given to anyone else.

Both copies go when the account is deleted. See section 12.7.

12.3 Connecting another fitness app

The app is being built to let you connect a watch or a fitness app — Apple Health, Garmin or Strava — so runs and rides you record elsewhere show up beside the training your coach wrote.

This is off unless you connect one yourself. If you never do, nothing is imported and there is nothing here to hold. If you do, what comes across is the activity itself — the sport, when it started, how long it lasted, distance and pace. Not your location trace, not your heart rate, and nothing else held in that account.

You can disconnect at any time, and imported activities are deleted with your account like everything else.

12.4 The race board

The app has a leaderboard. It is the one place where something of yours is shown to other members, so it is off unless you switch it on.

Nothing of yours appears until you choose to appear. If you do, other members see your first name, your finish time, the category, and the city and date — and the first names of any partners you entered. They do not see your surname, your email, the link to the official result, or anything else about your training. Switch it off and you are off the board everywhere, immediately.

You can also ask other members to partner with you for a race. They see your first name and what you are looking for; they can accept or decline, and either way that request is deleted with your account.

12.5 AI coach summaries, only if you say yes

The app can send workout data to an AI service to write a short summary for your coach. This happens only if you turn it on, and you can turn it off again at any time.

No names are sent. What goes to the AI service is the training itself — sets, times, notes — without your name or anything else that identifies you. The service is not permitted to use it to train its own models.

If you never turn this on, no part of your data ever leaves the app for this purpose.

We record the fact that you turned it on and the date you did, so that both of us can tell when the permission was given. Turning it off stops it from that moment. Both the switch and its date are deleted with your account.

12.6 No ads, no tracking, no selling

There is no advertising in the app. There are no advertising or analytics trackers in it. We do not sell your data, we do not rent it, and we do not share it with anyone for their own marketing. Nobody has ever paid us for it and nobody will.

12.7 How long the app keeps it

App data is deleted 90 days after your membership ends, whether or not you ask. The 90 days exist so that a member who leaves and comes back within a season does not lose their training history — not so we can keep it.

You can have it deleted sooner, at any time and without giving a reason. Do it yourself in the app under Settings → Delete my account, or sign in and do it in a browser — both routes are on the account deletion page. Your right to erasure under section 7 of this notice applies to app data exactly as it does to everything else.