Aktiv60 (Pty) Ltd, registration number 2023/527866/07, trading as MyAktiv60. Version 1.1. Last updated 2026-10-30.
1. Who we are
Aktiv60 (Pty) Ltd, registration number 2023/527866/07, trading as MyAktiv60 (M60), is the responsible party for the personal information described here. That means we decide why and how it is processed, and we are accountable for it under the Protection of Personal Information Act, 2013 (POPIA).
| Information Officer | Tyy Ford, Chief Executive Officer, registered with the Information Regulator |
|---|---|
| Address | 22 On Sloane, Bryanston, Sandton, Johannesburg |
| hello@myaktiv60.com, marked for the Information Officer | |
| Telephone | 010 312 5000 or 082 734 4434 |
We remain the responsible party for your information even where you take part through your employer or the company that hosts your facility. That company does not control your M60 information, and cannot instruct us to use it differently.
2. What this policy covers
2.1 This policy covers the website, your M60 membership, health screening, virtual and on-site sessions, events, challenges and rewards, and Alyss.
2.2 Where you sign a screening consent, the consent you sign sets out in more detail how your health information is handled, and it applies alongside this policy.
2.3 Websites and services we link to have their own privacy notices.
3. What we collect
From you
| Information | When and why |
|---|---|
| Name, email, phone, company | Enquiries, bookings and consultations, so we can reply |
| Account details: name, email, password stored only as a secure hash | If you register an account |
| Membership details: name, contact details, date of birth, gender, employer or site, membership category, payment method and the names of your medical aid and any rewards programme (never the membership numbers) | When you join, to run your membership. Date of birth and gender also for birthday messages and for age and gender reporting that names no one. Medical aid and rewards programme names only for our own planning, never shared with a scheme or used to book screenings |
| Sign-ups, bookings and check-ins | When you sign up, book or arrive for a session, to run sessions and to report attendance as numbers with no names (section 6). Held on our own system in Google Workspace. See section 7 |
| Health screening answers, measurements and clearance letters | When you are screened, so a practitioner can decide safely whether and how you train. See section 5 |
| Emergency contact | For physical sessions and events, so we can reach someone if you are hurt |
| Event registration and payment confirmation | To register you. Paystack takes your card details, not us |
| Questions typed to Alyss | See section 8 |
| Bank account details for a refund | Only when a refund is due and we cannot reverse it to your card, so we can pay you back |
| Name and contact details of someone you transfer a ticket to | To register them for the event. We then contact them directly and they register in their own name |
| The address you usually train from, and someone we can contact, if you join virtual sessions | So we can send help if something happens to you during a session |
| Recordings of virtual sessions | Every virtual session is recorded. See section 9 |
Automatically
| Information | When and why |
|---|---|
| Server logs: IP address, browser, pages, times | Every visit, to run the site securely and detect abuse |
| Analytics | Only if you agree. See section 10 |
From others
- From your employer or host company: your name, work email, employment category and site, so we can confirm you are eligible and enrol you.
- From a fitness app or device you choose to connect: only what you authorise it to share.
Whether you have to give it. It is voluntary, but without a name and contact details we cannot answer or enrol you, and without screening we cannot safely admit you to a programme that requires it. We tell you on each form what is optional.
What we do not collect. We do not ask for or keep your identity number, or your medical aid or rewards programme membership number, and we do not take progress photographs. If we ever need your identity number, we will update this policy and tell you why before we ask for it.
4. Why we use it, and on what basis
| Basis under POPIA | What for |
|---|---|
| Your consent | Health information, analytics, marketing, and any use of your Alyss conversations to improve her |
| Performing our contract with you, or steps before it | Enquiries, bookings, membership, sessions, events |
| Our legitimate interests, balanced against yours | Security, preventing fraud and abuse, understanding demand, improving services |
| Legal obligation | Records the law requires, and lawful requests |
We do not use your information for a purpose unrelated to the one we collected it for without telling you and, where required, asking again.
5. Health information
5.1 Health information is special personal information under POPIA. We process it only with your explicit consent, given when you complete the screening pack or a health declaration.
5.2 Who sees it. Your screening answers and measurements are seen only by the M60 Vital practitioner and the instructor assigned to you. Nobody else at M60, and never your employer or host company.
5.3 Where it is kept. In M60’s own Google Workspace account (Standard edition), with access limited to the people named in 5.2. Your PAR-Q+ is kept as a signed PDF. Health information is never held in Octiv Fitness and never shared with a rewards programme or medical scheme.
5.4 Independent practitioners. Some practitioners work independently at M60 facilities. They are not part of M60, do not receive your M60 information, and are responsible for their own clients’ information.
5.5 Screening by partners at events. Where a screening at an event is run by a partner organisation, we name the partner when you register and tell you who holds your results.
5.6 Withdrawing consent. You can withdraw at any time by contacting the Information Officer. We will explain what that means for the services you use. It does not affect anything done before.
5.7 How long. Three years after your last activity with us, then deleted or de-identified.
5.8 We do not process information about your race, religion, political views, trade union membership, sex life or criminal behaviour, except where the law requires it.
5.9 Surveys. Our surveys ask about your satisfaction with M60’s services, not about your health. Taking part is optional, and anything reported to your employer is combined as section 6 sets out.
6. What your employer or host company receives
This is the part people ask about most, so here it is in full.
Access information. Where your facility is at your employer’s or a host company’s premises, that company controls entry. To give you access, we share only: your name, employment category, reference number, access credential, membership category and access dates. Nothing else.
If you pay by salary deduction. Where your employer offers it for your membership category, you pay by salary deduction; where your category also offers card, you may choose either, at the same fee. Salary deduction needs your written consent to your employer, which your employer obtains. If you pay this way, your employer will know that you are a member, what you pay, and that you have facility access. To make the deduction we share only your name, your employee number, the amount deducted each month, and the dates the deduction starts and stops. Where your employer pays for or subsidises your membership, it will know you are a member however you pay.
Programme reporting. Your employer receives numbers and charts for the programme as a whole, with no names: total membership numbers, sign-ups, joins and leavers, and attendance, and those figures split by gender and age band. These go monthly, however few members there are. Where a gender or age-band group has fewer than three people, we merge it into the next band so that no one can be picked out. Health figures, meaning screening results, measurements and progress, are reported only where at least five people sit behind every number, including each part of a breakdown, and never as ranges, highest or lowest values, or anything that refers to one person. Your employer may share them only with the people named in its agreement with us, and may not try to identify anyone.
What your employer never receives. Your health information, screening answers, measurements, attendance, bookings, progress or anything you tell a practitioner or instructor. Your employer cannot ask us for it, and we will not provide an attendance register with names on it.
7. Bookings, challenges and rewards
7.1 Sign-ups, bookings and check-ins run on M60’s own system, built on our Google Workspace account (Standard edition). It holds your name, contact details, membership category, bookings and attendance, and no health information. M60 staff do not use Octiv Fitness.
7.2 If you choose to link a rewards programme such as Discovery Vitality, you register yourself in Octiv Fitness and give it the details it asks for. Your attendance is then shared with that programme so it can credit you. Octiv works on M60’s account under a written data processing agreement, its data is hosted outside South Africa, and it holds no health information from us. M60 sees nothing that comes back from the rewards programme. Octiv’s and the programme’s own privacy notices explain what they do with your information.
7.3 Challenges are optional. Leaderboards show your display name and score to others in the same challenge.
7.4 If you join an M60 WhatsApp group or Strava club, other members can see what those platforms show them, such as your number or profile. Those platforms’ own terms apply.
8. Alyss
Alyss is our chatbot, not a person. She is rule-based: she matches what you type against answers M60 has written. She is still learning and can be wrong. Nothing you type is sent to any third party. If she cannot answer, the question text alone is logged, with no name or contact detail attached, and kept for 36 months so we can write better answers.
Please note:
- please do not type personal or health information into the chat;
- Alyss does not diagnose, assess or make any decision about you, and does not profile you;
- if you rate an answer or flag a problem, we may use that rating or flag to improve Alyss. We use whole conversations only if you tick the box agreeing to it, which stays off unless you turn it on, and only after removing anything that identifies you. You can withdraw that agreement at any time.
We plan to develop Alyss into an AI companion over time. Before she is connected to any artificial intelligence service, we will update this policy to name the service, what is sent to it and how long it is kept, and we will tell you before the change takes effect.
9. Virtual sessions
If you train with us online, we run the session on your employer’s approved platform, such as Microsoft Teams, or otherwise on Google Meet. You decide whether your camera is on. If it is on, background blur and filters must be off, so what the camera shows is you and the room you are in. If it is off, the instructor cannot see you if you get into difficulty. We record every virtual session, and joining a session means you accept that. We use recordings only to show a session took place, check the quality of instruction, review your technique if you raise a difficulty, and establish what happened if someone is hurt. We make every recording on M60’s own account and store it there, including when the session runs on your employer’s platform. We keep recordings for 120 days and then delete them, unless one is needed for an incident or a claim. Recordings are never given to your employer and never used for marketing without your separate written consent.
10. Cookies and analytics
| Type | Purpose |
|---|---|
| Strictly necessary | Security and keeping you signed in. No consent needed |
| Preference | Remembers your analytics choice |
| Analytics (Google Analytics) | Loaded only if you agree. IP anonymised, advertising features off, aggregate reporting only |
To change your choice, clear this site’s data in your browser and we will ask again.
11. Who we share with
We do not sell personal information or share it for anyone else’s marketing.
| Who | Why |
|---|---|
| Cloudflare | Hosting and security |
| Google Workspace (Standard edition): email, forms, sign-ups, bookings and check-ins, records, Google Meet and its recordings, and analytics if you agree | |
| Microsoft | Teams, where it is your employer’s approved platform |
| Octiv Fitness | Only if you link a rewards programme: your registration and attendance. No health information |
| Paystack | Online payments |
| M60 practitioners and instructors | Delivering your sessions and screening |
| Venues and event partners | Running an event you registered for, only what they need |
| Your employer or host company | Only what section 6 lists |
| Professional advisers and authorities | Where the law requires or allows, or to establish or defend a legal claim |
Where an organisation processes information for us, a written agreement requires it to protect it, use it only on our instructions and tell us of any compromise.
12. Information outside South Africa
Some of the providers we use store or process information outside South Africa. These include Google (our Workspace account, our forms, our sign-up and check-in system and Google Meet recordings), Microsoft (Teams), Cloudflare, Octiv and parts of the Paystack group. We rely on section 72(1)(a) of POPIA: each provider is bound by written data processing terms that give protection substantially similar to POPIA, wherever it holds the information. A provider may move where it hosts information during our relationship with it. That does not change our responsibility for your information, and we only use providers whose terms keep that level of protection wherever the information is held.
13. How long we keep information
| Information | Kept for |
|---|---|
| Enquiries that go no further | 24 months, then deleted |
| Membership and booking records | 3 years after your membership ends |
| Payment records | 5 years, for tax and accounting duties |
| Health and screening records | 3 years after your last activity |
| Alyss unanswered-question log | 36 months |
| Server logs | A short rolling period for security |
| Combined statistics | Indefinitely. They identify no one |
| Virtual session recordings | 120 days, then deleted, unless one is needed for an incident or a claim |
| Incident and refused-entry records, including any that name a child | 3 years after the incident or refusal, then deleted. A record of an injury to a child is kept until the child turns 19, because a claim for that injury can be brought until then, and then deleted |
14. How we protect it
- The website is encrypted in transit.
- Passwords are stored only as a one-way hash.
- Access is limited by role, and health information is limited to the people named in section 5.2.
- We review these measures as M60 grows.
No system is completely secure. Please use a password you do not use elsewhere.
15. If something goes wrong
If there are reasonable grounds to believe your information has been accessed by someone unauthorised, we will notify the Information Regulator and you as soon as reasonably possible, as POPIA section 22 requires, and tell you what it means and what you can do.
16. Your rights
You may:
- ask whether we hold information about you, and for a copy;
- ask us to correct or delete information that is wrong, out of date, excessive or unlawfully held;
- object to processing based on our legitimate interests;
- withdraw consent at any time;
- object to direct marketing at any time (section 17);
- complain to the Information Regulator (section 19).
Contact the Information Officer. We may ask you to confirm your identity first. A formal access request may also be made under the Promotion of Access to Information Act, where a prescribed fee may apply.
17. Marketing
We send electronic marketing only if you asked for it, or if you are an existing member or client and it concerns something similar. Every message has an unsubscribe link. Service messages, such as a booking confirmation or a change to an event, are not marketing.
18. Children
18.1 Membership is for people 18 and older. We do not capture the personal information of anyone under 18. At a residential estate, the estate decides whether and from what age a person under 18 may use the facility, accompanied throughout by a responsible adult, and we do not record their details. The only record that names a child is a record of an incident or a refused entry involving them, which we keep for safety and legal reasons. If someone under 18 applies to join, we tell them we cannot accept the application and delete what they sent us straight away.
18.2 Where children attend a family or community event, we register only the accompanying parent or guardian and the number of children with them. We never publish an identifiable image of a child without the parent or guardian’s consent.
18.3 If you think we hold a child’s information without consent, tell the Information Officer and we will delete it.
19. Complaints
Please raise it with the Information Officer first. You may also complain to the Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Complaints: complaints.IR@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za. Website: inforegulator.org.za.
20. Changes
We may update this policy. The date at the top shows the latest version. If a change materially affects how we use your information, we will tell you before it takes effect, and where the change depends on consent, we will ask for it.