Privacy Policy

PT2Pro ("we", "us", or "our") is committed to protecting the privacy and personal data of all users of the PT2Pro platform ("Platform").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Platform. It is prepared in compliance with Malaysia's Personal Data Protection Act 2010 (PDPA).

By using the Platform, you consent to the collection and use of your personal data as described in this Policy. If you do not agree, please do not use the Platform.

Account & Identity Data

• Full name, email address, and password (stored in encrypted form)
• Role on the Platform (Trainer or Trainee)
• Profile photo (optional)

Trainer Profile Data

• Professional biography, coaching experience, and specialisations
• Fitness certifications and qualifications
• Gym affiliation and social media links
• Unique Trainer Code

Health & Fitness Data

• PAR-Q (Physical Activity Readiness Questionnaire) responses
• Body composition measurements (weight, height, body fat, muscle mass)
• Fitness assessment results (cardiovascular, strength, flexibility)
• Personal fitness goals and training history

Payment & Subscription Data

• Subscription status and billing history
• Payment transaction records (amount, date, reference)
• Note: Payment card details are processed directly by our payment processor and are not stored by PT2Pro.

Usage & Technical Data

• Login timestamps and session activity
• Device type, browser, and operating system
• IP address and approximate location (country level)

We use your personal data to:

• Operate the Platform — create and manage your account, connect Trainers with Trainees, and deliver core features;
• Process payments — handle subscription fees and session package purchases;
• Deliver fitness tools — store and display assessments, progress data, and session records for you and your Trainer;
• Communicate with you — send account notifications, subscription alerts, and service updates;
• Improve the Platform — analyse usage patterns to enhance features and fix issues;
• Comply with legal obligations — retain records as required by Malaysian law.

We do not use your data for unsolicited marketing without your explicit consent.

Under the PDPA 2010, we process your personal data on the following grounds:

• Consent — you consent to data collection when you create an account and accept these terms;
• Contractual necessity — processing is required to provide the services you have signed up for;
• Legitimate interest — to improve the Platform, detect fraud, and maintain security;
• Legal obligation — where Malaysian law requires us to retain or disclose data.

For sensitive health data (PAR-Q, body composition), we rely on your explicit consent, which you provide when completing assessments on the Platform.

We do not sell your personal data. We may share your data in the following limited circumstances:

Within the Platform

• Your Trainer can see your profile, health assessments, and fitness data;
• As a Trainer, your profile (name, photo, bio, certifications, trainer code) is visible to your linked Trainees.

Third-Party Service Providers

• Payment processors — to handle subscription and package payments;
• Hosting providers — to store and serve the Platform (data remains in our control);
• Analytics tools — anonymised usage data only, to improve the Platform.

Legal Requirements

We may disclose your data if required by Malaysian law, a court order, or a lawful request by a government authority.

All third-party providers are bound by data processing agreements and may only use your data as instructed by PT2Pro.

PT2Pro uses cookies and similar technologies to:

• Keep you signed in (authentication session cookies);
• Remember your preferences (e.g. dark/light mode);
• Analyse Platform usage to improve features.

Essential cookies required for the Platform to function cannot be disabled. You can control non-essential cookies through your browser settings. Disabling cookies may affect your experience on the Platform.

We retain your personal data for as long as your account is active or as required to provide the services. Upon account deletion:

• Your profile and personal data are deleted within 30 days;
• Health and fitness assessment data is deleted within 30 days;
• Payment and transaction records are retained for 7 years as required under Malaysian financial regulations;
• Anonymised usage analytics may be retained indefinitely.

If your Trainer account is suspended for a breach of our Terms, we may retain records of the breach for a longer period for legal and safety purposes.

As a data subject under Malaysia's PDPA 2010, you have the following rights:

• Right of Access — request a copy of the personal data we hold about you;
• Right to Correction — request correction of inaccurate or incomplete data;
• Right to Withdraw Consent — withdraw consent for data processing at any time (this may affect your ability to use certain features);
• Right to Limit Processing — request that we limit how we use your data in certain circumstances.

To exercise any of these rights, email us at privacy@pt2pro.my. We will respond within 21 days as required by the PDPA.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse, including:

• Encrypted passwords (bcrypt hashing — plaintext passwords are never stored);
• HTTPS encryption for all data transmitted to and from the Platform;
• Role-based access controls — users can only access data relevant to their role;
• Regular security reviews and vulnerability assessments.

Despite our measures, no system is completely secure. If you believe your account has been compromised, contact us immediately at support@pt2pro.my.

The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from individuals under 18 years of age.

If we become aware that we have collected data from a person under 18 without appropriate consent, we will take steps to delete that information promptly. If you believe a minor has registered on the Platform, please notify us at privacy@pt2pro.my.

PT2Pro is based in Malaysia. Your data may be processed on servers located outside Malaysia, including where we use third-party hosting or analytics providers. In such cases, we ensure that the transfer is subject to appropriate safeguards and that the receiving party provides a level of data protection equivalent to that required under Malaysian law.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes via email or a notice on the Platform at least 14 days before changes take effect.

The "Last updated" date at the top of this page indicates when the policy was most recently revised. We encourage you to review this Policy periodically.

If you have questions about this Privacy Policy, wish to exercise your rights under the PDPA, or wish to make a complaint, please contact our Data Protection contact:

• Privacy & Data enquiries: privacy@pt2pro.my
• General support: support@pt2pro.my
• Platform: PT2Pro, Malaysia

We aim to respond to all data-related enquiries within 21 days as required by the PDPA 2010.