Privacy Notice

1. About this notice

This notice explains how personal information is handled when you use the XaktGo mobile application.

Xakt AS
Organization number: 931 895 583
Trondheimsveien 7
7200 Kyrksæterøra, Norway
Email: support@xakt.no
General contact: post@xakt.no
Telephone: +47 72 45 39 20

This is a privacy notice, not consent to every use of personal information. Where consent is required, it is requested separately.

2. Xakt and your fitness center

Xakt operates the app account, authentication, app security, technical operation, support, and app analytics and diagnostics described in this notice.

The fitness center connected to your membership is responsible for its customer relationship with you, including center membership, access rights, contracts, bookings, invoices, payments, and records it must retain. Depending on the service, Xakt processes information on the center's behalf or for Xakt's own operational responsibilities. The center's membership terms and privacy information also apply to its processing.

You may contact Xakt at support@xakt.no if you are uncertain who is responsible for a request. We will respond or direct the request to the relevant center.

3. Information processed

Account, contact, and profile information

We process information used to establish and maintain your XaktGo account and connect it to the correct center customer record:

• name, telephone number, verified email address, and recovery email;
• address, postal code, city, country, date of birth, gender, and customer/member identifiers;
• profile picture and profile preferences;
• communication and marketing preferences;
• account status, selected center, PIN/security state, login/session information, and agreement acceptance;
• app-user, customer, subscriber, device, installation, and push-notification identifiers.

Your PIN is used for authentication and security. Where device biometrics such as Face ID or Touch ID are used, the biometric template remains under the operating system's control. XaktGo receives only the authentication result.

Membership, fitness activity, and center access

We process information needed to provide the center services available to your account, including:

• memberships, membership status, contracts, courses, and entitlements;
• class bookings, cancellations, waiting lists, attendance, visits, and check-ins;
• training schedules and related fitness-center activity;
• QR or door identifiers, access attempts, access decisions, and related security records.

XaktGo does not read information from Apple Health, HealthKit, Google Health Connect, or medical records in the current release.

Purchases, invoices, and financial information

Where relevant to your account, we process:

• purchases of memberships, passes, courses, gift cards, and other center services;
• purchase status, invoices, receipts, payment references, due dates, balances, reminders, and collection status;
• bank-agreement or AvtaleGiro status and related account information made available through the center's systems.

Payment-card or bank-account entry may take place on a payment provider's hosted page. The provider processes information under its own terms and privacy notice. Xakt and the center receive the information needed to complete and document the transaction, such as status, reference, amount, and the account information made available through the applicable service. We do not use payment information for advertising.

Location

With device permission, XaktGo obtains precise location coordinates for activation, finding nearby centers, and calculating center distance. The coordinates are transmitted to Xakt when these functions are used. XaktGo does not continuously track your location or share it with other members.

You can deny or withdraw location permission in device settings. Functions that require location may then be unavailable or less accurate.

Photos and user-supplied content

If you choose to add a profile picture, the selected image is uploaded to Xakt. Text you submit in a support or training-device problem report, gift-card message, or other account/service form is also processed to provide the requested function.

Camera frames used for QR scanning are analyzed on the device. XaktGo sends or acts on the decoded QR value, not the live camera frames.

Notifications

We process Firebase Installation IDs, push tokens, device information, notification preferences, and delivery information to provide service, security, booking, center, and account notifications. Promotional notifications are sent only according to the applicable communication preference and legal requirements.

Analytics and diagnostics

XaktGo uses the following Google Firebase services:

• Firebase Analytics;
• Firebase Crashlytics;
• Firebase Performance Monitoring;
• Firebase Cloud Messaging;
• Firebase Remote Config;
• Firebase Installations and Firebase Sessions.

These services process app interactions, screens, sessions, app-instance and installation identifiers, coarse location derived from network information, device and operating-system information, app version, language, country and time zone, crash reports, stack traces, performance and network timing, and other diagnostic information.

XaktGo analytics events may include center context and a stable pseudonymous value derived from the Xakt app-user identifier. Crash diagnostics may include an iOS identifier for vendor or corresponding device/app identifiers. Pseudonymous identifiers can still be linked to an account or device; we do not describe them as anonymous.

Firebase data is collected through the Firebase software components embedded in XaktGo and transmitted to Google when the relevant service operates. Xakt uses this information only to provide notifications and configuration, operate and secure the app, understand app use, investigate crashes and faults, and improve reliability and performance. Xakt does not use Firebase data for third-party advertising, cross-company tracking, behavioral advertising, retargeting, advertising measurement, or data brokerage, and does not use Firebase Analytics audiences or conversions with Google Ads for this release.

Google processes Firebase data as a service provider under applicable data-processing and security terms. Service providers acting for Xakt are required to protect personal information consistently with this notice and applicable law. Firebase collection and retention are controlled through Xakt's production configuration and the settings of the individual Firebase services.

4. Why we process information

When we rely on legitimate interests, we consider the necessity of the processing and its effect on users, including users aged 13–17. You may object as described below. When processing relies on consent, you may withdraw it at any time without affecting processing already carried out lawfully.

Device permission for camera, photos, notifications, location, or biometrics controls access to the device capability. It is not, by itself, the legal ground for every related processing activity.

5. Recipients and service providers

We disclose information only when needed for the purposes described above:

• Your selected fitness center, for its customer relationship, memberships, bookings, center access, purchases, invoices, and support.
• Google Firebase, for analytics, crash reporting, performance monitoring, messaging, configuration, installations, and sessions.
• Hosting, infrastructure, security, communications, email, and SMS providers that operate services for Xakt or the center.
• Payment and identity providers selected for the applicable center flow. A provider may be an independent controller for information entered directly on its service.
• Professional advisers and authorities when necessary to comply with law, protect rights and security, or handle legal claims.
• A successor organization if the relevant business is reorganized, merged, or transferred, subject to applicable privacy law.

Service providers acting for Xakt may process information only for the agreed service and under appropriate confidentiality, security, and data-processing requirements. We do not sell personal information or provide it to data brokers.

6. International transfers

Some providers, including Google Firebase, may process information outside Norway or the European Economic Area. Where personal information is transferred internationally, Xakt uses a lawful transfer mechanism and safeguards required by applicable law, such as an adequacy decision or approved standard contractual clauses. You may contact support@xakt.no for more information about relevant safeguards.

7. Advertising and tracking

XaktGo does not display third-party advertising and does not use personal information for cross-company tracking, behavioral advertising, retargeting, advertising measurement, or data brokerage.

If you separately choose to receive news or offers from Xakt or your center, the relevant contact information and preference are used to deliver those communications. You can withdraw a marketing preference through the available account/center controls or by contacting the sender. We do not profile users aged 13–17 for behavioral advertising.

8. Retention

We retain information only for as long as needed for the purpose for which it was collected, including the following criteria:

• XaktGo account and profile: while the app account remains active, and afterward only while needed to complete deletion, protect security, resolve disputes, or meet legal requirements.
• Authentication, device, installation, and push information: while needed for the active account or installation; replaced or invalid identifiers are removed or expire under operational security schedules.
• Membership, contracts, purchases, invoices, and payment records: according to the selected center's customer relationship and the accounting, tax, documentation, and legal-claim periods that apply.
• Bookings, visits, check-ins, and door-access records: according to the center's operational, safety, access-control, and documentation requirements, after which information is deleted or anonymized when appropriate.
• Location: used for the requested activation or center function. XaktGo does not create continuous location history. Technical or security logs containing request information are retained only under the applicable log-retention schedule.
• Support and user-submitted content: until the request has been handled and for any additional period needed for follow-up, security, documentation, or legal claims.
• Analytics, crash, session, and performance information: according to Xakt's configured Firebase retention settings and only while needed to understand usage, investigate faults, secure the service, and improve reliability.
• Backups: protected backup copies cycle out under the applicable backup schedule and are not used for ordinary business processing.

Where a legal obligation or active legal claim requires longer retention, access is restricted to that purpose. You may ask support@xakt.no or your center for the retention criteria applicable to a particular record.

9. Security

Xakt and its providers use technical and organizational measures intended to protect personal information against unauthorized access, alteration, loss, and misuse. These include access controls, authenticated sessions, transport encryption, operational monitoring, and controls appropriate to the service.

No electronic service can guarantee absolute security. Contact support@xakt.no if you believe your account or information has been compromised.

10. Your choices

Depending on the feature and your center configuration, you can:

• deny or withdraw camera, photo, location, notification, or biometric permission in device settings;
• update available profile details and communication preferences;
• choose whether to upload a profile picture;
• stop optional marketing communication using the provided preference or unsubscribe method;
• sign out and remove local app information from the device;
• request correction, access, or deletion as described below.

Declining an optional permission affects only the function that requires it. Some account, security, membership, and access information is necessary to provide XaktGo and cannot be omitted while using the associated service.

11. Account deletion

You can permanently delete your XaktGo account from inside the app by opening the profile/account settings and selecting Delete XaktGo account. The app asks you to confirm this irreversible action before sending an authenticated deletion request. You may also contact support@xakt.no if you cannot access the in-app function. We may need to verify that you control the account.

When the XaktGo service confirms successful deletion, the app signs you out, clears locally stored account data, and displays a completion message. Deletion permanently removes the XaktGo account and associated personal information that Xakt is not legally required to retain, including the app login, central app profile, profile image, app-device and push links, agreement links, and other app-account relationships covered by the deletion process. App access ends when deletion is completed. If the request cannot be completed, the app reports the failure and does not present the account as deleted.

Deleting the app account does not cancel a fitness-center membership, refund a purchase, terminate a payment obligation, or automatically erase customer, membership, contract, purchase, invoice, or accounting records held for the center. Contact the relevant center about cancellation and its records.

If you later register again, a new XaktGo app account is created. After verification, legitimate existing center memberships may be linked again, but information deleted with the earlier app profile is not restored.

Some information may remain for a limited period in protected backups, processor systems, security records, or records that Xakt or the center must retain for legal reasons. We will explain the applicable reason and retention criteria when responding to a deletion request.

12. Your privacy rights

Subject to applicable law, you may have the right to:

• receive information about and obtain access to your personal information;
• correct inaccurate or incomplete information;
• request deletion or restriction of processing;
• receive portable information where the right applies;
• object to processing based on legitimate interests or to direct marketing;
• withdraw consent where processing relies on consent;
• complain to a data-protection authority.

Send requests to support@xakt.no. We may request proportionate information to verify identity and protect the account. If the request concerns records controlled by your fitness center, Xakt will direct or forward the request as appropriate.

In Norway, you may complain to Datatilsynet. You may also contact the competent authority where you live or work.

13. Users aged 13–17

Eligible members aged 13–17 may independently use center-authorized app functions such as sign-in, membership viewing, booking, check-in, and facility access. Minor accounts are restricted from initiating, accepting, or purchasing legally binding memberships, recurring payment agreements, or other contracts through XaktGo. A fitness center may require a parent or guardian to establish or authorize the underlying center relationship under its terms and applicable law.

The app's 13+ minimum does not override a center's safety, access, or membership rules. Social Training, member discovery, and member-to-member messaging are disabled for all users in this release.

Information directed to younger users should be read together with a parent or guardian where appropriate. Users aged 13–17 and their guardians may contact support@xakt.no about privacy rights or age restrictions.

If you believe a child under 13 has created or used an account or provided personal information, contact support@xakt.no. We will investigate and take appropriate steps, including restricting the account and deleting information where required.

14. Changes to this notice

We may update this notice when XaktGo's functionality, providers, legal requirements, or data practices change. The current version and effective date will be published at this URL. Material changes will be communicated through an appropriate channel, such as the app, the account contact information, or a new notice or acceptance flow where required.

Social Training or any other feature that materially changes sharing, user interaction, or data collection will not be enabled without first updating this notice and the applicable App Store and Google Play declarations.

15. Contact

Questions, privacy requests, and account-deletion requests may be sent to:

Xakt AS
Organization number: 931 895 583
Trondheimsveien 7
7200 Kyrksæterøra, Norway
Email: support@xakt.no
General email: post@xakt.no
Telephone: +47 72 45 39 20

Additional company privacy information is available at xakt.no/personvaern.