Privacy Notice - CCPA Disclosure

HIIT IT LLC | Society 3

21144 Ventura Blvd, Woodland Hills, CA 91364

Effective August 1, 2026 | Policy v1.0

This Privacy Notice is provided to members and visitors of Society 3 in compliance with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), California Civil Code §1798.100 et seq. Society 3 is committed to transparency about how we collect, use, and protect your personal information.

---

1. Categories of Personal Information We Collect

Society 3 collects the following categories of personal information from members and prospective members:

• Identifiers: Name, email address, phone number, date of birth, emergency contact information.
• Financial Information: Payment method details (credit/debit card) processed and stored securely through our payment processor.
• Health & Physical Information: Self-reported medical history, injuries, and physical limitations disclosed on intake forms or verbally to coaches. (See Section 1A - Sensitive Personal Information below.)
• Commercial Information: Membership type, class attendance history, class pack purchases, and retail transactions.
• Visual Information (Marketing): Photographs and video recordings intentionally created by Society 3 staff for marketing purposes, only where consent has been provided via the optional Photo & Video Release.
• Visual Information (Security): Video footage from on-premises security cameras, collected for the safety and security of members, staff, and property. Security footage is used exclusively for security and incident documentation, is never used for marketing or promotional purposes, is not sold or shared with third parties except as required by law or in connection with an incident investigation or insurance claim, and is retained for a limited period on locally stored, access-restricted studio equipment. Security cameras do not record audio.
• Internet or Network Activity: Information collected through the Society 3 membership and booking platform, which is operated by Society 3 itself, including account login activity and app usage.

---

1A. Sensitive Personal Information (CPRA §1798.121)

Under the California Privacy Rights Act (CPRA), certain categories of personal information are classified as Sensitive Personal Information (Sensitive PI) and are subject to additional protections and disclosure requirements.

Society 3 collects the following Sensitive PI from members:

• Health and Medical Information: Self-reported injuries, physical limitations, pre-existing conditions, and other health disclosures provided on intake forms or verbally to coaches prior to participation.

Purpose of Collection: This Sensitive PI is collected solely to ensure member safety, enable coaches to provide appropriate modifications, and maintain records in the event of a medical emergency or insurance claim.

Third-Party Sharing of Sensitive PI: Member health disclosures are stored within Society 3's own membership platform, which Society 3 builds and operates directly. This information is not transmitted to or stored by any third-party studio management provider. It is not shared with our payment processor, our email or messaging providers, or any advertising or analytics platform. Access is restricted to authorized Society 3 staff who require it to provide safe instruction or to respond to a medical emergency. Health disclosures are stored in encrypted form.

Your Right to Limit Use: Under CPRA §1798.121, you have the right to direct Society 3 to limit the use and disclosure of your Sensitive PI to only what is necessary to provide the fitness services you have requested. To exercise this right, submit a written request to meow@society3studios.com. Society 3 will not retaliate against any member for exercising this right.

Society 3 does not use Sensitive PI to infer characteristics about members beyond what is necessary to provide fitness instruction and ensure member safety.

---

2. Purposes for Which We Collect Personal Information

We collect personal information for the following business purposes:

• To process membership enrollment, billing, and renewals.
• To manage class scheduling, reservations, and attendance.
• To ensure member safety by documenting health disclosures and emergency contacts.
• To communicate with members regarding class schedules, policy updates, promotions, and account information.
• To market Society 3's services through social media and other platforms, where consent has been given.
• To maintain the safety and security of the studio premises through video surveillance.
• To comply with applicable legal obligations.

We do not sell your personal information to third parties.

---

3. Third Parties With Whom We Share Personal Information

Society 3 shares member personal information only with the following categories of service providers, solely to the extent necessary to operate our business:

• Payment Processor (Stripe, Inc.) - Handles membership billing, class pack and drop-in purchases, and fee transactions. Payment card information is transmitted directly to Stripe, which is PCI-DSS compliant. Society 3 does not store full payment card numbers on its own systems. Stripe acts as a service provider and is subject to its own privacy policy.
• Communications Providers - Email and SMS service providers used to send account confirmations, class reminders, and waitlist notifications. These providers receive only the contact information necessary to deliver the message.
• Insurance Provider - Limited information may be shared in connection with insurance claims or coverage verification.

Society 3's membership and booking platform is built and operated by Society 3 itself. There is no third-party studio management provider with access to member records.

We do not share your personal information with advertisers, data brokers, or any third party for the purpose of targeted advertising.

---

4. Retention of Personal Information

Society 3 retains member personal information for the duration of an active membership and for a period of three (3) years following membership termination or the last transaction, unless a longer retention period is required by law. Health disclosures and signed waivers may be retained for up to five (5) years for liability purposes.

---

5. Your Rights Under California Law (CCPA/CPRA)

As a California resident, you have the following rights with respect to your personal information:

Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the purposes for which it was collected, and the categories of third parties with whom it was shared.

Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions (e.g., information necessary to complete a transaction, comply with a legal obligation, or maintain a record for safety purposes).

Right to Correct: You may request that we correct inaccurate personal information we maintain about you.

Right to Limit Use of Sensitive PI: You have the right to direct Society 3 to limit the use and disclosure of your Sensitive Personal Information (health disclosures) to only what is necessary to provide our services. See Section 1A for details.

Right to Opt Out of Sale or Sharing: Society 3 does not sell or share personal information for cross-context behavioral advertising. No opt-out is required, but you may contact us at any time to confirm this.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your rights under California law. Exercising your privacy rights will not affect your membership status, pricing, or access to services.

---

6. How to Exercise Your Rights

To submit a privacy rights request, contact Society 3 by:

• Email: meow@society3studios.com
• In Person: 21144 Ventura Blvd, Woodland Hills, CA 91364

We will respond to verified requests within 45 days. If additional time is needed, we will notify you and may extend the response period by an additional 45 days.

To protect your privacy, we may ask you to verify your identity before processing your request.

---

7. Website Tracking Technologies & Global Privacy Control (CPRA §1798.135)

Society 3's website may use third-party tracking technologies, including analytics tools (such as Google Analytics) and advertising or social media pixels (such as Meta/Facebook Pixel, TikTok Pixel, or similar). These technologies may collect information about your browser, device, and interactions with our website, and may share that information with third-party advertising and analytics platforms.

Categories of data collected via website tracking: Device identifiers, IP address, browser type, pages visited, time spent on pages, referral source, and behavioral interaction data.

Purpose: Website analytics, advertising performance measurement, and remarketing to prospective members.

Third parties receiving this data: Google LLC (Google Analytics), Meta Platforms Inc. (Facebook/Instagram Pixel), TikTok Inc. (TikTok Pixel), and other advertising platforms as applicable. Each of these parties operates under its own privacy policy and data processing terms.

Global Privacy Control (GPC): In accordance with CPRA §1798.135 and California Privacy Protection Agency (CPPA) regulations, Society 3 honors Global Privacy Control (GPC) browser signals as a valid opt-out of the sale or sharing of personal information for cross-context behavioral advertising. If your browser has GPC enabled, Society 3 will treat this as an automatic opt-out request and will suppress applicable tracking for your session. To enable GPC, visit globalprivacycontrol.org for compatible browsers and extensions.

Opt-Out: To opt out of the sale or sharing of your personal information via website tracking technologies independent of GPC, contact us at meow@society3studios.com or submit a request via the method described in Section 6.

---

8. Data Security

Society 3 operates its own membership and booking platform and takes reasonable and appropriate technical and organizational measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include encryption of personal information in transit and at rest, access controls limiting member records to authorized staff with an operational need, and restricted administrative access.

Payment card information is transmitted directly to Stripe, a PCI-DSS compliant payment processor. Society 3 does not store raw payment card data on its own systems.

Security camera footage is stored locally on studio equipment with restricted access and is retained for a limited period.

No system can be guaranteed absolutely secure. In the event of a data breach affecting personal information, Society 3 will provide notice to affected individuals as required by California Civil Code §1798.82.

---

9. Changes to This Privacy Notice

Society 3 reserves the right to update this Privacy Notice at any time. Material changes will be communicated to active members via email and/or the Society 3 app at least 14 days before taking effect. Continued use of our services following notice of a material change constitutes acceptance of the updated Privacy Notice.

---

10. Contact

For questions about this Privacy Notice or our data practices, contact:

HIIT IT LLC d/b/a Society 3

21144 Ventura Blvd, Woodland Hills, CA 91364

meow@society3studios.com