Who this policy covers

This policy explains how Leyendas Promotions Pte Ltd (“we”, “us” and “our”) collects, uses, discloses and protects personal data in connection with the Legends brand, including our website, Legends SG app, enquiries, trial sessions, memberships, classes and gym visits.

It applies to members, prospective members, visitors, and parents or guardians of junior members across our services and activities.

We handle personal data in accordance with Singapore’s Personal Data Protection Act 2012 (“PDPA”).

Information we collect

The personal data we collect depends on how you interact with us. It may include the following, where relevant to the service you use.

We collect information directly from you, from a parent or authorised representative, and through providers supporting our services, bookings and payments.

If you provide someone else’s information, such as an emergency contact, please ensure you are authorised to do so and inform them of the relevant purposes described in this policy.

How we use your information

We collect, use and disclose personal data for purposes notified to you, including to:

• Create and administer accounts, trials, memberships, packages and class bookings.
• Process payments, issue receipts and respond to billing enquiries.
• Send booking confirmations, timetable changes and other service updates.
• Support appropriate training, respond to emergencies and manage incidents.
• Answer enquiries, handle feedback and resolve complaints.
• Protect our premises and investigate security incidents where CCTV is used.
• Send optional promotions or use identifiable promotional content where appropriate consent or another lawful basis applies.
• Comply with applicable legal obligations and establish or defend legal claims.

We obtain consent where required and may collect, use or disclose personal data without consent where required or permitted by law. Where a new purpose requires additional notification or consent, we address that before proceeding.

Sharing & overseas transfers

Personal data may be shared with staff and coaches who need it for their work, and with providers supporting our membership system, app, payment processing, website hosting, communications and IT services.

Where necessary, we may also disclose relevant information to emergency responders, insurers, professional advisers and authorities, or where required or authorised by law.

We limit disclosure to information appropriate for the relevant purpose. Where service providers process personal data on our behalf, we require appropriate protection and handling of that data.

If personal data is transferred outside Singapore, we take steps required by the PDPA to ensure that it receives a standard of protection comparable to that under Singapore law.

Junior members & families

For junior programmes, we collect the child’s and parent or guardian’s information needed to administer participation, communicate with the family and support safety.

We explain the relevant purposes in clear language and obtain parental or guardian consent where required. For children below 13 using our digital services, we obtain consent from a parent or guardian.

We handle permission for promotional use of a junior member’s identifiable photo or video separately from enrolment.

Parents or guardians may contact us about their child’s personal data or media preferences using the contact details below.

Photos, videos & CCTV

Training and promotional content

We may take photos or videos during classes, activities or events. Before collecting or using identifiable images for publicity, we explain their intended use and obtain consent where required.

Please speak to our team if you prefer not to be featured. You may also contact us to discuss withdrawing consent for future use.

Requests concerning material already published will be assessed against applicable consent, lawful exceptions and the material under our control. We will explain what action we can take.

CCTV and premises security

Where CCTV is used, relevant notices are displayed at the premises. Footage collected for security is not automatically available for promotional use.

Marketing & your choices

We may send offers, programme news and event updates where permitted. You can opt out using the unsubscribe method provided in the message or by contacting us.

Declining optional marketing does not prevent you from joining our classes.

We comply with applicable Do Not Call requirements for marketing to Singapore telephone numbers, including checking the relevant register or obtaining clear and unambiguous consent in an evidential form where applicable.

After you opt out of marketing, we may still send essential communications about your bookings, payments or service arrangements.

Cookies & external services

Cookies are small files stored on your device. Websites may use them to support functions, remember preferences or understand usage.

You can manage cookies through your browser settings. Disabling some cookies may affect website functions.

Our website and app may link to or include services provided by other organisations. When you use those services, their own privacy notices may also apply. We encourage you to review them.

Protection & retention

We put reasonable security arrangements in place to protect personal data against unauthorised access, use, disclosure and other risks. Access is limited according to work responsibilities. No system can guarantee absolute security.

We retain personal data only while it serves the purpose for which it was collected or remains necessary for legal or business purposes. When it is no longer needed, we delete it securely or remove the means of associating it with an individual.

We assess suspected data breaches and notify the Personal Data Protection Commission and affected individuals where required by law.

Your requests & rights

Access and corrections

You may request access to personal data we hold about you and information about its use or disclosure within the preceding year, subject to the PDPA’s exceptions. You may also request correction of errors or omissions.

We may need to verify your identity or authority before responding. If an access fee applies, we will tell you beforehand.

We respond as soon as reasonably possible. If we cannot respond to an access or correction request within 30 days, we will inform you in writing within that period of when we expect to respond.

Withdrawing consent

You may withdraw consent with reasonable notice by contacting us. We will explain the likely consequences, such as being unable to administer a booking if we cannot use information needed to provide it.

Withdrawal does not require us to delete records we need to retain for legal or business purposes, or stop processing that the law otherwise requires or permits.

Speak to us about your data

For access or correction requests, withdrawal of consent, or a privacy concern, please email punchme@legends.com.sg

Include your name, the branch you use and a brief description of your request. Please avoid sending identity documents or detailed health information unless requested through an appropriate channel.

If your concern remains unresolved, you may contact the Personal Data Protection Commission.

Changes to this policy

We may update this policy to reflect changes to our services, practices or legal obligations. The current version will be available on this page with its updated date.

Where required, we will notify you of changes and obtain additional consent.

Last updated: 20 October 2026