1. Who we are and what this policy covers

This policy covers personal information collected through pbt.dance and the PBT mobile apps, including our China app, teacher-certification platform, workshops, online store, and customer communications. "PBT", "we", and "us" mean Progressing Ballet Technique.

We operate a parallel version of our platform for mainland China using different local technology partners. Section 6 explains how information is handled for that platform.

Contact us about this policy or your personal information at customerservice@pbt.dance.

2. Information we collect

Account and profile: name, email, phone number, a securely hashed password, profile photo, and school or location information.

China account holders: if you sign in or pay through WeChat, we receive your WeChat identity, such as a unique ID, nickname, avatar, and general location. For phone-based sign-in, we receive your mobile number through SMS verification.

Teacher certification: certifications and awards, assessment video submissions, certification renewal responses, and training or viewing history.

Workshops: name, email, phone, country or region, registration and attendance details, and any waiver you sign.

Payments: Stripe and, for some Latin American customers, EBANX process payments. We do not see or store your full card number. We keep a reference ID, invoices, and subscription or membership status.

Shopping: Shopify processes merchandise orders and holds information including your name, shipping and billing address, order history, and payment details under its own privacy terms.

Technical information: IP address, approximate location, device and browser information, and standard web server logs.

Correspondence: messages you send to us and the information needed to respond and keep appropriate records.

Cookies and advertising: the information described in Section 7.

3. How and why we use your information

We use your information to:

• create and manage your account and membership;
• process certification submissions and issue certifications;
• run and manage workshops you register for;
• process payments and manage subscriptions through providers including Stripe and EBANX;
• fulfil merchandise orders through Shopify;
• send service communications and, where you have opted in, marketing communications;
• provide customer support;
• translate website and app content into other languages;
• measure and improve our website, apps, and advertising; and
• detect and prevent fraud and abuse and comply with our legal obligations.

EU and UK legal bases

Where European Union or United Kingdom data protection law applies, we rely on one or more of these legal bases:

• Contract: processing needed to provide a membership, workshop, purchase, certification, or other service you request.
• Legitimate interests: operating, securing, supporting, and improving our services, preventing fraud, and measuring our business and advertising, where those interests are not overridden by your rights.
• Consent: activities such as optional marketing or non-essential cookies where consent is required. You may withdraw consent at any time.
• Legal obligation: processing needed to meet tax, accounting, regulatory, or other legal requirements.

4. AI and automated processing

Content translation: we use a third-party AI language tool to help translate content written by our team. It processes the text content itself, is not used to make decisions about you or your account, and does not need your personal information to do its job.

Lead and engagement scoring: our customer relationship system uses fixed, human-authored rules, such as recent email engagement or membership status, to help our marketing team prioritise follow-up. These rules do not affect pricing, access, eligibility, or another legal or similarly significant outcome.

Video and content processing: video-hosting providers may use standard automated delivery and playback tools. These are not AI decisions about you.

We do not currently use AI to decide account status, certification eligibility, pricing, or access. If that changes, we will update this policy and provide any notice, choice, or human review required by law.

We have built, but not activated, an internal support assistant intended to help staff work with customer records. It has no live connection to an AI provider and is not currently processing personal information. Before activation, we will update this policy and put the required data-processing arrangements in place.

5. Who we share your information with

China-specific providers are described in Section 6. We do not sell personal information to third parties.

6. International data transfers and China

Customers outside China: our platform is hosted on Amazon Web Services, primarily in the United States, with some infrastructure in Hong Kong for China-facing traffic. Information may be processed in the United States and other countries where our providers operate. We take reasonable steps to ensure an appropriate level of protection. Where European Union or United Kingdom transfer rules apply, this includes using the European Commission Standard Contractual Clauses adopted under Implementing Decision (EU) 2021/914, or another legally recognised transfer mechanism, where required.

Customers in mainland China: we use local technology partners including WeChat for sign-in and payment, Alibaba Cloud for file storage and SMS delivery, and Tencent Cloud for video hosting. Data collected through the China app and website is hosted in China-facing infrastructure. If personal information must be transferred outside mainland China, we use the transfer mechanism required by the Personal Information Protection Law based on the volume and sensitivity of the information and ask for separate, specific consent where that law requires it.

Google Analytics, Google Ads, and Meta Pixel are not used on the China platform.

7. Cookies and online advertising

Outside China, our website and apps use:

• Google Analytics to understand how visitors use our services.
• Google Tag Manager and Google Ads to measure and improve advertising.
• Meta Pixel and Meta Conversions API to measure whether Facebook or Instagram advertising led to a signup or purchase. The server-side connection sends Meta securely hashed contact details and browser identifiers when you sign up or purchase.

These tools are not used on our China website or app. You can control browser cookies through your browser settings. Blocking cookies may affect some features. Browser cookie controls do not stop the server-side Meta Conversions API. To ask us not to send this data to Meta for your account, contact customerservice@pbt.dance.

8. Your rights

European Union and United Kingdom: you may have rights to access, correct, delete, restrict, or object to processing and to receive a portable copy of your information. Where we rely on consent, you may withdraw it at any time. You may complain to your local data protection authority, including the ICO in the United Kingdom.

California: you may have rights to know, delete, and correct personal information and to opt out of its sale or sharing. We do not sell personal information. You will not be discriminated against for exercising applicable privacy rights.

Australia: you can request access to and correction of your personal information under the Australian Privacy Principles. If we cannot resolve a concern, you can contact the Office of the Australian Information Commissioner.

Other locations, including Canada: contact us and we will handle your request consistently with applicable local law.

To exercise a right, email customerservice@pbt.dance. We may need to verify your identity.

9. Data retention

We keep personal information for as long as reasonably necessary for the purposes in this policy, including legal, accounting, and tax obligations, and then take reasonable steps to delete or de-identify it.

10. Children's privacy

Our services are intended for teachers, studio owners, and adults and are not directed at children. Workshop bookings and merchandise purchases require an adult purchaser. We do not knowingly collect personal information directly from children without appropriate parental involvement. If you believe a child has provided personal information, contact us so we can act on it.

11. Data security

We use technical and organisational measures designed to protect information, including encryption in transit, access controls, and secure storage of payment information with Stripe or EBANX rather than on our own servers. No system is completely secure, and we cannot guarantee absolute security.

12. If something goes wrong

If we become aware of a data breach likely to result in serious harm, we will notify affected people and relevant regulators as required by applicable law, including Australia's Notifiable Data Breaches scheme.

13. Changes to this policy

We may update this policy from time to time. We will post the current version here with a new effective date and take reasonable steps to notify you before a material change takes effect.