2: How We Collect Personal Data

• Directly from you, when you create an account, book a class, purchase a package or membership, complete a waiver or intake form, or contact us

• Through our booking platform, OClass, which processes bookings, payments and waiver signatures on our behalf

• Through photos and video taken during classes, workshops, performances or events

• From a parent or guardian, where the participant is under 18 years old

3: Purposes for Collecting, Using & Disclosing Personal Data

We collect, use and disclose personal data for the following purposes, and will not use it for purposes beyond what a reasonable person would consider appropriate in the circumstances:

• Creating and managing your studio account and class bookings

• Processing payments for classes, packages, memberships and events

• Communicating with you about bookings, schedule changes, studio updates and promotions

• Ensuring instructor and participant safety, including emergency response

• Studio promotion and social media, where you have not opted out of photo/video use

• Complying with legal and regulatory obligations

• Improving our classes, services and studio operations

4: Consent

By providing your personal data to us, including via Momence at the point of booking, you consent to our collection, use and disclosure of your personal data for the purposes set out in this policy. Where required, we will seek your separate consent for specific purposes, such as the use of your photo or video in promotional material.

You may withdraw your consent at any time by contacting our Data Protection Officer (see Section 9), subject to legal or contractual restrictions. Withdrawing consent may affect our ability to provide certain services to you — for example, we may not be able to process your booking without basic contact and payment information.

5: Disclosure of Personal Data to Third Parties

We do not sell your personal data. We may disclose personal data to:

• OClass, our booking and payment platform provider, which processes bookings, payments and waiver records on our behalf

• Payment processors, to facilitate secure payment transactions

• Professional advisors (e.g. accountants, lawyers) where necessary for our business operations

• Government authorities, where required by law

Third parties who process personal data on our behalf are required to protect that data to a standard comparable to the PDPA.

6: Overseas Transfer of Personal Data

Some of our service providers, including Squarespace, may store or process personal data on servers located outside Singapore. Where this occurs, we take reasonable steps to ensure that any overseas recipient provides a standard of protection to your personal data that is comparable to the protection under the PDPA, including through contractual safeguards with our service providers.

7: Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law (for example, accounting and tax records). When personal data is no longer needed, we will securely delete or anonymise it.

8: Data Security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. This includes relying on Squarespace’s and OClass’ platform-level security measures for data processed through our booking system.

9: Your Rights & How to Contact Us

You have the right to:

• Request access to the personal data we hold about you

• Request correction of any inaccurate or incomplete personal data

• Withdraw consent for the collection, use or disclosure of your personal data

• Lodge a complaint about our handling of your personal data

To exercise any of these rights, please contact our Data Protection Officer:

Data Protection Officer name: Penny Pun

DPO email address: hello@ethosdance.com

We will respond to your request as soon as reasonably possible, and in any case in accordance with PDPA timelines.

10: Data Breach Notification

In the event of a data breach that is likely to result in significant harm to affected individuals, or that is of a significant scale, we will notify the Personal Data Protection Commission (PDPC) and affected individuals in accordance with PDPA requirements and timelines.

11: Children’s Data

Where a participant is under 18 years old, we collect and process their personal data based on consent provided by a parent or legal guardian. Parents/guardians may exercise the rights set out in Section 9 on behalf of their child.

12: Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on our website and/or booking platform, with the “last updated” date revised accordingly. Material changes will be communicated to active members where appropriate.