Privacy policy

Clearway Collective Coaching Services (trading as "The Clearway Collective")

Effective date: 30 September 2026

Last revised: 30 September 2026

1. Introduction and scope

1.1 This Privacy Policy ("Policy") governs the collection, use, disclosure, storage and transfer of Personal Data by Clearway Collective Coaching Services, a company established in the United Arab Emirates ("the Company", "we", "us", "our"), in connection with the website located at theclearwaycollective.com, the member application located at 30-day-reset.theclearwaycollective.com, and all related products and services (together, "the Services").

1.2 For the purposes of applicable data protection legislation, the Company is the Controller of the Personal Data described in this Policy.

1.3 By accessing the Services, purchasing from us, or creating a member account, you acknowledge that you have read and understood this Policy.

Company details

2. Governing data protection legislation

2.1 The Company processes Personal Data in accordance with Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data of the United Arab Emirates and its implementing regulations ("the PDPL").

2.2 Where the Company offers goods or services to Data Subjects located in the European Economic Area, the Company additionally processes such Personal Data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), which applies extraterritorially pursuant to Article 3(2) thereof.

2.3 Where the Company offers goods or services to Data Subjects located in the United Kingdom, the Company additionally processes such Personal Data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.

2.4 In the event of a conflict between this Policy and any mandatory provision of applicable law, the mandatory provision shall prevail.

3. Categories of Personal Data collected

3.1 Transaction Data. Name, email address, billing address, order number, order contents, transaction value and currency. Payment card data is collected and processed directly by our payment service providers through the Shopify checkout. The Company does not receive, process or store complete payment card numbers.

3.2 Account Data. Email address, an irreversibly hashed representation of your password, and the order number presented to redeem access to the Services.

3.3 User Content. Material you create within the member application, including daily logs, journal entries, written reflections, saved plans, correspondence addressed to your future self, and figures entered into the cost calculator.

3.4 Technical Data. Internet Protocol address, browser type and version, device and operating system identifiers, and date and time of access, recorded in the server logs maintained by our infrastructure providers.

3.5 Correspondence Data. Any information you provide when contacting us, together with our record of that correspondence.

3.6 Marketing Data. Where applicable, your email address and a record evidencing the date, time and method by which consent was obtained.

4. Special categories of Personal Data

4.1 User Content as described at clause 3.3 concerns your relationship with alcohol and therefore constitutes Sensitive Personal Data within the meaning of the PDPL and data concerning health within the meaning of Article 9(1) GDPR.

4.2 The Company processes such data solely on the basis of your explicit consent, obtained at the point of account creation, pursuant to Article 9(2)(a) GDPR and the corresponding provisions of the PDPL.

4.3 You may withdraw that consent at any time in accordance with clause 9. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

4.4 The Company does not use User Content for marketing, profiling, automated decision-making, or analytics of any kind. User Content is not accessed by personnel in the ordinary course of business. Access may be obtained by an authorised individual only where strictly necessary to remedy a technical defect or to comply with a legal obligation, and such access is restricted and logged.

5. Purposes and legal bases of processing

6. Disclosure to Processors and third parties

6.1 The Company engages the following categories of Processor, each of which processes Personal Data only on documented instructions from the Company and under a written data processing agreement:

(a) Shopify Inc., for e-commerce, checkout and order management;

(b) Payment service providers integrated with the Shopify checkout, for payment processing;

(c) Supabase, for authentication services and for hosting Account Data and User Content, stored in Ireland;

(d) Cloudflare, Inc., for hosting and delivery of the member application, with Ireland as the configured storage region;

(e) [EMAIL SERVICE PROVIDER], for transactional and marketing email delivery.

6.2 The Company may further disclose Personal Data to its professional advisers, auditors and accountants, and to any court, regulator or governmental authority where such disclosure is required by law.

6.3 The Company does not sell Personal Data, and does not disclose Personal Data to advertising networks or data brokers.

7. Location of storage and international transfers

7.1 The Company has configured its infrastructure providers such that Account Data and User Content are stored in data centres located in Ireland, within the European Union. Account Data and User Content are accordingly not stored outside the European Economic Area.

7.2 Delivery of the member application is effected by means of a global content delivery network. Technical Data as described at clause 3.4 may therefore be processed transiently at edge locations outside the European Economic Area for the purposes of serving requests and maintaining the security of the Services.

7.3 Transaction Data is processed by Shopify and by the applicable payment service providers, each of which operates internationally and may process such data outside the European Economic Area.

7.4 The Company is established in the United Arab Emirates. Authorised personnel of the Company may access Personal Data stored in Ireland from the United Arab Emirates for the purposes described in this Policy. Such access constitutes a transfer for the purposes of applicable law and is effected on the bases set out at clauses 7.5 and 7.6.

7.5 Transfers of Personal Data from the United Arab Emirates are effected in accordance with Articles 22 and 23 of the PDPL, whether on the basis of an adequacy determination, appropriate contractual safeguards, or the express consent of the Data Subject. Ireland is subject to the General Data Protection Regulation and accordingly affords an adequate level of protection for these purposes.

7.6 Transfers of Personal Data outside the European Economic Area or the United Kingdom, including access from the United Arab Emirates as described at clause 7.4, are effected on the basis of the Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR, the UK International Data Transfer Addendum, or another lawful transfer mechanism.

8. Retention

8.1 Personal Data is retained only for so long as is necessary for the purposes for which it was collected, save where a longer retention period is required by law.

8.2 The Company applies the following retention periods:

(a) Transaction Data and accounting records: not less than five (5) years, as required by the tax and commercial legislation of the United Arab Emirates;

(b) Account Data and User Content: until deletion by the Data Subject or upon request, the Services being supplied on a perpetual-access basis;

(c) Correspondence Data: two (2) years from the conclusion of the correspondence;

(d) Marketing Data: until withdrawal of consent, and thereafter for such period as is necessary to evidence that withdrawal;

(e) Technical Data: between thirty (30) and ninety (90) days, according to the retention settings of the relevant infrastructure provider.

8.3 Upon deletion of an account, the Company erases the associated Account Data and User Content and retains only the minimum Transaction Data required by clause 8.2(a).

9. Rights of the Data Subject

9.1 Subject to the conditions and exemptions provided by applicable law, you have the right to:

(a) obtain confirmation as to whether Personal Data concerning you is processed, and to obtain a copy of that data;

(b) obtain rectification of inaccurate or incomplete Personal Data;

(c) obtain erasure of Personal Data;

(d) obtain restriction of processing;

(e) object to processing carried out on the basis of legitimate interests;

(f) receive Personal Data in a structured, commonly used and machine-readable format, and to transmit it to another Controller;

(g) withdraw consent at any time, where processing is based on consent.

9.2 Requests should be addressed to help@theclearwaycollective.com. The Company shall respond without undue delay and in any event within thirty (30) days of receipt. No fee is payable, save where a request is manifestly unfounded or excessive.

9.3 Self-service controls. The member application provides the following functions within Settings, which may be exercised at any time without recourse to the Company: Export my data, which generates a complete copy of your User Content; Delete everything, which erases your User Content; and Set a PIN, which applies a local access lock to your device.

10. Right to lodge a complaint

10.1 Data Subjects in the United Arab Emirates may lodge a complaint with the UAE Data Office.

10.2 Data Subjects in the European Economic Area may lodge a complaint with the supervisory authority of the Member State of their habitual residence, place of work or place of the alleged infringement, pursuant to Article 77 GDPR.

10.3 Data Subjects in the United Kingdom may lodge a complaint with the Information Commissioner's Office.

10.4 The exercise of this right is without prejudice to any other administrative or judicial remedy.

11. Security measures

11.1 The Company implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including: transmission of all data over TLS; storage of authentication credentials as irreversible cryptographic hashes; row-level security controls at the database layer, such that a given record is retrievable only by the authenticated account to which it belongs; encryption of data at rest by our infrastructure providers; and an optional device-level PIN lock.

11.2 No method of transmission or storage is entirely secure. In the event of a Personal Data breach, the Company shall notify the competent supervisory authority and, where required, affected Data Subjects, within the periods prescribed by applicable law.

12. Cookies and local storage

12.1 The e-commerce website uses cookies that are strictly necessary for the operation of the shopping basket and checkout, together with cookies set by Shopify for fraud prevention and aggregate store analytics.

12.2 The member application uses browser local storage to enable offline operation and to preserve application state, together with a session token for the purpose of maintaining an authenticated session.

12.3 Neither the website nor the member application employs cookies or similar technologies for advertising or cross-site tracking purposes.

13. Minors

The Services are intended exclusively for persons aged eighteen (18) years or over. The Company does not knowingly collect Personal Data from minors. Where the Company becomes aware that such data has been collected, it shall be erased without undue delay.

14. Reminder functionality

Where you configure a reminder within the member application, that reminder is generated as a calendar file on your own device. The Services do not transmit push notifications or reminder emails, and no data relating to reminders is transmitted to the Company.

15. Amendments

15.1 The Company may amend this Policy from time to time. The revision date at the head of this Policy shall be updated accordingly.

15.2 Where an amendment materially affects the manner in which Personal Data is processed, the Company shall notify affected Data Subjects by email prior to the amendment taking effect.

16. Contact

All enquiries concerning this Policy should be addressed to help@theclearwaycollective.com.