Privacy Policy

Last updated: 30 August 2026

1. Purpose and scope

Nordic Sweat Pty Ltd as trustee for The Nordic Group Trust (ABN 21 773 206 334) trading as Nordic Sweat (Nordic Sweat, we, us or our) respects the privacy of customers, members, guests and website users. This Privacy Policy explains how we collect, hold, use and disclose personal information in connection with our website, bookings, memberships, digital building access and the recovery services provided at our Hobart studio.

Nordic Sweat provides self-service recovery facilities including an infrared sauna, ice bath, compression boots and associated amenities. The studio is ordinarily unmanned. Our booking and waiver process may involve health and safety information, and our security arrangements may involve digital access records and CCTV footage.

This Policy is intended to support Nordic Sweat's obligations under the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Notifiable Data Breaches scheme and other applicable Australian laws.

2. Personal information we collect

• Identity and contact information, including name, date of birth, postal address, email address and telephone number. Where you nominate an emergency contact, we may also collect that person's name and telephone number.
• Account, booking and membership information, including appointments, session packs, memberships, attendance, cancellations, guest details, booking history and communications about the services.
• Payment and transaction information. Payments are processed through third-party payment services such as Stripe. Nordic Sweat generally does not need to receive full payment-card details where those details are entered directly into the payment provider's systems.
• Health and safety information contained in or generated through the Risk Acknowledgement and Waiver or related booking process. This may include declarations concerning medical conditions, pregnancy, implanted medical devices, recent surgery or other circumstances that may affect safe participation, and whether medical clearance is required or has been obtained.
• Waiver evidence, including the participant's signature, date, contact details and records showing acceptance of the Risk Acknowledgement and Waiver and related terms.
• Access and security information, including digital access credentials and access-event information generated through the Kisi access-control system.
• CCTV footage from non-private areas of the studio where CCTV is in operation. CCTV does not operate in change areas, bathrooms, or the interior of sauna or cold-plunge areas as described in Nordic Sweat's Terms and Conditions and Waiver.
• Communications and enquiry information, including messages sent through the website, email, telephone, Momence or other communication channels.
• Technical and usage information generated by the website, embedded services or third-party platforms, such as IP address, browser or device information, cookie identifiers, approximate location, page interactions and similar service-use information.
• Marketing preferences, consent records and opt-out information.

3. How we collect information

We collect personal information directly from you when you create an account, make a booking, purchase a session pack or membership, complete or sign the Risk Acknowledgement and Waiver, register a guest, nominate an emergency contact, contact us, use the studio or access-control system, or interact with our website or marketing communications.

The Waiver is completed through the booking process before a person participates in the relevant activities. We may also receive information through service providers that support our operations, including Momence, Stripe, Webflow, Kisi, Google and Meta services where configured, the owners or managers of 188 Collins Street in connection with CCTV, and the consent-management provider used on the website.

4. Health and sensitive information

Health information is sensitive information under Australian privacy law. Nordic Sweat's Risk Acknowledgement and Waiver contains health and safety declarations about conditions that may be affected by extreme heat, extreme cold or rapid temperature change. We aim to collect only the health information reasonably necessary for safety, suitability, service administration, incident management and related legal or insurance purposes.

Where consent is required for collection of sensitive information, the Waiver or related collection process must obtain and record that consent before the information is collected. We do not use health information for direct marketing unless the consent required by law has been obtained.

5. Why we use personal information

• To create and administer customer accounts, bookings, memberships, session packs and guest bookings.
• To process payments, refunds, cancellations and transaction records.
• To provide digital building access and maintain studio security.
• To administer the Risk Acknowledgement and Waiver and manage health and safety risks associated with heat, cold and recovery activities.
• To communicate about bookings, memberships, service changes, incidents and customer enquiries.
• To operate, maintain, secure and improve the website, booking platform and studio systems.
• To conduct analytics and measure website or campaign performance where relevant technologies are deployed.
• To send direct marketing where permitted and to maintain opt-out preferences.
• To detect misuse, fraud, unauthorised access, safety issues or breaches of Nordic Sweat's Terms and Conditions.
• To keep business, accounting, insurance and legal records and to establish, exercise or defend legal claims.
• To comply with legal and regulatory obligations.

6. Service providers and disclosures

Nordic Sweat may disclose or make personal information available to service providers where reasonably necessary for the purposes described above. These may include:

• Momence, used as the booking, account, membership and customer-management platform. Momence states that it acts as a processor for subscriber customer data while Nordic Sweat determines the purposes for which its own customer data is handled.
• Stripe and related payment services used to process payments and manage payment-related risk.
• Webflow and related website infrastructure used to host and operate the website and website forms.
• Kisi, used to provide and administer digital access to the studio and to generate access-event records.
• The owners or managers of 188 Collins Street in connection with CCTV footage and building security.
• Google and Meta services where Nordic Sweat activates analytics, advertising, communication or measurement tools.
• GetTerms.io, the consent-management provider selected for the website.
• Professional advisers, insurers, IT providers, accountants, lawyers, regulators, law-enforcement bodies or other recipients where required or permitted by law.

7. Overseas processing and cross-border disclosure

Some technology and payment providers used by Nordic Sweat operate internationally. Based on current provider information, relevant data may be processed or stored outside Australia, including in the United States, and in some cases India or other countries where a provider or its subprocessors operate. For example, Webflow states that it stores customer and end-user data in the United States; Momence states that personal data may be processed outside the user's home country, including in the United States; and Stripe operates a global infrastructure that includes the United States and India.

The exact countries involved can depend on the product configuration and provider infrastructure in use at the relevant time. Where the Privacy Act requires steps in relation to an overseas disclosure, Nordic Sweat will take reasonable steps appropriate to the circumstances. Because provider infrastructure and subprocessors may change, the countries involved may change over time.

8. CCTV and building access

CCTV may operate in non-private areas of the studio for safety, security, incident investigation and protection of people and property. CCTV does not operate in change areas, bathrooms, or the interior of sauna or cold-plunge areas. Under Nordic Sweat's current Terms and Conditions, footage is held by the owners of 188 Collins Street and Nordic Sweat and is irreversibly deleted after 14 days, unless preservation is reasonably required for an incident, legal obligation or claim. CCTV is not a continuously monitored emergency-response system.

Kisi access credentials are personal to the authorised user. Access events may record information such as the responsible user, door or access point, and timestamp. Nordic Sweat uses access records for access administration, safety, security and incident investigation. Access records are retained only for as long as reasonably required for those purposes and any related legal or insurance requirement.

9. Direct marketing

Nordic Sweat may send occasional direct marketing communications where permitted by law. Marketing communications will provide a simple way to opt out. Nordic Sweat will record and respect opt-out requests within a reasonable period and will retain a minimal suppression record where necessary to avoid contacting a person who has opted out. Health information will not be used or disclosed for direct marketing unless the consent required by law has been obtained.

10. Cookies, analytics and online tracking

The website uses cookies and similar technologies for essential functions and may use additional functional, analytics, measurement or advertising technologies depending on the website configuration. Further information is available in Nordic Sweat's Cookie Policy. The website consent-management tool provides choices for non-essential technologies and allows users to revisit their preferences.

11. Storage, security and retention

Nordic Sweat takes reasonable technical and organisational steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. Controls may include access restrictions, strong authentication, secure service providers, account management, device security, backups, incident-response procedures and periodic review of administrator access.

Personal information is retained only for as long as it is reasonably required for a permitted purpose, legal or accounting obligation, safety and security, dispute, insurance requirement or the establishment or defence of a claim. Nordic Sweat maintains internal retention rules for different categories of information. CCTV currently has a confirmed 14-day deletion period. Relevant tax and business records are generally retained for the periods required under Australian record-keeping rules. When personal information is no longer required and no exception applies, Nordic Sweat takes reasonable steps to destroy or de-identify it.

12. Access and correction

You may contact Nordic Sweat to request access to personal information held about you or to ask for information to be corrected. Nordic Sweat may need to verify your identity before responding. Access may be refused or limited where permitted by law, in which case Nordic Sweat will provide an explanation where required. Nordic Sweat aims to respond within a reasonable period and, in ordinary cases, within 30 calendar days.

13. Privacy complaints

If you have a privacy concern or complaint, contact Clare Roberts at info@nordicsweat.com.au or 0432 380 241. Nordic Sweat will review the issue and respond within a reasonable period. If you are not satisfied with the outcome, you may be entitled to contact the Office of the Australian Information Commissioner (OAIC).

14. Data breaches

Nordic Sweat maintains a Data Breach Response Plan. Where Nordic Sweat has reasonable grounds to suspect an eligible data breach under the Notifiable Data Breaches scheme, it will assess the incident expeditiously and take reasonable steps to complete the assessment within the period required by law. Nordic Sweat will notify affected individuals and the OAIC where notification is required.

15. Eligibility and children

Nordic Sweat's Terms and Conditions and Waiver require users of the studio and services to be at least 18 years of age. The services are not directed to children under 18. If Nordic Sweat learns that personal information has been collected from a person who is not eligible to use the services, it will take appropriate steps consistent with its legal obligations and operational needs.

16. Changes to this Policy

Nordic Sweat may update this Policy when its services, technology, legal requirements or information-handling practices change. The current version will be published on the website with an updated effective or review date.

Business and privacy contact