COPPA Children's Privacy Policy - SoulCycle Inc.

SoulCycle Inc.'s ("SoulCycle") Children's Privacy Policy ("Children's Privacy Policy") is designed to comply with the Children's Online Privacy Protection Act ("COPPA") and contains important information about how we collect, use, and disclose the personal information we collect from children who we know to be under thirteen years old ("child"), who have registered to use our website, www.soul-cycle.com, and our mobile application (the "App") (collectively, the "Online Services").

SoulCycle Inc.
609 Greenwich Street, New York, New York, 10014
privacy@soul-cycle.com
1-212-787-7685

Parental Consent

Our Online Services are not targeted to children, and we do not knowingly collect any personal information from a child through the Online Services without first obtaining parental consent.

Once a parent signs their child under 13 up for SoulCycle classes in one of our studios, the child (now an "Authorized Child") may, with the parent's permission, use the Online Services to view, pay for and reserve classes, to review their class history, and to otherwise manage reservations (among other things), provided the parent consents to our collection, use, or disclosure of personal information about the Authorized Child through our Online Services. To provide consent, parents must sign a written consent statement in one of our studios when they sign up their Authorized Child to attend classes.

If a parent registers an Authorized Child to take classes, but does not consent to our collection of personal information from the child via the Online Services, the child will not be permitted to use the Online Services and make online reservations and payments, but may still be able to make reservations and payments in a studio.

Since our Online Services are not targeted to children, we do not age screen users who register for an account online, but have not created a studio account and completed the required registrations and consents to be eligible to take classes. Until a user completes a studio registration, they are not eligible to take classes. In such cases, we would not know if a user was under 13, and their information would be subject to the SoulCycle Privacy Policy. If we discover that we have collected personal information online from a child without parental consent, we will delete that information.

The Information We Collect About Children

As described below, we collect information about an Authorized Child directly from the child or parent, as well as automatically through the Authorized Child's use of our Online Services.

Information We Collect Directly. When a parent gives permission for their Authorized Child to use the Online Services, we collect the Authorized Child's name and email address; the Authorized Child is then able to create and/or link an online account with their studio account. We also collect information from children when they contact us, register for an online account, reserve and pay for classes online, or otherwise interact with our Online Services, including name, email address, password, contact info, emergency contact details and payment information. We also may collect information about a child's workout preferences, such as the child's bike size and settings, and shoe size preferences, as well as other relevant profile information they provide us.

Information We Collect Automatically. We automatically collect information about the use of our Online Services through cookies, web beacons, and other technologies, including technologies designed for mobile apps. We combine this information with other information we collect about users including and Authorized Child.

Website: domain name; browser type and operating system; web pages viewed; links clicked; IP address; length of time the user visits our Site and or uses our Online Services; and referring URL or the webpage that led the user to our Site.

App: mobile device ID; device name and model; operating system type, name, and version; language information; activities within the App; and the length of time that the Authorized Child is logged into our App; calendar (with permission, in order to help keep track of upcoming classes); contact list (with permission, to allow the Authorized Child to identify an emergency contact and upload their contact information); location information (with permission, to help locate the nearest SoulCycle location; this feature may be turned off through the location settings on the mobile device).

Performance Metrics in Connected Studios: If you consent in-studio by signing our hard copy Minor Rider Form to allow your child to participate in SoulCycle classes, we may also collect information about your child's performance in particular SoulCycle classes, including but not limited to your distance, power/effort, cadence, speed, and heart rate. This information is automatically collected by connected equipment in identified SoulCycle studios where we have installed connected equipment such as bicycles and wearable devices to measure such performance metrics.

How We Use Children's Information

We use the personal information collected from Authorized Children through the Online Services for the following purposes:

• To provide our services, to communicate with the Authorized Child or a parent about the use of our Online Services, to respond to inquiries, to fulfill orders, and for other customer service purposes.

• To tailor the content and information that we may send or display, to offer location customization, and personalized help and instructions, and to otherwise personalize experiences while using the Online Services.

• For marketing and promotional purposes. For example, to send news and newsletters, special offers, and promotions, or to otherwise contact users about products or information we think may be of interest, including information about third party products and services. You may tell us to not send marketing emails to your Authorized Child at any time by using the unsubscribe feature in our marketing email or contacting us at privacy@soul-cycle.com.

• To better understand how users access and use our Online Services, both on an aggregated and individualized basis, including in order to improve our Online Services, and for research and analytical purposes.

• To administer our Spread the Soul and other customer loyalty programs. You may tell us to not to permit your Authorized Child to participate in any of our loyalty programs at any time by contacting us at privacy@soul-cycle.com.

• To administer surveys and questionnaires (which are optional).

• To comply with applicable legal obligations, including responding to a subpoena or court order.

• For other business related purposes, including, for example, in the context of merger, acquisition, sale/purchase of assets, or bankruptcy.

• To protect us and others.

• To provide your child with information, on request, about his/her performance in connected SoulCycle classes.

How We Share Children's Information

We do not sell personal information about any Authorized Child, nor do we disclose such information to third parties for their own marketing use. We may share personal information, as follows:

Affiliates. We may disclose the information we collect from an Authorized Child to our affiliates or subsidiaries as part of our business operations; however, if we do so, their use and disclosure of such personal information will be subject to this Policy.

Service Providers. We may disclose the information we collect from an Authorized Child to third party vendors, service providers, contractors or agents who perform functions on our behalf. We do not, however, share this personal information with third parties for the third party's own marketing purposes.

Business Transfers. If we are acquired by or merged with another company, if some or all of our assets are transferred to another company, or as part of a bankruptcy proceeding, we may transfer the information we have collected from an Authorized Child to the other company.

In Response to Legal Process. We also may disclose the information we collect from an Authorized Child in order to comply with the law, a judicial proceeding, court order, or other legal process, such as in response to a court order or a subpoena.

To Protect Us and Others. We also may disclose the information we collect from Authorized Child where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of our Terms and Conditions or this Policy, or as evidence in litigation in which SoulCycle is involved.

Aggregate and De-Identified Information. We may share aggregate or de-identified information about Authorized Children with third parties for marketing, research or similar purposes.

Advertising

The following advertising networks, analytics providers and other third-party operators may collect or maintain persistent identifiers (e.g., cookies, device identifiers and IP addresses) and other usage statistics from users of the Online Services:

ACE
Adroll
Adyen
Auth.net
Avalara
Bing
Bootstrapcdn
Braze
Cloudfront
Doubleclick
Enspire
Facebook
Google
Googleadservices
Google Analytics
Instagram
JD Edwards
Mailgun, Inc.
Movable Ink,
mParticle Inc.
PebblePost
PostMark
Rackcdn
Rlcdn
Salesforce
Twitter Analytics
Yahoo

Please direct questions regarding the privacy practices of any of the above operators to:

SoulCycle Inc.
609 Greenwich Street
New York, NY 10014
Email Address: privacy@soul-cycle.com
Phone Number: 1-212-787-7685

We don't target our advertising specifically to Children. However, if you don't want your Child to receive targeted advertising on the Online Services, you may opt out with the ad network providers directly, or go to the Digital Advertising Alliance ("DAA") Consumer Choice Page and/or the Network Advertising Initiative ("NAI") Consumer Opt-Out Page for information about opting out of interest-based advertising and their choices regarding having information used by NAI members. After you opt-out, you and your Authorized Child may continue to receive contextual advertisements, for example, based on your use of our Website or App. Also, if your browsers are configured to reject cookies when you opt out on the DAA or NAI websites, your opt out may not be effective. Additional information is available on the DAA's website at www.aboutads.info or the NAI's website atwww.networkadvertising.org.

Parents' Rights Over Children's Personal Information

Parents have a right to review the information we have collected about their children, to delete it, and to tell us to stop using it. To exercise these rights, you may contact us atprivacy@soul-cycle.com. You will be required to authenticate yourself as the Authorized Child's parent to receive information about that Authorized Child. Please note that copies of information may remain in cached or archived form on our systems after you request us to delete it.

Changes to this Policy

This Children's Privacy Policy is current as of the Effective Date set forth below. We may change this Children's Privacy Policy from time to time, so please be sure to check back periodically. We will post any changes to this Children's Privacy Policy on our Website and App. If we make any material changes to Children's Privacy Policy with respect to how we collect, use and disclose personal information collected about Authorized Children through the Online Services, we will endeavor to provide parents with notice in advance of such change by emailing your email address of record.

EFFECTIVE DATE: April 18, 2018