App Privacy Policy
Last Reviewed/Dated: 04/04/2025
1. Introduction
This policy describes the collection of user data, the reasons for collecting user data, statements on the use of
data
as well as security considerations for Simmply Active’s Simmply Active Rewards App. This policy is designed to
provide
transparency in accordance with applicable data protection laws, including the General Data Protection Regulation
(GDPR)
in the European Union/United Kingdom.
By accessing or using the Service, the user acknowledge that the user have read, understood, and agree to the
practices
described in this Privacy Policy. If the user do not agree, please do not use the Simmply Active Rewards App. This
policy applies to all users of the Simmply Active Rewards App. Please note that this policy does not govern the
privacy
practices of third-party websites, services, or applications that may be linked within our Service, which have their
own
privacy statements.
1.1. Controller Identification
Trading Name: Simmply Active
Mailing Address: 47, Crouch Street, Colchester, CO3 3EN, England
Email: d.simmons@simmplyactive.com
Website: www.simmplyactive.com/contact
2. Personal Data
| Data Category |
Purpose of Use |
Legal Basis (GDPR) |
| Account & Profile Data (Name, Email, Password, DOB, Profile Picture) |
To create and manage the user's account; authenticate logins; personalize the user's profile; enable
social features. |
Performance of Contract (Article 6(1)(b)) |
| Health & Fitness Data (GPS routes, distance, pace, duration, heart rate, calories) |
To track, map, and analyze the user's runs; calculate points for the rewards program; enable
challenge
participation; provide fitness insights. |
Explicit Consent (Article 9(2)(a)) for sensitive health data (heart rate).
Performance of Contract (Article 6(1)(b)) for core run tracking. |
| Payment & Subscription Data (Billing name, address, payment method token via processor,
subscription
tier, transaction history) |
To process payments for Premium subscriptions; manage recurring billing; prevent fraud; provide
customer
support on billing issues; comply with financial regulations. |
Performance of Contract (Article 6(1)(b))
Legal Obligation (Article 6(1)(c)) for financial record-keeping |
| Rewards & Activity Data (Points earned, challenges joined, badges, redemption history) |
To operate the loyalty program; verify eligibility for rewards; fulfill reward requests; display
leaderboards. |
Performance of Contract (Article 6(1)(b)) |
| Device & Technical Data (IP address, device type, OS, crash logs, performance data) |
To troubleshoot technical issues; secure the app against fraud/abuse; improve app performance and
features; analyze aggregate usage. |
Legitimate Interest (Article 6(1)(f)) (network security, service improvement) |
| Marketing & Communication Data (Email, push notification token, marketing preferences) |
To send the user service-related announcements (e.g., challenge updates); with separate consent, to
send
promotional emails about new features and partner offers. |
Performance of Contract for service messages.
Consent (Article 6(1)(a)) for direct marketing. |
2.1. Context
2.1.1. Necessary for performance of contract
We process some of the user's personal data because it is necessary for the performance of a contract we have with
the
user or it is necessary prior to entering into such a contract. If the user do not wish to provide a nickname or
email
for example, we cannot create the user's account and the user will be unable to avail of certain features. It should
be
noted, however, that not every app will process this data.
2.1.2. Changes to Personal Data
It is important that the personal data we have in relation to the user is current and accurate. If the user's
personal
data changes during our relationship please inform us promptly. If, for whatever reason, the user's personal data is
inaccurate or incomplete the user have the right for this to be corrected or completed.
3. Automatic Collection, Retention and Sharing
Simmply Active is committed to the principle of storage limitation and will retain the user's personal data for no
longer than is necessary to fulfil our processing purposes and compliance with GDPR. All data retention begins at
account creation and continues as the user use the app. Simmply Active will also anonymise some personal data so it
will
no longer be associated with the user. In this event we are entitled to retain and use the information freely.
In conjunction with our partners we automatically collect and log certain information stored on the user's terminal
device device data including device type, operating system specification, network settings, unique device identifier
and
IP address. usage data is collected and logged to discover how the Apps are used and which features are popular, it
includes data relating to the time the user are active, purchases and the features. This helps to inform and improve
our
direction and development.
We rely on our legitimate interest of measuring and analysing app usage to further inform development and improve
the
overall user experience. Our Analytics providers may by default use IP addresses to determine the user's general
non-specific location. Among other things, this allows geographic sorting and protects us and our apps against
misuse
and nefarious activity.
3.1. Retention
Following account deletion, revocation of consent or a written deletion request, the user's personal data will be
retained for no longer than 30 days, except instances where legal obligations require longer retention periods.
3.2. Sharing
Simmply Active does not sell the user's personal data. We share the user's information only in the following limited
circumstances with the categories of third parties listed below, and only to the extent necessary to provide,
secure,
and improve our services.
Simmply Active engages trusted third-party companies to perform essential business functions on our behalf. These
processors are contractually bound to handle the user's data only according to our strict instructions and for the
purposes specified in Purpose of Collection and Usage.
3.2.1. Cloud Storage Providers
To enable Simmply Active to securely store and back-up the user's data. To be able to provide these services, the
providers receive the user's Account Information.
3.2.2. Newsletter and Mailing Providers
To enable Simmply to generate and send newsletters to the user if the user have subscribed. To be able to provide
this
service, the providers receive the user's Account Information.
3.2.3. Sponsors and Challenge Partners
When the user explicitly opt-in to a sponsored challenge or promotion, we must share certain data with the
sponsoring
partner to verify the user's participation, track collective progress for the challenge, and fulfill any rewards.
3.2.4. Payment Providers
Payment providers executing card payments for purchases made on the Simmply Active’s services and website receive
the
user's payment details and Account Information.
3.2.5. Cookie Consent Management Platforms
cookie consent management platforms assist Simmply Active in managing and implementing the user's preferences when
the
user visit our websites. The platforms receive automatically collected device information to provide this service.
3.2.6. Law Enforcement
Law enforcement authorities, government authorities, government bodies and the courts where they request data and
disclosure is lawful.
- To comply with a valid legal obligation (e.g., a subpoena, court order, or request from a law enforcement or
government authority).
- To protect and defend the rights, property, or safety of Simmply Active, our users, or the public.
- To investigate fraud, security breaches, or other potential violations of our Terms and Conditions.
4. Purpose of Collection and Usage
4.1. Payment Data
Simmply Active use a certified third-party payment processor to handle all financial transactions. We do not store
or
process the user's full credit card numbers on our servers. The payment processor provides us with a token and
limited
information (the last four digits of the user's card, card type, and expiration date) for customer support and
transaction history purposes.
4.2. Subscription Management
Payment data is retained as necessary to manage the active subscription and for legal and financial reporting
obligations, see Retention.
4.3. Legitimate Interest
Simmply Active relies on Legitimate Interests for processing device data to ensure the security and integrity of our
service, prevent fraudulent use of the rewards program, and improve our app's functionality.
5. Security
We have implemented appropriate technical and organisational security measures to protect the user's personal data
from
accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to.
These measures include encryption and pseudonymisation. Access to the user's personal data is granted strictly on a
need
to know basis and we have carefully selected our service providers with security considerations in mind.
6. User Rights
If the user are located in the United Kingdom, the user have specific statutory rights under the UK General Data
Protection Regulation (UK GDPR) and the Data Protection Act 2018. These rights are outlined below. Please note that
these rights are not absolute and may be subject to certain exemptions as stipulated by UK law.
6.1.1. Right of Access (Subject Access Request)
the user have the right to obtain:
- Confirmation as to whether or not we are processing the user's personal data.
- A copy of that personal data.
Supplementary information, including: the purposes of processing, the categories of personal data concerned, the
recipients or categories of recipient we disclose the data to, our retention periods, information about the user's
other
rights, and the source of the data if not collected directly from the user.
6.1.2. Right to Rectification
the user have the right to have inaccurate personal data concerning the user corrected without undue delay. the user
may
update certain information directly within the user's app account settings. Where the inaccuracy relates to data we
have
shared with third parties, we will take reasonable steps to inform those parties of the correction.
6.1.3. Right to Erasure
the user have the right to request the erasure of the user's personal data where one of the following grounds
applies:
- The data is no longer necessary for the purposes for which it was collected.
- the user withdraw the user's consent (where processing was based on consent) and there is no other legal
ground
for processing.
- the user object to the processing (under Article 21(1) UK GDPR) and there are no overriding legitimate
grounds
for the processing.
- The personal data has been unlawfully processed.
- The data must be erased to comply with a UK legal obligation.
This right is not absolute. We may refuse erasure where processing remains necessary for:
- Compliance with a UK legal obligation (e.g., retaining financial records for HMRC).
- The establishment, exercise, or defence of legal claims.
6.1.4. Right to Restriction of Processing
the user have the right to restrict our processing of the user's personal data in the following circumstances:
- the user contest the accuracy of the data, for a period enabling us to verify its
accuracy.
- The processing is unlawful, and the user oppose erasure, requesting restriction
instead.
- We no longer need the personal data for our original purposes, but the user require
it
for the establishment, exercise, or defence of legal claims.
- the user have objected to processing pursuant to Article 21(1) UK GDPR, pending the
verification of whether our legitimate grounds override the user's.
6.1.5. Right to Data Portability
the user have the right to receive the personal data the user have provided to us in a structured, commonly used,
and
machine-readable format, and have the right to transmit that data to another controller without hindrance, where:
- The processing is based on the user's consent or on a contract; and
- The processing is carried out by automated means.
This right applies to personal data the user have actively and knowingly provided (e.g., account details, run logs
the
user input).
6.1.6. Right to Object
the user have the right to object, on grounds relating to the user's particular situation, to the processing of the
user’s personal data which is based on our legitimate interests (Article 6(1)(f) UK GDPR). We will cease processing
unless we demonstrate compelling legitimate grounds for the processing which override the user’s interests, rights,
and
freedoms, or for the establishment, exercise, or defence of legal claims.
the user have an absolute right to object to the processing of the user's personal data for direct marketing
purposes at
any time. Upon objection, we will cease such processing immediately.
6.1.7. Rights in Relation to Automated Decision-Making and Profiling
The user has the right not to be subject to a decision based solely on automated processing, including profiling,
which
produces legal effects concerning the user or similarly significantly affects the user. We currently do not engage
in
any such automated decision-making or profiling that produces legal or similarly significant effects.
6.1.8. Right to Withdraw Consent
Where our processing of the user's personal data is based on the user's consent, the user have the right to withdraw
that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its
withdrawal.
7. Policy Changes and Contact Details
Changes: Reserve the right to update the policy. Promise to notify users of material changes via email or prominent
in-app notice prior to changes taking effect.
Trading Name: Simmply Active
Mailing Address: 47, Crouch Street, Colchester, CO3 3EN, England
Email: d.simmons@simmplyactive.com
Website: www.simmplyactive.com/contact