Simmply Logo
SimmplyActive

Privacy Policy

App Privacy Policy

Last Reviewed/Dated: 04/04/2025 1. Introduction This policy describes the collection of user data, the reasons for collecting user data, statements on the use of data as well as security considerations for Simmply Active’s Simmply Active Rewards App. This policy is designed to provide transparency in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) in the European Union/United Kingdom. By accessing or using the Service, the user acknowledge that the user have read, understood, and agree to the practices described in this Privacy Policy. If the user do not agree, please do not use the Simmply Active Rewards App. This policy applies to all users of the Simmply Active Rewards App. Please note that this policy does not govern the privacy practices of third-party websites, services, or applications that may be linked within our Service, which have their own privacy statements. 1.1. Controller Identification Trading Name: Simmply Active Mailing Address: 47, Crouch Street, Colchester, CO3 3EN, England Email: d.simmons@simmplyactive.com Website: www.simmplyactive.com/contact 2. Personal Data
Data Category Purpose of Use Legal Basis (GDPR)
Account & Profile Data (Name, Email, Password, DOB, Profile Picture) To create and manage the user's account; authenticate logins; personalize the user's profile; enable social features. Performance of Contract (Article 6(1)(b))
Health & Fitness Data (GPS routes, distance, pace, duration, heart rate, calories) To track, map, and analyze the user's runs; calculate points for the rewards program; enable challenge participation; provide fitness insights. Explicit Consent (Article 9(2)(a)) for sensitive health data (heart rate). Performance of Contract (Article 6(1)(b)) for core run tracking.
Payment & Subscription Data (Billing name, address, payment method token via processor, subscription tier, transaction history) To process payments for Premium subscriptions; manage recurring billing; prevent fraud; provide customer support on billing issues; comply with financial regulations. Performance of Contract (Article 6(1)(b)) Legal Obligation (Article 6(1)(c)) for financial record-keeping
Rewards & Activity Data (Points earned, challenges joined, badges, redemption history) To operate the loyalty program; verify eligibility for rewards; fulfill reward requests; display leaderboards. Performance of Contract (Article 6(1)(b))
Device & Technical Data (IP address, device type, OS, crash logs, performance data) To troubleshoot technical issues; secure the app against fraud/abuse; improve app performance and features; analyze aggregate usage. Legitimate Interest (Article 6(1)(f)) (network security, service improvement)
Marketing & Communication Data (Email, push notification token, marketing preferences) To send the user service-related announcements (e.g., challenge updates); with separate consent, to send promotional emails about new features and partner offers. Performance of Contract for service messages. Consent (Article 6(1)(a)) for direct marketing.
2.1. Context 2.1.1. Necessary for performance of contract We process some of the user's personal data because it is necessary for the performance of a contract we have with the user or it is necessary prior to entering into such a contract. If the user do not wish to provide a nickname or email for example, we cannot create the user's account and the user will be unable to avail of certain features. It should be noted, however, that not every app will process this data. 2.1.2. Changes to Personal Data It is important that the personal data we have in relation to the user is current and accurate. If the user's personal data changes during our relationship please inform us promptly. If, for whatever reason, the user's personal data is inaccurate or incomplete the user have the right for this to be corrected or completed. 3. Automatic Collection, Retention and Sharing Simmply Active is committed to the principle of storage limitation and will retain the user's personal data for no longer than is necessary to fulfil our processing purposes and compliance with GDPR. All data retention begins at account creation and continues as the user use the app. Simmply Active will also anonymise some personal data so it will no longer be associated with the user. In this event we are entitled to retain and use the information freely. In conjunction with our partners we automatically collect and log certain information stored on the user's terminal device device data including device type, operating system specification, network settings, unique device identifier and IP address. usage data is collected and logged to discover how the Apps are used and which features are popular, it includes data relating to the time the user are active, purchases and the features. This helps to inform and improve our direction and development. We rely on our legitimate interest of measuring and analysing app usage to further inform development and improve the overall user experience. Our Analytics providers may by default use IP addresses to determine the user's general non-specific location. Among other things, this allows geographic sorting and protects us and our apps against misuse and nefarious activity. 3.1. Retention Following account deletion, revocation of consent or a written deletion request, the user's personal data will be retained for no longer than 30 days, except instances where legal obligations require longer retention periods. 3.2. Sharing Simmply Active does not sell the user's personal data. We share the user's information only in the following limited circumstances with the categories of third parties listed below, and only to the extent necessary to provide, secure, and improve our services. Simmply Active engages trusted third-party companies to perform essential business functions on our behalf. These processors are contractually bound to handle the user's data only according to our strict instructions and for the purposes specified in Purpose of Collection and Usage. 3.2.1. Cloud Storage Providers To enable Simmply Active to securely store and back-up the user's data. To be able to provide these services, the providers receive the user's Account Information. 3.2.2. Newsletter and Mailing Providers To enable Simmply to generate and send newsletters to the user if the user have subscribed. To be able to provide this service, the providers receive the user's Account Information. 3.2.3. Sponsors and Challenge Partners When the user explicitly opt-in to a sponsored challenge or promotion, we must share certain data with the sponsoring partner to verify the user's participation, track collective progress for the challenge, and fulfill any rewards. 3.2.4. Payment Providers Payment providers executing card payments for purchases made on the Simmply Active’s services and website receive the user's payment details and Account Information. 3.2.5. Cookie Consent Management Platforms cookie consent management platforms assist Simmply Active in managing and implementing the user's preferences when the user visit our websites. The platforms receive automatically collected device information to provide this service. 3.2.6. Law Enforcement Law enforcement authorities, government authorities, government bodies and the courts where they request data and disclosure is lawful.
  • To comply with a valid legal obligation (e.g., a subpoena, court order, or request from a law enforcement or government authority).
  • To protect and defend the rights, property, or safety of Simmply Active, our users, or the public.
  • To investigate fraud, security breaches, or other potential violations of our Terms and Conditions.
4. Purpose of Collection and Usage 4.1. Payment Data Simmply Active use a certified third-party payment processor to handle all financial transactions. We do not store or process the user's full credit card numbers on our servers. The payment processor provides us with a token and limited information (the last four digits of the user's card, card type, and expiration date) for customer support and transaction history purposes. 4.2. Subscription Management Payment data is retained as necessary to manage the active subscription and for legal and financial reporting obligations, see Retention. 4.3. Legitimate Interest Simmply Active relies on Legitimate Interests for processing device data to ensure the security and integrity of our service, prevent fraudulent use of the rewards program, and improve our app's functionality. 5. Security We have implemented appropriate technical and organisational security measures to protect the user's personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to. These measures include encryption and pseudonymisation. Access to the user's personal data is granted strictly on a need to know basis and we have carefully selected our service providers with security considerations in mind. 6. User Rights If the user are located in the United Kingdom, the user have specific statutory rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. These rights are outlined below. Please note that these rights are not absolute and may be subject to certain exemptions as stipulated by UK law. 6.1.1. Right of Access (Subject Access Request) the user have the right to obtain:
  • Confirmation as to whether or not we are processing the user's personal data.
  • A copy of that personal data.
Supplementary information, including: the purposes of processing, the categories of personal data concerned, the recipients or categories of recipient we disclose the data to, our retention periods, information about the user's other rights, and the source of the data if not collected directly from the user. 6.1.2. Right to Rectification the user have the right to have inaccurate personal data concerning the user corrected without undue delay. the user may update certain information directly within the user's app account settings. Where the inaccuracy relates to data we have shared with third parties, we will take reasonable steps to inform those parties of the correction. 6.1.3. Right to Erasure the user have the right to request the erasure of the user's personal data where one of the following grounds applies:
  • The data is no longer necessary for the purposes for which it was collected.
  • the user withdraw the user's consent (where processing was based on consent) and there is no other legal ground for processing.
  • the user object to the processing (under Article 21(1) UK GDPR) and there are no overriding legitimate grounds for the processing.
  • The personal data has been unlawfully processed.
  • The data must be erased to comply with a UK legal obligation.
This right is not absolute. We may refuse erasure where processing remains necessary for:
  • Compliance with a UK legal obligation (e.g., retaining financial records for HMRC).
  • The establishment, exercise, or defence of legal claims.
6.1.4. Right to Restriction of Processing the user have the right to restrict our processing of the user's personal data in the following circumstances:
  • the user contest the accuracy of the data, for a period enabling us to verify its accuracy.
  • The processing is unlawful, and the user oppose erasure, requesting restriction instead.
  • We no longer need the personal data for our original purposes, but the user require it for the establishment, exercise, or defence of legal claims.
  • the user have objected to processing pursuant to Article 21(1) UK GDPR, pending the verification of whether our legitimate grounds override the user's.
6.1.5. Right to Data Portability the user have the right to receive the personal data the user have provided to us in a structured, commonly used, and machine-readable format, and have the right to transmit that data to another controller without hindrance, where:
  • The processing is based on the user's consent or on a contract; and
  • The processing is carried out by automated means.
This right applies to personal data the user have actively and knowingly provided (e.g., account details, run logs the user input). 6.1.6. Right to Object the user have the right to object, on grounds relating to the user's particular situation, to the processing of the user’s personal data which is based on our legitimate interests (Article 6(1)(f) UK GDPR). We will cease processing unless we demonstrate compelling legitimate grounds for the processing which override the user’s interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims. the user have an absolute right to object to the processing of the user's personal data for direct marketing purposes at any time. Upon objection, we will cease such processing immediately. 6.1.7. Rights in Relation to Automated Decision-Making and Profiling The user has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the user or similarly significantly affects the user. We currently do not engage in any such automated decision-making or profiling that produces legal or similarly significant effects. 6.1.8. Right to Withdraw Consent Where our processing of the user's personal data is based on the user's consent, the user have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. 7. Policy Changes and Contact Details Changes: Reserve the right to update the policy. Promise to notify users of material changes via email or prominent in-app notice prior to changes taking effect. Trading Name: Simmply Active Mailing Address: 47, Crouch Street, Colchester, CO3 3EN, England Email: d.simmons@simmplyactive.com Website: www.simmplyactive.com/contact