In accordance with Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC) - "GDPR" - we (Move Republic GmbH - "Move Republic“) inform you what personal data we process when you use our service of active lifestyle promotion - "Service" - and for what purposes  we use it and how we protect your data. We also inform you about your rights in this regard. The terms used are based on the wording of the GDPR. 

We provide the Service through our Move Republic IT platform ("Platform"), of which the Move Republic mobile application ("Application") is an integral part. Both the Platform and the Application are constantly changing, undergoing technical modifications and additions. For this reason, we update the information contained in this Privacy Policy from time to time.

You are not obliged to enter into a contract with us or provide your personal data. However, in order to be able to provide you with our Service in full, we need to process your personal data. 

1. Your rights

You have the right to obtain information about your personal data that we process free of charge. In addition, you have the following rights:

• right of access - the right to information about what data has been collected and how it is processed;
• right to rectification - the right to request that your personal data be changed if it is not up to date or correct;
• the right to request the deletion of personal data;
• the right to restrict the processing of personal data;
• the right to data portability - i.e. to receive personal data in a machine-readable format and/or to transfer it to another controller;
• the right to withdraw consent to the processing of personal data at any time with effect for the future (if the processing is based on consent); withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal;
• the right to object to the processing of personal data if the basis for processing is our legitimate interest (Article 6(1)(f) of the GDPR);
• the right to lodge a complaint against us with the competent supervisory authority. To do so, you can contact the supervisory authority responsible for us or the supervisory authority in your place of residence or work.

If you wish to exercise your rights as a data subject, the contact details can be found in section 8.1.

2. When, why and how we collect your data and what we do with it

In order to provide you with our Service, we record, process, store  in some cases share various personal data with third parties. Below you will find out which of your data we process for what purposes and under what circumstances we share it.

Personal data is information that can be used to directly or indirectly identify a specific person, such as your name, address, phone number, date of birth, or email address.

2.1 Data that we always process when you use the Service (even without registration)

Each time you use the Service, even without registering, we process the following data:

Type of data	Explanation	Data source
Device information	Data about the device connecting to our Service	Users themselves
Operating system and corresponding version or other device identifiers	Time, date  duration of access to our website, source of access, IP address a other communication protocol data (computer or mobile device type, software or browser type, operating system, application version an language settings)

We provide detailed information about the use of cookies in section 3. 

2.2 Personal data that we process in connection with user registration

In order to fully use our Service, you must register. As part of the registration process, we ask for personal data. After successful registration, you will receive a user account ("Move Republic Account" or "Move Republic User").

We process the following data:

Type of data	Explanation	Data source
Access data	Email address, password	Users themselves, Move Republic
User information	First name, last name, country of residence, date of birth, statement of acceptance of the Move Republic Terms and Conditions and Move Republic Privacy Policy, status of other consents, status of verification email

We process the data obtained during registration in order to identify you as a party to the contract with us, i.e. to conclude the contract, justify the contract between us, ensure its performance and in certain cases also to provide you with relevant information from your user account. In addition, we verify your email address to prevent abuse. 

2.3 Personal data we process when you use the Service 

We process your data in order to be able to fully offer you the services resulting from the contract between us. The Service helps you, as a registered user, to record and analyze physical activity data, manage your activity level, activity goals and your participation in various groups and events based on physical activity. 

User groups 

You can create and join Move Republic user groups (so-called "communities" or "teams"). If you decide to join one or more communities or teams, this information will be stored in your Move Republic Account as your explicit consent to the processing of data in this regard. In addition, we store the date and time of joining the relevant community or team. 

We record both invitations to communities and teams sent by you to other users and invitations sent to you by other users, along with their acceptance or rejection statuses. Depending on your settings, other members of the communities and teams you belong to may see your first name, last name, nickname, or initial, as well as your results. 

Events

You can also participate—individually or as a team—in events based on physical activity (like "competitions" or  "challenges").  Move Republic maintains and publishes so-called leaderboards with participant rankings and their results in the Service. By participating in events, you give us your consent to disclose your results to other participants in the leaderboards, as well as data on the results of the community and teams to which you belong, including their ranking positions.

Activity Points

We convert the activities recorded on your Move Republic Account into activity points (so-called "Activity Points"). Based on your results, i.e., data such as distance covered, training time, calories burned, number of steps, or Activity Points, we determine the degree to which you have achieved your activity goals, your position on the leaderboards  your overall activity level. You may also receive special awards, such as symbolic badges.

Reward points

By achieving specific activity goals and actively using the Move Republic app, you have the opportunity to earn reward points (such as "STARS" or "MOVES"). Some reward points can be exchanged for rewards. All this information is stored in your Move Republic Account.

Notifications

As part of our agreement, we may send you push notifications or emails to inform, remind, motivate and encourage you to achieve your goals and perform better in the events you participate in. You can opt out of receiving these messages at any time by adjusting the settings on your mobile device, your Move Republic User profile and in the settings of each community you are a member of.

In connection with the above, in addition to the data listed in section 2.2, we process the following data:

Type of data	Explanation	Data source
Contract data	Information about the selected package, contract commencement, usage fee, delivery address, residential address, payment date, outstanding payments, contract termination, status (active/suspended/terminated)	Users themselves, Move Republic
Information about the use of the Service	Time of use, date and time, application features used, interaction(s) with Move Republic and/or other users of the service, information about membership in communities and teams, consents and their status, other voluntary information	Users themselves, Move Republic
Physical activity data / Results	Type of physical activity, start/end time, duration of activity, number of steps, distance, speed, pace, calories burned, geolocation data, route, data about sports facilities and private stationary training locations, other activity-related data, data obtained from various health and fitness applications (if their transfer has been approved by the user), Activity Points, badges	Users themselves, Move Republic, other sources approved by the user
Reward points and rewards	Reward points, source, date of points determination, expiration date, expiration information, reward points used (type of reward, number of points used and time of use)	Move Republic, users themselves
Transmitted content	Content shared by Move Republic, such as training plans, information about events, activity goals, push notifications and emails informing and motivating the user, etc.  Content provided by the user, such as comments and questions about the Service and content provided to other users, such as invitations to communities and teams, message/feed content, content provided by making your own results and profile data public, likes and reactions to your own and other users' public content, etc. Content provided by other users, such as invitations to communities and teams, chat/feed content, public results and profile data of other users and likes and reactions to such content, etc.	Users themselves, other users, Move Republic

Partner Programs

You can join the Partner Entity's active lifestyle promotion program ("Partner Program") after entering the program ID ("Program ID") provided to you by the Partner Entity or by us on its behalf in the Move Republic application. 

If an entity (e.g. your employer) is not a Partner Entity and you want to inspire it to become one, you can submit a request to us to create a temporary program for that entity. For this purpose, we also process the personal data listed below.

If you use the Partner Program, we have agreed in a special agreement with the Partner Entity that has included you in its program to send you messages about inactivity, i.e., when you have not participated in the program for a certain period of time (usually one month). In addition, we provide anonymous reports to Partner Entities on the activity of participants in their programs to enable them to evaluate the effectiveness of these programs.

In some cases, depending on the rules of a specific Partner Program, the Partner Entity may receive from us named lists regarding program participants – in particular for the purpose of verifying eligibility to participate (e.g. confirming that the participant is an employee or an authorized person) and settling the program, including settlements related to rewards. If named lists are provided as part of a given Partner Program, the data contained therein will be provided only to the extent necessary to achieve the purpose of the program and as indicated to the user in the program rules.

In addition to the above-mentioned data, we process the following data for the purpose of implementing Partner Programs:

Type of data	Explanation	Data source
User information	First name, last name, email address (company), date of birth, phone number, user ID in the Partner Entity's system	Users themselves
Program / Partner Program data	Program ID, participation information (eligible/ineligible), sponsorship status information (supported/not supported), program level, inactivity messages	Partner Entity, Move Republic

Automated data processing (including profiling)

As part of the Service, we use automated data processing to calculate and present your results and activity level, in particular by converting recorded activities into activity points, determining the degree of achievement of activity goals, awarding badges, as well as determining and publishing positions in leaderboards in communities, teams and events in which you participate. The logic of this processing is based on data about your activity and on the rules of a given event or Partner Program and your settings. 

2.4 Personal data we process when you ask us to import physical activity information from other sources

As part of the Service, you can instruct us to automatically import your physical activity data from various health and fitness apps, for example, to include this data in active lifestyle promotion programs you participate in and to determine your activity level. You must consent to each such connection in order for us to import the data.

Apple HealthKit

We use Apple Inc.'s (1 Infinite Loop, Cupertino, CA 95014, USA) HealthKit software package, which manages a repository of health and physical activity data on the iPhone and Apple Watch and, with your express consent, allows applications to communicate with the HealthKit Store to access and import data. We process the following data obtained with your express consent:

Google Fit

We use the Fit SDK from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). This is an open platform that allows users to control their activity data. We process the following data that we receive via the Google Fit SDK with your express consent to import the data:

Health Connect

We use Health Connect from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). This is a central platform where users can store, combine and share their data from various smartwatches and health apps. We process the following data that we receive via Health Connect with your express consent to perform the data import:

Strava

We use Strava from Strava Inc. (208 Utah Street, San Francisco, CA 94103, USA). Strava is a social network with the ability to store sports activities. We process the following data that we receive via Strava with your express consent to perform the data import:

Garmin

We use the Garmin service provided by Garmin Deutschland GmbH (Parkring 35, 85748 Garching, Germany). It is a repository of data about the activity, fitness and health of users of Garmin devices and software. We process the following data that we receive via Garmin with your express consent for the purpose of data import:

Fitbit

We use the Fitbit service provided by Fitbit International Limited (76 Lower Baggot Street, Dublin 2, Ireland) to collect data on the activity, fitness  health of users of Fitbit devices and software. We process the following data received from Fitbit with your express consent for the purpose of data import:

Polar

We use the Polar service provided by Polar Electro Oy (Professorintie 5, 90440 Kempele, Finland) to collect activity, fitness and health data from users of Polar devices and software. We process the following data received from Polar with your express consent to perform data import:

Withings

We use the Withings service provided by Withings France SA (2 rue Maurice Hartmann 92130 Issy-les-Moulineaux, France) to collect data about the activity, fitness  health of users of Withings devices and software. We process the following data received from Withings with your express consent to import data:

Type of data	Explanation	Data source
Activity data	Type of activity, start/end time or duration of activity, number of steps taken, distance, speed, calories burned, data source, route, geolocation data and other activity-related data, if selected by the user in health and fitness apps	Health and fitness apps

You can refuse access to this data at any time by changing the settings on your mobile device.

2.5 Personal data we process when you personalize your user accounts 

As part of personalizing your Move Republic Account, we process all personal data that you provide to us. You can manage your data, including changing your primary email address and password for your user account. 

When you order paid services through the Move Republic app, you make one or more purchases in the app (so-called "in-app transactions"). You then authorize the "Apple App Store" or "Google Play Store" to use your personal data and information about you to process the payment. Move Republic is not responsible for this part of the data processing. For more detailed information on data processing by a given store, please refer to the privacy policies of those stores.

We process the following personal data:

Type of data	Explanation	Source of data
User data	First name, last name, nickname, primary email address, other email addresses, date of birth, gender, country of residence, phone number, password, photo, personal description, hyperlinks/identifiers on social media, addresses (residential, delivery), participation in Partner Programs, badges, linked fitness apps, privacy settings, publicly shared results, likes and reactions to them, profile data visibility status	Users themselves
Payment details (if the service is paid)	Confirmation of successful purchase processing - in-app transaction - with the selected payment service provider / app store	Users themselves; app store

 

2.6 Personal data we process when we communicate with you

Part of the Service involves contacting you. We do this in particular as part of the performance of our mutual agreement, to inform you about the services you have booked, other benefits, or to answer your questions. In addition, we may communicate with you for marketing purposes, market research and to improve our services, etc. We process the following personal data:

Type of data	Explanation	Data source
Contact	Email address, phone number, address (residential, delivery)	Users themselves
Message content	depending on the user's interests and needs	Users themselves

 

2.7 Data processing for legal purposes

In justified cases, we may use your personal data to resolve legal disputes or as part of investigations into compliance with compliance rules. We may also use it to enforce the terms of the agreement between you and us or to comply with requests from law enforcement or data protection authorities. In the context of data processing, we take appropriate measures to protect your rights and freedoms. In addition, we process your data in connection with legal obligations, e.g. those arising from commercial or tax law, anti-money laundering legislation, as well as in connection with the need to comply with other regulatory requirements.

3. Information about our cookies

3.1 Definition of cookies and what we use

We use cookies to improve the presentation and accessibility of our online platform. A cookie is a text file that is sent to your browser by a web server. This file contains the URL of the page you are visiting, the time you entered the page and the expiration date of the cookie. On the one hand, we use cookies to analyze how users use specific areas of the Platform and on the other hand, we allow them to save their personal settings in a cookie so that they can be applied the next time they visit the Platform. We compile aggregate statistics on behavior in order to analyze user preferences in using the Platform's content.

3.2 Third-party cookies we use

We use third-party content and services on the Platform to better analyze and improve the quality of our services. Therefore, we integrate their content or services through their cookies. Information about cookie providers can be found at: https://app.moverepublic.com/pl/pl/cookies.

3.3 What are your options

When you first visit our Platform, a banner informing you about the use of cookies appears. You can decide whether and to what extent you agree to the use of cookies. The Details section will tell you what cookies we use and you will have the option to reject the use of some of them. This does not apply to essential cookies, i.e., those that ensure the proper functioning of our Platform. The use of cookies is in accordance with your choice. If you do not accept cookies, you may not be able to use our Platform to its full extent.

You can also set your browser to notify you when you receive a cookie, or you can exercise your right to object by rejecting cookies in your browser settings.

4. Who we share your data with

We never share your data with unauthorized entities. Below, we summarize to whom and under what conditions we share your data or from whom we receive it. In addition, we explain the situation with regard to the countries to which we transfer data.

4.1 Data exchange with Partner Entities in case of participation in Partner Programs, as well as publication of your results when participating in events in the form of results/leaderboards

As explained in section 2.3, data is exchanged with Partner Entities in order to enable you to participate in Partner Programs organized for Partner Entities. Therefore, in accordance with the agreement between you and us, the legal basis for the above-mentioned data processing is Article 6 (1) (b) of the GDPR. In addition, we disclose your data on results achieved in communities, teams and events (including your position in the leaderboards) to other users, with your consent to the publication of data in the leaderboards. Here, our legal basis for the above data processing is Article 6(1)(a) of the GDPR.

4.2 What other third parties (other than those listed in section 4.1) have access to personal data

As part of our business, we use selected service providers and grant them limited and strictly monitored access to some of our data. The service providers we have carefully selected operate exclusively on behalf of Move Republic and are obliged to comply with the applicable data protection requirements. Below, we inform you about our data recipients and the reasons for transferring data to them:

Data recipient	Explanation
Authorized Service Providers	Third parties support our business activities by, for example, providing IT solutions and infrastructure, providing payment services, evaluating and optimizing marketing campaigns and ensuring the security of our business activities by, for example, identifying and removing faults. To the extent that these entities process personal data on our behalf, they act as processors on the basis of a data processing agreement and exclusively on our instructions. The legal basis for sharing personal data with these service providers is, depending on the purpose, Article 6(1)(b) of the GDPR (performance of a contract) and/or Article 6(1)(f) of the GDPR (our legitimate interest in ensuring a technically flawless and secure Service).  Service providers: https://www.moverepublic.com/pl/pl/dopuszczeni-uslugodawcy
Members of the Move Republic group	Within the group of companies, we use resources efficiently. In particular, group members provide us with mutual technical support in order to provide the Service as error-free as possible, for analytical purposes and to improve services, as well as for the detection, prevention and investigation of fraud and data breaches. To the extent that group members process personal data on our behalf, they act as processors on the basis of a data processing agreement. The legal basis for the disclosure of personal data is Article 6(1)(f) of the GDPR (our legitimate interest in ensuring the smooth and secure operation of the Service) and, where necessary, Article 6(1)(b) of the GDPR (performance of a contract). Group members: Move Republic Sp. z o.o. (Krakow, Poland)
Law enforcement authorities /  Law enforcement	We disclose personal data when we are required to do so or when we act in our own interest to prevent damage, pursue claims, or reject unjustified claims. The legal basis for the transfer of personal data is Article 6(1)(f) of the GDPR.

 

4.3 To which countries do we transfer your data

We process your data primarily within the European Union (EU) and the European Economic Area (EEA). However, some of the service providers we list are located outside the EU and the EEA ("third countries"). The GDPR sets high requirements for the transfer of personal data to so-called third countries. For some third countries, the European Commission has decided that they offer an adequate level of data protection (e.g. Switzerland, Canada). To the extent that we transfer data to a third country for which no such adequacy decision exists, the transfer takes place, unless otherwise specified in this Privacy Policy on the basis of an agreement between us and the relevant recipient using the European Union's standard data protection clauses and, where applicable, further supplementary measures agreed with the recipient to ensure an adequate level of data protection.

4.4 Special treatment of activity and health data

Data concerning the activity and health of Move Republic Users, as defined in sections 2.3 and 2.4, are not generally disclosed to third parties, except in cases where the provision of the Service by hosting service providers requires such disclosure, or where disclosure is required by law enforcement agencies and legal processes. The data is not transferred to advertising platforms, data brokers, or information intermediaries. 

An exception may be the disclosure of certain data to a Partner Entity under the Partner Program, to the extent necessary to verify eligibility, settle the program and settle rewards, in accordance with the rules of the program known to the user.

5. Legal basis on which we process your data

Data processing process	Legal basis
Provision of the Service (point 2.1)	The processing of data collected when accessing our Service falls within the scope of pre-contractual activities within the meaning of Article 6(1)(b) of the GDPR. Furthermore, it serves to protect our legitimate interests (Article 6(1)(f) of the GDPR). Move Republic's legitimate interest is a business interest in ensuring a technically flawless and optimized Service.
Registration (Section 2.2)	The processing of data serves to fulfill a contract concluded with the user or to carry out pre-contractual measures within the meaning of Art. 6 (1) (b) GDPR. Furthermore, it serves to protect our legitimate interests (Art. 6 (1) (f) GDPR).
Active lifestyle promotion programs, Partner Programs, determining activity levels,  data on physical activity, activity points, reward points, badges, rewards  transmitted content, (point 2.3)	Data processing serves to perform a contract with the user and for pre-contractual measures (Article 6(1)(b) of the GDPR) – in particular to enable the recording and analysis of activity, the calculation of Activity Points, the presentation of progress and the handling of participation in programs and events. This also includes providing the Partner Entity with statements regarding participation and entitlements, activity status, inactivity notices and reward information—to the extent necessary for the settlement of the Partner Program. To the extent that activity data may constitute special category data (relating to health), we process it only on the basis of the user's explicit consent (Article 9(2)(a) of the GDPR). Explicit consent may be withdrawn at any time with effect for the future; withdrawal may limit the availability of functions dependent on this data. In addition, depending on the situation, processing may be based on Article 6(1)(f) GDPR (legitimate interest, e.g. ensuring security and pursuing claims) and Article 6(1)(c) GDPR (legal obligations, e.g. arising from commercial law, tax law, or supervisory requirements).
Import of activity data, information from other sources (section 2.4)	Data processing as part of the integration and import of data from external sources (e.g. Apple Health, Health Connect) is based on the user's consent (Article 6(1)(a) of the GDPR) and, if the imported data may constitute special categories of data relating to health, on the user's explicit consent (Article 9(2)(a) of the GDPR). The user may withdraw their consent at any time with effect for the future; the withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. After withdrawal of consent, the Controller will suspend further import and processing of data for this purpose, unless further processing is permissible on another legal basis (e.g. legal obligation or establishment, exercise, or defense of legal claims).
Personalization of the user account (point 2.5)	The processing of data serves to fulfill the contract concluded with the user (Article 6(1)(b) of the GDPR). Furthermore, it serves to protect our legitimate interests (Article 6(1)(f) GDPR). In addition, it serves to fulfill a legal obligation (Article 6(1)(c) GDPR), e.g. identification requirements, regulatory requirements.
Communication (section 2.6)	If we communicate with you in connection with a contract, the processing of data serves to fulfill the contract (Article 6(1)(b) GDPR). If the subject of the communication is marketing campaigns, market research, or the general improvement of the quality of our services, we act solely on the basis of the consent given to us within the meaning of Article 6(1)(a) GDPR. You have the right to revoke your consent at any time with future effect. The revocation must be effectively communicated.
Legal purposes (section 2.7)	Data processing serves to fulfill legal obligations (Article 6(1)(c) of the GDPR) – e.g. those arising from commercial law, tax law, or supervisory requirements. In addition, data processing is carried out to protect the legitimate interests of Move Republic or third parties within the meaning of Article 6(1)(f) of the GDPR. Our legitimate interest is to enforce legal claims or defend against unjustified claims. When we use personal data for legitimate purposes, we always weigh the interests of the user and their right to data protection against our rights and interests, as well as those of third parties.

 

6. How we protect your data and when we delete it

6.1 Data protection mechanisms

We use technical and organizational measures in line with industry standards, using various security technologies and procedures to protect your data from unauthorized access, use, loss, destruction, or disclosure.

• As part of our security measures, we use SSL/TLS technology to secure data transmission between our systems. This means that all data transmitted between us and you, including sensitive data, is encrypted during transmission to prevent unauthorized access.
• Your data is secured at the storage level using the Advanced Encryption Standard (AES)-256 encryption algorithm, which is the industry standard for data encryption. This ensures the confidentiality of your data processing.
• To further protect your data, such as health and fitness data, we use additional data protection methods such as pseudonymization and aggregation.

6.2 Deletion of your data

We only store personal data for as long as necessary. Access data is deleted when it is no longer needed for the purposes described in this Privacy Policy, unless longer storage is required by law. 

We delete your personal data at your request. If your Move Republic Account has been inactive for three years, we will also delete it.

In addition to the above-mentioned data deletion rules, there are statutory retention periods that we must also comply with. For example, tax records must be kept for a period of six to ten years  in some cases even longer. Specific retention periods vary depending on local legal requirements. Therefore, despite your request to delete your data, we may still need to retain certain data for legal reasons. In this case, however, we will restrict further processing of the data.

7. How we use mobile devices

We develop and offer apps. These apps collect and process your personal data in much the same way as a website. With your consent, we send you push notifications with information about the services you use. You can find out how to change your settings and how to activate or block push notifications in the user manual for your mobile device.

8. Responsible entities

The data controller is the entity responsible for processing your personal data and determining the purposes and means of processing. 

8.1 Responsible entity (Controller)

Move Republic GmbH 

Address: Poststr. 14-16

20354 Hamburg, Germany

Management: Daniel Hanelt, Till Kubelke

Email: cr@moverepublic.com 

8.2 Data Protection Officer

DS EXTERN GmbH

Dipl.-Kfm. Marc Althaus

Address: Frapanweg 22

22589 Hamburg

Email: anfragen@dsextern.de   ‍

8.3 Supervisory authority

Commissioner for Data Protection and Freedom of Information in Hamburg 

The Hamburg Commissioner for Data Protection and Freedom of Information 

Address Ludwig-Erhard-Straße 22

20459 Hamburg

Germany

Phone: +49 40 428 54 4040

Email: mailbox@datenschutz.hamburg.de

9. Objection

If, in accordance with applicable data protection law, you wish to object to our collection, processing, or storage of your personal data, please send your objection by email to the address provided in section 8.1. Due to your objection, further use of our services may be impossible or significantly limited.

10. Reservation of the right to modify

The current version of the Privacy Policy is available at www.moverepublic.com. As changes in the law or our internal processes may require changes to the Privacy Policy, we reserve the right to do so. We encourage you to regularly review the current version of the Privacy Policy.