Privacy Policy
Updated on: 08.12.222 Version: 4
This Privacy Policy has been created to help you understand the personal data which we may collect, how we intend to securely process and store that data, and the rights you have in relation to your personal data.
This privacy notice provides you with details of how we collect and process your personal data through your use of our sites https://herspirit.co.uk https://community.herspirit.co.uk and https://lakestolondon.co.uk
By providing us with your data, you warrant to us that you are over 13 years of age.
Summary Privacy Policy
● Data Controller: Her Spirit
● We will only collect personal information that you have voluntarily decided to provide to us or we have recorded from your usage of the Service
● Depending on how you choose to interact with us we may collect your name, email, phone number, IP address, activity data or any other contact details or content which you have provided to us
● We will use this personal information
○ to provide you with the full features of the App;
○ to analyse, improve and promote the App and its content
● We will always ask you before processing your personal data in any other ways
● We will use an anonymised version of your personal data, from which you cannot be identified, to prepare statistics so we can learn and improve our service. For example, how many users login each day, how many messages are sent, how many comments are made, activity levels etc
● We will only share your personal information with our declared data processors
● We may transfer your data to authorised data processors outside of the EEA, but will make sure that there are appropriate safeguards in place. By voluntarily submitting your personal data you consent to these transfers
● We will never sell, rent or give away your personal data to other third parties
● We will only keep your information for as long as needed to answer your query or as required by applicable legislation or regulations
● We will use appropriate technical and organisational measures to ensure the safety, security and accuracy of your personal data
● You have important rights in relation to the use of your personal data, listed in Section 9
● We do not knowingly request or store sensitive or children’s information
● You should contact the Data Controller if you have any questions about this Privacy Policy or the collection, processing and storage of your personal data. See Section 16
Full Privacy Policy
1. Introduction
This Privacy Policy will help you to understand what information We collect and process using the official Her Spirit Application (and related Website used to support account management and sharing of posts on social media and other platforms), hereinafter referred to as “the Service“, and the choices and rights you have in connection with your personal information.
In this Privacy Policy when we refer to ‘Her Spirit‘, ‘We‘, ‘Us‘ or ‘Our‘ we are referring to Her Spirit of Antenna, 9a Beck Street, Nottingham, England, N1 1EQ, telephone 07771346748, email holly@herspirit.co.uk, the “Data Controller” for this Service.
The Data Controller is responsible for determining the processing purposes of your personal data, and the content and related services or features which are made available to you from using this Service.
2. Data Protection Framework
Her Spirit is a trading name of Her Spirit is based within the United Kingdom and is registered with the Information Commissioner’s Office (ICO) as a Data Controller under the UK Data Protection Act of 1998 (registration number ZA479490).
3. What is the Purpose of this Service?
The purpose of this Service is a Fitness and Wellness Community.
4. Where do we collect personal data about you from?
We may collect personal data about you from the following sources:
● Directly from you. This is information you have voluntarily provided whilst entering your personal details or connecting your activity tracker or application on the Service.
We do not collect personal data about you from:
● From an agent/third party acting on your behalf.
● Through publicly available sources such as Facebook, Twitter or LinkedIn.
5. What Information Do We Collect and Why?
We will only ever collect the information We need to enable us to undertake the specific information processing activities noted later in this section.
We collect and process two distinct kinds of information:
● non-personal information such as the pages you have accessed, helping Us to determine how many people use Our Service, how many people visit on a regular basis, and how popular each of Our pages are. This information doesn’t tell Us anything about who you are or where you live. It simply allows Us to monitor and improve Our service.
● personal information such as your IP address, email address, username, password, approximate location and any optional information you may choose to provide to Us as part of your experience within the Service (e.g. text, photograph, meme). If you choose to connect your activity tracker or application we will collect the follwoing data;
- Basic Personal Data: “First Name’’, “Last Name’’, “Nickname’’, “Gender’’ and “Date of Birth’’
- Lifestyle information: “Steps’’ “Weight’’, “Length’’, “BMI’’, “Distance (km)’’, “Active minutes’’, “Heartbeat’’, “REM sleep (min)’’, “Light sleep (min)’’, “Deep sleep (min) ’’, “Activities’’, “Burnt calories’’ and “Summaries’’
- Gamification information (for example, number of active challenges and teams)
When you first open the App, you will be invited to register.
Should you decide to register we ask for the following information:
● Email address – we use this to send you a welcome email, and any service related communications such as live classes, programmes, challenges, events and resetting your password or verifying your email address. We will not send you any marketing or third-party messages unless you have explicitly provided your consent for Us to do so.
● Your Name and Surname – we ask for this to send you a welcome email, and any other service related communicaitons.
● Your City/Town – we ask for this to allow members to find and connect with each other locally ● Your name/username – we ask for a username so that if you make any posts or comments that these are attributable to you. Other users will also be able to search for you by name, and it will be shown on your public profile page. You do not need to use your real name, though we generally encourage it.
● A photo – this is optional, but if you add one this will be shown next to any posts and comments you make, as well as on your public profile page.
● A password – we store this in a secure one-way encrypted system. If you forget your password, you may request that it be reset, and we will send an email to you with instructions on how to do so.
Once registration is complete, we process the following information: Posts and comments in the App that you choose to make available. Please bear in mind that any posts and comments you make are in the public domain and may be viewed by non-registered users in the App, on public web pages, and by other users of the App via periodic emails showing recent App activity.
You may also send friend requests to other users and, should they accept, you will have the ability to send one-to-one and group messages to them. These messages are completely private between you and any other recipients and are not monitored.
As you use the App We will keep track of what sections you have visited, so that We can highlight sections or content to you that you may have missed. We also use this data in an aggregated form to understand how popular the App and its different sections are so that We can improve the service. This data is never shared with anyone and is only used for Our internal purposes.
We record the last IP address you accessed the service from so that We can protect the service from malicious access. As part of this We may look up the approximate location of the IP address such as country and city.
Your decision to disclose your personal information to Us is entirely voluntary. If you do not provide the personal data necessary, or withdraw your consent for the processing of your personal data, you may not be able to access or use the App.
We will only retain your personal information for as long as you are a registered user of the Channel. We comply with all legislative and regulatory information retention requirements and will securely and permanently delete your personal information when there is (a) no justification for its further retention, or (b) you have asked Us to delete it.
We will not use your personal information for any other purposes. We will not share your personal information with any other organisation, other than the declared Data Processors recorded in Section 11.
6. What legal basis do we have for using your personal data?
The legal basis we have for processing your data is based around the consent you have voluntarily provided us.
7. Sensitive Personal Data
GDPR Article 9 specifies a set of special categories which are considered to be “sensitive personal data” (e.g. racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership) and which require special consideration by Data Controllers.
This Service does not knowingly collect or process any sensitive personal information unless you have chosen to voluntarily disclose and share such information during your use of the Service (e.g. post in the App or connecting your activity tracker).
8. Children’s Personal Data
This Service, and any services available from it, are not directed to users under the age of 18 (save where any users between 13 – 18 years old have obtained prior parental or guardian consent).
If you learn that a user under the age of 18 has provided Us with their personal information without having parental or guardian consent, please contact Us (see Section 16) immediately so we can take appropriate action.
9. User Data Rights
As prescribed within the EU General Data Protection Regulation, you have several rights connected to the provision of your personal information to Us from using the Service.
1. The right to be informed
You have the right to be provided with clear, transparent and easily understandable information about how We use your information and your rights. This is why We’re providing you with the information in this Privacy Policy.
2. The right of access
You have the right to obtain access to your personal information (if We’re processing it), and certain other information such as the reasons why we are processing or storing it. This is so you’re aware and can check that We’re using your personal information in accordance with data protection legislation and your agreement.
3. The right to rectification
You are entitled to request that your personal information is promptly corrected if it’s identified as being inaccurate or incomplete.
4. The right to erasure
This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your information under certain circumstances where there’s no compelling reason for Us to keep using it. This is not a general right to erasure; there are exceptions.
5. The right to restrict processing
You have rights to ‘block’ or suppress further use of your personal information. When processing is restricted We can still store your information but may not be able to process it further. We maintain lists of people who have asked for further use of their personal information to be ‘blocked’ to make sure the restriction is respected in future.
6. The right to data portability
You have rights to obtain and reuse your personal data for your own purposes across different services. For example, if you decide to switch to a new provider, this enables you to move, copy or transfer your information easily between Our IT systems and theirs safely and securely, without affecting its usability.
7. The right to object to processing
You have the right to object to certain types of personal data processing, including processing for direct marketing activities.
8. The right to lodge a complaint
You have the right to lodge a complaint about the way We have handled or processed your personal data with your national data protection regulator (the Information Commissioner’s Office within the UK)
9. The right to withdraw consent
If you have given your consent to anything We do with your personal data, you have the right to vary or withdraw your consent at any time (although if you do so, it does not mean that anything We have done with your personal data with your consent up to that point is unlawful). This includes your right to withdraw your consent to Us using your personal data for marketing purposes.
We usually act on validated requests and provide the requested information or activity free of charge, but by law we are allowed to charge a reasonable fee to cover Our administrative costs of providing the information for:
● baseless or excessive/repeated requests, or
● further copies of the same information.
Alternatively, there are reasons why We may be entitled to refuse to act on the request.
Please consider your request responsibly before submitting it. We’ll respond as soon as We can. Generally, this will be within one month from when We receive your validated request but, if the request is going to take longer to deal with, We will let you know.
To contact Us please see Section 16 below. If We do not address your request or fail to provide you with a valid reason why We are unable to do so, you have the right to contact the Information Commissioner’s Office to make a complaint. They can be contacted via their website (www.ico.org.uk) or by telephone 0303 123 1113.
10. Personal Data Breach Reporting
You have the right to be promptly informed by Us of any personal data loss, theft or compromise arising directly or indirectly from the Service, and any supporting systems or declared Data Processors (see Section 11) involved with delivering, supporting, maintaining, monitoring or improving the Service. Similarly, We are required to notify the Information Commissioner’s Office promptly, as the supervisory authority for the United Kingdom.
As a user of the Service, you have a responsibility to safeguard and manage your Service login credentials securely. This requires you to ensure that they are changed frequently, of sufficient strength and complexity, different from any other passwords you may use, and not recorded in a format which could be accessed or guessed by others. If you suspect that your credentials have been compromised, you should notify Us immediately (see Section 16 below). We will not be liable for any personal information loss, theft or compromise where this can be attributed to your failure to secure your Service login credentials.
11. Declaration of Personal Data Sub-Processors
To make an informed decision on whether to provide your personal data to Us when using this Service, we need to make you aware of the organisations that act as Data Sub-Processors for Us, helping in the provision of the Service and its functionality.
These partners are as follows:
● Disciple Media: provider of the Service technology platform, based in the United Kingdom. Disciple is registered with the Information Commissioner’s Office within the UK under the Data Protection Act 1998, registration number ZA147341.
●Wefitter – Used to connect your activity tracker to the Her Spirit app and reqest personal data from your activity tracker account (i.e Garmin, Polar, Fitbit, Strava etc). Based in the Nertherlands. Wefitter complies with the [EU-US Privacy Shield Framework] ● MailChimp: Used to send Administration of Service emails such as Email Verification, Password reset and Welcome email; and other potential marketing messages where you have given your explicit consent for Us to do so. Based in the United States. MailChimp complies with the EU-US Privacy Shield Framework, as set forth by the US Department of Commerce, covering the collection, use and retention of personal data transferred from the European Union to the United States.
● Appsflyer: Provider of analysis of personal (e.g. IP addresses) and non-personal information specifically volumes of traffic to app stores. Appsflyer complies with the EU-US Privacy Shield Framework, as set forth by the US Department of Commerce, covering the collection, use and retention of personal data transferred from the European Union to the United States.
● Google Analytics: Used to provide analytics to understand how the Service is used and help provide actionable insights for improvements. Google, including Google Inc. and its wholly-owned US subsidiaries, comply with the EU-US Privacy Shield Framework, as set forth by the US Department of Commerce, covering the collection, use and retention of personal data transferred from the European Union to the United States.
● Google G Suite: Used as email system, so any emails you send to support will be handled by G Suite. Google, including Google Inc. and its wholly-owned US subsidiaries, comply with the EU-US Privacy Shield Framework, as set forth by the US Department of Commerce, covering the collection, use and retention of personal data transferred from the European Union to the United States.
● Crashlytics (Part of Google): Used to provide actionable insights and analytics on crash reporting. Part of Fabric, acquired by Google’s Developer Products Group. Crashlytics complies with the EU-US Privacy Shield Framework, as set forth by the US Department of Commerce, covering the collection, use and retention of personal data transferred from the European Union to the United States.
● Amazon Web Services: Hosting services. AWS complies with the EU-US Privacy Shield Framework, as set forth by the US Department of Commerce, covering the collection, use and retention of personal data transferred from the European Union to the United States.
● Heroku (Subsidiary of Salesforce): Hosting services. Heroku complies with the EU-US Privacy Shield Framework, as set forth by the US Department of Commerce, covering the collection, use and retention of personal data transferred from the European Union to the United States.
● PubNub: Used to pass user comments in livestreams. Based in the United States. PubNub complies with the EU-US Privacy Shield Framework, as set forth by the US Department of Commerce, covering the collection, use and retention of personal data transferred from the European Union to the United States.
12. International Transfers of Personal Data
As We have described above, to be able to provide you with the Services We may transfer your personal data to partners in countries outside the EEA (such as the United States). These countries’ privacy laws may be different from those in your home country.
Should We transfer data to a country which has not been deemed to provide adequate data protection standards We always have security measures and approved model clauses in place to protect your personal data.
By voluntarily submitting your personal data to us you consent to these international transfer. If you later wish to withdraw your consent, please contact the Data Controller using the details in Section 16.
13. Use of Cookies
Cookies are small text files sent by websites to your web browser and sent back to them each time you access or use the site, and may be necessary for the site to function. They are unique to you or your web browser and may contain personally identifiable information as well as technical information (e.g. your device manufacturer and model, screen resolution, internet service provider, browser, and geo-location data). Session-based cookies last only while your browser is open and are automatically deleted when you close the browser. Persistent cookies last until you or your browser delete them, or until they expire.
When using this Service, you should be aware that the App element of the Service does not use cookies. We do maintain recognition of Log In, but this is not managed by cookies. Third- party websites which we, or other users, may link to might however include cookies. These are outside of our control and we cannot guarantee their behaviour. These sites may use both session-based and persistent cookies, dependent upon the functionality in those sites.
However, when posts are shared from the App into social media, the webpages in the Service that support this feature do use cookies to anonymously gather metrics on which pages are the most popular.
Further information about cookies can be found at Interactive Advertising Bureau or Out-Law’s.
14. External Links
The Service includes relevant hyperlinks (posted by us or App users) to external websites which are not directly controlled by Us. Whilst all reasonable care has been exercised in selecting and providing such links, you are advised to exercise caution before clicking any external links. We cannot guarantee the ongoing suitability of external links, nor do we continually verify the safety or security of the contents which may be provided to you. You are advised, therefore, that your use of external links is at your own risk and We cannot be responsible for any damages or consequences caused by your use of them.
15. Changes to this Privacy Policy
We may change this Privacy Policy from time to time, and if We do so, you will be notified at your next available interaction with the Service, at which time you will be provided with the updated Privacy Policy to review and consent to before you are able to continue using the Service.
16. Contacting the Data Controller
If you have any questions about this Privacy Policy, would like to exercise any of your statutory rights or to make a complaint, please write to:
Her Spirit
Antenna, 9a Beck Street,
Nottingham, England, N1 1EQ,
Tel: 07771346748
Email: holly@herspirit.co.uk
