Privacy Policy – Consumers and Exercise Participants

Last update: 21 March 2024

Introduction

We value your fundamental right to privacy. As a company based in the European Union, we comply with our obligations uner European data protection laws (GDPR). In this document, we show you how we use your personal data if you’re a consumer or an individual participant in our exercise activities.

For clarity, we have divided the privacy policy into two parts:

• Part 1 contains general information about personal data processing at Hydrohex.
• Part 2 applies to the processing of your personal data as a consumer or a Hydrohex exercise participant.

If you have any questions or concerns regarding the processing of your personal data at Hydrohex, please don’t hesitate to contact us:

Hydrohex Oy Ltd

Privacy team
[email protected]

We may update our privacy policies from time to time. The date of last update is shown above. Minor changes will be shown in this document, and we ask that you review it regularly. If we have your contact details, we’ll let you know by email or notification if we maked changes that significantly affect your data protection rights and freedoms.

Part 1: General information

Categories of personal data

If you are our customer or otherwise participate in our exercise activities, we often collect and process certain types of your personal data. These are:

• Your name and contact details
• Messages and correspondence between you and us
• Age, gender, certain physical characteristic (like height and weight)
• Preferences and activity history (like what exercises you’ve participated in)

Occasionally, we process certain additional types of your personal data. These are:

• Health data (like if you connect your sports watch with our services and share your heart rate and other health information)
• Technical identifiers (like device identifiers, IP addresses and geolocation data)
• Video and sound recordings and photographs (like if we record an event that you attend, or if we record a customer service phone call)
• Social media content and other public information (like if we engage with you in social media)
• Consents and prohibitions that you may have given (like if you have consented to the processing of your health data as part of our services, or if you have prohibited us from contacting you for marketing purposes)

Also, if you purchase or sign up for our paid services, we process additional types of your personal data. These are:

• Payment information and payment history (like your payment card information and invoice history)
• Financial information (like credit reports)

Mandatory categories of personal data

Some categories of personal data are mandatory in the sense that without certain data, we cannot provide our services to you.

In Part 2 of the privacy policy, we have marked clearly which categories of personal data are mandatory for a given purpose.

Sources of personal data

We primarily process personal data that you give us, for instance when you sign up for our services or otherwise participate in our exercise activities.

However, in some cases we may receive personal data relating to you from other sources. These are:

• Your employer (like if you participate in our exercise acitivities through your employer)
• Social media and the internet
• Technical sources such as cookies, scripts, databases and similar technologies (like if you access our website or online services)
• Public registers (like credit report registers)

Retention periods of personal data

As is our duty under European data protection laws, we only keep your personal data as long as necessary for the purposes that we describe more in detail below, and only as long as we have a legal basis set out in the GDPR to process the data.

As soon as no relevant purpose or legal basis applies, we will either destroy your personal data or anonymise it in an irreversible manner.

In Part 2 of the privacy policy, we have marked clearly all retention periods of your personal data for given purposes.

Sharing personal data with third parties

As a commercial service provider, we like most other companies have to outsource some of the processing of your data to trusted partners. Because of that, we transfer certain types of personal data to third parties.

We always make sure that all transfers are protected by a contractual arrangement between us and our trusted partners as required by the GDPR.

Our trusted partners can be categorised as follows:

Website, data storage and technical operations

• Web hosting companies (e.g. to operate our website and online services)
• Content management services and content delivery networks (e.g. to operate our website and onlice services and to store and process online data)
• Cloud storage (e.g. to store customer and contract information)
• Online collaboration tools (e.g. if we plan and discuss our services with you internally)

Communications and deliveries

• E-mail and messaging services
• Chatbox service providers (e.g. if you use our customer service chatbox)
• Video call service providers (e.g. if we have a video call with you)
• Postal service providers and delivery companies (e.g. to ship our hardware to you)

Financial service providers

• External accountants and auditors
• Accounting software service providers (e.g. to store our invoices for bookkeeping obligations)
• Banks and payment processors

Professional  advisers

• Law firms
• Business consultants

Customer and contract management

• Hosted customer management services
• Digital signature services
• Calendar and booking services (e.g. to book and handle meetings with you)

Public authorities

• Any information lawfully requested by a public authority

Transfers outside the EU/EEA

We normally process your personal data within the European Union and European Economic Area. In some cases, we or our trusted partners process your personal data outside these areas.

Because of that, some of your personal data are transferred to the following countries:

• United States: We and our trusted partners make sure that transfers are protected under the EU-US Data Privacy Framework. If not, we and our trusted partners make sure transfers are protected by contractual arrangements using the Standard Contractual Clauses (SCC) issued by the European Commission.

Your rights

According to the GDPR, you have various rights as we process your personal data. These are:

• Right of access: You may ask us whether we process any personal data about you, and if we do, you have a right to request a copy of some or all of the data. You also have a right to ask for more information regarding the third-party recipients of your personal data, and about the protective measures that we take when transferring your data to trusted partners and outside the EU/EEA.

If you request a copy of your data, we will send it to you electronically.  In most cases we will be glad to accommodate your request, but if we receive repeated or manifestly unfounded requests from you, we may have to refuse or charge a reasonable administrative fee to process your request.

• Rectifying incorrect or incomplete personal data: If you consider that some of your personal data that we process is incorrect or incomplete, you may ask us to correct or complete the data. We will investigate your request without undue delay, and accommodate it if we can be sufficiently certain that the request is justified.

• Erasing personal data (“the right to be forgotten”): If you don’t want us to process your personal data, you may ask us to erase a part or all of it. We will do our best to accommodate your request, but in some cases we may have to refuse or postpone the request. This may happen e.g. if you are our customer or a service user and we need your personal data to perform our services, or if we have a legal duty or a legitimate interest to retain some of your data (we have described these in more detail in Part 2).

• Restricting the processing of personal data: If you consider that our processing of your personal data breaches the GDPR or other laws, you may ask us to stop the processing for the time being. We will accommodate your request as well as possible while we investigate the matter.

You may also ask us that we do not erase or otherwise process your personal data if you need the data e.g. in a legal dispute and the erasure or other processing would jeopardise your interests in that regard. We will aim to accommodate your request as well as possible.

• Objecting to processing of personal data: As explained in detail in Part 2, we sometimes process your data on the basis of our or someone else’s legitimate interest. If that’s the case, you may object to our processing of your data on that basis. We will aim to accommodate your request as much as possible, however in some cases the legitimate interests in question may be so important that they outweigh your interest to object.

If that happens, we will let you know about our reasons for not accommodating your request and inform you about your right to lodge a complaint with the relevant data protection authorities.

If we have contacted you for direct marketing purposes, you may also object to our processing of your personal data for that purpose. (In other words, you may prohibit us from contacting you for direct marketing purposes). We will accommodate your request without undue delay.

• Withdrawing consent: As explained in detail in Part 2, we sometimes process your personal data on the basis of your consent. If that’s the case, you may, at any time, withdraw your consent for that processing. We will accommodate your request without undue delay, however we may continue the processing if we have another legal basis to do so. Please note that withdrawing consent will not affect the prior processing of your personal data.

• Right to lodge a complaint: If you consider that our processing of your personal data breaches the GDPR or other laws, you may at any time lodge a complaint with the relevant data protection authorities.

To exercice any of your above rights, please contact us using the contact details shown at the beginning of the document. We’ll be glad to assist you.

Cookies and tracking

Like most other companies, we use cookies and similar technologies on our website, online services and in marketing. We will adhere to applicable laws regarding the requirements for the processing of your personal data in such ways.

We have described in detail the types of cookies and similar technologies we use as well as their purposes in our cookie policy.

Part 2: Processing of your data

If you sign up for our services or otherwise participate in our exercise activities, we process your personal data in certain ways in the context of our relationship.

Here we describe the purposes of processing your personal data together with the appropriate legal bases for the processing, as well as the categories of personal data processed together with their retention periods.

Purposes and legal bases of the processing of personal data

According to the GDPR, all processing of personal data must be justified using a legal basis found in the law. We use the following legal bases for our processing:

• Contract (including contract preparation): If you are our customer or otherwise participate in our exercise activities, to perform our services we need to process certain categories of your personal data.
• Legal obligation: As a commercial service provider, we have a number of legal obligations to fulfil. For instance, we must keep financial records of our transactions, which may include your personal data.
• Consent: In some cases, we may ask for your consent to process your personal data. If we receive your consent, we may process your data on that basis within the limits of the consent. For instance, we use cookies for statistical and marketing purposes, which may only be done if we receive your consent. Also, if we process any of your health data, we only do so with your consent.
• Legitimate interest: In some cases, we may process your personal data if it’s justified for our or someone else’s legitimate interest. We only do so after having assessed your rights and freedoms against the importance of the legitimate interest (we conduct a so-called “balancing test”). For more information about this, please contact us using the contact details shown above.

Here is a complete overview of our purposes of processing and the corresponding legal bases:

Categories of personal data processed and their retention times

Below is a list of our retention times for different types of personal data under a given purpose. Once a specific retention period runs out, we will destroy the relevant personal data or anonymise it irreversibly, unless a different purpose with a longer retention period applies.

For instance, we keep personal data for the purposes of communications (like e-mails containing your name and e-mail address) for 1 year. Once the retention period runs out, we will destroy the relevant data unless we need to keep it for the purposes of risk management for 3 years. If so, we will continue to retain the data until the 3-year retention period runs out.