1.1. This document (the "Privacy Notice") describes how IM WITH BRUCE AB, company registration number 559037-5597 ("Bruce", "we", "us" or "our") process your personal data when you visit our website www.bruce.app (the "Website") and/or use our smartphone application (the "Service").
1.2. Bruce is the controller of your personal data. If you have questions about how Bruce process your personal data, please contact us by using the contact information specified in Section 10.
2. Categories of personal data, purpose and legal basis
2.1. We will process the following personal data when you visit our Website:
- Browser type;
- search terms used on our Website; and
- IP-address including your network location and technical information about your device.
The purpose of our processing is to optimise your user experience of our Website. The legal basis for our processing is legitimate interest (Article 6(1)(f) of the GDPR).
2.2. We will process the following personal data when you register in our Service:
- Full name;
- phone number;
- e-mail address;
- personal identity number; and
- billing information.
The purpose of our processing is to provide our Service to you. The legal basis for our processing is performance of a contract to which you are a party or in order to take steps at the request of you prior to entering into a contract (Article 6(1)(b) of the GDPR).
2.3. We will process the following personal data when monitoring and analysing your use of our Service:
- Statistical data based on your bookings.
The purpose of our processing is to improve and develop our current Service and to develop new products and services. The legal basis for our processing is your consent (Article 6(1)(a) of the GDPR). You are free to withdraw your consent at any time but please notice that your withdrawal will not affect the legality of our processing conducted prior to such withdrawal.
2.4. We will process the following personal data when providing you direct marketing:
- Full name;
- phone number;
- e-mail address;
- user triggered events in the Service (purchases, bookings, subscriptions, language, location and last activity).
The purpose of our processing is to send you direct marketing about our Service and other products and services from Bruce which we think you might be interested in.
When we use profiling for our direct marketing, the legal basis for our processing is your consent (Article 6(1)(a) of the GDPR). You are free to withdraw your consent at any time but please notice that your withdrawal will not affect the legality of our processing conducted prior to such withdrawal.
Insofar profiling is not involved, the legal basis for our processing is legitimate interest (Article 6(1)(f) of the GDPR).
3. Processing due to legal obligations or legal claims
3.1. If required by applicable law, we will process your personal data as necessary to fulfil a legal obligation that we are subject to (Article 6(1)(c) of the GDPR). This may include processing your personal data to abide by bookkeeping legislation or to respond to an inquiry from a law enforcement authority.
3.2. We may also process your personal data to establish, assert or defend legal claims directed towards us. The legal basis in these cases is legitimate interest (Article 6(1)(f) of the GDPR).
4. How your personal data is collected
We will primarily collect personal data directly from you but will however also collect personal data about you from the following publicly accessible:
- Apple; and
5. Disclosure of your personal data
Your personal data is disclosed to the following categories of recipients:
- Payment processors who handle our customer's payments;
- CRM service providers who enable us to build and manage relationships with our customers;
- Booking system service providers who enable our customers to book workouts;
- Customer communication service providers who enable us to effectively engage and communicate with our customers;
- Media management service providers who enable us to deliver images and videos to our customers; and
- Fitness centres, work out studios and gyms who offer workouts to our customers.
6. Transfer of your personal data to third countries
Bruce only process your personal data within the EU/EEA. In the event that Bruce would transfer your personal data to a country outside the EU/EEA which is not subject to an adequacy decision, Bruce will safeguard such transfer by entering into the EU Standard Contractual Clauses with the third country recipient (available here: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914.
7. Profiling and automated decision-making
7.1. We will use an AI tool to examine your profile picture. The AI tool will not identify you and doesn't have the capability to do so. The sole purpose of the examination of your profile picture is to make sure that you don't upload material which violates third party intellectual property rights and that your profile picture isn't inappropriate (e.g. defamatory, threatening, incites hate crimes etc.). If we remove your profile picture, you will be provided with opportunity to upload a new profile picture and to obtain human intervention to express your view and to contest our removal decision.
7.2. Our direct marketing is partly based on profiling. This means that we will, subject to your prior consent, make predictions about your personal preferences based on how often you train, what type of workouts you do and which fitness centres, work out studios and gyms you attend. Based on these predictions, we will tailor our direct marketing to you.
8. Data Retention
We will only retain your personal data for as long as necessary to fulfil each respective purpose in this Privacy Notice. Any personal data we no longer have a purpose of processing in accordance with this Privacy Notice will be deleted immediately.
9. Your rights
9.1. The right of access
You have the right to request access to your personal data. This enables you to receive a copy of the personal data we process about you and to check that we are processing it in a lawful manner.
9.2. The right to rectification
You have the right to request correction of the personal data that we process about you. If you become aware that the personal data we process is inaccurate, we encourage you to contact us in writing and request that we correct any incomplete or inaccurate personal data we process about you.
9.3. The right to erasure
You may have the right to request erasure of your personal data. This enables you to ask us to delete or remove personal data we process about you where there is no valid reason for us to process it. To the extent the continued processing of your personal data is necessary, for example in order for us to comply with our legal obligations or for legal claims to be established, asserted or defended, we are not required to delete your personal data.
9.4. The right to restriction of processing
You may have the right to request restriction of our processing of your personal data. This enables you to ask us to suspend the processing of your personal data, for example if you want us to establish its accuracy or the purpose for processing it.
9.5. The right to data portability
You may have the right to obtain your personal data that we process, in a structured, commonly used, machine-readable format and to request a transfer of that personal data to another controller.
9.6. The right to object
You have the right to object to our processing of your personal data at any time when it relates to our direct marketing efforts, including profiling, towards you. You may also have the right to object to a decision based solely on automated processing, including profiling, which produces a legal effect or similarly affects you.
Furthermore, you have the right to object to our processing of your personal data at any time, where we rely on a legitimate interest as legal basis for the processing. This enables you to ask us to stop the processing of your personal data unless we demonstrate compelling legitimate grounds for the processing or unless our processing is necessary for the establishment, exercise or defence of legal claims.
9.7. The right to lodge a complaint
You have the right to lodge a complaint to the relevant supervisory authority regarding our processing of your personal data. The relevant supervisory authority in Sweden is the Swedish Data Protection Agency (Sw. Integritetsskyddsmyndigheten).
10. Contact information
If you have any questions regarding our processing of your personal data or wish to exercise your rights, please send an e-mail to [email protected].
11. Changes to this privacy notice
We may make changes to this Privacy Notice. Any changes to this Privacy Notice will be communicated to you in the Service. The latest version of this Privacy Notice will be available at any time at www.bruce.app/privacy.
Last updated: 2022-10-19