Oopla

OOPLA DATA Privacy notice

This privacy notice includes the following sections:

1. WHO WE ARE

2. ABOUT THIS NOTICE

3. THE PERSONAL DATA WE COLLECT ABOUT YOU

4. HOW WE COLLECT YOUR PERSONAL DATA

5. HOW WE USE YOUR PERSONAL DATA

6. WHO WE SHARE YOUR PERSONAL DATA WITH

7. INTERNATIONAL TRANSFERS

8. DATA SECURITY

9. DATA RETENTION

10. YOUR LEGAL RIGHTS

11. Changes to this notice and your duty to inform us of changes

12. QUERIES, REQUESTS OR CONCERNS

1. WHO WE ARE

We are Support To Perform Ltd, a company registered in Northern Ireland, with registered address 44 Summerhill Park, Belfast, Northern Ireland, BT5 7HE and company number NI651972 (we, us, our). We are registered with the ICO. Our registration number is ZA768111.

We provide a software application called “Oopla” to individuals and organisations to enable them to participate in a series of 28 day activity challenges, competing against themselves or other individuals and/or groups, for the purpose of improving health and well-being (Activity Challenges). 

In this notice, any reference to Oopla is a reference to the software which we make available to enable you to set up or take part in an Activity Challenge. For the purposes of this notice, the definition doesn’t include any third party applications or software which, for example, you might use to transfer data on to Oopla (such as Strava).

Any reference in this notice to our Services is a reference to the provision of Oopla. 

2. ABOUT THIS NOTICE

In order to use Oopla, you will be required to set up an individual account on Oopla which allows you to track your own activities (Oopla Solo). To do this, you must provide us with certain details, including personal information such as your name and email address. You can optionally provide us with details of your gender, date of birth and country. 

You can also opt to (i) individually subscribe to join any open group activity on Oopla which will allow you to participate in a group activity (Oopla Groups) or (ii) purchase a subscription which will allow you to create a members-only private group for friends or colleagues (subject to a minimum of 10 participants) (Oopla Private Group).  In order to provide our Services, we will need to collect personal data about you and in some cases other individuals who wish to set up or participate in an Activity Challenge. We hold this data as a controller, which means that we are responsible for deciding how we hold and use that data. 

As a controller, we are required at law to provide a notice to all of the individuals involved in an Activity Challenge to let them know how we manage the data we hold about them. That’s the purpose of this notice. 

This notice only binds us.

That means that:

• if you access Oopla through third party software (such as Facebook or Google) or if you use a third party app (such as Strava) to upload details about the activities you have completed for an Activity Challenge, that third party will have their own privacy notice and will not be bound by these terms. Please read any such third party’s privacy notice before you upload any data on to it; and any other users of Oopla who may be able to see information about you if you use Oopla, will not be bound by the terms of this privacy notice. For more information about who can see information about you on Oopla, have a look at section 7 below.

From time to time, we may update this notice. If we do so, we will not contact you directly, but we will publish the updated notice on Oopla so that the next time you log in you will be notified. 

If we are running a service related to an Activity Challenge, we may also provide you with additional information relating specifically to the data collected in connection with that additional service.

3. THE PERSONAL DATA WE COLLECT ABOUT YOU

Personal data, or personal information, means any information about an individual from which that person can be identified (whether directly or indirectly). You can find out more about personal data from the Information Commissioners Office.

In order to participate in an Activity Challenge, we will need to obtain the following types of information about you:

• Contact Data such as your full name and email address;

• Demographic Data such as your gender, country and date of birth which you may optionally chose to provide to us; and

• Participation Data this includes points earned from activities you have undertaken (but not the details of how or where you earned them) and may also include information about Activity Challenge results. We do not knowingly collect location data from you. 

We also collect:

• Usage Data that is technical data which we collect automatically about your interaction with Oopla.

• Marketing and Communications Data such as your preferences about receiving marketing from us.

If you are paying us to receive some of our Services we will also need to obtain:

• Financial and Transaction Data such as bank and/or card details and information about services you have purchased from us.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

We do not knowingly collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your medical health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

Nor do we knowingly collect any information relating to children. Our Services are only for individuals aged 18 years and above. 

If you fail to provide personal data 

Most of the information we collect about you, we collect because we require it in order to enable us to provide you with our Services. If you don’t provide us with the information we need to do this, we may not be able to provide our Services to you.

4. HOW WE COLLECT YOUR PERSONAL DATA

We use different methods to collect data from and about you:

• Directly: Most of the information we collect about you, you give to us directly. You do this when or if you:First register your interest with us;Create an account on Oopla to sign up as an individual or as a participant or as a “Group Owner” or “Administrator” in a group based Activity Challenge (Group Owners and any Administrators appointed by them will manage the Oopla Private Group Account and will have access to certain personal information about you which you upload onto your Oopla account – see section 7 for more information);Contact us with questions, queries, complaints or requests; orSign up to receive marketing communications from us.

• From third parties: We may also obtain information about you from other people. For example: If you have registered your interest to participate in a group based Activity Challenge on Oopla Private Group and the “Group Owner” and/or an Administrator of your organisation approves you as a participant, the Group Owner (and any associated Administrators) may process certain personal information about you when managing the Oopla Private Group Account – this information will include your name and email address (even if you have opted for ‘stealth’ mode – see section 7 for more information) and may include your age band, gender and country if you choose to provide this optional information. The Group Owner may also request other information directly from you (e.g. your role in your organisation) from which you may be identifiable (which may include location data if requested) but you can minimise this risk by changing some of the other optional fields on your account at any time (e.g. gender, age band or country).  If you choose to transfer information using a third party app like Strava, then data relating to you will be transferred to us. This will usually happen if you want to upload information about the activities you have undertaken as part of an Activity Challenge. Please be advised that this may include the transfer of location data.If you contact us using social media.

• Automatically: Oopla is set up to record usage data relating to how a user uses and interacts with Oopla. This may include your IP address and other technical information such as times and duration of login on your Oopla account, device type used by you, operating system and mobile network information. We do this by using cookies. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of Oopla may become inaccessible or not function properly. For more information on this, please have a look at our Cookies Policy which can be accessed at https://www.oopla.app/cookie-policy

5. HOW WE USE YOUR PERSONAL DATA

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Performance of Contract this means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract. 

• Legitimate Interest this means the interest of our business in conducting and managing our business to enable us to give you the best service and the most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting our Data Protection Officer.

• Comply with a legal or regulatory obligation this means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

Generally we do not rely on consent as a legal basis for processing your personal data other than in relation to sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us at services@support2perform.com.

6. WHO WE SHARE YOUR PERSONAL DATA WITH

We have set out below, in a table format, a description of all the ways we plan to use your personal data, with the legal bases we rely on to do so. 

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. If you have a question about a particular processing activity carried out by us, please email us at services@support2perform.com.

Opting out

You can ask us or third parties to stop sending you marketing messages at any time by following the unsubscribe link in any of our marketing emails or by request to services@support2perform.com at any time.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. 

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

7. INTERNATIONAL TRANSFERS

Our Processors

We may disclose any Personal Data that we hold to our employees as well as other third parties who we engage to help us provide our Services. Any such parties contracted by us will be acting as our Processors and will be subject to strict contractual requirements only to use Personal Data in accordance with our privacy notice. If you would like more information about third party processors used by us, please contact us at:  services@support2perform.com

Information shared on Oopla 

• When you set up your Oopla account, your name (unless you use the ‘stealth’ mode – in which case your unique ID number will appear instead of your name), the details of any Activity Challenges you have completed and any points awarded will be published and publically available on the Oopla dashboard and the Oopla Global Leader board. 

• If you participate in an Oopla Private Group Activity Challenge, the Group Owner and/or any associated Administrators may process certain personal information about you when managing the Oopla Private Group Account – this information will include your name and email address (even if you have opted for ‘stealth’ mode) and may include your age band, gender and country if you choose to provide this optional information. The Group Owner and/or an Administrator may also request further information directly from you (such as your role in your organisation). The Group Owner and/or an Administrator’s processing activities will be governed by your organisation’s privacy notice. Other participants in group based Activity Challenges (who may be inside or outside your organisation) may also be able to see any personal data which you have uploaded onto your Oopla account. If you opt for ‘stealth’ mode, your unique ID number will appear instead of your name in the Oopla Global Leader board (but note that your name will still be accessible to the Group Owner and/or Administrator if you choose to participate in an Oopla Private Group Activity Challenge). We cannot guarantee that you will not be identifiable from the information you submit to Oopla in ‘stealth’ mode but you can minimise this risk by changing or removing some of the other optional fields on your account (e.g. gender, age band and country).  If you have any questions about ‘stealth’ mode, please contact us at services@support2perform.com.

Other Disclosures

We may also disclose Personal Data if:

• we are under a duty to do so in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements or to protect the operation of our website, or the rights, property, or safety of us, our Users, or others; 

• to any buyer if we sell, transfer or merge parts of our business or our assets. If a change happens to our business, then the new owners will only be entitled to use Personal Data in accordance with the provisions set out in this privacy notice (in which case such disclosure shall be on the basis that it is necessary to achieve our legitimate interest of protecting our business interests); and

• in order to enforce or apply our terms of use and other agreements, or to protect the rights, property, or the safety of us, other users of the Platform, or our customers or others (in which case such disclosure shall be on the basis that it is necessary to achieve our legitimate interest of protecting our business interests and/or enforcing our legal rights).

8. DATA SECURITY

Other Participants

Since many of our users are based around the globe, participants in a group based Activity Challenge and/or Group Owners may be located outside the EU and the UK. These participants and/or Group Owners may be able to see the names, organisational roles and participation details of the other people who have requested to participate in the same Activity Challenge. In some cases, participants and/or Group Owners may be based in countries which offer lower levels of data protection than enjoyed in the UK. If you do not want your details to be accessible to other participants and/or Group Owners, please choose the ‘stealth’ mode when you register. If you have any questions about ‘stealth’ mode, please contact us at services@support2perform.com.

Storage of Data

We store any data uploaded on to Oopla in servers based in the EU.

If any of our external third party service providers are based outside the European Economic Area (EEA) and their processing of your personal data will involve a transfer of data outside the EEA, we ensure a similar degree of protection is afforded to your personal data by implementing safeguards as specified by data protection laws. 

9. DATA RETENTION

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Our external third party service providers will only process your personal data on our instructions and are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and all applicable legal requirements.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

We retain certain information relating to your use of Oopla and transactions for up to six years after the end of the applicable Activity Challenge. We do this for our records; to meet our accounting and tax requirements and to manage any dispute which may arise during that period.

In some circumstances (subject to certain exemptions) you can ask us to delete your data: see Your legal rights below for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

10. YOUR LEGAL RIGHTS

Unless subject to an exemption under the data protection laws, you have the following rights with respect to your personal data: 

• The right to request a copy of the personal data which we hold about you;

• The right to request that we correct any personal data if it is found to be inaccurate or out of date;

• The right to request your personal data is erased where it is no longer necessary to retain such data;

• The right to withdraw your consent to the processing at any time, where consent was the lawful basis for processing your data; 

• The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), where applicable; 

• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing; and

• The right to object to our processing of personal data in certain circumstances (subject to some exemptions). 

If you wish to exercise any of the rights set out above, please email us at services@support2perform.com

No fee required – with some exceptions

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable admin fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

11. Changes to this notice and your duty to inform us of changes

This version was last updated on 2 June 2021.

It is important that the personal data we hold about you is accurate and current. You may correct, amend or update your account information at any time by adjusting that information in your account settings. If you need further assistance correcting inaccurate information, please contact us.

12. QUERIES, REQUESTS OR CONCERNS

To exercise all relevant rights, queries or complaints in relation to this policy or any other data protection matter between you and us, please in the first instance contact our Data Protection Officer on 028 90 409975 or services@support2perform.com 

If this does not resolve your complaint to your satisfaction, you have the right to lodge a complaint with the Information Commissioners Office on 03031231113 or via email https://ico.org.uk/Groups/contact-us/email/ or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, England, UK.