YUMUUV PLATFORM
PRIVACY NOTICE

Last updated: 3 November 2026

This Privacy Notice describes how yuMuuv OÜ (a company incorporated under Estonian law with registry code 14636730 and registered address at Savi 4C, 50405 Tartu, Estonia; “YuMuuv”, “we”, “us” or “our”) collects, uses or otherwise processes and safeguards data relating to individuals (“data subjects” or “you”) who use our website accessible at www.yumuuv.com and our mobile application (jointly the “YuMuuv Platform”), and with whom we otherwise interact, including in the course of providing our services via the YuMuuv Platform. The controller of your personal data is YuMuuv. You can contact us by e-mail at info@yumuuv.com. You may also contact our data protection officer at dpo@yumuuv.com.

YuMuuv is responsible for ensuring that your personal data is processed in accordance with this Privacy Notice and applicable data protection laws, in particular the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

The current list of the service providers who process personal data on our behalf is available in our Trust Center at https://trust.yumuuv.com. To get more information on how we process the personal data of job applicants, please refer to the Appendix at the end of this Privacy Notice.

1. PERSONAL DATA WE COLLECT AND HOW WE USE IT

Personal data means any information relating to an identified or identifiable natural person. We usually collect personal data directly from you when you interact with the YuMuuv Platform. We may also collect personal data through integrations with third-party applications and wearable devices, such as Apple Health, Health Connect, Garmin, Polar, Suunto, Google Health (formerly Fitbit) and Google Fit, if you have allowed such integrations.

1.1. Registering an account to access our services

To register an account to access our wellness-related services via the YuMuuv Platform, we ask you to enter your e-mail address and select a password. If you decide to register an account through a third-party service provider, we may collect personal data that is associated with your account at that provider, such as your name, e-mail address, language preference and profile picture.

The legal basis for this processing is the performance of the contract with you under our Terms of Use (Article 6(1)(b) GDPR).

1.2. Using our wellness-related services and other features

To provide our wellness-related services and other features, such as tracking your personal progress and issuing activity reports, organising and participating in challenges, and chatting with other users, we process the personal data required for the service or feature you request. These data may include your name, e-mail address, age, gender, language preference, data about your physical activity (including type, date and duration of activity, steps, distance, burned calories and activity reports), and, if you opt in to the challenges that use them, your heart rate, weight, height, sleep data, water intake and nutrition entries, the challenges you organise or take part in, the company or organisation you are part of, your chat messages, and any other data you provide while using the YuMuuv Platform. The legal basis for this processing is the performance of the contract with you or our legitimate interest in performing the contract with the legal entity you represent.

Most of the activity data we process, such as steps, distance and the type and duration of activities, is used only to count your results in challenges, and we do not use it to assess your health or to give health advice. If you opt in to calorie, intensity-minute or Activity Index challenges, we also process your heart rate, weight and height, together with your age and gender, to calculate your results in these challenges. If you opt in to sleep, water intake or nutrition challenges, we process the sleep data and the water intake and nutrition entries needed for them. Heart rate, weight, height and sleep data are data concerning your health, which is a special category of personal data, and water intake and nutrition entries may be. We process them only if you give your explicit consent in a separate opt-in step in the YuMuuv Platform, and only for these challenges. You may withdraw your consent at any time in the settings of the YuMuuv Platform; we will then stop collecting these data.

If you decide to connect other wellness applications or wearable devices to the YuMuuv Platform, we collect the activity data associated with them on the basis of your consent. You may end such integrations, and so withdraw your consent, at any time via the YuMuuv Platform or in the settings of the application or device.

When you participate in challenges, certain activity data may be disclosed to the other users in the same challenge, including its organisers. When you use the chat, your display name and messages are visible to the other participants of that chat. Your heart rate, weight and height are never shown to other users. If the organisation that gave you access to the YuMuuv Platform runs a calorie, intensity-minute, Activity Index, sleep, water intake or nutrition challenge and you opt in to it, your results in that challenge are shown on its leaderboard to the other participants and organisers of that challenge.

1.3. Inquiries, demos and responses

If you submit an inquiry to us via the YuMuuv Platform, including to book a demo of our services, we collect personal data depending on the content of your inquiry, such as your name, e-mail address, the entity you represent, the means of the proposed meeting, details of other participants and other content of the inquiry. We record a demo or sales call and create notes from it only if you agree to the recording at the start of the call.

The legal basis for this processing is taking pre-contractual measures before concluding a contract with you (or, on the basis of our legitimate interest, with the entity you represent), or our legitimate interest in responding to inquiries about us and our services. The legal basis for recording a call is your consent. If your request relates to our contractual relationship, the processing is based on our obligation to perform the contract.

1.4. Customer support

If you contact our support through the help center, the YuMuuv Platform or by e-mail, we process your name, e-mail address, the organisation you belong to, the content of your request and the account details needed to resolve it. The legal basis for this processing is the performance of the contract with you or with the legal entity you represent, or our legitimate interest in answering your request.

1.5. Improving and developing the YuMuuv Platform, including for security purposes

For these purposes, we may process your IP address, information about the devices you use, e-mail and other communications, and usage, navigation, analytics and log data associated with your use of the YuMuuv Platform. To protect the YuMuuv Platform from misuse, we may look up the approximate location of an IP address and whether it belongs to a VPN, and we collect technical error reports, which may include a user identifier. We may also use cookies and similar technologies for these purposes, as described in our Cookie Notice at https://yumuuv.com/cookie-notice.

The legal basis for this processing is our legitimate interest in understanding our partners’ and users’ needs and preferences to improve the YuMuuv Platform, including by conducting analytics and ensuring the availability and security of the YuMuuv Platform.

1.6. Management of contractual and business relationships

To manage our contractual and business relationships, including databases of our partners, we may process personal data on the basis of our legitimate interest in maintaining such relationships. This mainly concerns the names and contact details of our business partners’ representatives and our correspondence with them. For this purpose we may also process information about our business customers’ payments and transactions, such as the type of subscription, the payment method and bank account details, which may to a limited extent contain personal data.

1.7. Contacting business representatives

We may contact representatives of organisations that could be interested in our services, using professional contact details such as name, job title, business e-mail address and professional profile, which are publicly available or which you have shared with us. The legal basis for this processing is our legitimate interest in promoting our services to businesses. You can object at any time, for example by replying to our message or using the unsubscribe link, and we will stop contacting you.

1.8. Compliance with our legal obligations

For compliance purposes deriving from applicable law, for example accounting and tax laws, we may process your personal data on the basis of the legal provision obliging us to process the relevant data. This also applies to personal data about payments and transactions.

1.9. Direct communication

If you opt in to receive push notifications and/or e-mail communication from us on the YuMuuv Platform, we may send you push notifications and/or use your e-mail address to send you updates, offers and other material. The legal basis is your consent, which you may withdraw at any time to stop receiving such communications.

1.10. Establishing, exercising and defending legal claims

If necessary, we may process your personal data to establish, exercise or defend legal claims arising out of or in relation to the legal relationship between us and you (or the entity you represent), on the basis of our legitimate interest.

2. DISCLOSURE AND TRANSFER OF PERSONAL DATA

We put our best efforts into keeping your personal data safe and always require a high level of security and confidentiality from our employees and partners.

We may disclose and share certain categories of your personal data:

  • with other users when you participate in wellness challenges or use the chat, including the organisers of challenges;
  • with the organisation that gave you access to the YuMuuv Platform, to the extent needed to administer its challenges;
  • with our service providers, who process personal data on our behalf and under our instructions, such as cloud hosting (Amazon Web Services), e-mail delivery (SendGrid), in-app chat (Stream), push notifications (Google Firebase), customer support (Zendesk), error monitoring (Bugsnag) and IP address lookups (IPinfo), as well as payment, IT support, legal and accounting service providers. The current list is available at https://trust.yumuuv.com. We control and remain responsible for the use of your personal data in such cases;
  • with our partners who provide analytics and advertising tools on our website, as described in our Cookie Notice;
  • with public authorities, if we are required to disclose personal data by applicable law or to comply with a lawful request of authorities; and
  • in relation to a merger, acquisition or sale of our business or its parts.

We host the YuMuuv Platform in the European Union: production systems run in Amazon Web Services’ Stockholm region (Sweden), with backups in its Frankfurt region (Germany).

Some of our service providers are located in, or may access data from, countries outside the European Economic Area, in particular the United States. In such cases we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for providers certified under it, or on other appropriate safeguards, such as the standard contractual clauses approved by the European Commission. You can contact us for more information about transfers of your personal data, using the contact details at the beginning of this Privacy Notice.

3. RETENTION OF YOUR PERSONAL DATA

We process your personal data only for as long as necessary to fulfil the purposes described above. We keep your account data for as long as your account on the YuMuuv Platform is connected to a customer of YuMuuv, usually your employer. If your account is no longer connected to any customer, for example because you left the organisation or its contract with us ended, we delete it, together with its data, 12 months later, unless it is connected to another customer before then. We delete the account of a customer organisation 12 months after its contract with us ends, or sooner if agreed with that organisation. If you delete your account yourself, we delete its data within 30 days. Heart rate, weight, height, sleep, water intake and nutrition data are deleted within 30 days after the customer contract ends. Deleted data may remain in our backups for up to 30 days. After a contract ends, we may keep the business contact details of the customer's representatives and the contract history, as described in section 1.6. We may keep some personal data for longer where this is necessary to achieve our legitimate interests or to fulfil obligations deriving from applicable law.

We determine the appropriate retention period on the basis of the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, whether we can achieve the purposes of the processing through other means, and the requirements of applicable law.

When retaining your personal data is no longer necessary for the purposes of processing, your data will be permanently deleted, unless you instruct us otherwise and we agree on the terms of longer storage.

4. YOUR RIGHTS AS A DATA SUBJECT

By contacting us at the contact details at the beginning of this Privacy Notice, you may exercise your rights as a data subject to the extent permitted under applicable law, including the following:

  • You may request access to your personal data.
  • To the extent permitted under applicable law, you may request us to correct, update, change or erase your personal data. In some cases you may also have a right to restrict processing and to object to the processing of your personal data.
  • If you request the erasure of your personal data, please note that certain personal data is strictly necessary to fulfil the purposes defined in this Privacy Notice, and its processing may also be required by applicable law. If personal data is erased at your request, we will only retain such copies of the information as are necessary to protect our or third parties’ legitimate interests, comply with authorities’ orders, resolve disputes, troubleshoot problems or enforce any agreement you (or the entity you represent) have entered into with us. Therefore, such personal data may not be erased in full.
  • You may withdraw your consent where the legal basis for processing is your consent. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
  • You may use your right to data portability. In some cases we may limit or deny your request if we are required or permitted by applicable law to do so, for example where it is necessary to protect our trade secrets or other confidential information.
  • To the extent permitted under applicable law, you may request more information about our legitimate interest and why we consider that it overrides your rights and interests, where the legal basis for the processing is our legitimate interest.

We will respond to your requests and provide additional privacy-related information within the time limits set by applicable data protection law. We may ask you for additional information to verify your identity before acting on your request.

If you are not satisfied with our response or are concerned that your privacy rights have been infringed, you have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work or where the alleged infringement took place. In Estonia, this is the Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee. A list of European supervisory authorities is available on the website of the European Data Protection Board here.

5. SECURITY MEASURES

We implement reasonable technical and organisational measures (including physical, electronic and administrative measures) to protect your personal data from loss, destruction, misuse and unauthorised access or disclosure.

No method of transmission over the Internet, or method of electronic storage, is fully secure. While we use all reasonable efforts to protect your personal data from loss, destruction, unauthorised access, misuse or disclosure, we cannot fully guarantee the security of your personal data.

6. UPDATES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time. If we make a substantial update, we will notify you via the e-mail address that you, or the company on whose behalf you use our services, have communicated to us. This Privacy Notice was last updated on the “Last updated” date indicated above.

APPENDIX: PROCESSING OF JOB APPLICANTS’ PERSONAL DATA

This Appendix describes the processing of your personal data if you apply for a vacant position with us, either on your own initiative or as a result of a targeted search carried out by us or on our behalf. Where applicable, it also applies to internship applications. Aspects not covered here, such as disclosure and transfer of personal data and your rights, are described in the general part of this Privacy Notice.

1. Personal data we collect

As your prospective employer, we collect your personal data in a variety of ways, in particular from you during the recruitment process. We may also receive your personal data from recruitment agencies and, to the extent permitted by applicable law, from other third parties, such as public databases and recruitment portals, your educational institutions, previous employers and the referees indicated in your application.

We may collect the following personal data necessary for the recruitment process:

  • general personal data, such as your name, personal identification code, citizenship, gender, date and place of birth, and language of communication;
  • contact details, such as your e-mail address, home address and phone number;
  • information in your application and CV, such as your education, language skills, previous employers, job titles and descriptions, experience (including start and end dates of previous employment), trainings and certificates, the position, salary and other benefits you seek and, where applicable, the existence of or need for a visa or residence permit;
  • other data collected during the recruitment process, such as the status of the process, information exchanged during the process (in particular in interviews), recommendations and referees, aptitude tests and suitability exercises (if applicable), and the outcome of the process and the reasons for it.

You may also provide us with other personal data voluntarily in your application or during the process, but such additional data is generally not required. If you do not provide certain personal data that we need to take steps towards concluding an employment (or service) contract with you, we may not be able to conclude that contract.

2. Purposes and legal bases

2.1. Taking steps before entering into an employment (or service) contract with you, including when you apply on your own initiative, and negotiating and preparing the contract. The legal basis is taking the necessary steps to conclude the contract with you (Article 6(1)(b) GDPR).

2.2. Achieving and protecting our legitimate business interests, such as conducting a targeted search for prospective employees and inviting you to apply; contacting you about your application and the recruitment process; assessing your application and suitability for the position, including by verifying the information you provided, carrying out aptitude tests and suitability exercises (if applicable) and contacting your referees; and establishing, exercising and defending legal claims. The legal basis is our legitimate interest (Article 6(1)(f) GDPR), on which we rely only where it outweighs your interests and rights.

2.3. Retaining your personal data to contact you in the future about vacant positions. The legal basis is your consent (Article 6(1)(a) GDPR), which you may withdraw at any time using the contact details in the general part of this Privacy Notice. Withdrawal does not affect the lawfulness of processing carried out before it.

3. Retention of your personal data

We retain your personal data for as long as necessary to achieve the purposes described in this Appendix. Most of your personal data is retained for up to 1 year after the recruitment process is completed. In some cases it may be retained for longer to protect our legitimate interests, for example in case of a legal dispute.

If you are hired, your personal data will continue to be processed under the rules that apply to employees’ personal data, and the relevant notice will be given to you when the contract is concluded. If you are not selected but wish us to keep your information for future openings, we will retain it on the basis of your consent for the period stated in that consent.