YUMUUV PLATFORM
PRIVACY NOTICE

Last updated: 6 May 2025

This Privacy Notice describes how yuMuuv OÜ (a company incorporated under Estonian law with registry code 14636730 and registered address at Savi 4C, 50405 Tartu, Estonia; “YuMuuv”, “we”, “us” or “our”) collects, uses or otherwise processes and safeguards data relating to individuals (“data subjects” or “you”) who use our website accessible at www.yumuuv.com and our mobile application (jointly hereinafter - “YuMuuv Platform”), and with whom we otherwise interact, including in the course of providing our services via the YuMuuv Platform. The controller of your personal data is YuMuuv. You can contact us by e-mail at info@yumuuv.com. You may also contact our data protection officer at dpo@yumuuv.com.

YuMuuv is responsible for ensuring that your personal data is processed in accordance with this Privacy Notice and applicable data protection laws, in particular with the General Data Protection Regulation (EU) 2016/679.

To get more information on how we process the personal data of job applicants, please refer to the Appendix at the end of this Privacy Notice.

1. PERSONAL DATA WE COLLECT AND HOW WE USE IT

Personal data means any information relating to an identified or identifiable natural person. We usually collect personal data directly from data subjects when data subjects interact with the YuMuuv Platform. We may also collect personal data through integrations with third-party applications and wearable devices such as Google Fit, Apple Health, Garmin, Fitbit, Suunto, Polar, Health Connect, if the data subject has allowed such integrations.

1.1. Registering an account to access our services

To register an account to access our wellness-related services via the YuMuuv Platform, we request you to enter your e-mail address and select a password. If you decide to register an account through a third-party service provider, we may collect personal data that is associated with your third-party service provider’s account, such as your name, e-mail address, language preference and profile picture.

The legal basis for the processing of your personal data for these purposes is our legitimate interest to create your unique account and to provide you with access to the YuMuuv Platform.

1.2. Using our wellness-related services and other features

For the purposes of providing you our wellness-related services and other features, such as to track your personal progress and issue activity reports, enable you to organise challenges and participate in them, interact with other users using chat functionalities, we process your personal data which are required to provide the service or functionality requested by you. These data may include your name, e-mail address, age, gender, language preference, weight and height, data about your physical activity (including type, date and duration of activity, steps, distance, burned calories, activity reports), challenges you organise and where you participate, company or organisation you are a part of, and any other data you provide while using the YuMuuv Platform. The legal basis for the processing of your personal data for these purposes is the performance of the contract with you or our legitimate interest to perform the contract with the legal entity you represent.

Some of the data processed for this purpose may constitute special categories of personal data (particularly, data concerning your health). The legal basis for the processing of such data is your explicit consent. You may withdraw your consent at any time. Also, if you decide to use our services by integrating other wellness applications and wearable devices with the YuMuuv Platform, we may collect certain personal data that is associated with these applications and devices on the basis of your consent. You may terminate such integrations by withdrawing your consent at any time via the YuMuuv Platform or under the settings of the used application or device.

Please note that when you participate in challenges, your certain activity data may be disclosed to other users that have entered the same challenge. Your health data or other special categories of data will not be disclosed to other users for this purpose.

1.3. Inquiries and responses

If you submit an inquiry to us via the YuMuuv Platform, including to book a demo of our offered services, we collect some of your personal data depending on the content of the submitted inquiry. For these purposes, we may process your personal data, such as your name, e-mail address, the entity you represent, means of the proposed meeting, details on additional participants and other content of the inquiry (if applicable).

The legal basis for the processing of your personal data is the implementation of pre-contractual measures prior to the conclusion of the contract with you (or the entity you represent on the basis of our legitimate interest), or our legitimate interest to respond to inquiries about us and our services in general. If your request relates to our contractual relationship, the processing of your personal data is based on our obligation to perform our contractual obligations.

1.4. Improving and developing the YuMuuv Platform, including for security purposes

For these purposes, we may process your personal data, such as your IP address, used devices, e-mail and other communications, any usage, navigation, analytics and log data associated with the use and engagement with the YuMuuv Platform. We may also use cookies and similar technologies for collecting your personal data for these purposes. The use of cookies (including legal bases and purposes) is described in our Cookie Notice available at https://yumuuv.com/cookie-notice.

The legal basis for the processing of your personal data for this purpose is our legitimate interest in improving our understanding of our partners’ and users’ needs and preferences in order to constantly enhance the functioning of the YuMuuv Platform, including by conducting analytics and ensuring the technical availability and security of the YuMuuv Platform.

1.5. Management of contractual and business relationships

For the purposes of managing our contractual and business relationships, including databases of our partners, we may process your personal data on the basis of our legitimate interest in maintaining such legal relationships. Primarily, this processing concerns the name and contact details of our business partners’ representatives, as well as our correspondence with them. For this purpose, we may also process information about our business customer’s payments and transactions, such as type of subscription, used payment method, details of used bank account. These types of information may, to a limited extent, contain personal data.

1.6. Compliance with our legal obligations

For compliance purposes which derive from applicable law, for example, accounting and tax laws, we may process your personal data on the basis of the respective legal provision obliging us to process the relevant data. This also applies to the processing of your personal data regarding payments and transactions.

1.7. Direct communication

If you opt in to receive our push notifications and/or e-mail communication from us on the YuMuuv Platform, and you consent to receive such communications, we may send you push notifications and/or use your e-mail address for the purpose of sending you updates, offers and other material.

The legal basis to provide you with direct communication is your consent. You may withdraw your consent at any time to stop receiving such communications.

1.8. Establishing, exercising and defending any potential legal claims

If necessary, we may process your personal data in order to establish, exercise or defend legal claims arising out of or in relation to the legal relationship between us and you (or the entity you represent) on the basis of our legitimate interest.

2. DISCLOSURE AND TRANSFER OF PERSONAL DATA

We put our best efforts to keep your personal data safe and always require a high level of security and confidentiality from our employees and partners.

We may disclose and share certain categories of your personal data:

  • with other users when you participate in the wellness-related challenges (including to organisers of such challenges);
  • with our trusted services providers when they provide services to us or to you, on behalf of us and under our instructions (such as cloud-based and payment service providers, IT-support, legal and accounting service providers, etc.). We will control and shall remain responsible for the use of your personal data in such cases;
  • with our partners, who provide us with tools for analytics (who may, in particular, process statistical browsing data, such as Google Analytics);
  • to public authorities if we are required to disclose personal data by applicable law or to comply with a lawful request of authorities; and
  • in relation to a merger, acquisition or sale of our business or its part(s).

We may transfer your personal data outside of the European Economic Area in limited cases. In such a case, we implement adequate safeguards to protect your personal data, such as the standard contractual clauses for transfers established by the European Commission. You can contact us to get more information about the transfers of your personal data, for this please use the contact details brought out in the beginning of this Privacy Notice.

3. RETENTION OF YOUR PERSONAL DATA

We process your personal data only for as long as necessary for the fulfilment of the original purposes of personal data processing described above. Most of your personal data will be kept until the end of the legal relationship with us, i.e. until your account on the YuMuuv Platform is active. However, we may keep some of your personal data for longer, if this is necessary to achieve our legitimate interests or where this is required to fulfil our obligations deriving from applicable law.

We determine the appropriate retention period for personal data on the basis of the amount, nature, and sensitivity of the personal data being processed, the potential risk of harm from unauthorised use or disclosure of the personal data, whether we can achieve the purposes of the processing through other means, and on the basis of applicable requirements deriving from applicable law.

When the retention of your personal data is no longer necessary to achieve the purposes of processing, your data will be permanently removed, unless you instruct us otherwise and we agree on the terms on longer storage of your data.

4. YOUR RIGHTS AS A DATA SUBJECT

By contacting us at the contact details provided in the beginning of this Privacy Notice, you may exercise your rights as the data subject to the extent permitted under applicable law, including the following rights:

  • You may request access to your personal data;
  • To the extent permitted under applicable law, you may request us to correct, update, change or erase your personal data. In some cases you may also have a right to restrict processing and object to the processing of your personal data;
  • If you request the erasure of your personal data, please note that certain personal data is strictly necessary in order to fulfil the purposes defined in this Privacy Notice and the processing of which may also be required by applicable law. If personal data is erased under your request, we will only retain such copies of the information as are necessary for us to protect our or third parties’ legitimate interests, comply with authorities’ orders, resolve disputes, troubleshoot problems, or enforce any agreement you have (or the entity you represent has) entered into with us. Therefore, such personal data may not be erased in full;
  • You may withdraw your consent regarding the processing of your personal data, where the legal basis for processing is your consent. Please note that withdrawal of consent does not affect the lawfulness of the processing of personal data carried out on the basis of consent before withdrawal;
  • You may use your right to data portability. In some cases we may limit or deny your request if we are required or permitted by applicable law to do so, e.g. if it is necessary for the purpose of our legitimate interest to protect our trade secrets or any other confidential information; and
  • To the extent permitted under applicable law, you may request more information about our legitimate interest and why we think our legitimate interest overrides your rights and interests as a data subject. This applies where the legal basis for the processing of your personal data is our legitimate interest.

We will respond to your requests and to provide you with additional privacy-related information within the timeframes specified in applicable personal data protection law. Please note that we may ask you for additional information to adequately verify your identity before taking action on your request to exercise your rights as a data subject.

If you are not satisfied with our response or have a concern that your privacy rights have been infringed, you have the right to lodge a complaint with your local supervisory authority. List and contact details of European supervisory authorities can be found here.

5. SECURITY MEASURES

We implement reasonable technical and organisational measures (including physical, electronic and administrative) to protect your personal data from loss, destruction, misuse and unauthorised access or disclosure, including by implementing additional restrictions or measures for safeguarding special categories of personal data (in particular, health data) which are, for instance, retained separately from any other personal data.

Please note that no method of transmission over the Internet, or method of electronic storage, is fully secure. While we use all reasonable efforts to protect your personal data from loss, destruction, unauthorised access, misuse, or disclosure, we cannot fully guarantee the security of your personal data.

6. UPDATES TO THIS PRIVACY NOTICE

From time to time, we may update this Privacy Notice in order to adapt it to any updates that might arise. In case of making any substantial update, we will notify you via the e-mail that you have, or the company on behalf of whom you use our services has, communicated us. This Privacy Notice was last updated as of the “Last updated” date indicated above.

APPENDIX OF THE PRIVACY NOTICE ON RECRUITMENT

This Appendix of the Privacy Notice describes the processing of your personal data in case you apply for a vacant job position with us, either on your own initiative or as a result of a targeted search which may be carried out by or on behalf of us. If applicable, this Appendix shall also apply to internship applications.

The aspects not covered by this Appendix are described in the general part of the Privacy Notice (e.g., disclosure and transfer of your personal data, information on your rights as a data subject).

1. PERSONAL DATA WE COLLECT

As your prospective employer, we collect your personal data in a variety of ways. In particular, we process personal data provided directly by you during the recruitment process. We may also receive your personal data from recruitment agencies. To the extent permitted by applicable law, we may also collect your personal data from other third parties, such as public databases and recruitment portals, and also by contacting your educational institution, previous employers, and referees indicated in the job application.

We may collect certain personal data necessary for the recruitment process, including:

  • general personal data, such as your name, personal identification code, citizenship, gender, date and place of birth, and the language of communication;
  • contact details, such as your e-mail address, home address and phone number;
  • information contained in your job application and curriculum vitae (CV), such as your level of education and educational institution(s), language skills, your previous employers, job description and title, experience (including commencement and end dates of your previous employments), in progress and completed trainings and received certificates, information about the job position, salary and other benefits desired and, where applicable, information about the existence or need for a visa and/or residence permit (i.e., possibility of relocation);
  • other data collected and processed during the recruitment process, such as the status of the recruitment process, exchange of information related to the recruitment process (in particular, data collected during interviews), information on recommendations and referees, aptitude tests and suitability exercises (if applicable), information on the results of the recruitment process and the reasons thereof.

We may also collect other personal information about you that you voluntarily provide to us by submitting the job application or during your recruitment process. Therefore, you can provide us with additional personal data if you deem so, but any additional data is not generally required for the recruitment process.

Please note that if you do not provide certain personal data listed above, which we may be obliged to collect for the purposes of taking steps to conclude an employment (or service) contract with you, we may not be able to conclude the relevant contract with you.

2. PURPOSES AND LEGAL BASES OF DATA PROCESSING

Depending on the specific personal data processing operation in question, we may process your personal data during the recruitment process (and to a limited extent, after the recruitment) for the following purposes and on the following legal bases:

2.1. Taking steps prior to entering into an employment (or service) contract with you

For these purposes, including when you apply for a vacant position on your own initiative, as well as for the negotiation of the relevant contract and performing related processes (e.g., preparation of the contract), the legal basis for the processing of your personal data is to take the necessary steps for the conclusion of the contract with you (Article 6(1)(b) of the GDPR).

2.2. Achieving and protecting our legitimate business interests, such as:

  • conducting a targeted search of prospective employees, as well as to invite you to submit the job application as a result of such targeted search;
  • contacting you in relation to the job application you have submitted, and the recruitment process in general;
  • assessing your application and suitability for the position in order to hire the applicants best suited for the position at hand, including by verifying the information you have provided, carrying out aptitude tests and suitability exercises (if applicable), contacting the referees indicated by you;
  • establishing, exercising, and defending legal claims.

For these purposes, the legal basis for the processing of your personal data is our legitimate interest (Article 6(1)(f) of the GDPR). We rely on our legitimate interest only where it outweighs your interests and rights as a data subject.

2.3. Retaining your personal data for the purpose of contacting you in the future to invite you to apply for a vacant position

For these purposes, the legal basis for the processing of your personal data is your consent (Article 6(1)(a) of the GDPR). You may withdraw your consent at any time by contacting us at the contact details set out in the general part of the Privacy Notice. Please note that the withdrawal of consent does not affect the lawfulness of the processing of personal data carried out on the basis of consent before withdrawal.

3. RETENTION OF YOUR PERSONAL DATA

We process and retain your personal data as long as necessary to achieve the purposes described in this Appendix. Most of your personal data will be retained for up to 1 year after the recruitment process is completed. In some cases, personal data may be retained for a longer period if storage of personal data is required in order to protect our legitimate interests, e.g., in case of a legal dispute.

For successful job applicants, your personal data shall continue to be processed in accordance with the rules applicable to employees' personal data processing. The relevant notice for employees shall be presented to you at the time of the conclusion of the contractual relationship.

If you are not selected but wish us to retain your information for future job openings, we will retain your data based on your consent for the period specified in the consent.