Privacy Policy and Notice for App Users Signing Up for ARVRA Services.
1. Introduction
GS Wellness Limited (t/a Arvra) (a company registered in England, UK under number 13774370) (Arvra) values the privacy of its users and clients and strives to protect the privacy and confidentiality of personal data that it uses in connection with the Arvra Wellness platform, accessible via its mobile app (referred to in this Privacy Notice as the App). Arvra, as Data Controller, complies with applicable data protection laws, including the UK’s General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Privacy Notice outlines how your personal information is treated and forms part of the Terms and Conditions of our App. We may from time to time modify our Privacy Notice. We will notify you via our App when we do so.
If you send us your data whilst using our App, this Privacy Notice relates to that data. We only ask for the data we need and do not keep it longer than necessary. We respect your privacy and, save as set out in paragraph 7 below (Security of your data), we will not disclose any personal information to any third party unless we are legally entitled to, obliged to or you have consented.
2. Our contact details - Email address: info@arvra.co.uk. Postal address: FAO: DPO, GS Wellness Limited, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.
3. What personal data do we process and what is our legal basis? When you use our App we may process the following personal data about you:
3.1 Your contact information (Contact Data) – we will collect and process your email address and mobile phone number.
3.2 Your individual details (Identity Data) – name / username and contact information.
3.3 Usage Details (Usage Data) - the date and time you use our App, usage patterns, traffic data and logs.
3.4 Log-in details external parties (Technical Data) - log-in details from third-parties to facilitate log-in into our App.
3.5 Other personal information that you share with us (Profile Data)- any other information that you share with us through your use of our App.
The below outlines the data we process as part of our delivery of the services.
Legal Basis
To install the App and register you as a new App user
o Data processed: Identity and Contact details.
o Legal basis: Performance of a contract with you.
To deliver services to you
o Data processed: Identity and Contact details.
o Legal basis: Performance of a contract with you. Additionally, processing is necessary for our legitimate interests, specifically to recover monies owed to us.
To enable you to receive marketing materials
o Data processed: Identity and Contact details.
o Legal basis: Necessary for our legitimate interests to carry out direct marketing, develop products and services, and grow the business.
To use data analytics for improvements
o Data processed: Technical and Usage data.
o Legal basis: Necessary for our legitimate interests to run the business efficiently, define customer types, keep the website and App relevant, develop the business, and inform marketing strategies.
To deliver relevant content and advertisements
o Data processed: Identity, Contact, Profile, Usage, and Technical data.
o Legal basis: Necessary for our legitimate interests to study how customers use our products and services, develop and grow the business, and inform marketing strategies.
To make suggestions and recommendations
o Data processed: Identity, Contact, Technical, Usage, and Profile data.
o Legal basis: Necessary for our contract with you to develop products and services and grow the business. This includes profiling activities.
To address matters after account closure
o Data processed: Identity, Contact, Profile, and Usage data.
o Legal basis: To comply with legal and regulatory obligations and to protect our business, interests, rights, and those of others.
To provide the Arvra App to you - we require your personal data to be able to provide our services to you. This includes the use of your personal data to allow you to use our App, manage our relationship with you, and all communications related to the ongoing delivery and management of the services.
Use justification:
(1) performance of our contract with you; and
(2) compliance with a legal obligation.
For security purposes and to analyse and continuously improve our App - we may use personal data for testing and improving our App, platform and services, the security thereof and for further tailoring our App to our users’ needs (including by estimating and measuring usage patterns). Only in very exceptional circumstances will we use personal data for testing purposes and if this is necessary, it will always be in a closed and secured environment. We will also use your personal data to inform you when updates of our App are available.
Use justification:
(1) performance of our contract with you; and
(3) for our legitimate business interests (to enable us to ensure the security of our systems and further improve our App).
For marketing our products and services - we may use personal data to contact you by email and send you push notifications in our App for marketing purposes. Where we do so, we will offer you the option to indicate that you would prefer not to receive such marketing. In addition, you may opt-out at any time from any of these marketing communications by contacting us at info@arvra.co.uk.
Use justification:
(1) performance of our contract with you; and
(3) for our legitimate business interests (to provide information which we consider may be of interest to you).
To defend our legitimate interests and to change our business structure - We may disclose personal data in connection with legal proceedings or investigations anywhere in the world to third parties, such as public authorities, law enforcement agencies, regulators and third party litigants (these third parties are not data processors on behalf of Arvra and will process personal data for their own purposes). In confidence, we may also provide your personal data to any potential acquirer of or investor in any part of our business for the purpose of that acquisition or investment.
Use justification:
(1) performance of our contract with you;
(3) legitimate interest (to enable us to cooperate with law enforcement and regulators and to allow us to change our business); and
(5) for legal claims.
Do we disclose your personal data to others and where is data being stored?
Arvra currently stores your personal data on IT systems located in the European Economic Area (EEA), but reserves its right, in compliance with relevant laws, to vary this for those persons living outside of the UK and EEA. Arvra engages various data processors for the processing of your personal data on our behalf, including IT developers, IT service providers and other business service providers.
We have contracts in place with our data processors, which means that they cannot do anything with your personal data unless we have instructed them to do so. They will not share your personal data with any organisation (unless legally required to do so) apart from us. They will hold it securely and retain it for the period that we instruct and then either return it to us or destroy it as we instruct.
Arvra may be legally required to disclose your personal data in response to requests from regulators and law enforcement or security agencies, in which case these regulators and law enforcement or security agencies will be acting as a data controller as well. Arvra will always assess the legitimacy of such requests before disclosing any personal data and will only disclose the personal data required to comply with such a request.
From what sources do we collect your personal data?
We may obtain personal data from various sources, including from you directly through our App.
1. International Data Transfers
Your data captured from the App is stored on our IT systems, currently located in the European Economic Area (EEA) and/or the UK. As such, your personal information may be transferred to a country within the EEA other than the country in which the data was originally collected for the purposes described in this Privacy Notice. For example, if you are located in the United States, your personal information will for the time being be transferred to the the European Economic Area. When we transfer personal information across borders, we consider a variety of requirements that may apply to such transfers.
2. Security of your data
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our written instructions and are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
3. Data retention
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
In some circumstances you can ask us to delete your data: see paragraph 9 below for further information.
4. Your rights concerning the information we hold about you
If you live in the UK or the European Economic Area (EEA), you currently have the following rights for information that Arvra holds about you.
a) Right to access: You have the right to access (and obtain a copy of, if required) the categories of personal information that we hold about you, including the source of the information, purpose, period of processing, and the persons with whom the information is shared.
b) Right to rectification: You have the right to update the information we hold about you or to rectify any inaccuracies. Based on the purpose for which we use your information, you can instruct us to add supplemental information about you to our database.
c) Right to erasure: You have the right to request that we delete your personal information in certain circumstances, such as when it is no longer necessary for the purpose for which it was originally collected.
d) Right to restriction of processing: You may also have the right to request to restrict the use of your information in certain circumstances, such as when you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
e) Right to data portability: You have the right to transfer your information to a third party in a structured, commonly used and machine-readable format, in circumstances where the information is processed with your consent or by automated means.
f) Right to object: You have the right to object to the use of your information in certain circumstances, such as the use of your personal information for direct marketing.
g) Right to complain: You have the right to complain to the appropriate supervisory authority if you have any grievance against the way we collect, use or share your information.
5. Changes to this privacy policy
Arvra may amend this policy from time to time. If we make any substantial changes in the way we use your personal information we will publish this by posting a notice on the App and/or our website.
If you have any questions or concerns, please e-mail info@arvra.co.uk in the first instance as most matters can be resolved informally.
Without prejueice to your other rights, you also have the right to lodge a genuine compliant about our processing with the UK’s Information Commissioner’s Office (ICO). Their address is Wycliffe House, Water Lane, Wilmslow, SK9 5AF.