Integritetspolicy
Pushappy AB (“PushAppy”), 559063-1718, Kungsholmstorg 4, 112 21 Stockholm, is a provider of web-based programs for motivation, follow-up, and pulse measurement (employee surveys) and associated apps. The programs and apps are hereinafter referred to as the “Service.” This Privacy Policy outlines the processing of personal data in accordance with the EU General Data Protection Regulation (2016/679) (GDPR).
When PushAppy is the Data Controller
PushAppy acts as a data controller in some cases and as a data processor in others with regard to the processing of your personal data. This Privacy Policy pertains to when PushAppy is the data controller. If you are an employee of an organization that is a customer of PushAppy, that organization is, in most cases, the data controller in relation to you, and you should contact them to learn more about how they process your personal data in the Service.
We respect your privacy and are committed to protecting your personal data. This Privacy Policy contains information on the processing of personal data for which PushAppy is the data controller and describes, among other things, the purposes for which we process your personal data, with whom we share it, and what rights you have in relation to your personal data.
PushAppy is the data controller when:
- you order the Service and become a customer of PushAppy;
- you are registered as a contact person for your organization with PushAppy;
- you receive login credentials and become a user of the Service;
- you or the entity you represent enter into an agreement with PushAppy and become a business partner;
- you are a potential customer of PushAppy;
- you contact us;
- you receive newsletters and information from us;
- you visit our website and accept cookies (see our Cookie Policy).
What Categories of Personal Data Are Processed
The personal data we process varies depending on our relationship with you, for what purposes we process your personal data, under what circumstances, and on what legal basis the processing is based. These are outlined in the table below.
| When | Category of personal data | Personal data | Legal basis for processing |
|---|---|---|---|
| Collection of Health and Activity Data | Health and activity data | The number of steps taken by the user, as synced from Health Connect. | The processing is based on your explicit consent, which is freely given by you when you choose to activate the feature and explicitly connect the app to your Health Connect account. You can withdraw your consent at any time by deactivating the feature in the application settings or by revoking access within Health Connect. |
| Ordering a Service and becoming a customer | Company information | Company name, Organization number, Address, Postal code, City, Customer number, VAT number, E-mail, Phone number | Fulfill our contractual obligations to you, legitimate interest, and legal obligation |
| CRM information | Notes | Legitimate interest | |
| When logging in and becoming a user of the Service | User information | First name, Surname, E-mail adress, User-ID, Profile Picture | Performance of our obligations and legitimate interest assessment |
| Online identification | IP address | Legitimate interest | |
| Entered into an agreement and becoming a business partner | Company information | Organization number, Company name, Address | Fulfill our contractual obligations to you, |
| Contact information | First name, Last name, E-mail, Phone | Legitimate interest | |
| Potential customer | Company information | Organization number, Company name, Address | Legitimate interest |
| Contact information | Name, E-mail, Phone | Legitimate interest | |
| Contact via the website | Company information | Company name | Legitimate interest |
| Contact information | Name, E-mail, Phone | Legitimate interest | |
| Case details | Message in free text | Legitimate interest | |
| Contact via chat | Company information | Company name | Legitimate interest |
| Contact information | First name, Last name, E-mail, User ID | Legitimate interest | |
| Case details | Message in free text, Attachments, Case number | Legitimate interest | |
| Online identification | Operating system, Browser, Location (approximate) | Legitimate interest | |
| Contact via email | Company information (may occur) | Company name | Legitimate interest |
| Contact information | Name, E-mail | Legitimate interest | |
| Case details | Message in free text, Attachments, Case number | Legitimate interest | |
| Newsletter distribution | Company information (may occur) | Company name | Legitimate interest |
| Contact information | First name, Last name, E-mail | Legitimate interest |
Collection of Step Data
If you enable step tracking in the Service, PushAppy will collect data about your number of steps from your device or a connected service (e.g. Google Health Connect or similar). The processing only takes place after you have enabled this feature in the Service and is intended to give you an enhanced user experience, for example by visualizing your steps in the Service, providing personalized insights into your activity and motivation, or creating incentives and challenges in the Service.
This processing is based on your consent in accordance with Article 6(1)(a) GDPR, and you can withdraw your consent at any time by turning off step tracking in the Service. Once you turn off step tracking, PushAppy will stop collecting further step data.
How Long the Data Is Stored
The data is retained only for as long as is necessary to fulfill the purposes outlined above.
Customers, Users, and Business Partners
PushAppy retains personal data about you as a customer and/or user as long as the customer relationship continues or is necessary to fulfill the purpose of the processing described above. Once the customer relationship ends, we will keep data about you as a customer or user for up to 3 years to allow us to restore data if you return as a customer, unless you object to this processing. After that, your data as a potential customer will be retained until you object to the processing.For those who have never been a customer, personal data may be retained as long as PushAppy’s legitimate business interest exists unless you object to this processing.
In the case of a contract with PushAppy, we will store your data and contact information for the purpose of fulfilling the contract as long as the contract is active. Once the contract ends, we will store the contract and related contact information for 10 years.
Contacting Us
Depending on the way you contact us, data will vary; emails and chat conversations in our support system may be retained for up to 10 years.Newsletter Subscriptions
Indefinitely, unless you opt out of future communications. Your email will be kept on an “unsubscribe” list to prevent further contact.PushAppy may also be required to process certain personal data for a longer period than outlined above to comply with legal or regulatory obligations. For example, data related to you as a customer may be kept for accounting purposes as required by the Swedish Bookkeeping Act.
With Whom Do We Share Your Personal Data
To fulfill the purposes described in previous sections, PushAppy will share your personal data with service providers that process your data solely on our behalf and under our explicit instructions. We will only transfer your personal data to such processors for purposes consistent with those for which we originally collected the data, and we will enter into data processing agreements ensuring that these processors comply with our security requirements and restrictions, including requirements concerning international data transfers. Personal data may also be disclosed to third parties where required by law. Data may thus be provided to authorities if required by law.
Transfers of Personal Data Outside the EU/EEA
PushAppy may transfer your personal data to countries outside the EU/EEA. If so, we will ensure that a legal basis exists for the transfer and that appropriate safeguards are in place to protect your personal data by ensuring that the transfer complies with decisions by the European Commission on adequate data protection.
What Rights Do You Have
As a data subject, you have several rights under the GDPR, including:
Right of Access
You have the right to obtain a copy of the personal data we process about you and to receive supplementary information about our processing of your personal data.Right to Rectification
You have the right to have your personal data corrected if it is inaccurate or incomplete.Right to Erasure
You have the right to request the deletion of your personal data. This applies, for example, when the personal data is no longer necessary for the purposes for which it was collected, or when the personal data has been processed unlawfully, or when you withdraw the consent on which the processing is based. However, we may refuse to delete your data if we are required to retain it to comply with legal obligations or if it is needed to fulfill a contract.Right to Restriction of Processing
You have the right to request restriction of the processing of your personal data, for instance if you contest the accuracy of the data or believe that the processing is unlawful.Right to Object
You have the right to object to processing based on a legitimate interest. If the personal data is used for direct marketing purposes, you have an absolute right to object to that processing.Right to Data Portability
In certain circumstances, you have the right to receive your personal data that you have provided to PushAppy in a structured, commonly used, and machine-readable format and have the right to transmit those data to another service provider if the processing is based on your consent or on a contract.
Protection of Personal Data
PushAppy processes personal data in a manner that aims to ensure its security and to protect it against unauthorized processing, accidental loss, destruction, or damage.
PushAppy achieves this by implementing appropriate technical and organizational security measures, including encryption during transfer and storage, firewalls, access control, logging, backups, regular system updates, and providing guidance to staff who process personal data.
Updates to this Privacy Policy
Our business and its services are continually evolving. This Privacy Policy may be updated due to new data, new legislation, new guidelines or general advice, or other changes in our data processing practices. Any updates to this Privacy Policy will be published on our website. Significant changes of material importance will also be communicated directly to affected parties via email and, where required by law, prior to the changes becoming effective.
This version was last updated on May 15, 2024.
How to Contact Us
You can contact us at happy@pushappy.com or at Pushappy AB, Kungsholmstorg 4, 112 21 Stockholm, Sweden.