Introduction
Nurmi is committed to protecting and respecting your privacy. Nurmi is a trading name of Clifton Steps. Throughout this Privacy Policy, the terms “Nurmi”, “we”, “us”, “platform” and “our” refer to Clifton Steps Limited. We are a Limited Company established in United Kingdom with a registered office at 55 Sea road, Milford on Sea, SO410PH and registered company number 16118889 and for the purpose of applicable data protection laws, we are the data controller.
This Privacy Policy sets out the basis on which we will process any personal data or usage information we collect from you, or that you provide to us, in connection with your use of our website, mobile applications and related services we provide to you (together, the “Services”).
Please read this Privacy Policy carefully so that you understand your rights in relation to your personal data, and how we will collect, use and process your personal data. This Privacy Policy supplements any other privacy related notices and policies we may provide to you from time to time, and is not intended to override them. If you do not agree with this Privacy Policy in general or any part of it, you should not use our Services or otherwise provide your information to us.
Our services are not intended for children under 18 years of age. If you are under this age, you should not use the Services. Our Services use technical measures to prevent children under 18 years of age from creating an account and therefore we do not knowingly collect personal data from any persons under such age. If we become aware that a child has provided us with personal information, we will take steps to delete that information, terminate that person’s account, and restrict access to that person.
We change our Privacy Policy from time to time. We will note on our Services when our Privacy Policy has been updated. If you object to any changes to this Privacy Policy, you should stop using the Services and delete your account.
The information we collect
Information you give to us
You may provide some or all of the following personal data to us by applying or subscribing to our products or services, creating an account with us, contacting us via our Services or by telephone, text/SMS, email, social media or our “contact us” page, or otherwise signing up for our newsletters or alerts.
- Account Information: Name, email, date of birth and your contact details such as your email address.
- Training Data: Workout history, goals, fitness level, and training preferences.
Information we collect automatically
When you use our Services we automatically collect the information sent to us by your computer, mobile phone or other device. This information includes:
- (i) your IP address and app usage logs, including but not limited to, feature engagement, crash reports etc;
- (ii) device information including, but not limited to, name and type of operating system;
- (iii) mobile network information;
- (iv) transaction information (but not payment card or account details), including device information, transaction details, and IP address;
- (vi) security information including device and internet connection information.
Information we collect from third parties
- Connected Apps and Devices: If you choose to connect third-party services (e.g., Apple Health, Garmin Connect, Strava), we may access: (i) activity data from logged workouts; (ii) health information such as heart rate, VO₂ max, recovery metrics, sleep, step count, and other fitness indicators; (iii) GPS and location data, if enabled.
How do we use your information?
We process your personal data in order to perform our contract with you, such as:
- Provide you with our Services;
- Register and maintain your account with us
We obtain your consent to process your personal data for the following reasons:
- Sign you up for our newsletters or alerts;
- If you opted into marketing, to communicate with you about products, services, marketing, promotions, events and other news and information we think will be of interest to you; and
- Where we are processing any special category data.
In order to be responsive to you, to provide effective services to you, and to maintain our business relationship, as a matter of our legitimate interests, we will use your personal data to:
- Administer the Services, and for internal operations, in order to conduct troubleshooting, data analysis, testing, research, statistical and survey analysis;
- Maintain the safety and security of our users, our Services, and business;
- Send you announcements in relation to security, privacy or administrative related communications (these communications are not marketing orientated, and we do not rely on consent, so you may not opt out);
- Personalise our Services to ensure content is presented in the most effective manner for you and your device; and
- Improve and develop our products.
In addition, we will use some or all of the above information to comply with any applicable legal obligations, to enforce any applicable terms and conditions and/ or terms of service, and to protect or defend the Services, our rights, the rights of our users, or others.
How we share your information
We do not use or share your personal data with others except as described in this Privacy Policy. In certain circumstances, we will share your information with third parties with your consent, as necessary, or as otherwise required or permitted by law. Specifically, we share your personal data:
- With service providers and vendors. Such third parties include: (i) cloud storage and analytics providers, that assist us with many different functions and tasks; and (ii) providers of large language models, to help us provide enhanced coaching insights.
- When you request us to share certain information with third parties, with consent or to perform a contract with you. With your permission, we will disclose your personal data to relevant third parties.
- With professional advisors, in our legitimate interests or as required by law. As necessary, we will share your personal data with professional advisors such as auditors, law firms, or accounting firms.
- For legal and security reasons and to protect our services and business, in our legitimate interests or as required by law. We will share your personal data with regulators, law enforcement agencies, public authorities, or any other relevant organisations: (i) in response to a legal obligation; (ii) if we have determined that it is necessary to share your personal data to comply with applicable law or any obligations thereunder, including cooperation with law enforcement, judicial orders, and regulatory inquiries; (iii) to protect the interests of, and ensure the safety and security, of us, our users, a third party or the public; (iv) to exercise or defend legal claims; and (v) to enforce our terms and conditions, other applicable terms of service, or other agreements.
Where we store your information
The personal data that we collect from you will be transferred to, and stored at/processed in countries outside [the European Economic Area (“EEA”) and the United Kingdom (“UK”)]. Your personal data is also processed by staff operating [outside the EEA and the UK] who work for us or one of our third party service providers or partners. We will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this Privacy Policy.
For any transfers of data outside [the EEA or the UK], the data transfer will be under the European Commission’s standard contractual clauses for the transfer of personal data to third countries, or the UK Information Commissioner’s international data transfer addendum to the EU standard contractual clauses, as relevant, unless the data transfer is to a country that has been determined by the European Commission or the relevant UK authorities, as applicable, to provide an adequate level of protection for individuals’ rights and freedoms for their personal data.
How long do we store your personal data?
We will retain your personal data as follows:
- Your account data for as long as you keep your account open or as needed to provide you with our Services;
- If you delete your account, we will anonymise your data in no longer than 5 working days;
- If you contact us, we will keep your data for 1 month after you contact us;
- Your technical usage information data on your use of our Services for 24 months;
- Data on your use of our Services is retained for 24 months.
We will also retain and use your personal data to the extent necessary to comply with our legal obligations, resolve disputes and enforce our terms and conditions, other applicable terms of service, and our policies. If you stop using our Services [or if you delete your account with us,] we will store your information in an aggregated and anonymised format; we may use this information indefinitely without further notice to you.
Security
Although we do our best to protect your personal data, we cannot guarantee the security of your information transmitted through the Services or over email, text/SMS, or instant chat; any transmission is at your own risk.
Your rights
You have certain rights in relation to your personal data:
- Access: You have the right to access personal data we hold about you, how we use it, and who we share it with.
- Portability: You have the right to receive a copy of the personal data we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.
- Correction: You have the right to correct any of your personal data we hold that is inaccurate.
- Erasure: In certain circumstance, you have the right to delete the personal data we hold about you.
- Restriction of processing to storage only: You have the right to require us to stop processing the personal data we hold about you, other than for storage purposes, in certain circumstances.
- Objection: You have the right to object to our processing of your personal data.
- Objection to marketing: You can object to marketing at any time by opting-out using the unsubscribe/ opt-out function displayed in our communications to you.
- Withdrawal of consent: Where we rely on consent to process your personal data, you have the right to withdraw this consent at any time.
Please note that a number of these rights only apply in certain circumstances, and all of these rights may be limited by law. For example, where fulfilling your request would adversely affect other individuals or our trade secrets or intellectual property, where there are overriding public interests or where we are required by law to retain your personal data.
To exercise any of these rights, you can contact privacy@nurmi.training and we will respond to requests to exercise these rights without undue delay and at least within one month (though this may be extended by a further two months in certain circumstances).
Third party links
Our Service may contain links to other online platforms, plug-ins or other applications operated by third parties. We do not control such other sites or applications, and are not responsible for their content, their privacy policies, or their use of your information. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators except as disclosed on the Service. We expressly disclaim any and all liability for the actions of third parties, including but without limitation to actions relating to the use and/or disclosure of personal data by third parties. Any information submitted by you directly to these third parties is subject to that third party’s privacy policy.
Automated technologies
Some user interactions, including training questions and responses, may be processed using artificial intelligence models to enhance the coaching experience and to provide more personalised recommendations. We do not share personally identifiable information with such artificial intelligence models.
Complaints
If you have complaints about how we process your personal data, please contact us at privacy@nurmi.training and we will respond to your request as soon as possible. We hope we will be able to resolve any issues you may have. You may also have the right to lodge a complaint with the Information Commissioner (the UK data protection regulator) and/or the relevant supervisory authority in your jurisdiction.
Contact
We welcome your questions, comments, and concerns about this Privacy Policy or your personal data. Please send us any feedback to privacy@nurmi.training
Language
Except as otherwise prescribed by applicable law, in the event of any inconsistency between the English language version and local language version of this Privacy Policy, the English language version will prevail.