Privacy Notice

At Runtastic, we’re continuously striving to provide you with the best possible experience – and your privacy is important to us.

With the following Privacy Notice we want to:

make it easier for you to understand which data we collect and how we use it
give you increased control over your data
and provide a detailed explanation of your rights as a user.

General
Categories of Personal Data we process
Purpose and Legal Basis For Processing of Personal Data
Sharing of Personal Data
Retention of Personal Data
Your Rights concerning Personal Data
Further Information
Changes to the Privacy Notice
Annex 1 - Information for California residents pursuant the California Consumer Privacy Act (“CCPA”)
Annex 2 - Information for Citizen of the Russian Federation under the Russian Federal Law on Personal Data (“Law #152-FZ”)
Annex 3 - Information for Residents in Turkey under the Turkish Personal Data Protection Law No. 6698 ("TPDPL")
Annex 4 - Information for the processing of personal data in the scope of the Brazilian Lei Geral de Proteção de Dados („LGPD“)
Annex 5 - Information for the processing of personal data in the scope of the Korean Personal Information Protection Act ("PIPA")
Annex 6 - Information for the processing of personal data in the scope of the Peruvian Personal Data Protection Law N° 29733 ("PDPL")
Annex 7 - Information for the processing of personal data in the scope of the Data Privacy Act of 2012 of the Republic of the Philippines

1. General

1.1 Controller. Runtastic GmbH, FN 334397k, Pluskaufstraße 7, 4061 Pasching, Austria (see our imprint) (“Runtastic“, “we”, “us”), is a brand of adidas AG, Adi-Dassler Strasse 1, 91074 Herzogenaurach, Germany (“adidas”). We process your personal data as a controller when you use our apps (“Apps”, go here for a list of all Apps) or website (“Website” and, together with the Apps, “Products“) or otherwise get in contact and communicate with us.

1.2 Applicable Law. The processing of your personal data takes place in compliance with applicable local data privacy laws, e.g. the EU General Data Protection Regulation (“GDPR“) or the Austrian data protection act in its current form.

1.3 Content. In this Privacy Notice (“Privacy Notice”) we want to provide you with information about us, the nature, scope and purposes of the data processing, e.g. collection and use, giving you insights into the processing of your personal data related to the use of our Products. Please note that the processing of personal data of business partners and applicants is not subject to this Privacy Notice. Corresponding information can be found in separate privacy policies.

1.4 Contact. Our general point of contact for all questions, requests or concerns in regard to the processing of personal data is the email address: dataprotection@runtastic.com (“the Email Address“). In addition, you can also contact us by mail at the above-mentioned postal address, to the attention of the Data Protection Officer or check our privacy help pages for frequently asked information.

1.5 Data Protection Officer. Our Data Protection Officer can be contacted under the Email Address. Should you have any questions regarding the processing of your personal data, please do not hesitate to contact him/her.

2. Categories of Personal Data we process

2.1 Data Sources. Runtastic processes personal data that you directly or indirectly make available to us, for example by using our Products, that others provide to us, for example when you link your profile with a Partner Platform, or that we generated on our own, for example your user ID. Please note that the exact amount of personal data we process regarding you depends on how you use our products. Therefore, we may not process personal data concerning you in all categories.

2.2 Categories of personal data we collect from you or generate. These are the categories of personal data we might collect directly or indirectly from you and/or generate on our own
Identity information - Any information that identifies you as an individual living person, including but not limited to: name (first name, last name, initials), date of birth, e-mail address, gender, profile picture, unique customer identifier number, nickname, password and gift card codes that are assigned to you.
Contact information - Any information that can be used to contact you, including but not limited to: phone number, shipping and billing address, e-mail address, Messenger ID, social media handle or any other communication channel you have used to contact us.
Location information - Any information we can use to know or guess where you are, real time or otherwise, including but not limited to: chosen residential location, current log-in location (IP address), real-time device location information via device sensors and signals, GPS location (if you wish to it share with us, for example through your mobile device settings) or information that helps us guess where you may be such as the specific Runtastic and adidas website you have visited that might give us clues about where you are or when you “check-in” to an event or website on a social media page indicating location, if it is shared with us.
Size information - Any information related to your body measurements, including but not limited to: shoe size, clothes size, height, weight.
Purchase Information - Any information we use to complete or in relation to your purchase record and invoice, including but not limited to: payment provider, duration of Runtastic subscription, price, currency and VAT (based on country info). Although we do not store or otherwise process any credit card or bank details ourselves, we process a payment ID number given by the respective Payment Service Provider and can be allocated to you.
Profile and Community Information - Any information you provide to us in your social profile and/or when interacting with our communities and other users, including but not limited to: follower information in the Runtastic community, information provided when you participating in Runtastic or adidas events/challenges and groups/communities either as a trainer, team member, a participant or as a promoter, pictures and videos you share, information you provide in your profile biography, team memberships and roles there, interests, feedback, likes and comments, leaderboard rankings, event participation, joined groups including roles as well as challenge participations and success.If you explicitly allow us to access your phone book, we will compare the email addresses of your contacts with email addresses from registered users within the Runtastic community and show you a list of people you might want to follow. Anyhow, we do not store this information.
Social Media Information - Any information about you we obtain through your interaction with us on social media channels, including but not limited to: any social media information that is publicly available such as your social media handles, social media interactions and public postings, “Likes” and other reactions, social media connections, photos that are public, or those send to us by mentioning us or following our social media posts by using “handles” or “hashtags” and comments or messages you shared with us publicly or privately on social media platforms.
Device Information - Any information related to your (mobile) device, which is collected by our Apps, including but not limited to: device EUI, device ID, device fingerprint, IP/Wifi Information, operating system, data stored on device when access is granted, log information when access to device is granted, Partner Platform Apps installed and device type and version.
Browsing information - Any information on your browsing behavior, including but not limited to: browser name, IP address, clickstream data, date and time of the visit, time remained on Website, pages visited, links clicked in our marketing messages or Website, transmitted data volume, the referral URL (if you came to our Website via a different site or an advertisement), browser language and version and add-ons.Activity information - Any information connected to your fitness activity which you track using our Products or import, including but not limited to: activity type, distance, exercise duration, exercise routine (start and finish time), fitness score, pace, space utilization data, speed, calories burned, heart rate, RunScore, nutrition information, GPS maps and photos.
Correspondence - Any information you share through correspondence you have with our Customer Happiness Agents, and/or other employees and personnel including any opinion you share with us that indicate your point of view and comments. This may include when you provide us feedback and review rating our service or products, or if you participate in any product research and development surveys.
Preference Information - Any information which indicates your preference whether explicitly, if provided by you, or inferred, including but not limited to: activity preference (sports), site/brand preference, preferred language, product and product attributes preferences, units (distance, weight, temperature), personal goals and motivation (e.g. yearly running goal, weight goal), training plan information, custom workouts, equipment information (brand, model, size, color, picture) and product reviews.3. Personal Data we receive from others. This is the personal data we receive from the following third parties:
Registration via Facebook or Google - If you register an Runtastic account via social login, we will receive the following information from the respective provider:

Facebook Inc. (1601 South California Avenue, Palo Alto, CA 94304, USA, “Facebook”): First and last name, email address, gender, birthdate and profile picture.
Google Inc. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA, “Google”): First and last name, email address, gender, birthdate and profile picture.

Facebook Friend List - We will receive information about your friends on Facebook from Facebook if you explicitly allow us to access it. We will use this information to make suggestions on people you might want to follow in the Products, but do not store it
Partner Platforms - We offer an automatic import of your activity information from other platforms we have a partnership with (“Partner Platforms”). However, we only import personal data from Partner Platforms if you have given us and the partner the order to connect your Runtastic account with the respective Partner Platform.
Apple HealthKit - We provide the opportunity to sync our Products with Apple’s (Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA; “Apple”) HealthKit framework, which provides a central repository for health and fitness data on iPhone and Apple Watch.Within the Health Kit settings, you can decide if you want to allow our Products to read the personal data listed there and import it to the Products, to write personal data collected in our Products (please see Sharing of personal data with other services in this regard) in the Health Kit or both.
Google Fit - We provide the opportunity to sync our Products with Google’s Fit SDK which is an open platform that lets users control their fitness data.Within Google Fits settings you can decide if you want to allow the Products to read personal data listed in Google Fit and import it to the Products, to write personal data collected in our Products in Google Fit (please see Sharing of personal data with other services in this regard) or both.

3. Purpose and Legal Basis For Processing of Personal Data

3.1 General Information. In general, we collect and use personal data for specific purposes. However, please note that we may sometimes also use such personal data for other purposes if we have the right and permission (“legal basis”) to do so.

In this section, we provide details to all scenarios and reasons (“purposes”) where we may collect (directly and indirectly) and otherwise process your personal data. We will provide information on the legal basis of these processing activities, on what categories of personal data are affected and on categories of third parties that we share data with for the respective purpose.

3.2 Communication. We process personal data in order to communicate with you regarding the user agreement you have with us. This includes for example sending you information on changes to our Terms and Conditions or Privacy Notice, sending you invoices for paid subscriptions or information on new features of our Products of the potential fade out of certain features.The legal basis for these processing activities is the performance of your contract with us.The data categories processed for this purpose are Identity Information, Contact Information, Location Information, Purchase Information, Correspondence and Preference Information.For this purpose we share personal data with Processors, in this case with Messaging Service Providers and CRM Solution Providers.3. Providing our Products. We process your personal data to be able to provide you with a seamless user experience when using our Products and the Products features.We may collect your Personal Data for this purpose by using technologies such as cookies, pixels and tags to collect your device information. For more information on the cookies we use, the personal data they collect, and how to disable them, please see our Cookie Policy .The legal basis for these processing activities is the performance of your user agreement with us.The data categories processed for this purpose are Identity Information, Contact Information, Location Information, Purchase information, Size Information, Profile and Community Information, Device Information, Browsing Information, Activity Information, Correspondence and Preference Information.For this purpose we share personal data with other users, other services (where applicable - see Sharing of personal data with other services. for more information), Processors, in this case with Cloud Solution Providers, CRM Solution Providers, Authentication Solution Providers and Payment Solution Providers, and with Partners (where applicable - see Sharing of personal data with adidas and partners for more information).

3.4 Event Registration and Participation. When you sign up for an event which we organize that have limited spots, we use the personal data you provide to reserve a spot for you. We often also organize events that are open to all users. We use the personal data you provide to keep you informed of the events you are interested in. Please read the specific privacy notice we may publish at the time of the registration if available.Please note that we conduct all events on behalf of or in cooperation with adidas. For the processing of the corresponding data, we are therefore joint controllers or processors for adidas, which in turn processes the data in accordance with its Privacy Notice.The legal basis for these processing activities is the performance of your contract with us.The data categories processed for this purpose are specified in the specific privacy notice we may publish at the time of the registration.For this purpose we share personal data with other users, Processors, in this case with Cloud Solution Providers and CRM Solution Providers, and with Partners that host the event with us, where applicable.

3.5 User Experience - Global credential to all adidas/Runtastic Platforms. User log-in identities and account management for all adidas / Runtastic platforms are administered centrally by adidas, so users can use one set of credentials to log in to participating platforms. Your adidas log-in credentials are stored in the global authentication platform. When you use your adidas log-in to access our Products, we will use a token to verify your identity from the global authentication platform. This further ensures our network and domain security. Besides providing you access to our Products and protecting your account, we and adidas use your personal data provided for this purpose to administer your account, including sending account management related messages, such as password reset.We may collect your Personal Data for this purpose by using technologies such as cookies, pixels and tags to collect your device information. For more information on the cookies we use, the personal data they collect, and how to disable them, please see our Cookie Policy .The legal basis for these processing activities is our legitimate interest.The data categories processed for this purpose are Identity Information, Contact Information and Device Information.For this purpose we share personal data with adidas and with Processors, in this case with Authentication Solution Providers.

3.6 Prize Delivery. Once you won a prize in a sweepstakes we hosted, potentially together with a partner, we will use your contact details (home and/or shipping address) and other information necessary to inform you and to deliver the products you have won.The legal basis for these processing activities is the performance of your contract with us.The data categories processed for this purpose are Identity Information, Contact Information and other information necessary to deliver your prize (e.g. Size Information where applicable).For this purpose we share personal data with Processors, in this case with, CRM Solution Providers and Messaging Service Providers, and with shipping companies, where applicable.

3.7 Customer Support. We process your personal data to answer your queries about your use of our Products and respond to your questions and concerns through various communications channels we make available to you, including if you contact us for questions about your privacy rights. Your requests to our customer service will be analyzed so that we can provide you with valuable service in the future.The legal basis for these processing activities is our legitimate interest or, in the case of privacy issues, our legal obligation to process them, if applicable.The data categories processed for this purpose are Identity Information, Contact Information, Location Information, Purchase Information, Profile and Community Information, Device Information, Browsing Information, Activity Information, Correspondence, Preference Information and adiClub Information.For this purpose we share personal data with Processors, in this case with, CRM Solution Providers and Messaging Service Providers.

3.8 Operating the Products. We screen all traffic to our Websites and Apps and analyze data that is received by our servers to: a) run the Websites that are connected to our domain and Apps, b) fix bugs to make sure the layout and design are displayed properly, and c) fix bugs to make sure the Websites and the Apps function properly, and d) to monitor compliance with our Terms and Conditions.We may collect your Personal Data for this purpose by using technologies such as cookies, pixels and tags to collect your device information. For more information on the cookies we use, the personal data they collect, and how to disable them, please see our Cookie Policy .The legal basis for these processing activities is our legitimate interest.The data categories processed for this purpose are Identity Information, Browsing Information and Device Information.For this purpose we share personal data with Processors, in this case with Data Analytics Solution Providers.

3.9 Product Research and Development. We conduct analysis and research to improve our products and services. This includes asking you questions in surveys, asking you for feedback or asking you to test our Products and provide us with a review. We collect this information based on your consent. Where it is possible for the specific project or upon your request, we will remove any Identity, Contact, or Device Information, so the information cannot be used to identify you anymore and is considered “anonymized”.The legal basis for these processing activities is your explicit consent. You can always revoke a consent you have given.The data categories processed for this purpose depend on the specific project/survey and might include all categories of personal data we process.For this purpose we share personal data with Processors, in this case with Research/Survey Solution Providers and CRM Solution Providers.

3.10 Domain and Network Security and User Authentication. To protect our domains, detect unusual activities, and prevent security threats and protect our users from unauthorized accesses (such as hackers), we screen all traffic to our Products, and authenticate user log-in information using tokens to verify the details you provide to us and compare it with other available information, such us the credentials you have provided directly to us or other platforms (such as Facebook) or information that is available in the public domain to ensure only “authorized” users have access to our Products.
The legal basis for these processing activities is our legitimate interest.
The data categories processed for this purpose are Identity Information, Contact Information, Browsing Information and Device Information.
For this purpose we share personal data with Processors, in this case with Authentication Solution Providers and Data Analytics Solution Providers.

3.11 Business Operational Analytics. We need to know how we do as a business. This is in the interest of our shareholders, our board members, our employees, and our partners, as well as our users. We create data models for different analytical purposes and analyze using these data models how our Products are selling in different markets, what are the popular features of our Products, what worked and what didn't in terms of our marketing and advertising campaigns, our Product designs and distribution strategy, our website design and overall user experience, so we can establish, implement, and evaluate our business strategy.This includes, for example, analyzing data to understand how users browse our Website and use the Apps to improve our user experience design to make sure you will continue to use our Products and interact with us on our Websites and Apps.We may collect your Personal Data for this purpose by using technologies such as cookies, pixels and tags to collect your device information. For more information on the cookies we use, the personal data they collect, and how to disable them, please see our Cookie Policy .The legal basis for these processing activities is our legitimate interest.The data categories processed for this purpose are Identity Information, Location Information, Purchase Information, Profile and Community Information, Social Media Information, Device Information, Browsing Information, Activity Information, Correspondence Information and Preference Information.For this purpose we share personal data with Processors, in this case with Data Analytics Solution Providers and Cloud Solution Providers.

3.12 Personalized Marketing Messages Via Email / Push Notification. Upon your explicit consent, we send you marketing messages that we think you would be interested in (“personalized”) to the email address you provide to us or via push-notifications when you have installed our Apps.We might also send such messages when you purchase our Products and we consider that to be an indication of interests to our Products, services, promotions, and various offerings.To send you “personalized” messages, we observe your online (and sometimes, where applicable, offline) behavior, and analyze it to best estimate what you might be interested in, and you can benefit from. We therefore use different analytics tools to understand what your behavior means in terms of your like and dislike of our Products, and to understand the impact (success rates) of the messages delivered to you.We may collect your Personal Data for this purpose by using technologies such as cookies, pixels and tags to collect your device information. For more information on the cookies we use, the personal data they collect, and how to disable them, please see our Cookie Policy .Additionally, we assess your behavior when reading such emails with the help of so-called web beacons or tracking pixels.The legal basis for these processing activities is your explicit consent or our legitimate interest. You can always revoke a consent given or object to the data processing for this purpose which is based on our legitimate interestThe data categories processed for this purpose are Identity Information, Contact Information, Location Information, Purchase Information, Profile and Community Information, Social Media Information, Device Information, Browsing Information, Activity Information, Correspondence Information, Preference Information and adiClub Information.For this purpose we share personal data with Processors, in this case with CRM Solution Providers and Messaging Service Providers.

3.13 Targeted messages on 3rd-party advertising platforms. We use third-party solutions to send targeted campaigns and messages on their platforms. Therefore, Social Media Platforms will attempt to match your profile in their database to determine the optimal time and place (e.g the page you are browsing) to show an advertisement from Runtastic. Besides that, we analyze information to understand the impact of our campaigns.Please note that you may see ads from Runtastic on social media or other platforms even if you have not consented to data processing for this purpose. This will not happen based on the fact that we process and share your personal data, but randomly.We may collect your Personal Data for this purpose by using technologies such as cookies, pixels and tags to collect your device information. For more information on the cookies we use, the personal data they collect, and how to disable them, please see our Cookie Policy .The legal basis for these processing activities is your explicit consent. You can always revoke a consent you have given.The data categories processed for this purpose are Identity Information, Contact Information, Location Information, Purchase Information, Profile and Community Information, Social Media Information, Device Information, Browsing Information, Activity Information and Preference Information.For this purpose we share personal data with Processors, in this case with Advertising Solution Providers and Data Analytics Solution Providers.

3.14 Cooperation with Law Enforcement and Regulatory Authorities (including Courts). When we are legally required to provide your personal data for national and public security reasons, crime prevention, investigation and prosecution, anti-money laundering, judicial proceedings, protection of other individuals’ rights and freedoms, and enforcement of civil claims, we will provide information as requested by the authorities or parties once we are satisfied that the request is mandated by law. We may not be able to notify you if it is against the law to do so.The legal basis for these processing activities is our respective legal obligation, the necessity in order to protect the vital interests’ people or the necessity for public interest.The data categories processed for this purpose depend on the specific request/obligation and might include all categories of personal data we process. Anyhow, we will always limit the amount of personal data processed for this purpose to the smallest amount possible.For this purpose we share personal data with authorities, including courts and with Processors, in this case with Messaging Service Providers.

3.15 Contract Dispute and/or Legal Compliance. We need to keep evidence in case of any contractual dispute, or to defend ourselves in case of any investigatory audits or privacy compliance disputes and complaints, including how we have handled your privacy rights. Besides that, we might also have to process certain information which might include personal data to comply with statutory retention periods.The legal basis for these processing activities is our respective legal obligation or our legitimate interest.The data categories processed for this purpose depend on the specific obligation and situation and might include all categories of personal data we process. Anyhow, we will always limit the amount of personal data processed for this purpose to the smallest amount possible.For this purpose we share personal data with authorities, including courts, our lawyers and tax advisors and Processors, in this case Cloud Solution Providers and Messaging Service Providers.

4. Sharing of Personal Data

4.1 General Information. We share your personal data with third parties

if this is necessary, for the purposes listed above,
if you have instructed us to do so (e.g. if you connect your account to a partner platform),
to exercise or protect the rights and interests of Runtastic, our users and personnel, or
if you have (explicitly) consented beforehand.

We distinguish between the following categories of third-parties we share personal data with:

other users of our Products,
other services,* Processors,
adidas and other Partners,
authorities including courts and
lawyers and tax advisors.

4.2 Sharing of personal data with other users. The use of certain features of our Products includes the sharing of personal data with other users. These features would not work without such data sharing, i.e. it is necessary to fulfill our user agreement with you. Using the following features includes sharing of personal data with, i.e. making personal data visible to other users:

Your Runtastic profile and Followers - We distinguish between “private profiles” and “public profiles” where all profiles are private by default and only become public on your request. As long as your profile is a “private profile”, other users will see your name, your profile picture, your background image, your biography text, your country of residence and the common followers you have with the user visiting your profile. Moreover, all users will see the number of Followers you have and the amount of people you follow.When your profile is a “private profile”, other users can send you a request to become your Followers. Once you accept this request, all information, which according to your privacy settings, you share with Followers, will become visible for those users, your Followers.Once you make your profile a “public profile”, your profile is fully visible to all other users of our Products by default unless for certain data, like GPS maps for example, you determine otherwise in the privacy settings. This means by making your profile a public profile, all privacy settings are set to “everybody” and all other Runtastic users can access your AR info, activity records and details, statistics and the connections you have without even following you. In case you don't want to have certain data publicly available, you need to change the corresponding privacy setting accordingly. In any case other users, except blocked users, might follow a public profile without a need to request.
News Feed - Our Products allow viewing and sharing information, including through posts, likes, and comments in the so-called News Feed. Certain actions, such as tracking an activity, starting a training plan or upgrading to Premium Membership, will be automatically posted in the News Feed. By default setting, only you and your Followers will be able to see such information in their News Feed. You can modify the visibility anytime in your privacy settings.
Leaderboard - If you track an activity, you will automatically join a weekly/monthly Leaderboard of accumulated distance, or duration among the people you follow. This means, once you are followed by someone, you will be part of their Leaderboard. You can opt out of this at any time in your privacy settings.
Challenges - We offer participation in competitions with a specific goal in a defined timeframe (“Challenges”). There are different challenges available for registered users to join, potentially with the possibility to win prices. You can compare your ranking/success with all users who are part of the same challenge. First name, last name, profile picture and activity information (e.g. total distance, total duration) are visible to all participating users.
Groups and Communities - Every user can join and create groups and can invite other users to these groups. Users can also be invited to communities. Within a group or community, you can interact with other members and compare your rankings. First name, last name, profile picture and activity information (e.g. total distance, total duration) are visible to all users within a specific group or community you joined.
LIVE Tracking - The Products include a "LIVE Tracking" feature, which enables your Followers in our Products to see the activity information, including heart rates, of your current sports activity. LIVE Tracking can either be completely activated or completely deactivated. LIVE Tracking is deactivated by default and can be activated at your own discretion. Once activated, it stays activated for new activities, unless you turn it off again. By activating the feature, you accept the responsibility for such activation at your own risk. If you do not want to give other people access to your current position/localization, LIVE Tracking should not be activated.

4.3 Sharing of personal data with other services. We allow you to connect our Products to several Partner Platforms and/or other services and share personal data you have recorded or generated with or in our Products there. Please note that once personal data is transferred to a Partner Platform or other service, the further processing of this data will take place outside our responsibility and according to the partners Privacy Notice.
Partner Platforms - If you connect your Runtastic profile with your accounts on Partner Platforms and decide to import or share personal data from our products there, this includes the transfer of your data to the platform upon your explicit instruction to do so by connecting your Runtastic account to your respective Partner Platform account.
Social Networks and Messenger Services - If you decide to share finished activities via a social media plattform or messenger service you may use on your mobile device, you explicitly instruct us to share the respective data with the messaging service you have chosen.

4.4 Sharing of personal data with our Service Providers (“Processors”). We share your personal data with Processors that help us to conduct the processing activities necessary for the purposes listed in Purpose and Legal Basis for Processing of Personal Data . Our Processors will have access to your personal data as reasonably necessary to perform their tasks on our behalf and are obligated to protect it and not to disclose or use it for other purposes. We use processors of the following categories: Advertising Solution Providers, Data Analytics Solution Providers, Cloud Solution Providers, CRM Solution Providers, Messaging Service Providers, Payment Service Providers, Authentication Solution Providers and Research/Survey Solution Providers.

4.5 Sharing of personal data with adidas and partners. We share personal data with adidas, which is a Joint Controller for all locations with the adidas Local Selling Entity (see here ), and with Partners where this is necessary for the purposes listed in Purpose and Legal Basis For Processing of Personal Data . This is relevant, for example, if we organize challenges or competitions together with adidas, adidas runners or other partners. To be able to, for example, determine the challenge results or to award the winners, certain information might be shared with adidas, adidas Runners or the respective other partner. We will inform you if this is the case and will let you know, which information this concerns in a separate notice for the respective challenge.

4.6 Sharing of personal data with authorities and lawyers and tax advisors. We share personal data with authorities and lawyers and tax advisors where this is necessary for the purposes listed in Purpose and Legal Basis for Processing of Personal Data .

4.7 Data Selling. We do not sell any of your personal data to third parties.

4.8 Receipients of personal data. A list of the (potential) recipients of your personal data as well as information about the data categories affected and the purpose of the respective data sharing is available here .

5. Retention of Personal Data

5.1 Retention Period. In order to enable you to use our Products, we retain personal data for as long as you have an account with us. Anyhow, if certain personal data is no longer required for the purposes listed above, e.g. because certain functions of our Products are no longer operated or offered, we will delete or anonymize this data within a reasonable time after the complete fade out of the function.

If our user agreement with you is terminated and you don't request us to immediately delete your personal data, we will delete it 25 months after termination.

5.2 Deletion of personal data. If you request deletion of your account or if we delete it after the above-mentioned period, your personal data processed by Runtastic will be deleted, with the following exceptions:

Personal data made public by you in our Products (e.g. comments on other registered users’ activities) will be anonymized, i.e. it will be indicated that such details were provided by a deleted user.
Personal data required for our performance of statutory obligations will not be deleted but reduced to the minimum necessary.
Personal data that we need to defend against claims, that we need to enforce our claims or that we need to document our compliance with legal requirements will not be deleted but reduced to the minimum necessary.
Personal Data we have collected for analytical purposes or research will not be deleted but anonymized.

6. Your Rights concerning Personal Data

6.1 Exercise your Rights. To exercise your rights concerning personal data (“privacy rights”) defined in the sections below or within the Annexes to the Privacy Notice, please follow the steps indicated for each case. If no certain steps are defined or if you have any problems completing the steps or if you have questions, please send a request via email to the Email Address or contact us via mail to our postal address.

6.2 Revocation of Consent If you have given your consent to the processing of personal data for a specific purpose, you can withdraw (revoke) it at any time. However, this does not affect the lawfulness of data processing based on the consent before the revocation. Please note that in certain cases, we may continue to process your personal data after you have withdrawn consent, if we have another legal basis to do so.

If you want to revoke the marketing consent you have given, please:

log in to Runtastic.com
click on Home
go to Privacy Settings on the left-hand side
unmark the stay informed
checkbox.

You can also revoke marketing consent within the apps by navigating to " More " and " Privacy where you can easily deactivate the " Stay informed " slider.Please note: The implementation may take a few days. Meanwhile, you may still receive a couple of marketing messages from us based on the marketing consent you have given in the past.

6.3 Right to Information and Access. You have the right to obtain (i) confirmation as to whether or not your personal data is being processed by us and, if so, (ii) more specific information on the data and (iii) a copy of the data. The more specific information concerns, among other things, processing purposes, categories of data, potential recipients, or the duration of storage and can be found in this Privacy Notice.If you like to receive a copy of your personal data processed, please:

log in to Runtastic.com
click on Home* go to Account & Data on the left-hand side
click on Export Data on the right-hand side
follow the instructions in the email sent to your registered email once the export is ready.

Within the export we will provide a copy of your data and the mentioned more specific information for download.

6.4 Right to Rectification. You have the right to obtain the rectification of inaccurate personal data we process concerning you. In case the personal data processed by us is not correct, we will rectify these without undue delay and inform you of this rectification. Please note that (i) you can rectify much of your personal data in the settings of our Products on your own and that (ii) it is not technically possible for us to rectify all kinds of data in our Products.

6.5 Right to Erasure. You have the right to have personal data we store about you deleted. Should you want to exercise this right, i.e. if you want to delete your Runtastic account, please:

log in to Runtastic.com
click on Home
go to Account & Data on the left-hand side
click on Request Deletion on the right-hand side
follow the instructions in the email sent to your registered email to confirm the request.

As a safety measure, we will send you an email in order for you to confirm your deletion request and will only delete your personal data after such confirmation. Please note that your phone may still have data stored on it after deletion of your account and that we might keep some of your personal data despite your deletion request.If you have requested a copy of your personal data we process, your account can only be deleted after the export is completed, because otherwise, we would no longer be able to comply with this request.Please note that we consider a request to delete your account as a termination of our user agreement with you. However, you are free to subsequently create a new account at any time.Please also be aware that deletion may take up to a couple of days.

6.6 Right to Restriction of Processing. You have the right to obtain a restriction of processing of your personal data from us in the following cases:

the personal data is no longer necessary for the purpose they were collected or otherwise processed for;
you have withdrawn consent on which the processing is based and there is no other legal ground for the processing;
you have objected to the processing pursuant and there are no overriding legitimate grounds for the processing;* the processing is unlawful;
the personal data have to be erased for compliance with a legal obligation in European Union or Member State law to which Runtastic is subject to.

6.7 Right to Data Portability. You have the right to (i) receive a copy of your data in a structured, commonly used and machine-readable format and (ii) transmit those Data to another controller without hindrance from us. In order to exercise your right to data portability please:

log in to Runtastic.com
click on Home
go to Account & Data on the left-hand side
click on Export Data on the right-hand side
follow the instructions in the email sent to your registered email once the export is ready
send the (part of the) personal data you want to have transmitted to the controller, to which you want the transmission to take place.

6.8 Right to Object. You have the right to object at any time to the processing of personal data for which our legitimate interests are the legal basis, including profiling. You also have the right to object to processing of personal data for direct marketing purposes.

6.9 Right to File a Complaint. You have the right to file a complaint with your local data protection authority, if you think that our processing of your personal data infringes applicable law.

The Österreichische Datenschutzbehörde (Austrian Data Protection Authority) can be contacted as follows:Mail: dsb@dsb.gv.at Phone: +43 (0) 1 52152 2550 Postal-Address: Barichgasse 40-42, 1030 Wien ,Austria Web: https://www.dsb.gv.at/kontakt

7. Further Information

7.1 Security Measures. We are committed to protecting your personal data and do implement appropriate technical and organizational security measures to protect it against any unauthorized or unlawful processing and against any accidental loss, destruction, or damage. We require our service providers to do the same through contractual agreements.

These security measures are constantly revised to comply with the latest technological developments. However, you should be aware that any transmission of your personal data through the internet is at your own risk. We can only protect your personal data once it reaches our area of responsibility.

7.2 Transfer of personal data outside of the EU/EEA/CH. We only share your personal data with third parties outside the EU, EEA and Switzerland if (i) the third party is located in a country that provides an adequate level of data protection under Article 45 of the GDPR or if (ii) appropriate safeguards are in place to protect your personal data and your rights related thereto.

7.3 Do Not Track Signals. Our Products do not recognize or respond to browser-initiated Do Not Track signals. To learn more about Do Not Track signals, you can visit https://allaboutdnt.com.

7.4 California Consumer Privacy Act (“CCPA”). For information regarding your rights as a citizen of the US-State of California pursuant CCPA, please refer to Annex 1 - Information for California Residents pursuant the California Consumer Privacy Act (“CCPA”) .

7.5 Russian Federal Law on Personal Data (“Law #152-FZ”) For information pursuant the Law #152-FZ, please refer to Annex 2 - Information for Citizen of the Russian Federation under the Russian Federal Law on Personal Data (“Law #152-FZ”) .

7.6 Turkish Personal Data Protection Law No. 6698 (“TPDPL”). For information regarding your rights as a Resident of Turkey pursuant TPDPL, please refer to Annex 3 - Information for Residents in Turkey under the Turkish Personal Data Protection Law No. 6698 ("TPDPL") .

7.7 Brazilian Lei Geral de Proteção de Dados („LGPD“). For information regarding the processing of personal data that is collected in Brazil, or while offering and supplying of our Products in Brazil or relates to data subjects who are geographically located in Brazil as well as regarding the data subjects rights pursuant LGPD, please refer to Annex 4 - Information for the processing of personal data in the scope of the Brazilian Lei Geral de Proteção de Dados („LGPD“) .

7.8 Korean Personal Information Protection Act ("PIPA") For information pursuant the Korean Personal Information Protection Act please refer to Annex 5 - Information for the processing of personal data in the scope of the Korean Personal Information Protection Act (PIPA) .

7.9 Peruvian Personal Data Protection Law N° 29733 ("PDPL") For information pursuant the Personal Data Protection Law N° 29733 please refer to Annex 6 - Information for the processing of personal data in the scope of the Peruvian Personal Data Protection Law N° 29733 ("PDPL") .

7.10 Data Privacy Act of 2012 of the Republic of the Philippines For information pursuant the Data Privacy Act of 2012 of the Republic of the Philippines please refer to Annex 7 - Information for the processing of personal data in the scope of the Data Privacy Act of 2012 of the Republic of the Philippines .

8. Changes to the Privacy Notice

8.1 General Information We review and update the Privacy Notice periodically to reflect any changes resulting from our day-to-day business operations. We will notify you when we make significant changes that you must be aware of.

8.2 Last Update. This Privacy Notice was last modified on 6 April 2022 .

9. Annex 1 - Information for California residents pursuant the California Consumer Privacy Act (“CCPA”)

If you are a California resident, this section applies to you and supplements the Privacy Notice. Please note that when the Privacy Notice talks about personal data, this is personal information pursuant CCPA.

9.1 Categories of Personal Information we process. In the preceding 12 months, we have collected the categories of personal information listed below.

Identifiers - for details please see Identity Information, Contact Information, Device Information and Location Information descriptions in the Privacy Notice.
Categories of personal information described in the California Customer Records statute (California Civil Code Section 1798.80) - for details please see Size Information and Purchase Information descriptions in the Privacy Notice.
Characteristics of protected classifications under California law, such as gender and age (over 40) - for details please see Identity Information description in the Privacy Notice.
Commercial information, including records of products or services purchased or purchasing habits - for details please see Purchase Information Description in the Privacy Notice.
Biometric information - for details please see Activity Information description in the Privacy Notice.
Internet and other similar network activity - for details please see Browsing Information and Device Information description in the Privacy Notice..
Geolocation data - for details please see Location Data description in the Privacy Notice.
Audio and visual information - for detail please see Profile & Community Information description in the Privacy Notice.

9.2 Your Rights. Pursuant CCPA, California consumers have the right to request access to the specific pieces of personal information we have collected about them in the last 12 months. You may also request additional details about our processing practices, including the categories of personal information we have collected about you, the categories of sources of such collection, the business or commercial purpose for collecting personal information, the categories of third parties with whom we share your personal information and the categories of personal information we have disclosed about you in the preceding 12 months. This corresponds with the Right to Information and Access as listed in the Privacy Notice and can be enforced accordingly.

You also have the right to request deletion of your personal information (subject to certain exceptions). This corresponds with the Right to Erasure as listed in the Privacy Notice and can be enforced accordingly.Moreover, you have the right to opt out of sales of personal information and to receive equal service and price and not be discriminated against even if you exercise any of your CCPA rights.In addition to the ways to enforce privacy rights as described in the Privacy Notice, California Consumers may address their request to enforce their rights pursuant CCPA by making a call to our toll-free service number.Toll-free number for requests pursuant CCPA by residents of the US-State of California: 888 694 6364Please note that this Toll-free number is operated by adidas. Adidas processes your requests addressed to this number on our behalf.In any case, your request must include sufficient information that allows us to reasonably verify you are the person about whom we collected personal information, which may include your email address, name and account id (which is required only if you already have an account with us).We will not discriminate against you if you choose to exercise your rights under the CCPA.The right to opt out from data selling is not enforceable regarding Runtastic, because Runtastic does not sell user data at all.

9.3 Metrics reporting. We disclose the number of requests to know we received, complied with in whole or in part, or denied and the number of requests to delete that we received, complied with in whole or in part, or denied retroactively for each year here . There we also publish the median number of minutes within which we responded to these requests. Please note that as Runtastic is not selling any personal information, we therefore do not count "do not sell my data" requests.

10. Annex 2 - Information for Citizen of the Russian Federation under the Russian Federal Law on Personal Data (“Law #152-FZ”)

If you are a Russian resident, this section applies to you and supplements the Privacy Notice. In case there are certain contradictions between the Privacy Notice and this Annex 2, Annex 2 prevails. The Annex and the Privacy Notice were designed to meet the requirements of the Russian legislation on protection of the personal data. Details of processing personal data are stipulated in internal legal documentation of Runtastic. All the personal data is secured according to the Russian legislation and remains confidential unless the user declares it as public (e.g. by posting it). By sharing certain content or data (e.g. pictures) containing your image, you give to Runtastic irrevocable, perpetual, free of any remuneration consent to use these image and the right to use it by any means not prohibited by law and specified by the Terms of Service in whole or in part, without restrictions on the accompanying text, sound and / or visual design. The territory for such consent is not limited. You confirm to understand that in those cases your name and/or reputation can be associated with Runtastic. For the purpose of defining the scope of personal data in the legal context, it is specifically outlined that profile pictures are not considered to be personal data given the fact that it is not required to upload a picture and it is not necessarily an image of you (it could be any graphic image, e.g. drawing or cartoon). The purpose of processing, personal data categories, and legal basis are named in the Privacy Notice. For the avoidance of doubt, Russian users by following the registration and taking explicit note of the Privacy Notice provide consent as a legal basis for the processing. When the Privacy Notice refers to the adidas AG as a Controller, for the Russian user adidas ltd. (121614, Moscow, Krylatskaya st., 15) acts as a Controller.

Processing conditions and security measures:

For the development and implementation of specific measures to ensure the security of personal data, monitoring the implementation of this policy, a responsible person has been appointed – Data Protection Officer.
Runtastic has established a list of persons processing personal data.
Technical measures for the protection of the personal data:
- carrying of technical measures aiming for preventing unauthorized access to personal data and (or) for transferring it to persons who do not have the right to access such information;
- configuration of protective tools for timely detection of unauthorized access to personal data;
- isolation of technical means of automated processing of personal data in order to prevent exposure to them, as a result of which their functioning may be disrupted;
- exercising of constant control over ensuring the level of security of personal data.
Organizational measures for the protection of the personal data:
- definition of threats to the security of personal data during processing and formation of threat models on that basis;
- developing a personal data protection system that ensures the neutralization of alleged threats using methods for protecting personal data provided for the corresponding class of information systems;
- establishment of a plan for conducting checks on the readiness of new information protection tools for use;
- conducting trainings on how to work with the information protection tools used them for the employees who are using them;
- keeping of records of persons (job titles) authorized to work with personal data in the information system;
- monitoring of compliance with the terms of use of information security tools.

11. Annex 3 - Information for Residents in Turkey under the Turkish Personal Data Protection Law No. 6698 ("TPDPL")

If you are a resident in the Republic of Turkey, this section also applies to you and supplements the Privacy Notice.

11.1 Reminder on Data Controller.

We hereby declare that Adidas Spor Malzemeleri Satış ve Pazarlama Anonim Şirketi ("adidas Turkey"), a Turkish joint-stock company registered with the Istanbul Trade Registry under the number 406873, and having its registered offices at "Rönesans Biz Plaza Mecidiyeköy Mah. Oğuz Sok. No. 4 Şişli/Istanbul" shall not be considered as data controller within this Privacy Notice; accordingly adidas Turkey shall act only as data processor. The only data controller is Runtastic; and there is no joint data controller mechanism.

11.2 Information on Data Protection Officer. As the term "Data Protection Officer'' is not defined under TPDPL it shall not be applicable in Turkey. However, you can contact us via email using the Email Address (see 1.4 Contact).

11.3 Method and legal basis of personal data collection. We are only allowed to collect and process your data if we have lawful bases for processing in accordance with Article 5 and Article 6 TPDPL (including processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, and processing of data necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject). We collect the personal data fully or partially by automated means / methods provided being a part of the data recording system, in accordance with TPDPL.

11.4 Your Rights. Save the circumstances stipulated under Article 28 of TPDPL entitled "Exceptions'', as the personal data subject you have the following rights within the scope of Article 11 of TPDPL upon your application to Runtastic:

to learn whether your personal data is processed or not - this partly corresponds to the Right to Information and Access as described in the Privacy Notice and can be enforced accordingly;
if your personal data has been processed, to demand information with regards to said processing - this partly corresponds to the Right to Information and Access as described in the Privacy Notice and can be enforced accordingly;
to learn the purpose of processing your personal data and whether your personal data is being used for the intended purposes - this partly corresponds to the Right to Information and Access as described in the Privacy Notice and can be enforced accordingly;
to know the third parties to whom your personal data is transferred within the country or abroad - this partly corresponds to the Right to Information and Access as described in the Privacy Notice and can be enforced accordingly;
to request the rectification of incomplete or inaccurate personal data, if any - this corresponds to the Right to Rectification as described in the Privacy Notice and can be enforced accordingly;
to request the erasure or destruction of your personal data in accordance with the conditions of the law and its regulations - this corresponds to the Right to Erasure as described in the Privacy Notice and can be enforced accordingly;
to request notification on operations conducted as per the two last sub-paragraphs - you will always receive such information if you requested Rectification or Erasure;
to object to the processing, exclusively by automatic means, of your personal data which leads to an unfavorable consequence for yourself - this partly corresponds to the Right to Object as described in the Privacy Notice and can be enforced accordingly;
to request compensation for the damage arising from the unlawful processing of your personal data.

11.5 Contact Information of Local Personal Data Protection Authority in Turkey. Kişisel Verileri Koruma Kurumu Nasuh Akar Mahallesi 1407. Sok. No: 4, 06520 Çankaya / Ankara

12. Annex 4 - Information for the processing of personal data in the scope of the Brazilian Lei Geral de Proteção de Dados („LGPD“)

Whenever personal data is processed to make our apps, websites or other services usable in Brazil or you are located in Brazil at the time we collect your personal data, the LGPD applies. Overall, the LGPD is very similar to the GDPR in terms of its regulatory framework. Nevertheless, there are small deviations and additions which are explained in this Annex. Accordingly, this annex is supplementary to the information given in our Privacy Notice and applicable where the LGPD applies.

12.1 Legal Basis. The LGPD acknowledges the exercise of rights in judicial, administrative, or arbitral proceedings and protection of credit as legitimate bases for data processing. Accordingly, please note that in addition to the legal bases as set forth in Purpose and Legal Basis For Processing of Personal Data of the Privacy Notice, we might process your personal data because this is necessary to exercise our rights in judicial, administrative, or arbitral proceedings to which you and we are parties or to protect credit, where applicable.

12.2 Types of processing activities we perform. For the purposes mentioned in Purpose and Legal Basis For Processing of Personal Data of the Privacy Notice, we carry out all necessary processing activities such as: collection, storage, sorting, query, matching, display, extract and arrangement. We might also access, inspect and evaluate your personal data e.g., to determine your success in a certain challenge, in connection with support services or to ensure compliance with our terms of use. Furthermore, it may be that we anonymize personal data and – e.g., if you ask us to do so – delete, block or correct it.

12.3 Processing Location. Your personal data is processed and therefore transmitted to outside the Brazilian territory. Since we do not have any data centers or other data processing facilities in Brazil, this is necessary for all purposes described in Purpose and Legal Basis For Processing of Personal Data of the Privacy Notice.

12.4 Contact / Data Protection Officer. If you have any questions about data protection, the handling of your personal data or your rights as a data subject, please contact us at any time by sending an email to the Email Address or via post to our address given in the Privacy Notice . Our data protection officer Anne K. Stein and Team will take care of your request.

12.5 Responsibility for the data processing. Runtastic is responsible for all data processing activities performed under our Privacy Notice. Runtastic is also responsible, if certain processing activities are carried out by contractors of Runtastic on behalf of Runtastic. These contractors are called processors and are contractually bound to process your personal data strictly in accordance with and only within the scope of our instructions. They must also ensure strict data security standards, must not disclose your personal data without our instruction and are obliged to stop processing the personal data immediately in case of termination of the contract.

If you connect to the service of one of our partners and export personal data from our apps to these services, the respective partner offering the service is responsible for the data processing from the moment of the export.

12.6 Your rights. Regarding your personal data being processed by Runtastic in the scope of the LGPD, you have the following rights that can be enforces as described in the Privacy Notice or as indicated below:

confirmation of the existence of the processing - this partly corresponds to the Right to Information and Access as described in the Privacy Notice and can be enforced accordingly;
access to the personal data - this partly corresponds to the Right to Information and Access as described in the Privacy Notice and can be enforced accordingly;
correction of incomplete, inaccurate or out-of-date personal data - this corresponds to the Right to Rectification as described in the Privacy Notice and can be enforced accordingly;
anonymization, blocking or deletion of unnecessary or excessive personal data or personal data processed in noncompliance with the provisions of the LGPD;
portability of the personal data to another service provider or product provider, by the means of an express request, pursuant with the regulations of the national authority, and subject to commercial and industrial secrets - this corresponds to the Right to Data Portability as described in the Privacy Notice and can be enforced accordingly;
deletion of personal data processed with no other legal basis than your consent to do so;
information about public and private entities with which we have shared the personal data;
information about the possibility of denying consent and the consequences of such denial;
revocation of consent to process the personal data.Please note that the rights mentioned are not absolute rights. In individual cases it is possible that the exercise of these rights is opposed by rights or obligations of Runtastic or third parties.

12.7 Possibility of denying consent and the consequences. If the Privacy Notice indicates that the processing of your personal data for a certain purpose is based on your consent, please be advised that you are not obligated to give such consent and that you may revoke a consent you have given at any time. In case you do not give a certain consent or in case you revoke a consent you have given, your personal data will not be processed for this purpose (anymore).

13. Annex 5 - Information for the processing of personal data in the scope of the Korean Personal Information Protection Act ("PIPA")

If you are a resident in the Republic of Korea, this section applies to you and supplements the Privacy Notice.

13.1 Deletion of personal information. Pursuant to PIPA, we have to delete all personal data concerning you, i.e. your user account, if you are inactive for more than 1 year. We consider you active when you log in to our products, open them or record or import an activity.

Deletion of personal data at Runtastic takes place through the complete removal of the personal reference or through the complete deletion of the relevant data from all our systems.

13.2 Your rights. In addition to the rights described under Your Rights concerning Personal Data if you suffer damage by reason of violation of the PIPA by Runtastic, you are entitled to claim compensation for such damage.

14. Annex 6 - Information for the processing of personal data in the scope of the Peruvian Personal Data Protection Law N° 29733 ("PDPL")

If you are a resident of Peru, this section applies to you and supplements the Privacy Notice.Registred data base. Runtastic is operating a data base according to the definition of the PDPL that is currently registered with the Peruvian authority. The data base registration code applicable for Peruvian users will be published as soon as available.

15. Annex 7 - Information for the processing of personal data in the scope of the Data Privacy Act of 2012 of the Republic of the Philippines

If you are a resident in the Republic of the Philippines, this section applies to you and supplements the Privacy Notice.Your rights. In addition to the rights described under Your Rights concerning Personal Data you are entitled to claim indemnification for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information by Runtastic.