Version 12-2025
In accordance with Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC) - "GDPR" - we (Move Republic GmbH - "Move Republic“) inform you what personal data we process when you use our service of active lifestyle promotion - "Service" - and for what purposes we use it and how we protect your data. We also inform you about your rights in this regard. The terms used are based on the wording of the GDPR.
We provide the Service through our Move Republic IT platform ("Platform"), of which the Move Republic mobile application ("Application") is an integral part. Both the Platform and the Application are constantly changing, undergoing technical modifications and additions. For this reason, we update the information contained in this Privacy Policy from time to time.
You are not obliged to enter into a contract with us or provide your personal data. However, in order to be able to provide you with our Service in full, we need to process your personal data.
You have the right to obtain information about your personal data that we process free of charge. In addition, you have the following rights:
If you wish to exercise your rights as a data subject, the contact details can be found in section 8.1.
In order to provide you with our Service, we record, process, store in some cases share various personal data with third parties. Below you will find out which of your data we process for what purposes and under what circumstances we share it.
Personal data is information that can be used to directly or indirectly identify a specific person, such as your name, address, phone number, date of birth, or email address.
Each time you use the Service, even without registering, we process the following data:
|
Type of data |
Explanation |
Data source |
|
Device information |
Data about the device connecting to our Service |
Users themselves |
|
Operating system and corresponding version or other device identifiers |
Time, date duration of access to our website, source of access, IP address a other communication protocol data (computer or mobile device type, software or browser type, operating system, application version an language settings) |
We provide detailed information about the use of cookies in section 3.
In order to fully use our Service, you must register. As part of the registration process, we ask for personal data. After successful registration, you will receive a user account ("Move Republic Account" or "Move Republic User").
We process the following data:
|
Type of data |
Explanation |
Data source |
|
Access data |
Email address, password |
Users themselves, Move Republic |
|
User information |
First name, last name, country of residence, date of birth, statement of acceptance of the Move Republic Terms and Conditions and Move Republic Privacy Policy, status of other consents, status of verification email |
We process the data obtained during registration in order to identify you as a party to the contract with us, i.e. to conclude the contract, justify the contract between us, ensure its performance and in certain cases also to provide you with relevant information from your user account. In addition, we verify your email address to prevent abuse.
We process your data in order to be able to fully offer you the services resulting from the contract between us. The Service helps you, as a registered user, to record and analyze physical activity data, manage your activity level, activity goals and your participation in various groups and events based on physical activity.
User groups
You can create and join Move Republic user groups (so-called "communities" or "teams"). If you decide to join one or more communities or teams, this information will be stored in your Move Republic Account as your explicit consent to the processing of data in this regard. In addition, we store the date and time of joining the relevant community or team.
We record both invitations to communities and teams sent by you to other users and invitations sent to you by other users, along with their acceptance or rejection statuses. Depending on your settings, other members of the communities and teams you belong to may see your first name, last name, nickname, or initial, as well as your results.
Events
You can also participate—individually or as a team—in events based on physical activity (like "competitions" or "challenges"). Move Republic maintains and publishes so-called leaderboards with participant rankings and their results in the Service. By participating in events, you give us your consent to disclose your results to other participants in the leaderboards, as well as data on the results of the community and teams to which you belong, including their ranking positions.
Activity Points
We convert the activities recorded on your Move Republic Account into activity points (so-called "Activity Points"). Based on your results, i.e., data such as distance covered, training time, calories burned, number of steps, or Activity Points, we determine the degree to which you have achieved your activity goals, your position on the leaderboards your overall activity level. You may also receive special awards, such as symbolic badges.
Reward points
By achieving specific activity goals and actively using the Move Republic app, you have the opportunity to earn reward points (such as "STARS" or "MOVES"). Some reward points can be exchanged for rewards. All this information is stored in your Move Republic Account.
Notifications
As part of our agreement, we may send you push notifications or emails to inform, remind, motivate and encourage you to achieve your goals and perform better in the events you participate in. You can opt out of receiving these messages at any time by adjusting the settings on your mobile device, your Move Republic User profile and in the settings of each community you are a member of.
In connection with the above, in addition to the data listed in section 2.2, we process the following data:
|
Type of data |
Explanation |
Data source |
|
Contract data |
Information about the selected package, contract commencement, usage fee, delivery address, residential address, payment date, outstanding payments, contract termination, status (active/suspended/terminated) |
Users themselves, Move Republic |
|
Information about the use of the Service |
Time of use, date and time, application features used, interaction(s) with Move Republic and/or other users of the service, information about membership in communities and teams, consents and their status, other voluntary information |
Users themselves, Move Republic |
|
Physical activity data / Results |
Type of physical activity, start/end time, duration of activity, number of steps, distance, speed, pace, calories burned, geolocation data, route, data about sports facilities and private stationary training locations, other activity-related data, data obtained from various health and fitness applications (if their transfer has been approved by the user), Activity Points, badges |
Users themselves, Move Republic, other sources approved by the user |
|
Reward points and rewards |
Reward points, source, date of points determination, expiration date, expiration information, reward points used (type of reward, number of points used and time of use) |
Move Republic, users themselves |
|
Transmitted content |
Content shared by Move Republic, such as training plans, information about events, activity goals, push notifications and emails informing and motivating the user, etc. Content provided by the user, such as comments and questions about the Service and content provided to other users, such as invitations to communities and teams, message/feed content, content provided by making your own results and profile data public, likes and reactions to your own and other users' public content, etc. Content provided by other users, such as invitations to communities and teams, chat/feed content, public results and profile data of other users and likes and reactions to such content, etc. |
Users themselves, other users, Move Republic |
Partner Programs
You can join the Partner Entity's active lifestyle promotion program ("Partner Program") after entering the program ID ("Program ID") provided to you by the Partner Entity or by us on its behalf in the Move Republic application.
If an entity (e.g. your employer) is not a Partner Entity and you want to inspire it to become one, you can submit a request to us to create a temporary program for that entity. For this purpose, we also process the personal data listed below.
If you use the Partner Program, we have agreed in a special agreement with the Partner Entity that has included you in its program to send you messages about inactivity, i.e., when you have not participated in the program for a certain period of time (usually one month). In addition, we provide anonymous reports to Partner Entities on the activity of participants in their programs to enable them to evaluate the effectiveness of these programs.
In some cases, depending on the rules of a specific Partner Program, the Partner Entity may receive from us named lists regarding program participants – in particular for the purpose of verifying eligibility to participate (e.g. confirming that the participant is an employee or an authorized person) and settling the program, including settlements related to rewards. If named lists are provided as part of a given Partner Program, the data contained therein will be provided only to the extent necessary to achieve the purpose of the program and as indicated to the user in the program rules.
In addition to the above-mentioned data, we process the following data for the purpose of implementing Partner Programs:
|
Type of data |
Explanation |
Data source |
|
User information |
First name, last name, email address (company), date of birth, phone number, user ID in the Partner Entity's system |
Users themselves |
|
Program / Partner Program data |
Program ID, participation information (eligible/ineligible), sponsorship status information (supported/not supported), program level, inactivity messages |
Partner Entity, Move Republic |
Automated data processing (including profiling)
As part of the Service, we use automated data processing to calculate and present your results and activity level, in particular by converting recorded activities into activity points, determining the degree of achievement of activity goals, awarding badges, as well as determining and publishing positions in leaderboards in communities, teams and events in which you participate. The logic of this processing is based on data about your activity and on the rules of a given event or Partner Program and your settings.
As part of the Service, you can instruct us to automatically import your physical activity data from various health and fitness apps, for example, to include this data in active lifestyle promotion programs you participate in and to determine your activity level. You must consent to each such connection in order for us to import the data.
Apple HealthKit
We use Apple Inc.'s (1 Infinite Loop, Cupertino, CA 95014, USA) HealthKit software package, which manages a repository of health and physical activity data on the iPhone and Apple Watch and, with your express consent, allows applications to communicate with the HealthKit Store to access and import data. We process the following data obtained with your express consent:
Google Fit
We use the Fit SDK from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). This is an open platform that allows users to control their activity data. We process the following data that we receive via the Google Fit SDK with your express consent to import the data:
Health Connect
We use Health Connect from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). This is a central platform where users can store, combine and share their data from various smartwatches and health apps. We process the following data that we receive via Health Connect with your express consent to perform the data import:
Strava
We use Strava from Strava Inc. (208 Utah Street, San Francisco, CA 94103, USA). Strava is a social network with the ability to store sports activities. We process the following data that we receive via Strava with your express consent to perform the data import:
Garmin
We use the Garmin service provided by Garmin Deutschland GmbH (Parkring 35, 85748 Garching, Germany). It is a repository of data about the activity, fitness and health of users of Garmin devices and software. We process the following data that we receive via Garmin with your express consent for the purpose of data import:
Fitbit
We use the Fitbit service provided by Fitbit International Limited (76 Lower Baggot Street, Dublin 2, Ireland) to collect data on the activity, fitness health of users of Fitbit devices and software. We process the following data received from Fitbit with your express consent for the purpose of data import:
Polar
We use the Polar service provided by Polar Electro Oy (Professorintie 5, 90440 Kempele, Finland) to collect activity, fitness and health data from users of Polar devices and software. We process the following data received from Polar with your express consent to perform data import:
Withings
We use the Withings service provided by Withings France SA (2 rue Maurice Hartmann 92130 Issy-les-Moulineaux, France) to collect data about the activity, fitness health of users of Withings devices and software. We process the following data received from Withings with your express consent to import data:
|
Type of data |
Explanation |
Data source |
|
Activity data |
Type of activity, start/end time or duration of activity, number of steps taken, distance, speed, calories burned, data source, route, geolocation data and other activity-related data, if selected by the user in health and fitness apps |
Health and fitness apps |
You can refuse access to this data at any time by changing the settings on your mobile device.
As part of personalizing your Move Republic Account, we process all personal data that you provide to us. You can manage your data, including changing your primary email address and password for your user account.
When you order paid services through the Move Republic app, you make one or more purchases in the app (so-called "in-app transactions"). You then authorize the "Apple App Store" or "Google Play Store" to use your personal data and information about you to process the payment. Move Republic is not responsible for this part of the data processing. For more detailed information on data processing by a given store, please refer to the privacy policies of those stores.
We process the following personal data:
|
Type of data |
Explanation |
Source of data |
|
|
User data |
First name, last name, nickname, primary email address, other email addresses, date of birth, gender, country of residence, phone number, password, photo, personal description, hyperlinks/identifiers on social media, addresses (residential, delivery), participation in Partner Programs, badges, linked fitness apps, privacy settings, publicly shared results, likes and reactions to them, profile data visibility status |
Users themselves |
|
|
Payment details (if the service is paid) |
Confirmation of successful purchase processing - in-app transaction - with the selected payment service provider / app store |
Users themselves; app store |
|
Part of the Service involves contacting you. We do this in particular as part of the performance of our mutual agreement, to inform you about the services you have booked, other benefits, or to answer your questions. In addition, we may communicate with you for marketing purposes, market research and to improve our services, etc. We process the following personal data:
|
Type of data |
Explanation |
Data source |
|
Contact |
Email address, phone number, address (residential, delivery) |
Users themselves |
|
Message content |
depending on the user's interests and needs |
Users themselves |
In justified cases, we may use your personal data to resolve legal disputes or as part of investigations into compliance with compliance rules. We may also use it to enforce the terms of the agreement between you and us or to comply with requests from law enforcement or data protection authorities. In the context of data processing, we take appropriate measures to protect your rights and freedoms. In addition, we process your data in connection with legal obligations, e.g. those arising from commercial or tax law, anti-money laundering legislation, as well as in connection with the need to comply with other regulatory requirements.
We use cookies to improve the presentation and accessibility of our online platform. A cookie is a text file that is sent to your browser by a web server. This file contains the URL of the page you are visiting, the time you entered the page and the expiration date of the cookie. On the one hand, we use cookies to analyze how users use specific areas of the Platform and on the other hand, we allow them to save their personal settings in a cookie so that they can be applied the next time they visit the Platform. We compile aggregate statistics on behavior in order to analyze user preferences in using the Platform's content.
We use third-party content and services on the Platform to better analyze and improve the quality of our services. Therefore, we integrate their content or services through their cookies. Information about cookie providers can be found at: Cookies.
When you first visit our Platform, a banner informing you about the use of cookies appears. You can decide whether and to what extent you agree to the use of cookies. The Details section will tell you what cookies we use and you will have the option to reject the use of some of them. This does not apply to essential cookies, i.e., those that ensure the proper functioning of our Platform. The use of cookies is in accordance with your choice. If you do not accept cookies, you may not be able to use our Platform to its full extent.
You can also set your browser to notify you when you receive a cookie, or you can exercise your right to object by rejecting cookies in your browser settings.
We never share your data with unauthorized entities. Below, we summarize to whom and under what conditions we share your data or from whom we receive it. In addition, we explain the situation with regard to the countries to which we transfer data.
As explained in section 2.3, data is exchanged with Partner Entities in order to enable you to participate in Partner Programs organized for Partner Entities. Therefore, in accordance with the agreement between you and us, the legal basis for the above-mentioned data processing is Article 6 (1) (b) of the GDPR. In addition, we disclose your data on results achieved in communities, teams and events (including your position in the leaderboards) to other users, with your consent to the publication of data in the leaderboards. Here, our legal basis for the above data processing is Article 6(1)(a) of the GDPR.
As part of our business, we use selected service providers and grant them limited and strictly monitored access to some of our data. The service providers we have carefully selected operate exclusively on behalf of Move Republic and are obliged to comply with the applicable data protection requirements. Below, we inform you about our data recipients and the reasons for transferring data to them:
|
Data recipient |
Explanation |
|
Authorized Service Providers |
Third parties support our business activities by, for example, providing IT solutions and infrastructure, providing payment services, evaluating and optimizing marketing campaigns and ensuring the security of our business activities by, for example, identifying and removing faults. To the extent that these entities process personal data on our behalf, they act as processors on the basis of a data processing agreement and exclusively on our instructions. The legal basis for sharing personal data with these service providers is, depending on the purpose, Article 6(1)(b) of the GDPR (performance of a contract) and/or Article 6(1)(f) of the GDPR (our legitimate interest in ensuring a technically flawless and secure Service). Service providers: Approved Subcontractors |
|
Members of the Move Republic group |
Within the group of companies, we use resources efficiently. In particular, group members provide us with mutual technical support in order to provide the Service as error-free as possible, for analytical purposes and to improve services, as well as for the detection, prevention and investigation of fraud and data breaches. To the extent that group members process personal data on our behalf, they act as processors on the basis of a data processing agreement. The legal basis for the disclosure of personal data is Article 6(1)(f) of the GDPR (our legitimate interest in ensuring the smooth and secure operation of the Service) and, where necessary, Article 6(1)(b) of the GDPR (performance of a contract). Group members: Move Republic Sp. z o.o. (Krakow, Poland) |
|
Law enforcement authorities / Law enforcement |
We disclose personal data when we are required to do so or when we act in our own interest to prevent damage, pursue claims, or reject unjustified claims. The legal basis for the transfer of personal data is Article 6(1)(f) of the GDPR. |
We process your data primarily within the European Union (EU) and the European Economic Area (EEA). However, some of the service providers we list are located outside the EU and the EEA ("third countries"). The GDPR sets high requirements for the transfer of personal data to so-called third countries. For some third countries, the European Commission has decided that they offer an adequate level of data protection (e.g. Switzerland, Canada). To the extent that we transfer data to a third country for which no such adequacy decision exists, the transfer takes place, unless otherwise specified in this Privacy Policy on the basis of an agreement between us and the relevant recipient using the European Union's standard data protection clauses and, where applicable, further supplementary measures agreed with the recipient to ensure an adequate level of data protection.
Data concerning the activity and health of Move Republic Users, as defined in sections 2.3 and 2.4, are not generally disclosed to third parties, except in cases where the provision of the Service by hosting service providers requires such disclosure, or where disclosure is required by law enforcement agencies and legal processes. The data is not transferred to advertising platforms, data brokers, or information intermediaries.
An exception may be the disclosure of certain data to a Partner Entity under the Partner Program, to the extent necessary to verify eligibility, settle the program and settle rewards, in accordance with the rules of the program known to the user.
|
Data processing process |
Legal basis |
|
Provision of the Service (point 2.1) |
The processing of data collected when accessing our Service falls within the scope of pre-contractual activities within the meaning of Article 6(1)(b) of the GDPR. Furthermore, it serves to protect our legitimate interests (Article 6(1)(f) of the GDPR). Move Republic's legitimate interest is a business interest in ensuring a technically flawless and optimized Service. |
|
Registration (Section 2.2) |
The processing of data serves to fulfill a contract concluded with the user or to carry out pre-contractual measures within the meaning of Art. 6 (1) (b) GDPR. Furthermore, it serves to protect our legitimate interests (Art. 6 (1) (f) GDPR). |
|
Active lifestyle promotion programs, Partner Programs, determining activity levels, data on physical activity, activity points, reward points, badges, rewards transmitted content, (point 2.3) |
Data processing serves to perform a contract with the user and for pre-contractual measures (Article 6(1)(b) of the GDPR) – in particular to enable the recording and analysis of activity, the calculation of Activity Points, the presentation of progress and the handling of participation in programs and events. This also includes providing the Partner Entity with statements regarding participation and entitlements, activity status, inactivity notices and reward information—to the extent necessary for the settlement of the Partner Program. To the extent that activity data may constitute special category data (relating to health), we process it only on the basis of the user's explicit consent (Article 9(2)(a) of the GDPR). Explicit consent may be withdrawn at any time with effect for the future; withdrawal may limit the availability of functions dependent on this data. In addition, depending on the situation, processing may be based on Article 6(1)(f) GDPR (legitimate interest, e.g. ensuring security and pursuing claims) and Article 6(1)(c) GDPR (legal obligations, e.g. arising from commercial law, tax law, or supervisory requirements). |
|
Import of activity data, information from other sources (section 2.4) |
Data processing as part of the integration and import of data from external sources (e.g. Apple Health, Health Connect) is based on the user's consent (Article 6(1)(a) of the GDPR) and, if the imported data may constitute special categories of data relating to health, on the user's explicit consent (Article 9(2)(a) of the GDPR). The user may withdraw their consent at any time with effect for the future; the withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. After withdrawal of consent, the Controller will suspend further import and processing of data for this purpose, unless further processing is permissible on another legal basis (e.g. legal obligation or establishment, exercise, or defense of legal claims). |
|
Personalization of the user account (point 2.5) |
The processing of data serves to fulfill the contract concluded with the user (Article 6(1)(b) of the GDPR). Furthermore, it serves to protect our legitimate interests (Article 6(1)(f) GDPR). In addition, it serves to fulfill a legal obligation (Article 6(1)(c) GDPR), e.g. identification requirements, regulatory requirements. |
|
Communication (section 2.6) |
If we communicate with you in connection with a contract, the processing of data serves to fulfill the contract (Article 6(1)(b) GDPR). If the subject of the communication is marketing campaigns, market research, or the general improvement of the quality of our services, we act solely on the basis of the consent given to us within the meaning of Article 6(1)(a) GDPR. You have the right to revoke your consent at any time with future effect. The revocation must be effectively communicated. |
|
Legal purposes (section 2.7) |
Data processing serves to fulfill legal obligations (Article 6(1)(c) of the GDPR) – e.g. those arising from commercial law, tax law, or supervisory requirements. In addition, data processing is carried out to protect the legitimate interests of Move Republic or third parties within the meaning of Article 6(1)(f) of the GDPR. Our legitimate interest is to enforce legal claims or defend against unjustified claims. When we use personal data for legitimate purposes, we always weigh the interests of the user and their right to data protection against our rights and interests, as well as those of third parties. |
We use technical and organizational measures in line with industry standards, using various security technologies and procedures to protect your data from unauthorized access, use, loss, destruction, or disclosure.
We only store personal data for as long as necessary. Access data is deleted when it is no longer needed for the purposes described in this Privacy Policy, unless longer storage is required by law.
We delete your personal data at your request. If your Move Republic Account has been inactive for three years, we will also delete it.
In addition to the above-mentioned data deletion rules, there are statutory retention periods that we must also comply with. For example, tax records must be kept for a period of six to ten years in some cases even longer. Specific retention periods vary depending on local legal requirements. Therefore, despite your request to delete your data, we may still need to retain certain data for legal reasons. In this case, however, we will restrict further processing of the data.
We develop and offer apps. These apps collect and process your personal data in much the same way as a website. With your consent, we send you push notifications with information about the services you use. You can find out how to change your settings and how to activate or block push notifications in the user manual for your mobile device.
The data controller is the entity responsible for processing your personal data and determining the purposes and means of processing.
Move Republic GmbH
Address: Poststr. 14-16
20354 Hamburg, Germany
Management: Daniel Hanelt, Till Kubelke
Email: biuro@moverepublic.com
DS EXTERN GmbH
Dipl.-Kfm. Marc Althaus
Address: Frapanweg 22
22589 Hamburg
Email: anfragen@dsextern.de
Commissioner for Data Protection and Freedom of Information in Hamburg
The Hamburg Commissioner for Data Protection and Freedom of Information
Address Ludwig-Erhard-Straße 22
20459 Hamburg
Germany
Phone: +49 40 428 54 4040
Email: mailbox@datenschutz.hamburg.de
If, in accordance with applicable data protection law, you wish to object to our collection, processing, or storage of your personal data, please send your objection by email to the address provided in section 8.1. Due to your objection, further use of our services may be impossible or significantly limited.
The current version of the Privacy Policy is available at www.moverepublic.com. As changes in the law or our internal processes may require changes to the Privacy Policy, we reserve the right to do so. We encourage you to regularly review the current version of the Privacy Policy.
