Privacy policy

1. Data controller

We are the data controller for the personal data we process about our users and partners.

Løbeklubben ApS
Sørupvej 27A 2, 3480 Fredensborg, Denmark
CVR no.: 46452054
Email: info@loebeklubben.dk

We are not required to appoint a Data Protection Officer (DPO). If you have questions about how we process your personal data, you are always welcome to contact us.

2. What data do we process in the app?

The Løbeklubben app processes the following data, depending on which features you use:

2.1 Your profile

When you create an account, we process:

• Name
• Email address
• Password (encrypted – we cannot see your password in plain text)

Legal basis: GDPR Article 6(1)(b) (performance of a contract), as the data is necessary to create and manage your account.

2.2 Activity data from Strava

Strava, Inc. is an independent data controller with its own terms and privacy policy. If you connect the app to your Strava account, you authorise us through Strava’s official login (OAuth 2.0) to receive a limited set of data. We only collect:

• Activity type (e.g. running, walking)
• Duration and distance
• Date and time of the activity

We never collect GPS routes, segments, heart rate, photos, social data or any other Strava information. You can disconnect at any time in your Strava profile under “App authorisation” – our access then stops immediately.

Legal basis: GDPR Article 6(1)(a) (consent).

2.3 Activity data from Apple Health

Apple Health is a local feature on your iPhone, and Apple receives no data from the app. If you give the app access, we only read the following directly from your phone:

• Activity type (e.g. running, walking)
• Duration and distance
• Date and time of the activity

We write no data back to Apple Health and never read health, sleep, nutrition or any data other than movement activities.

Legal basis: GDPR Article 6(1)(a) (consent). You can withdraw access under Settings › Health › Data Access & Devices › Løbeklubben on your iPhone.

2.4 Club coins and rewards

We record the club coins you earn and spend, and which partners you spend them with. This is necessary to manage club coins correctly.

Legal basis: GDPR Article 6(1)(b) (performance of a contract).

2.5 Location for notifications

If you give the app access to your location, we only use it to send you notifications about active offers nearby. We do not store your location – it is only used at the moment the notification is sent, and we never share it with others.

Legal basis: GDPR Article 6(1)(a) (consent). You can withdraw access under Settings › Privacy & Security › Location Services › Løbeklubben on your iPhone.

2.6 Redemptions and statistics

When you redeem a coupon, we record which shop it was redeemed at. We use this for aggregate statistics, e.g. “47 redemptions in Fredensborg in April”. The statistics are never linked to you as a person and are shared with our partners as documentation of how their offers perform.

Legal basis: GDPR Article 6(1)(b) (performance of a contract) and (f) (legitimate interest).

3. The website

3.1 Contact form and email

If you write to us through the contact form or by email, we process the information you give us – typically name, email, subject and your message – in order to reply. We delete the correspondence once the matter is resolved.

Legal basis: GDPR Article 6(1)(f) (legitimate interest).

3.2 The partner map

The map on the front page is loaded from CARTO (map data from OpenStreetMap), and its functions are loaded from unpkg.com. When the map loads, these services receive your IP address, as this is necessary to display the map. We do not use this information for anything.

3.3 Statistics

We count visits to the website with Koko Analytics, which runs on our own server. No cookies are used, and we store no information that can be linked to you – only aggregate figures, e.g. how many people viewed a page and which page they came from. The data is not shared with anyone.

Legal basis: GDPR Article 6(1)(f) (legitimate interest in improving the website).

3.4 Cookies

The website only uses necessary cookies. We use no cookies for statistics or marketing, so we do not ask for cookie consent.

4. Data processors

We use external suppliers to run the app and the website. They may only process your data according to our instructions:

• Supabase, Inc. – backend for storing user data and login. Data is stored on servers in Sweden (Stockholm) within the EU. We have a data processing agreement with Supabase.
• Formspree, Inc. (USA) – receives messages from the contact form on the website and forwards them to us.
• Simply.com – hosting of the website.
• Strava, Inc. (USA) – we receive activity data through Strava’s API. Strava is an independent data controller for the data it processes on its own behalf.
• Apple Inc. – access to Apple Health happens only locally on your phone. Apple receives no data from the app and is not a data processor for us.

5. Disclosure

We do not disclose your personal data to others for marketing or commercial purposes. Disclosure only happens when necessary to provide the service through the suppliers above, or if required by law.

6. Transfers outside the EU

Where possible, we use suppliers that store data in the EU/EEA. Where data is processed outside the EU/EEA – as with Strava and Formspree in the USA – we ensure an adequate level of protection through the EU’s Standard Contractual Clauses (SCC) or equivalent approved mechanisms.

7. Retention and deletion

• Profile information: deleted within 30 days after you delete your account.
• Activity data from Strava: deleted when you disconnect or delete your account.
• Activity data from Apple Health: stored only to calculate club coins and deleted when you delete your account.
• Location: not stored.
• Redemptions: stored only as aggregate statistics at shop level, not linked to you.
• Enquiries: deleted once the matter is resolved.

8. Data security

We protect your data with appropriate technical and organisational security measures in accordance with GDPR Article 32, including:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Access control and encrypted storage of passwords
• Continuous monitoring and updating of security
• Data minimisation – we only collect what is necessary
• Regular assessment of security risks

9. Data breaches

If a data breach occurs that may pose a risk to you, we report it to the Danish Data Protection Agency (Datatilsynet) within 72 hours, in accordance with GDPR Article 33. If the risk is high, we notify you directly by email without undue delay, in accordance with Article 34.

10. Profiling

We do not carry out profiling or automated decisions that have legal or similarly significant effects on you.

11. Your rights

You have the following rights. Email info@loebeklubben.dk to use them:

• Access: see what data we process about you.
• Rectification: have inaccurate data corrected.
• Erasure: in certain cases have your data deleted early.
• Restriction: in certain cases have processing restricted.
• Objection: object to our processing, including direct marketing.
• Data portability: in certain cases receive your data in a machine-readable format.

12. Withdrawing consent

You can withdraw your consent at any time:

• Strava: disconnect in the app or on strava.com.
• Apple Health: Settings › Health › Data Access & Devices › Løbeklubben.
• Location: Settings › Privacy & Security › Location Services › Løbeklubben.

Withdrawing consent does not affect the lawfulness of processing carried out before.

13. Changes

If we make material changes to this policy, we will let you know by notification, email or in the app before the change takes effect. If a change requires a new legal basis, we will ask for your consent again.

14. Complaints

If you are not satisfied with how we process your personal data, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk.

Terms and conditions

The terms for using the app can be found in Privacy & Terms (PDF).