Join the Make-A-Wish Ireland 12 Days of Wishes challengeStarts 30 NovLearn more
Book a 15-Min Demo

Legal

GDPR Statement

GDPR privacy notice for European clients.

GDPR Privacy Notice for European Clients

Last updated: 14 October 2026

Identity of the Data Controller

"Data controllers" are the people or organisations that determine the purposes for which, and the manner in which, any Personal Data is processed, and make independent decisions in relation to the Personal Data and/or who/which otherwise control that Personal Data.

For the purposes of the GDPR, GoChallenge Ltd. (Company No. 701174) is the data controller with regard to the Personal Data described in this statement and in our Privacy Policy.

  • Registered office: Asgard, Knockhouse, Woodstown, Co. Waterford, Ireland
  • Trading address: SETU Xcelerate Centre, South East Technological University, West Campus, Waterford, Ireland

Our mission is to revolutionise the workplace by making movement an integral part of every workday. GoChallenge Ltd. takes the protection and privacy of our users' personal data seriously. To that end, we have appointed a Data Protection Officer.

Our Data Protection Officer is John Barron, who can be contacted at support@gochallenge.com.

Purpose and Scope of this Statement

The purpose of this statement is to provide you, as our data subject, with a statement regarding the Data Protection and Privacy practices and obligations of GoChallenge Ltd. and an explanation of your rights as a data subject. It should be read together with our Privacy Policy, which sets out in more detail what we collect, why, and for how long.

This statement applies to our business practices, the GoChallenge app, and our website, which is accessible from www.gochallenge.com.

Why and how do we ensure compliance?

Data protection and privacy laws provide rights to individuals with regard to the use of their Personal Data by organisations, including our organisation. Irish and EU laws on data protection govern all activities we engage in with regard to our collection, storage, handling, and disclosure of your Personal Data within the EU.

We must comply with data protection and privacy laws because the law requires us to but we also would like you to have confidence in dealing with us, and our compliance with data protection law helps us to maintain a positive reputation in relation to how we handle Personal Data.

We are required to demonstrate accountability for our data protection obligations. We must be able to show how we comply with the applicable data protection and privacy laws, and that we have in fact complied with the laws.

We do this, in conjunction with our written policies and procedures, by building data protection and privacy compliance into our systems and business practices, by internally monitoring our data protection and privacy compliance and keeping it under review, and by acting if our representatives, including employees or contractors, fail to follow the rules.

We also have certain obligations in relation to keeping records about our data processing.

What are the data protection principles and rules?

We aim to comply with the following principles found in Data Protection Law:

  • Lawfulness, fairness and transparency – Personal data must be processed lawfully, fairly and in a transparent manner.
  • Purpose Limitation – Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
  • Data minimisation – Personal Data must be adequate, relevant and limited to what is necessary in relation to purposes for which they are processed.
  • Accuracy – Personal data must be accurate and, where necessary, kept up to date. Inaccurate Personal Data should be corrected or deleted.
  • Retention – Personal data should be kept in an identifiable format for no longer than is necessary.
  • Integrity and confidentiality – Personal data should be kept secure.
  • Accountability – Under the GDPR, we must not only comply with the above six general principles but we must be able to demonstrate that we comply by documenting and keeping records of all decisions.

What types of personal data will we process?

Personal Data

We collect personal data for the purposes outlined in this statement and in our Privacy Policy. For clients, this is usually the name and work email address of your contacts and, from time to time, billing information. If you are a sole trader or partnership, we will consider your address to be personal data.

Ways in which GoChallenge Ltd. may process your Personal Data:

Information you provide us

  • Account Information
    • You provide us with information when you create an account such as your name, email, username, and password. This information is required for account creation. You may also choose to share a profile photo and your activity preferences.
  • Additional Information
    • When you use our Service and interact with certain features, you may choose to provide us with additional information such as chats, messages on group threads or discussion boards, comments, and likes.
    • If you contact us or participate in a survey, contest or promotion, we gather the information you provide such as name, contact info, organisation or company name, and message.
  • Business contact information
    • If you work for a company we think could benefit from GoChallenge, we may process your business contact details, from sources including Apollo.io and LinkedIn Sales Navigator, to tell you about our services. Our legal basis is legitimate interests, and you can opt out at any time. Details are in our Privacy Policy.
  • Payment and card information
    • If you pay by card, we use your card information solely to collect payment from you. Card payments are processed by our payment provider, Stripe. We do not store your card details, and Stripe may not use them except to process payments on our behalf.

Information we collect automatically

  • Device and Activity Information
    • Your fitness tracking device or mobile smartphone collects data to estimate a variety of metrics like your steps, distance travelled (walking, running, cycling and swimming), and active minutes moved. Not every device tracks all of these metrics. The data collected varies depending on the device you use. When your device syncs with our applications and software, data recorded on your device is transferred from your device or device app to our servers, where it is stored and used to run your challenges.
    • When you pair your device to your account, you grant us access to your exercise or activity data from that device service. You can use your account settings and tools to withdraw this consent at any time by stopping use of a feature, removing our access to a third-party service, unpairing your device, or deleting your data or your account.
  • Location Information
    • We collect your time zone. This is either gathered from your mobile device, your connected fitness device or is manually set by you. We use time zone to allow challenges to start and end locally at the same time for everyone participating in the challenge. You can change your time zone at any time in your profile settings.
  • Usage Information
    • When you access or use our Services, we retain certain usage data. This includes information about your interaction with our Services such as how long you're in our app or what you're viewing in our app.
    • We also collect data about the devices and computers you use to access our Services, including IP addresses, browser type, language, operating system, fitness device type or mobile device information, the referring web page and pages visited.

Special Category Personal Data

Step count, distance and activity data collected through the app may be health data, which is special category personal data under the GDPR. We process it only with your explicit consent, which you give when you connect Apple Health, Health Connect or another activity source. You can withdraw your consent at any time, as described above. We do not collect special category data through our website.

Children

Our services are for adults only. You must be 18 or over to use GoChallenge, and we do not knowingly collect personal data from, and/or about, children under the age of eighteen (18). For the purposes of the GDPR, we do not intend to offer information society services directly to children. If we become aware that we hold personal data about a child, we will remove the account and delete the data. If you believe that we might have any such information, please contact us at: support@gochallenge.com

Who has access to or processes personal data?

Your Organisation Administrator(s)

If you sign up for our service through an employer or organisation, remember that their use of your information will be governed by their privacy policies and terms. You can revoke your consent to share with organisational or employee wellness programmes by deleting your personal account with them or asking your employer's administrator to remove you from the organisation account. GoChallenge does not control the way our organisational clients or admins use our tool. They control the configuration of groups, challenges, content, and communications associated with hosting a wellness programme.

By default, your employer or organisation sees only team and company totals, never your individual activity. We share an individual participant's data with their employer only in these specific circumstances:

  • Exceptions: where we need to make an exception for a participant's data or participation in a challenge, and the employer needs to know.
  • Fair play: where we believe a participant is gaming the challenge in a way that is particularly notable, and we need to notify the employer.

We rely on our legitimate interest in running fair challenges for our clients, and we share only the data needed for that purpose.

Service Providers

We may use trusted service providers who could be considered data processors, sub-processors or third parties. They are listed in our Privacy Policy. We have written agreements in place with all of our service providers and, before we sign each agreement, we need to have vetted and be satisfied with the service provider's data security. The agreements also need to contain specific clauses that deal with data protection. We require all third parties to have appropriate technical and operational security measures in place to protect your Personal Data, in line with EU laws on data protection. Any such organisation or individual will have access to Personal Data needed to perform these functions but may not use it for any other purpose.

We may pass on your details if we are:

  • under a duty to disclose or share your Personal Data in order to comply with any legal obligation, or
  • in order to enforce or apply any contract or other agreements with you, or
  • to protect our rights, property, or safety of our employees, customers, or others. This includes reporting information about incidents (as appropriate) to the law enforcement authorities and responding to any requirements from law enforcement authorities to provide information and/or Personal Data to them for the purposes of them detecting, investigating and/or prosecuting offences or in connection with crime sentencing.

Other than the above, or captured herein or in another agreement with you, we will not disclose personal information to any third party without your consent or prior knowledge except in incidences where an individual is potentially at risk or where the law requires it.

Informed Consent

If you choose to consent, and where we have identified relevant and appropriate grounds, our processing of your Personal Data in line with this statement and our Privacy Policy you will be giving us permission to process your Personal Data specifically for the purposes identified.

You may withdraw consent at any time. If you have any queries relating to withdrawing your consent, please contact our Data Protection Officer at support@gochallenge.com.

Data Transfers Outside the EEA

We host most of our data in the EEA and the UK. Some of our service providers process data in data centres in the United States.

When we transfer your personal data outside the EEA, we will ensure that, where required by applicable law, at least one of the following safeguards is implemented: (1) we will only transfer your personal data to countries, or to providers certified under frameworks such as the EU–US Data Privacy Framework, that the European Commission has decided provide an adequate level of protection for personal data; (2) we use the Standard Contractual Clauses approved by the European Commission, which give personal data the same protection it has in Europe.

Your Rights

Under certain circumstances, and dependent on the legal basis under which your personal data is processed, by law you have the right to:

  • Request information about whether we hold Personal Data about you, and, if so, what that Personal Data is and why we are holding/using it.
  • Request access to your Personal Data (commonly known as a "Data Subject access request"). This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.
  • Request correction of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
  • Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have exercised your right to object to processing (see below).
  • Object to processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your Personal Data for direct marketing purposes.
  • Object to automated decision-making including profiling, that is not to be subject of any automated decision-making by us using your Personal Data or profiling of you.
  • Request the restriction of processing of your Personal Data. This enables you to ask us to suspend the processing of Personal Data about you, for example if you want us to establish its accuracy or the reason for processing it.
  • Request transfer of your Personal Data in an electronic and structured form to you or to another party (commonly known as a right to "data portability"). This enables you to take your data from us in an electronically useable format and to be able to transfer your data to another party in an electronically useable format.

How do you exercise your rights?

Our Data Protection Officer monitors compliance with our data protection obligations, with this statement and with our related policies. If you have any questions about this statement or about our data protection compliance, or you wish to exercise your rights, please contact our Data Protection Officer. We will respond to your request within 1 month.

We are obliged to comply with exceptions to your requests where laid out in law. Such exceptions may relate to health data, disclosures that would be likely to cause serious harm to your physical or mental health or emotional condition and opinions given in confidence.

Our Data Protection Officer, John Barron, can be contacted at support@gochallenge.com.

Your Right to Lodge a Complaint

You as the Data Subject have the right to complain at any time to a supervisory authority in relation to any issues related to our processing of your Personal Data. We would like to hear from you first if you have a complaint about how we use your data so that we may rectify the issue. Our organisation is located in the Republic of Ireland and we conduct data processing in the European Union, we are regulated for data protection purposes. Our lead supervisory authority is the Data Protection Commission (Ireland).

You can find current contact details for the Data Protection Commission, and make a complaint online, at www.dataprotection.ie.

Updates

Our practices as described in this statement may be changed, but any changes will be posted, and changes will only apply to activities and information on a going forward, not retroactive basis.

You are encouraged to review this statement periodically to make sure that you understand how any personal information you provide will be used. We may also email you in certain circumstances to let you know if and when we update this statement to ensure you are informed.

Any changes to this statement will be posted on this website so you are always aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. If at any time we decide to use Personal Data in a manner significantly different from that stated in this statement, or otherwise disclosed to you at the time it was collected, we will notify you by email, and you will have a choice as to whether or not we use your Personal Data in the new manner.