Privacy Policy
1. Introduction
Reflectly ApS (“Reflectly”, “we”, “our” or “us”) are committed to respecting your privacy andprocessing personal data in accordance with the EU GDPR. The Privacy Policy set out in thisdocument relates to all websites and mobile applications owned or controlled by Reflectly at any
given time. The applications are subject to change but set out in the Reflectly and Reflectly X
developer pages on the Apple Store and the Reflectly developer page on the Google Play Store.
Collectively they will be referred to as “the Apps” and will include any alternative means of offering
or delivering our software and services provided in the future. Certain parts of the Privacy Policy will
only relate to some of the websites, the Apps or app categories. The Privacy Policy should be read
carefully to discover how we obtain, process, store and disclose your personal data. The policy also
sets out your rights as a data subject.

2. Personal Data
Purpose and Lawful Basis
Personal Data

Processing Operation andLawful Basis

PurposeAccount Informationi.

(e.g. nickname, emailand subscriptionstatus)

ii.

iii.

To provide Newsletterswith exclusive contentand inform you of offers,
depending on whether
you are a Subscriber orNon-subscriber.
To create an account,allowing you to back up
content and for theGrowth Bundle website
to manage yoursubscription.
To provide access toPremium features if asubscription ispurchased.

i.

We require your consent*.

ii.

Necessary for the performanceof a contract we have with you.

iii.

Necessary for the performanceof a contract we have with you.

iv.

Necessary to comply with legal
obligations.

*By ticking the box you consent toNewsletters from both Reflectly and/or theGrowth Bundle (a platform controlled byus).

1 / 10

iv.

Photo

To notify you aboutmaterial changes to theTerms of Service andPrivacy Policy.

To allow you to upload a profile

To revoke your consent click ‘Unsubscribe’at the bottom of one of our emails.

We require your consent.

photo, creating a more
personalised service.
Moods, associatedTo provide a mood journal that

We require your explicit consent toactivities, feelings andcontains relevant content, stores process the health data. It constitutes aadditional photos,entries, compiles data andspecial category of personal data undernotes, text and voicepresents statistics.

the GDPR, which by default is prohibited

notes detailing mental

save for certain exceptions including

health, moods orexplicit consent. Explicit consent is given

related thoughts (theby marking a tick in the requisite box at“Mental Health Data”)

sign up or the update notice.

Fingerprint or facial

If enabled, your fingerprint or

We require your explicit consent todata (the “Biometricfacial data will be used toprocess the Biometric Data. ItData”)

confirm your identity for the sole constitutes a special category of
purpose of protecting in-app

personal data under the GDPR, which bydata against unauthorised

default is prohibited save for certain

access. The Apps simply avail of

exceptions including explicit consent.

the authentication system

Explicit consent is given by affirmatively

provided by your mobile phone.

clicking that you allow the App to

You may have provided yourprocess the data when prompted.

Biometric Data upon setting up
your mobile phone, we have noaccess to this.
When a user attempts to accessthe Apps, the authentication
system will collect freshBiometric Data to crossauthenticate against theBiometric Data stored on yourmobile phone. We do not store
this fresh Biometric Data, it isprocessed by your mobile phone
operator for the sole purpose ofauthentication.

2 / 10Data relating toi.

To monitor your health

We require your explicit consent toexercise, mindfulness,more effectively byprocess the Apple Health Data. It

sexual activity, sleep,

allowing us to write data. constitutes a special category ofphysique, nutrition,
heart rate, blood

personal data under the GDPR, which byii.

To provide your healthdefault is prohibited save for certain

pressure and otherdata in an easy to read

exceptions including explicit consent.

data supported bygraphical format, and to

Explicit consent is given by affirmatively

Apple Health (thetrack your progress.

clicking that you allow us to read and“Apple Health Data”)

write data when prompted.

Calendar data from the To automatically integrate

We require either your consent, or

terminal device

explicit consent depending on theCalendar events.

calendar event. If the event relates to a
special category of personal data suchas health or religious belief (i.e. medical
appointments or church service) explicit
consent is required.
Explicit Consent is one of the limited
exceptions to the prohibition ofprocessing special category personal
data under the GDPR.
Both consent and explicit consent,
whichever is required, can be given byaffirmatively clicking that you allow us toaccess the data when prompted.
Demographic group

To automatically generate App

Processing is necessary for the mutualand general goals

recommendations associatedlegitimate interest for Apps to bewith the selected demographic

suggested to you.

or goal when a User signs up via
the Growth Bundle website.

3 / 10Payment details

To allow purchases to be madeNecessary for the performance of athrough the Growth Bundle

contract we have with you.

website using card payment.

Some of the Apps or websites may not process every category of personal data listed above. This will
be clear if and when it applies (e.g. if not asked for your email address, it is not being processed).
Necessary for performance of contract
We process some of your personal data because it is necessary for the performance of a contract wehave with you or it is necessary prior to entering into such a contract. If you do not wish to provide anickname or email for example, we cannot create your account and you will be unable to avail ofcertain features. It should be noted, however, that not every app will process this data.
Changes to Personal Data
It is important that the personal data we have in relation to you is current and accurate. If yourpersonal data (e.g. email address) changes during our relationship please inform us promptly. If, forwhatever reason, your personal data is inaccurate or incomplete you have the right for this to becorrected or completed.
Unprompted Health Data
Although some of our Apps do not directly prompt or encourage you to input health data, you may
wish to still provide such data. Often this data is not collected for storage or any other purposes, butinstead, stored locally on your device terminal. The same applies to our expenditure and budgeting
apps, despite the fact health spending may exist as a default spending category.
Some of the Apps provide the option to back up your data with iCloud, for more information on how
Apple processes your personal data see Apple’s Privacy Policy. The option to synchronise data acrossdevices using Google Drive or Dropbox may also be provided, please refer to their privacy policies.

4 / 103. Automatic Collection, Retention and Sharing
Device and Usage information automatically collected
In conjunction with our partners we automatically collect and log certain information stored on yourterminal device (“Device Data”) including device type, operating system specification, network
settings, unique device identifier and IP address. “Usage Data” is collected and logged to discover
how the Apps are used and which features are popular, it includes data relating to the time you areactive, purchases and the features, buttons or screens you interact with. This helps to inform andimprove our direction and development. We rely on our legitimate interest of measuring andanalysing app usage to further inform development and improve the overall user experience.
Our Analytics providers may by default use IP addresses to determine your general non-specificlocation. Among other things, this allows geographic sorting and protects us and our apps against
misuse and nefarious activity.
Retention of Personal Data
We are committed to the principle of storage limitation and will retain your personal data for nolonger than is necessary to fulfil our processing purposes. Following account deletion, revocation ofconsent or a written deletion request, your personal data will be retained for no longer than 30 days,
save for certain instances where legal obligations require longer retention periods.
We will also anonymise some personal data so it will no longer be associated with you. In this event
we are entitled to retain and use the information freely.
Sharing with Third PartiesIn order to provide you with our services, carry out our activities and to comply with legal
obligations, we share your personal data with certain third parties such as:●cloud storage providers, to help us securely store and back-up your data. To be able toprovide these services, the providers receive your Account Information; Photo (if provided);
and the Mental Health Data. The providers we currently use are located in the US.

●

analytics providers, who assist us in the improvement and optimisation of the App. To beable to provide these services, the providers receive Device Data and Usage Data. We
currently use a provider located in the US.

5 / 10●

analytics providers, who assist us in the improvement and optimisation of the App. To beable to provide these services, the providers receive Device Data and Usage Data. We
currently use a provider located in the US.

●

newsletter and mailing providers, to enable us to generate and send newsletters to you if
you have subscribed. To be able to provide this service, the providers receive your AccountInformation. The providers we use are located in France and the US.

●payment providers, who execute card payments for purchases made on the Growth Bundle
website. To do this, the providers receive your payment details and Account Information.
The provider we currently use is located in the US.

●subscription infrastructure platforms, who facilitate the offering of in-app subscriptions. In
doing so they receive your Account Information. The platform we are currently using islocated in the US.

●

cookie consent management platforms, who assist us in managing and implementing yourpreferences when you visit our websites. The platforms receive automatically collected
device information to provide this service. The platform we are currently using is located inDenmark.

●law enforcement authorities, government authorities, government bodies and the courts
where they request it and disclosure is lawful. (e.g. prevention and detection of crime).

4. International Data Transfers
To provide storage and email newsletters we transfer your data to our partners outside the EU. We
are committed to ensuring your personal data is protected when transferring to third countries
without an adequate level of protection, namely the U.S.
In light of the EU-US Privacy Shield being invalidated, Standard Contractual Clauses are now reliedon. Reflectly acknowledges the comments in the Schrems II decision that additional safeguards may
be needed to supplement such clauses. We are currently assessing our transfers and working with
our partners to implement safeguards, along with the updated Standard Contractual Clauses.

6 / 105. Security
We have implemented appropriate technical and organisational security measures to protect yourpersonal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of oraccess to. These measures include encryption and pseudonymisation. Access to your personal data
is granted strictly on a need to know basis and we have carefully selected our service providers withsecurity considerations in mind.

6. Your Rights
General Rights
You have several rights in relation to your personal data, these include the right to:●Access a copy of the personal data we hold about you;●

Correction or completion of any inaccurate or incomplete personal data;●

Erasure (save for personal data necessary to comply with legal obligations or for theestablishment, exercise or defence of legal claims);●

Obtain a copy of your personal data in a portable format;●Restrict the processing of your personal data, in the following instances:-

1) You are contesting the accuracy of your personal data and we need time to verify it.
2) Processing has been found unlawful, but you oppose erasure.
3) You require the personal data for the establishment, exercise or defence of legal claims, but
we no longer need it for our processing purposes.
4) You have objected to processing based on our legitimate interests and a final decision ispending.
●Withdraw consent or explicit consent for specific processing;●

Object to the processing of personal data based on our legitimate interests on the grounds
that they are overridden by your interests or fundamental rights and freedoms;●

Object to the processing of personal data for direct marketing purposes.

7 / 10If you wish to exercise any of these rights, please contact us. We may request proof of identification
to verify your request.
Complaint: Supervisory authority
If you think we have infringed your rights under data protection legislation, you have the right tolodge a complaint. When making your complaint, the relevant supervisory authority is the one in thecountry:i.

where you are habitually resident;ii.

where you work; oriii. where the alleged infringement took place.
The right to lodge a complaint is without prejudice to any other administrative or judicial remedy
you may have. The contact information for the Danish Data Protection Agency is provided below.
Datatilsynet
Carl Jacobsens Vej 35
DK-2500 Valby+45 33 19 32 00
dt@datatilsynet.dk7. Age Requirement
You must be at least 13 years of age to use any of the Apps.

8. Cookies
We use cookies and other such tracking technologies (“Cookies”) to remember certain details whena “User” visits some of the websites owned or otherwise controlled by Reflectly.
Cookies are small data files that transfer to the User’s computer, phone, or other such device(“Terminal Device”) upon visiting some of the websites. Information is then obtained on the return
visit. Cookies are stored locally on a Terminal Device for different periods, determined by their
expiry date. Session Cookies are deleted once the browser is closed, while Persistent Cookies may
remain on the Terminal Device until a given date.
Cookies can be categorised in two further ways: by the party that placed them (“Source”); and what
they are used for (“Function”).

8 / 10

1.

Source(a)

1st Party Cookies (placed by Reflectly)(b)

3rd Party Cookies (placed by Third Party Vendors)2.

Function(a)

Necessary Cookies(b)Preference Cookies(c)Statistics Cookies(d)Marketing Cookies

We require your consent to place Preference, Statistics and Marketing Cookies. When you visit someof our websites you will be asked for your cookie preferences by a Cookie Banner. Thesepreferences can be changed at any time through the Cookie Settings window, accessed by clicking
the black circular button at the bottom left corner of your display. For further information on thespecific cookies used on a website please see the relevant Cookie Banner or Cookie Settings window.
Necessary Cookies
Necessary Cookies help make a website usable by enabling basic functions like page navigation andaccess to secure areas of the website. The website cannot function properly without these cookies.
There is no option to use the site without Necessary Cookies and unlike the latter three categories,
we do not need User consent. The Cookie Banner and Cookie Settings window will by default
permanently enable these cookies.
Preference Cookies
Preference Cookies enable a website to remember information that changes the way the website
behaves or looks, like your preferred language or the region that you are in.
Statistic Cookies
Statistic cookies help website owners to understand how visitors interact with websites by collecting
and reporting information anonymously.

9 / 10Marketing Cookies
Marketing cookies are used to track visitors across websites. The intention is to display
advertisements that are relevant and engaging for the individual User and thereby more valuable forpublishers and third party advertisers.
Disabling and Deleting Cookies
The current versions of Safari and Mozilla Firefox, by default, block third-party Cookies. For more
information please refer to the following blog posts regarding Safari and Mozilla Firefox. If otherBrowsers, such as Google Chrome or Microsoft Edge are used, third-party Cookies can be blocked
manually through the Browser settings.
The option may also exist in the Browser settings to block all Cookies, including strictly necessary
ones. However, the websites may not work as intended, or at all. Most Browsers will allow the User
to delete all Cookies or to delete them on an individual basis. The User should be aware that by
doing so, their preferences for the websites may be lost. For instructions specific to a particular
Browser, please refer to the online support pages provided by the Browser.

9. Contact
If you wish to get in contact with us please email hello@reflectly.app or write to us at Balticagade 14B,
8000 Aarhus C, Denmark.
Questions, comments and requests in relation to this privacy policy or the processing of yourpersonal data should be addressed to our Data Protection Officer (“DPO”).
DPO email: dpo@reflectly.app

10. Changes to this Privacy Policy
We are constantly reviewing our Privacy Policy to ensure compliance with data protection legislation.
Our apps are also constantly evolving and new features and services may change how we process
your personal data. Any substantive or material change to this Privacy Policy will be brought to yourattention.
Last updated: 9 December 2022

10 / 10