Privacy Policy

Last updated: 11 November 2026 · Version 2026-11-11

This policy explains what personal data CoworkMoves (“we”, “us”) collects, why, and what rights you have. CoworkMoves is a platform that lets companies run fitness challenges for their teams at coworkmoves.com and its company subdomains (for example yourcompany.coworkmoves.com).

1. Who we are

The controller for your account data is Oxana Ktoridou, Nicosia, Cyprus. Contact: privacy@coworkmoves.com (shown here as text too: privacy@coworkmoves.com), or use our contact form. We have not appointed a Data Protection Officer because we are not required to; privacy questions go to the address above.

2. Two roles: us and your company

Your account (name, email, password, sign-in): we decide how this is processed, so we are the controller.
Your company’s challenge (your membership, the activities you log, kudos, the leaderboard and totals): the company that runs the challenge decides why this data is processed (for example its wellbeing programme or a charity donation). For this data the company is the controller and we are its processor, acting under our Data Processing Agreement. Questions about how your employer uses challenge data are best sent to your company’s organiser; we will help them answer.

3. What we collect

Account data: your name, email address, a securely hashed password (we never store the password itself), and if you sign in with Google, your Google account ID and verified email.
Challenge data: the companies you belong to and your role, the activities you log (type, optional description, optional minutes, date and time), the points and rewards they earn, kudos you give, and your display settings (name or initials, leaderboard visibility).
Company data provided by organisers: company name, subdomain, logo, brand colour, invitation emails.
Technical data: a login cookie (see section 8) and standard server logs kept by our hosting provider for security and troubleshooting (IP address, browser type, time of request).

We do not ask for health information such as heart rate, weight or medical conditions. Please don’t put such details in activity descriptions.

4. Why we use it and our legal basis

To provide the service you signed up for: create your account, let you join companies, log activities and show feeds, leaderboards and totals. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
Account emails: email confirmation, password reset, invitations from your organiser. Legal basis: contract (Art. 6(1)(b)). We do not send marketing emails.
Security and abuse prevention: protecting accounts and the platform. Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f)).
Challenge data on behalf of your company: processed on your company’s instructions under the DPA; your company determines its own legal basis.

5. Who can see your data

Members of the same company see your display name (or initials), your activities and kudos in that company only. You can hide yourself from the leaderboard.
Organisers (owners and admins) of your company also see your email address and can export that company’s activity list (including names and emails) for reporting, for example to confirm a donation.
Service providers (sub-processors) that help us run CoworkMoves:
- Cloudflare, Inc. – hosting, database, file storage and network security.
- Resend, Inc. – sending account and invitation emails.
- Google LLC – only if you choose “Sign in with Google”.

We do not sell your data or use it for advertising.

6. International transfers

Some of these providers are based in the United States or may process data outside the European Economic Area. Where that happens, the transfer is covered by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission’s Standard Contractual Clauses.

7. How long we keep it

Account data: until you delete your account. When you do, we remove your name, email, password and Google link straight away.
Activities you logged: kept as part of your company’s challenge history and totals, but anonymised when you delete your account (shown as “Former member”, with descriptions removed). They are deleted entirely if the company is deleted.
When you leave a company, your past activities stay in its totals under your name until you delete your account or ask us to anonymise them.
Invitations expire after 7 days (email) or 14 days (shareable link). Login sessions expire after 24 hours, or 30 days if you choose “Keep me logged in”.
Company data is kept until the company owner deletes the company.

8. Cookies

We use only cookies that are strictly necessary for the service: cm_session keeps you logged in (until you close the browser, or 30 days if you tick “Keep me logged in”), and cm_oauth protects Google sign-in for up to 10 minutes. We use no analytics, advertising or tracking cookies, so we don’t show a cookie banner.

9. Your rights

Under the GDPR you can ask to access, correct, delete or export your data, object to processing based on legitimate interests, and restrict processing. You can do the most common ones yourself on your Account page:

Download my data gives you a copy of your account and activity data (JSON).
Delete my account removes your account and anonymises your activities.
Your name can be changed on the Account page; display and leaderboard choices are in each company’s “My settings”.

For anything else, email privacy@coworkmoves.com. We reply within one month. You also have the right to complain to a data protection authority, in Greece the Hellenic Data Protection Authority (www.dpa.gr), or the authority where you live or work.

10. Security

Passwords are hashed with PBKDF2, all traffic is encrypted (HTTPS), login and invitation tokens are stored only as hashes, and company pages are visible only to members.

11. Children

CoworkMoves is for workplaces and is not intended for anyone under 16.

12. Changes

If we change this policy in a meaningful way we will update the date above and tell you when you next log in or by email.