NewU - Privacy Policy
1 - Important information for you
What NewU does
NewU exists to improve the health, well-being and work experience of employees and organisations. To this end, we process personal data, including data concerning your health and data relating to how you experience your work. We attach great importance to transparency in this respect. In this Privacy Policy, we explain which data we process, for what purposes, on which legal basis and for how long we retain such data.
This Privacy Policy applies to every person who interacts with NewU: employees who use the app or participate in a survey, group administrators who manage an organisation, and visitors to our website.
Should you have any questions or a complaint, please contact us at info@newu-app.com.
Who are we?
NewU is the trade name of RabbitQuest B.V., having its registered office at Tolstraat 127, 1074 VJ Amsterdam, the Netherlands, and registered with the Netherlands Chamber of Commerce (Kamer van Koophandel) under number 75177307.
References to âNewUâ, âweâ, âusâ and âourâ are references to RabbitQuest B.V. References to âthe Serviceâ are references to the NewU app, the Portal (www.newu.app) and the Website (www.newu-app.io). References to âyour organisationâ or âthe Groupâ are references to the employer or organisation that makes NewU available to you.
To what does this Privacy Policy apply?
This Privacy Policy applies to all products and services of NewU and describes the processing of personal data relating to the following categories of data subjects:
-
employees and other end users of the app;
-
group administrators and HR contact persons who manage a Group via the Portal;
-
visitors to our website.
This Privacy Policy relates exclusively to personal data. Fully anonymised data, which cannot be traced back to an individual, fall outside the scope of the General Data Protection Regulation (GDPR) and of this Privacy Policy.
What is personal data?
Personal data means any information that can be directly or indirectly traced back to you as an individual. This includes your name and e-mail address, but also your answers to a questionnaire, your activity in the app and technical data such as your IP address.
Certain data constitute special categories of personal data. These are data that merit additional protection, such as data concerning your health. Stricter rules apply to such data. Accordingly, we process health data only where an additional legal basis exists for doing so under the GDPR, such as your explicit consent.
In what capacity does NewU process your data?
For most processing operations, NewU acts as an independent controller. With respect to the employee file supplied by your organisation, NewU acts as a processor on behalf of your organisation.
For the processing operations in respect of which NewU acts as an independent controller, NewU itself determines the purposes and means of the processing of your personal data. This allocation of roles protects your privacy: your employer cannot give us instructions regarding your individual data in respect of these processing operations, has no access to such data and receives exclusively aggregated results at group level. You exercise your privacy rights in respect of these processing operations directly with NewU.
With respect to the employee file, NewU processes personal data on behalf of your organisation. Any questions or requests concerning this employee file should therefore be addressed to your employer.
What your organisation can and cannot see
The following is the fundamental principle of NewU and is safeguarded both legally and technically.
Your organisation can neither view nor request individual survey data.
Individual answers, individual results, personal feedback, participation data and consent choices are never visible to your employer, HR or any manager, whether directly, indirectly or upon request. NewU does not disclose such data, including where the organisation requests it.
Your organisation receives exclusively aggregated results at group level.
What colleagues can see. If you participate in a challenge, other participants can see that you are participating and when you complete it. Photographs and comments that you post are visible to the other participants. Your habits, your survey results and your personal suggestions are not visible to them: these are for you alone. If you do not wish to be visible at all, you may anonymise your profile in the app.
Where your organisation engages an occupational physician. Certain organisations have the survey conducted under the responsibility of an occupational physician or an occupational health and safety service. If you give your explicit consent thereto, the occupational physician will have access to your individual results via a secure portal, exclusively for the purpose of providing you with occupational health guidance. NewU enters into a separate agreement with the occupational physician or occupational health and safety service, setting out obligations of confidentiality and security and a prohibition on sharing results with your employer. The physician and the persons working under his or her responsibility are bound by medical professional secrecy.
2 - Which personal data do we process?
Which section applies to you?
-
Do you use NewU through your employer or organisation? Please refer to 1. Employees and other end users
-
Do you manage a group on behalf of an organisation via the Portal? Please refer to 2. Group administrators and HR contact persons
-
Do you only visit our website? Please refer to 3. Website visitors.
The remaining sections of this Privacy Policy apply insofar as they relate to your situation.
Employees and other end users
You are an end user if you use NewU through your employer or organisation, for example to complete a questionnaire or to use the app.
| Processing operation | Purpose | Personal data | Legal basis |
|---|---|---|---|
| Employee file and invitation | Inviting you to NewU, preparing your access and assigning you to the appropriate group(s) | Name, e-mail address, department, language preference, gender, date of birth and other user attributes | Processing on behalf of your organisation. Your organisation determines the legal basis for this processing. |
| Account and access | Providing you with access to the app and remembering your settings | E-mail address, password, profile information, language preference | Performance of our contract with you (Article 6(1)(b) GDPR) |
| Habits, challenges and content | Enabling you to build habits, enabling participation in challenges, providing content and sending you reminders thereof by push notification and e-mail | Account data, activity data, completed habits and challenges, photographs and comments | Performance of our contract with you (Article 6(1)(b) GDPR) |
| Support and contact | Answering your questions and resolving issues | Account data, content of your message | Performance of our contract with you (Article 6(1)(b) GDPR) |
| Participation in surveys | Conducting the survey, processing your answers and calculating your personal result | Answers to questionnaires, including health data and psychosocial data Participation and progress status | Your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR). We request such consent separately at the start of each survey. |
| Benchmarking | Comparing survey results with those of comparable organisations. | Survey results. Organisations receive exclusively outcomes at group level. | Your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR). We request such consent separately at the start of each survey. |
| Personal feedback and suggestions | Displaying your own result and making appropriate suggestions for habits and actions | Survey data, activity data in the app | Your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR). We request such consent separately at the start of each survey. |
| Connection with a wearable | Synchronising your wearable activities so that you can complete challenges | Wearable activity data, such as steps and movement | Your consent, which you give when you activate the connection (Article 6(1)(a) and Article 9(2)(a) GDPR) |
| Location-based challenges | Calculating the distance covered for the purpose of completing a GPS challenge | Location data, processed exclusively in real time and not stored | Your consent, which you give when you activate the connection (Article 6(1)(a) and Article 9(2)(a) GDPR) |
| Technical operation and security | Operating the platform, resolving malfunctions, monitoring security and investigating misuse | Usage data, IP address, device and browser type, log files | Our legitimate interest in a secure and properly functioning platform (Article 6(1)(f) GDPR) |
| Survey under the responsibility of an occupational physician | Making your individual results available to the occupational physician or occupational health and safety service of your organisation for the purpose of occupational health care | Answers to questionnaires, including health data, and your individual result | Your explicit consent to share your results with the occupational physician or occupational health and safety service (Article 6(1)(a) and Article 9(2)(a) GDPR). We request such consent separately at the start of the survey. |
Group administrators and HR contact persons
You are a group administrator if you use the Portal on behalf of an organisation to manage a Group.
| Processing operation | Purpose | Personal data | Legal basis |
|---|---|---|---|
| Access to the Portal | Providing you with access to the Portal and identifying you | E-mail address Name Password Role and permissions | We process your data for the performance of the contract between NewU and your organisation (Article 6(1)(b) GDPR). In addition, we process data on the basis of our legitimate interest (Article 6(1)(f) GDPR): in order to send you necessary service communications regarding changes and maintenance, and to keep the Portal secure and operational. |
| Support and contact | Answering your questions and resolving issues | Account data, as well as: Content of your message | We process your data for the performance of the contract between NewU and your organisation (Article 6(1)(b) GDPR). In addition, we process data on the basis of our legitimate interest (Article 6(1)(f) GDPR): in order to send you necessary service communications regarding changes and maintenance, and to keep the Portal secure and operational. |
| Management of the Group, vitality and survey settings | Enabling you to configure surveys, schedule e-mails and create initiatives | Survey configuration Vitality configuration Scheduling and e-mail scheduling Group settings Content created | We process your data for the performance of the contract between NewU and your organisation (Article 6(1)(b) GDPR). In addition, we process data on the basis of our legitimate interest (Article 6(1)(f) GDPR): in order to send you necessary service communications regarding changes and maintenance, and to keep the Portal secure and operational. |
| Access to group reports | Providing you with insight into outcomes at group level | Aggregated outcomes, no individual data | We process your data for the performance of the contract between NewU and your organisation (Article 6(1)(b) GDPR). In addition, we process data on the basis of our legitimate interest (Article 6(1)(f) GDPR): in order to send you necessary service communications regarding changes and maintenance, and to keep the Portal secure and operational. |
| Service communications and product updates | Informing you of changes, maintenance and new functionality | E-mail address Name Organisation | We process your data for the performance of the contract between NewU and your organisation (Article 6(1)(b) GDPR). In addition, we process data on the basis of our legitimate interest (Article 6(1)(f) GDPR): in order to send you necessary service communications regarding changes and maintenance, and to keep the Portal secure and operational. |
| Technical operation and security | Operating the Portal, resolving malfunctions, monitoring security and investigating misuse | Usage data, IP address, device and browser type, log files | We process your data for the performance of the contract between NewU and your organisation (Article 6(1)(b) GDPR). In addition, we process data on the basis of our legitimate interest (Article 6(1)(f) GDPR): in order to send you necessary service communications regarding changes and maintenance, and to keep the Portal secure and operational. |
Website visitors
This section concerns visitors to www.newu-app.io.
| Processing operation | Purpose | Personal data | Legal basis |
|---|---|---|---|
| Availability and security of the website | Providing, maintaining, securing and improving the website | IP address Browser type and settings Technical data collected via cookies | We process these data on the basis of our legitimate interest (Article 6(1)(f) GDPR): providing and securing the website and being able to respond to your enquiry. For the placing and reading of cookies and similar technologies, we process data on the basis of your consent, insofar as such consent is required. |
| Contact via form or chat | Responding to your enquiry and contacting you | Name E-mail address Organisation Content of your message | We process these data on the basis of our legitimate interest (Article 6(1)(f) GDPR): providing and securing the website and being able to respond to your enquiry. For the placing and reading of cookies and similar technologies, we process data on the basis of your consent, insofar as such consent is required. |
3 - How do we collect your personal data?
Data you provide to us yourself. For example, when you create an account, complete a questionnaire or contact us.
Data we receive from your organisation. Your employer supplies the employee file so that we can invite you, prepare your access to NewU and assign you to the appropriate group(s). NewU processes this file as a processor on behalf of your organisation. The employee file may contain, among other things, your name, business e-mail address, department and language preference, as well as other user attributes. We also use these data to send functional service communications on behalf of your organisation. As soon as you activate your personal account, NewU processes the data of your personal account as an independent controller for its own purposes as described in this Privacy Policy.
Data we collect automatically. Technical data relating to your use of the app, the Portal and the website.
Data from a wearable. Only if you choose to do so yourself and establish the connection.
You are under no obligation to provide data to us. If you choose not to share certain data, we may be unable to provide certain parts of the Service. Participation in a survey is always voluntary and non-participation shall have no consequences for you.
4 - How we use your data
All data are stored within the European Economic Area (EEA).
We do engage suppliers who process data on our behalf. We do so exclusively subject to the following conditions:
-
they are granted access only to the data they require for the performance of their tasks and may not use such data for their own purposes;
-
the persons who have access to the data at such party are bound by a duty of confidentiality;
-
the party must comply with applicable data protection legislation.
| Processor | Purpose |
|---|---|
| Google Cloud Platform / Firebase | Data storage, hosting and infrastructure for the app, the Portal and the survey module |
| Brevo | Sending functional and transactional e-mails: invitations, reminders, test e-mails and service communications. Not used for marketing directed at employees |
| Terra | Transmission mechanism for wearable data. Terra does not itself store any data |
| ActiveCampaign | Sending newsletters and product updates to group administrators and HR contact persons. Not used for communications directed at users and not used for functional e-mails. You may unsubscribe at any time by clicking âunsubscribeâ in those e-mails. |
What we do not do with your data
In order to avoid any misunderstanding, we expressly state the purposes for which NewU does not use your personal data:
-
we do not use your personal data for advertising;
-
we do not sell or rent out personal data;
Minimum reporting threshold
Group results are displayed only where a group consists of a sufficient number of participants. Your organisation sets this threshold itself. The minimum threshold is five participants; a lower value is not permitted. Where a group or breakdown contains fewer participants than the threshold set, no result shall be displayed in respect thereof.
Measures against indirect re-identification
The threshold applies to every data point displayed to your organisation, irrespective of the filters applied. If, for example, a person combines department, age group and gender, no result shall be displayed as soon as that combination yields fewer participants than the threshold set.
Benchmarking
Benchmarking assists your organisation in placing its group results in perspective. This provides it with better insight into where matters are going well and where opportunities exist to further improve the health, well-being and work experience of employees.
NewU uses survey results to compile these benchmarks. Your organisation sees exclusively aggregated outcomes at group level that meet the minimum reporting threshold.
Profiling and automated decision-making
NewU may use profiling to provide you with personal insights, suggestions and recommendations based on your survey results and your use of the app. These may relate, for example, to health, vitality, work experience, employee satisfaction, engagement, workload, recovery, habits, challenges, tips, recipes and workouts.
The suggestions are intended to provide you with insight and to support you with possible improvements. You always decide for yourself whether to act upon them.
This processing may constitute profiling within the meaning of Article 4(4) GDPR, but does not result in decisions producing legal effects concerning you or similarly significantly affecting you. Personal suggestions and recommendations are not shared with your organisation. Accordingly, there is no automated decision-making within the meaning of Article 22 GDPR.
Artificial intelligence
Wearable data: We do not share any personal data obtained via wearable providers, such as Garmin devices or Garmin Connect, with third-party providers of artificial intelligence (AI).
5 - How do we protect and retain data?
Security
We implement appropriate technical and organisational measures in accordance with Article 32 GDPR, including:
-
NewU is certified in accordance with ISO/IEC 27001:2022 and maintains a fully implemented information security management system (ISMS);
-
all data are encrypted, both at rest and in transit;
-
access is granted exclusively on the basis of role and necessity, in accordance with a no-access-by-default policy;
-
NewU has an annual penetration test carried out by an independent ethical hacking firm;
Where are your data stored?
All personal data are stored within the European Economic Area. The data are stored on Google Cloud Platform in a Europe-West-3 cluster near Frankfurt, Germany.
How long do we retain your data?
We do not retain data for longer than is necessary for the purpose for which they were collected. In this respect, we distinguish between two types of data.
Data of your organisation. These include, among other things, the employee file, the survey settings, anonymous group results and other data linked to the Group. Upon termination of the contract, your organisation may request us to delete such data; we shall do so within 20 days.
If your organisation invites you to NewU and you do not create an account, we hold only your e-mail address from that file. Accordingly, that e-mail address will be deleted together with the data of your organisation.
Your own data: As soon as you accept the invitation and create an account, NewU processes your personal data for the purposes described in this Privacy Policy. You may have your personal data deleted at any time, insofar as no statutory or other valid ground exists for retaining such data for a longer period.
If your organisation no longer actively uses NewU, your personal account shall remain available for a further 24 months. Thereafter, we shall delete your personal data, unless a statutory or other valid ground exists for retaining such data for a longer period. You will receive an e-mail in advance informing you that your account and personal data will be deleted.
Your employer cannot have these data deleted. Upon termination of your organisationâs contract, your access through your organisation shall cease; however, you may continue to log in during this period in order to view, download or delete your data.
If you are no longer able to log in, please contact us at info@newu-app.com.
6 - What are your privacy rights?
Under the GDPR, you have the following rights. Most of these rights can be exercised directly in the NewU app under âRights and permissionsâ. If this is not possible, please e-mail us at info@newu-app.com.
Right of access to your personal data: to obtain confirmation as to whether or not we process your personal data and to request a copy of the data we hold about you;
Right to rectification of inaccurate or incomplete data: to request that we correct inaccurate information or complete incomplete data by providing supplementary details;
Right to erasure of your personal data: in certain circumstances, to request that we permanently delete or anonymise your personal data. Please note that this may not always be possible owing to statutory or legitimate obligations;
Right to restriction of processing: in specific circumstances, to request that we restrict the manner in which we process your personal data;
Right to data portability: to receive a copy of the data you have provided to us in a structured, commonly used and machine-readable format, or to have such data transmitted to another service provider where technically feasible;
Right to object to processing: to object to the processing of your personal data where such processing is based on our legitimate interests.
Right to withdraw your consent: to withdraw your consent at any time. Please note that you may consequently no longer be able to use certain functions of the Service.
Right to lodge a complaint: you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you consider that NewU does not process your personal data in accordance with the GDPR.
7 - About this Privacy Policy
Age limit
The Service is not directed at persons under the age of 16. We do not knowingly collect personal data from persons below that age. If you are a parent or guardian and you are aware that a minor has provided us with data, please contact us. Should we discover that we have collected data from a person below that age without a valid legal basis, we shall delete such data.
Corporate restructuring
If we sell or transfer NewU, in whole or in part, to another organisation, for example in the event of a merger or acquisition, your personal data may form part of such transfer. If, as a result, the controller or the manner in which your personal data are processed changes, we shall inform you thereof in accordance with the GDPR. You shall remain the owner of your user content.
Amendments to this Privacy Policy
We may amend this Privacy Policy from time to time. The current version is always available on our website, stating the version number and the date of the most recent amendment. Previous versions are available upon request via info@newu-app.com. Should we intend to use your data for a new purpose, we shall inform you thereof before commencing such use.
Languages
This Privacy Policy was originally drawn up in Dutch. NewU may make translations available in other languages in order to enhance readability. In the event of any discrepancy between the Dutch text and a translation, the Dutch text shall prevail.
Contact
Should you have any questions regarding this Privacy Policy or the manner in which we handle your data, please e-mail us at info@newu-app.com.
