Privacy Policy

1. Who we are

Purposeful Miles Limited, registered in England and Wales, company number 16125977, is the data controller for the personal data described here. We operate purposefulmiles.com. You can reach us at hello@purposefulmiles.com. Our registered office address is on the public register at Companies House.

2. What we collect

• Account details: your name, email address and, if you add one, a display name, a short bio, a location and a profile photo.
• Activity data: the runs, walks and rides you log by hand — distance, duration, date, activity type and any note you write.
• Connected app data: if you connect Strava, the activities it sends us (distance, moving time, elevation, activity type, start time and whether the activity had GPS) and the identifiers and tokens needed to keep that connection working.
• Payment and entry data: if you enter a paid club challenge, which challenge you entered, the amount you paid, when, your confirmation that you are 18 or over, the part of your entry owed to the host club, and the payment references Stripe gives us. Your card details go straight to Stripe. We never see or store them.
• Membership and organisation data: the company or charity you belong to, your role in it, and whether you have chosen to share your statistics with your employer.
• Things you write: community posts and replies, enquiries you send us, and reports you make about someone else's content.
• Technical data: the records our platform keeps to run and secure the service, including sign-in sessions and error reports.

3. Why we are allowed to use it (lawful basis)

Under UK GDPR we must have a lawful basis for each purpose, not a general permission:

• To run your account and the platform — performance of a contract with you.
• To send you service messages about your account — performance of a contract with you. These are the emails the service cannot work without: a welcome when you join, an invitation if a company adds you to its team, and a note to a charity when a contribution to it has been settled. They are not marketing, and they carry no unsubscribe link because they are how we tell you what has happened to your own account. Closing your account stops them.
• To reply to an enquiry you send us — your consent, given when you tick the box on the form, and recorded with the moment you gave it. We send an automatic acknowledgement to the address on the form, quoting your message back to you, and then a real reply.
• To receive and show your Strava activities — your consent, given when you connect Strava and withdrawn whenever you disconnect it.
• To show leaderboards, badges and challenge progress — performance of a contract; you choose whether to take part.
• To show a company its team totals — our legitimate interest in operating corporate challenges. Individual member figures are only ever shown where you have switched sharing on, and only once at least five colleagues have done the same.
• To send you a weekly summary of your own miles, or any other update that is not about running your account — your consent, given by ticking the box on your profile page. It is never pre-ticked, and we record the moment you ticked it. Every one of these emails tells you where to turn it off — the same tick on your profile page — and unticking it takes effect immediately. We cannot offer a one-click unsubscribe link because our emails are sent as plain text, so the link takes you to the setting itself.
• To take payment for a paid challenge entry, put you on that challenge, and refund you where the Terms say so — performance of a contract with you.
• To keep records of donations pledged and paid, and of challenge entries paid for — compliance with our legal obligations, including tax and accounting law.
• To keep the community safe and investigate reports — our legitimate interest in a safe service, and our duties under the Online Safety Act 2023.

Activity and fitness data can say something about your health. We treat your Strava connection as explicit consent for that reason, and we ask for the narrowest permission Strava offers. We do not ask for, and do not want, medical information.

4. Who we share it with

• Charities: the amount pledged or paid for a period. Not your name, unless you have chosen to make it public in the community.
• Your employer, if you joined through one: team totals always; your individual figures only if you switched sharing on, and only once at least five colleagues have too, so that no single person's numbers can be read out of a small group.
• Other members: anything you post in the community, and your display name on leaderboards you take part in.
• Stripe: if you enter a paid challenge, Stripe processes your payment. It receives your card details and email address directly from you on its own checkout page, and uses them under its own privacy policy as well as on our instructions, including for fraud prevention.
• The club hosting a paid challenge: how many people have entered, the miles logged in total, and the amount we owe it. Not your name or email address.
• Our suppliers: the platform that hosts the application and its database, the service that serves the website, the service that delivers our email, and error-reporting and website-measurement tools where we have switched them on (including Google Analytics, only if you accept analytics cookies). They act on our instructions.

We do not sell your personal data, we do not use it for advertising, and we make no automated decisions that have a legal or similarly significant effect on you.

5. Where your data goes

Our application platform, our hosting, Strava and Stripe are based outside the United Kingdom, mostly in the United States, Israel and Ireland. Where personal data leaves the UK we rely on the transfer mechanisms UK law provides, such as adequacy regulations or the International Data Transfer Addendum to the European Commission's standard contractual clauses. Ask us at hello@purposefulmiles.com if you would like more detail.

6. How long we keep it

• Your account and profile: while your account is open, and deleted when you delete it.
• Your activities, badges and challenge entries: the same — they are deleted with your account.
• Strava tokens: until you disconnect, then removed.
• Community posts and replies: when you delete your account we remove your name from them and take them out of public view.
• Enquiries and newsletter sign-ups: 24 months from your last contact with us.
• Reports you make about someone else's content: kept as part of our safety records, and not removed when you delete your account — they are the reason a decision was taken about somebody else.
• An invitation to join a company: kept until it is claimed, revoked or expires, and then as a record that it was sent.
• Donation records: seven years, because tax and accounting law requires it. These survive account deletion, along with the safety records above.
• Paid challenge entries: seven years, for the same reason. They survive account deletion too. Your place on the challenge and the miles you logged are deleted with your account; the record of the sale is not.
• Technical and webhook records: 90 days.

7. Your rights

You have the right to access, correct, erase, restrict or object to our use of your data, and to receive a copy of it in a portable form. Where we rely on consent, you can withdraw it at any time without affecting what we did beforehand.

Two of these you can exercise yourself, immediately, from your profile page: download everything we hold about you, and delete your account. For anything else, email hello@purposefulmiles.com and we will respond within one month.

8. Complaints

If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

9. Children

Purposeful Miles is not intended for children. You must be 16 or over to create an account. If you believe a child has given us personal data, contact us and we will delete it.

10. Cookies

We use the cookies needed to keep you signed in and the platform secure. If you accept on our cookie banner, we also use Google Analytics cookies to understand how the site is used; if you decline, none are set. There is no advertising cookie on this site. Our Cookie Policy has the detail.

11. Changes to this policy

If we change how we use your data we will update this page and change the date at the top. Where a change matters to you, we will tell you directly rather than relying on you noticing.