Privacy Policy

Onward Labs LTD ("Onward", "we", "us" or "our") is developing Onward, a training app for people who combine running and strength training. This Privacy Policy describes how we process personal information that we collect through the website at onward.training, the Onward waitlist and mailing list, and the emails we send (collectively, the "Service").

We are the controller of your personal information for the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018 and, where it applies to us, the EU General Data Protection Regulation (together, the "GDPR"). See How to contact us for our contact details.

This Privacy Policy covers the website, waitlist and mailing list. Use of the Onward app, including any training data you record in it, will be covered by a separate privacy notice that we will make available before you use the app.

Personal information we collect

Information you provide to us. Personal information you may provide to us through the Service or otherwise includes:

• Contact data, namely the email address you enter to join the waitlist and, if you choose to give it, your first name.
• Communications data based on our exchanges with you, including when you email us or contact us through social media.
• Marketing data, such as whether you have confirmed your waitlist sign-up, whether you have unsubscribed from our emails, and which links in our emails you have clicked.

Apart from an optional first name, we do not ask for your name, date of birth, payment details or any health or training information on the website. Please do not send us sensitive personal information (for example, information about your health) by email or otherwise.

Automatic data collection. We and our service providers may automatically log information about you, your computer or mobile device, and your interaction with the Service, such as:

• Device data, such as your browser type, operating system, device type, IP address and general location (such as country) derived from your IP address.
• Online activity data, such as the pages you viewed, the website you visited before browsing to the Service, whether you clicked a waitlist button or submitted or confirmed a waitlist sign-up, and whether you clicked a link in one of our emails.

For more information about our automatic collection of data, see Tracking and other technologies below.

Tracking and other technologies

Analytics. We use Vercel Web Analytics to understand how the website is used, such as which pages are most and least visited and how many visitors join the waitlist. Vercel Web Analytics does not use cookies. It identifies visits using a hash created from the incoming request, which is discarded after 24 hours, so it cannot recognise you across days or across other websites.

Email link tracking. Links in the emails we send, other than unsubscribe links, pass through our email provider Resend, which records that the link was clicked before taking you to the page. This tells us which updates are useful. We do not use tracking pixels to record whether you open our emails.

Cookies. The website does not currently set cookies. For more information, see our Cookie Notice.

How we use your personal information

We may use your personal information for the following purposes or as otherwise described at the time of collection:

Service delivery and operations. We may use your personal information to:

• provide the Service, including the website and waitlist;
• send you an email asking you to confirm your waitlist sign-up, and record your sign-up once you confirm it;
• send you a welcome email once you confirm your sign-up;
• contact you about access to Onward;
• send you occasional product updates and news about Onward, including its launch;
• address you by your first name in our emails, if you gave it to us; and
• respond to your requests, questions and feedback.

Service improvement and analytics. We may use your personal information to understand how the Service is used, including which pages are most and least visited, how visitors move around the Service and which links in our emails are clicked, and to improve the Service.

Compliance and protection. We may use your personal information to:

• comply with applicable laws, lawful requests and legal process, such as responding to requests from government authorities;
• protect our, your or others' rights, privacy, safety or property (including by making and defending legal claims);
• enforce the terms that govern the Service; and
• prevent, identify, investigate and deter fraudulent, harmful, unauthorised or illegal activity, including abuse of the waitlist form and cyberattacks.

To create aggregated or anonymised data. We may create aggregated or anonymised data from your personal information, such as the total number of waitlist sign-ups, by removing information that makes the data identifiable to you. We will not attempt to re-identify such data.

Further uses. If we want to use your personal information for a purpose that is not compatible with the purpose for which we collected it, we will ask for your consent first.

We do not sell your personal information, use it for interest-based advertising, or use it to make automated decisions that produce legal or similarly significant effects on you.

Our legal bases for processing

The GDPR requires us to have a "legal basis" for each purpose for which we use your personal information. Our legal bases are:

• Consent, where you have given us your specific consent to the processing, such as when you join the waitlist and confirm that you want to receive emails about access and product updates.
• Legitimate interests, where the processing is necessary for our legitimate interests and your interests and fundamental rights do not override those interests.
• Compliance with law, where we need to comply with a legal or regulatory obligation.

Retention

We keep personal information for as long as necessary to fulfil the purposes for which we collected it, including satisfying legal, accounting or reporting requirements and establishing or defending legal claims. In particular:

• the link in a waitlist confirmation email expires after 7 days. If you do not confirm, we do not add you to the waitlist, although our email provider keeps a log of the email it sent for a limited period;
• if you confirm, we keep your email address and first name, and records of which links in our emails you have clicked, until you unsubscribe, ask us to delete them, or we no longer need them to contact you about Onward; and
• visit identifiers used for analytics are discarded after 24 hours.

When we no longer need personal information, we will delete or anonymise it or, if that is not possible (for example, because it is stored in backups), securely store it and isolate it from further processing until deletion is possible.

How we share your personal information

We may share your personal information with the following parties, or as otherwise described in this Privacy Policy or at the time of collection:

• Service providers. Third parties that provide services on our behalf or help us operate the Service, namely Vercel Inc. (website hosting and analytics) and Resend (Plus Five Five, Inc.) (sending our emails, storing the waitlist and mailing list, and recording link clicks in our emails). They may only use your personal information to provide those services to us.
• Professional advisers, such as lawyers, accountants and insurers, in the course of the professional services they provide to us.
• Authorities and others. Law enforcement, government authorities and private parties, where we believe in good faith that it is necessary or appropriate for the compliance and protection purposes described above.
• Business transferees. Parties involved in an actual or prospective business transaction, such as an investment in, financing of, or sale, transfer or merger of all or part of Onward's business, assets or shares, including an acquirer, successor or assignee, or in the event of insolvency.

International data transfers

We are based in the United Kingdom. Our service providers Vercel and Resend are based in the United States, so your personal information will be processed in the United States and may be processed in other countries outside the UK and European Economic Area.

Where we transfer personal information outside the UK or EEA, we make sure one of the following safeguards applies: the transfer is to a country, or under a framework (such as the UK Extension to the EU-U.S. Data Privacy Framework), that the UK Government or European Commission has found provides an adequate level of protection; or we use standard contractual clauses approved for this purpose, such as the UK International Data Transfer Addendum. You can contact us for more information about the safeguard we use and, where applicable, a copy of it.

Your rights and choices

Data protection law gives you rights over your personal information. You can ask us to:

• Access: give you information about how we process your personal information and a copy of it.
• Correct: update or correct inaccurate personal information.
• Delete: delete your personal information where there is no good reason for us to keep it, including where you have withdrawn your consent or objected to processing.
• Transfer: give you, or a third party you choose, a machine-readable copy of your personal information.
• Restrict: restrict our processing of your personal information, for example while we check its accuracy.
• Object: stop processing your personal information where we rely on legitimate interests, or for direct marketing.
• Withdraw consent: where we rely on your consent, you can withdraw it at any time. This will not affect processing that took place before you withdrew it.

Unsubscribing. You can stop all emails from us, including emails about access and product updates, by using the unsubscribe link in any email we send, or by emailing hello@onward.training.

Exercising your rights. You can make any request by emailing hello@onward.training. We may ask for information to confirm your identity, such as asking you to reply from the email address on the waitlist. We will respond within one month, and if we decline any part of your request we will tell you why, unless the law prevents us from doing so.

Complaints. If you are not satisfied with our response or how we process your personal information, you can complain to the data protection regulator where you live. In the UK, this is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk. Users in the EEA can find their regulator through the European Data Protection Board. We would appreciate the chance to address your concerns first, so please contact us.

Users in the United States. We do not sell your personal information, share it for targeted advertising, or process sensitive personal information to infer characteristics about you. Wherever you live, you can ask us to access, correct or delete your personal information using the contact details below.

Do Not Track. Because we do not track you across websites, the Service does not change its behaviour in response to "Do Not Track" or Global Privacy Control signals.

Declining to provide information. We need your email address to add you to the waitlist. If you do not provide it, we cannot contact you about access to Onward. Your first name is optional. If you do not give it, our emails will greet you without it.

Other sites and services

The Service contains links to websites and services operated by third parties, such as our Instagram and X profiles. These links are not an endorsement of, or a representation that we are affiliated with, any third party. We do not control third-party sites and are not responsible for their actions. We encourage you to read their privacy policies.

Security

We use technical and organisational safeguards designed to protect the personal information we collect, such as encrypting connections to the website and signing waitlist confirmation links. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.

Children

The Service is not intended for anyone under 18 years of age, and we do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has given us personal information, please contact us and we will delete it.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the date at the top of this page and post the new version on the Service, and where appropriate we will tell you by email. Changes take effect when we post them, unless we say otherwise.

How to contact us

If you have questions about our practices or want to exercise any of your privacy rights, please contact Onward Labs LTD by email at hello@onward.training.