Privacy Policy
10XU BUNDLE PLATFORM AND APPLICATION PRIVACY NOTICE
10XU LIMITED (we) are committed to protecting your personal data and respecting your privacy. We know that users of apps and digital platforms are becoming increasingly concerned about what happens to their data. We have invested a significant amount of time and resources to ensure that the amount of personal data we collect and store is kept to a minimum.
This Privacy Notice gives you information on how we collect and process your personal data through your use of this site and any data you may provide if you contact us regarding our products and services.
Introduction
This Notice (together with our end-user licence agreement as set out in our 10XU Bundle EULA and any additional terms of use incorporated by reference into the EULA, together, our Terms of Use) applies to your use of:
- The 10XU Account Hub and web portal (Portal) accessible via web browser.
- The applications made available under the 10XU Bundle, including WithU, Mvmnt, Trvlwell, and URUNN (each an "Individual App" and collectively "Individual Apps") hosted on either the Google Play Store or the Apple App Store (each an "App Store"), once you have downloaded or streamed a copy onto your mobile telephone, handheld device, or web browser (Device).
This Privacy Notice also applies where you contact us either directly or through our websites or through links on other websites or social media.
This Privacy Notice sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. The Portal and Individual Apps are not intended for children under the age of 18. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.
Important information and who we are
10XU LIMITED is the controller and is responsible for your personal data (collectively referred to as "10XU", "we", "us" or "our" in this policy).
We have appointed a data protection officer (DPO) who is responsible for monitoring and providing guidance with our GDPR status. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO/us using the details below.
Contact details
Our full details are:
- Full name of legal entity: 10XU Limited
- Email address:dpo@10xu.group
- Postal address: 10XU LIMITED, The Carriage House, Mill Street, Maidstone, ME15 6YE, United Kingdom
- Website address:https://www.10xu.group/
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (https://ico.org.uk/make-a-complaint/) or other competent supervisory authority of an EU member state if you access our Services outside the UK.
Changes to the privacy policy and your duty to inform us of changes
We keep our privacy policy under regular review.
This version was last updated on 13 August 2026. It may change and if it does, the new version will be posted on this page and, where appropriate, notified to you when you next log in to the Portal or start an Individual App, and, if we choose, by email. The new policy may be displayed on-screen and you may be required to read and accept the new version to continue your use of the Services.
It is important that any personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you, using the contact details above.
Third party links
Our websites and Portal may, from time to time, contain links to and from the websites of our partner networks, advertisers, corporate sponsors, and affiliates. Please note that these websites and any services that may be accessible through them have their own Privacy Policies and that we do not accept any responsibility or liability for these policies or for any personal data that may be collected through these websites or services. Please check these policies before you submit any personal data to these websites or use these services.
Why we collect your personal information
We collect personal information from you for one of the following purposes:
- To manage communications between you and us
- Where we need to perform the contract, we have entered into with you
- To provide you with information you have requested or which we may feel may be of interest to you
- To ensure the safe operation of our websites and to monitor the performance of our websites
- To develop new products, services, features, and functionality
- To communicate with you, either directly or through one of our partners, including for customer service.
- to provide you with updates and other information relating to the website, and for marketing and advertising purposes
- To respond to your queries
- To help improve our services
- To process your transactions and manage your orders
- To provide and manage community features, including user interactions and content moderation
- To facilitate live competitions and display leaderboard rankings.
The data we collect about you
When you use the Portal and/or download any Individual App and agree to our Terms of Use, your device or account is allocated a unique identification code (Unique Code), which is the basis on which we manage user accounts and entitlement across the 10XU Bundle. All interactions by you with the Portal or Individual Apps are recorded by reference to the Unique Code. Depending on how you access the Services, we may also have access to unique device identifiers (IDFA, IDFV, AAID, IP & Android ID (collectively the "IDFA")).
In order to use the 10XU Bundle, you will be required to create a 10XU central account using your email address and password (Login Data). We link your Login Data with the Unique Code, enabling your account activity, app entitlements, and preferences to carry across multiple devices and across the Individual Apps (WithU, Mvmnt, Trvlwell, URUNN).
Access via B2B, employers, or partner organisations
If you gain access to the 10XU Bundle through a company, employer, or partner organisation (e.g., via a redeemable access link or access code), we may process:
- Contact Data: Your name and email address provided by you or your organisation to distribute or validate your access code.
- Partner/Corporate ID: A unique code supplied by or allocated to your employer/partner organisation identifying your membership or entitlement group. This allows us to activate access to the specific suite of Individual Apps enabled under your organisation's bundle package (which may include 2, 3, or all 4 apps).
Usage, profile, and health data
- Usage Data: We collect and store all interactions with the Portal and Individual Apps on your device and systems to analyse usage, maintain entitlement, and improve functionality.
- Profile Data: Demographic data (such as age, gender) and fitness profile details (such as weight, fitness level, goals) you choose to provide within any of the Individual Apps to personalise your experience.
- Health Data: Information such as heart rate or activity metrics provided if you choose to connect third-party peripheral devices (e.g., heart rate monitors or wearables) to any Individual App.
- Communication Data: Information provided when you contact customer support or interact with us via email, helpdesk, or web forms.
- Device Data: Information about the type of device, operating system, and web browser you use to access the Portal and Individual Apps.
We may also collect, use, and share Aggregated Data (such as statistical or demographic data) for any purpose. Aggregated Data is non-identifiable and is not considered personal data in law.
How is your personal data collected?
We collect and process data through:
- Direct Interactions: Information you give us when creating your 10XU account, entering a redemption code, contacting support, or completing web forms.
- Employer or Partner Provision: Information provided by your employer or corporate partner (e.g., work email address or access entitlement parameters) to enable code redemption.
- App and Portal Interactions: Information collected automatically when you navigate the 10XU Portal or interact with WithU, Mvmnt, Trvlwell, or URUNN.
- Third-Party Connected Devices: Health and activity metrics transmitted if you pair third-party devices to any of the Individual Apps.
- Device Signatures and Cookies: Technical metadata transmitted by your browser or mobile operating system.
How we use your personal data
We will only use your personal data when the law allows us to do so. Most commonly, we will use your personal data in the following circumstances:
- Where you have consented before the processing.
- Where we need to perform a contract we are about to enter or have entered with you.
- Where it is necessary for our legitimate interests (or those of a third party) and your fundamental rights do not override those interests.
- Where we need to comply with a legal or regulatory obligation.
Purposes for which your data will be used
Cookies and tracking technologies
We use cookies and similar tracking technologies on the Portal and within our web/mobile applications to distinguish you from other users, remember your preferences, track code redemption, and maintain user sessions across the 10XU ecosystem.
Disclosures of your personal data
We may share your personal data with:
- Service Providers / Data Processors: Third-party vendors who provide IT, hosting, helpdesk, analytics, data warehousing, and communication services to support the 10XU Portal and Individual Apps.
- Employers and Corporate Partners:
- Anonymised data: Aggregate usage statistics provided to corporate buyers.
- Identifiable data: Shared only where required for tax/compliance or where you have provided explicit consent (e.g., to participate in an employer wellness reward program).
- Payment Processors: Where direct purchases or upgrades are made (e.g., via Stripe or App Stores), payment data is processed directly by the payment provider in accordance with their privacy policies. 10XU does not collect or store full credit card details.
- Business Transfers: Third parties to whom we may choose to sell, transfer, or merge parts of our business or assets.
International transfers
Some of our external third-party service providers are based outside the UK and European Economic Area (EEA). Whenever we transfer your personal data out of the UK or EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- Transferring data to countries deemed to provide an adequate level of protection for personal data.
- Utilising specific Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) approved for use in the UK/EU.
- Transfers to US entities certified under the EU-U.S. Data Privacy Framework (and UK Extension).
Data security
All information you provide to us is stored on secure servers. We employ technical and organisational measures to prevent your personal data from being accidentally lost, used, accessed, altered, or disclosed in an unauthorised way. We have established procedures to deal with any suspected personal data breach and will notify you and applicable regulators where legally required.
Data retention
We will retain your personal data (including Login Data and 10XU account details) for up to 3 years after your account becomes inactive or after you cease using the 10XU Bundle, except for Contact Data linked to employer schemes, which is retained for the duration of the corporate contract or your active account status.
Anonymised and depersonalised data (which cannot identify you) may be retained and used indefinitely for analytical, research, and product enhancement purposes.
Children's information
We do not knowingly collect information on children. If we have collected personal information on a child, please contact us immediately using the details in section 15, so we can remove this information without any undue delay.
Your legal rights
Under data protection laws (including the UK GDPR and EU GDPR), you have rights in relation to your personal data, including the right to:
- Request access to your personal data.
- Request correction of inaccurate or incomplete data.
- Request erasure of your personal data ("right to be forgotten").
- Object to processing based on legitimate interests or direct marketing.
- Request restriction of processing under specific circumstances.
- Request data portability to transfer your data to another provider.
- Withdraw consent at any time where processing relies on consent.
Right to complain
Pursuant to the Data (Use and Access) Act 2025 (DUAA), we will acknowledge your complaint within 30 days and provide a response without undue delay in all likelihood within 30 days
To exercise any of these rights, please contact our Data Protection Officer at dpo@10xu.group
Alternatively, you can make a complaint to the Information Commissioner's Office:
- By Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- By Website:ico.org.uk/make-a-complaint
- By Email:Contact the ICO
- By Phone: 0303 123 1113 (Local rate) or 01625 545 745 (National rate)
Automated decision making
Automated decision making or profiling is not used for legally or similarly significant decisions. Automated processing of personal data is used to provide personalised programming or services to users.
Glossary of lawful bases
- Consent: Processing where you have given clear, affirmative consent for a specific purpose. You may withdraw consent at any time.
- Legitimate Interest: The interest of our business in conducting and managing our Services to deliver the best experience safely and effectively.
- Performance of Contract: Processing necessary to fulfill our contract with you (or your employer/partner) or to take steps at your request before entering a contract.
- Comply with a Legal Obligation: Processing necessary to comply with legal or regulatory requirements.