This policy explains what personal data uBurn collects, why, and the rights you have under the EU General Data Protection Regulation (GDPR). It applies to the uBurn apps, the web app at app.uburn.org and this website.

1. Who is responsible

The data controller is:

uBurn asbl / vzw, a Belgian non-profit association, company number BE1007.466.249, registered office at Avenue Marie-José 52, 1200 Brussels, Belgium. Email: info@uburn.org.

For any privacy question or request, write to info@uburn.org.

2. What we collect

Data	Examples	Source
Account	Name, email address, password (encrypted), language	You
Profile (optional)	Photo, height, date of birth	You
Activity	Date, type, duration and active calories of your activities	Your connected tracker (such as Strava or Garmin) or manual entry
Sponsorship and donations	Who you sponsor or who sponsors you, rates, caps, chosen Organisations, amounts	You and the app
Payment	Billing name and address, payment status. Card or bank details are handled by Stripe, not stored by uBurn	You, via Stripe
Organisation plans	The sponsorship code you use and the organisation it belongs to	You
Messages	What you send us through forms or email, newsletter subscription	You
Technical	Device type, app version, IP address, error logs	Your device

We only import from your tracker what we need to count active calories. We do not collect precise location tracks for this purpose.

3. Why we use it, and on what legal basis

To provide the Service (account, counting calories, calculating and collecting donations, transferring them): performance of our contract with you (art. 6.1.b GDPR).
Activity data: calories and activity information are used only to run the Service and with your explicit consent when you connect a tracker. You can disconnect it at any time.
To keep accounts and finances in order (accounting records, fraud prevention): legal obligations (art. 6.1.c) and our legitimate interest in protecting the Service and donors (art. 6.1.f).
To improve uBurn using aggregated, non-identifying statistics: legitimate interest.
To send newsletters and news: your consent (art. 6.1.a), which you can withdraw at any time through the unsubscribe link.
To answer your messages: legitimate interest, or pre-contractual steps if you ask about a plan.

4. Who we share it with

We never sell your personal data. We share it only with:

The Organisations you support: your name and email address and the amount donated, so they can acknowledge and thank you. You can object to this in the app settings or by writing to us, in which case your donation is passed on anonymously.
Your Sponsors or Burners: your name, profile photo and activity totals, as needed to make sponsorship work.
Your organisation's plan, if you use a sponsorship code: aggregated or individual totals (calories and amounts), never your detailed health or activity data.
Service providers acting on our instructions, such as Stripe (payments), our hosting and infrastructure providers, and email tools. They are bound by data processing agreements.
Authorities, when the law requires it.

5. Transfers outside the EU

We store data in the European Union where possible. Some providers, such as Stripe, may process data outside the European Economic Area. In that case we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or on the European Commission's standard contractual clauses.

6. How long we keep it

Account, profile and activity data: as long as your account exists. When you delete your account, we delete or anonymise this data within 30 days.
Donation and payment records: 7 years, as required by Belgian accounting law.
Messages and form submissions: up to 3 years after our last exchange.
Newsletter: until you unsubscribe.

7. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its use, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time without affecting earlier processing. To exercise your rights, write to info@uburn.org. We answer within one month. We may ask you to confirm your identity.

You can delete your account at any time in the app: open the settings and choose "Delete account".

You also have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be, or with the authority of your country of residence.

8. Children

uBurn is not intended for children under 13. If we learn that we hold data of a child under 13 without parental consent, we delete it. Parents or guardians can contact us at any time.

9. Security

We protect your data with encryption in transit, access controls and providers that meet recognised security standards. Access is limited to people who need it. No system is perfectly secure: if a breach affects your rights, we will inform you and the authorities as the GDPR requires.

10. Cookies and similar technologies

This website does not use advertising or tracking cookies. It stores your language choice in your browser so we can show you the right version. The apps use only the technical storage they need to work. If we ever add analytics or other non-essential cookies, we will ask for your consent first.

11. Changes

We may update this policy. We will tell you about important changes in the app or by email before they apply. The date of the latest version is shown at the top of this page.

Privacy policy.