Privacy Policy
1. Who Are We?
IM WITH BRUCE AB, company registration number 559037-5597 ("Bruce Studios", "we", "us" or "our"), address: Kungsgatan 52, 111 35 Stockholm, is the data controller responsible for the processing of your personal data described in this Privacy Policy.
2. Why Do We Process Your Personal Data?
We process your personal data to provide the services to you and to develop our business as specified here below:
2.1. Visiting our website and app
When you visit our website or app, we collect technical information that is necessary for its operation and to improve it.
- If you agree to statistic cookies, we collect information about your device and how you use our website or app, including pages visited, screens viewed, clicks, and session duration. On our website we use cookies and local storage for this purpose. In our mobile app we do not use cookies; instead, our analytics software development kit stores an identifier on your device, which is linked to your account while you are logged in and reset when you log out.
- If you agree to marketing cookies, we use Google Analytics and Mixpanel (Mixpanel, Inc., USA) to understand how visitors and app users interact with our services, measure conversion and retention, and improve product functionality. The information sent includes an identifier for your account or your device, the events you trigger (such as sign-up, purchase or cancellation), the screens you view, and certain account properties such as your email address, phone number, city and subscription status. We do not use the advertising identifier (IDFA) or device fingerprinting. You can withdraw or change your cookie consent at any time via the “Cookies” link in the footer of our website. Rejecting is as easy as accepting: the cookie banner offers a “Reject all” option displayed as prominently as “Accept all”.
- We may also collect analytical data using Meta Pixel (Facebook Pixel), TikTok and Reddit cookie to measure the effect of our advertising campaigns in the event you agree to these marketing cookies.
The legal basis for this processing is your consent (cookie consent). Cookie and analytics data is retained in accordance with our cookie settings and, for analytics reports, only for as long as needed to measure usage and improve the service, subject to the retention periods in Section 8.
2.2. Registration and use of our services (onboarding and account management)
When you register as a member or use our services, we process your personal data in order to create and manage your account, enable bookings and access, and deliver the services you have purchased.
We process: your name, personal identity number, email address, phone number, address, payment details, booking history, visit history, membership type and duration, and preferences.
The legal basis for this processing is the performance of our contract with you, or the taking of steps at your request prior to entering into a contract. Some processing (such as processing of personal identity numbers) may also be necessary to comply with legal obligations or for our legitimate interests in preventing misuse and ensuring secure access to our services.
Data is retained for the duration of your membership, and thereafter for as long as is necessary for the purposes described in this Privacy Policy. Your member data is stored in our administrative system and hosted by using cloud services.
Where you book sessions at partner studios that use a digital access-control system (such as Parakey), we share your name and relevant booking details with that system to enable secure access to the studio premises, verify attendance, prevent misuse of memberships, and support facility safety. The legal basis for this sharing is the performance of our contract with you and, where applicable, our legitimate interests in secure and efficient facility access.
2.4. Access to facilities with changing rooms based on legal gender
Where we or our partners operate facilities with gendered changing rooms, we may process information about your legal gender in order to assign you to the appropriate changing room.
The legal basis for this processing is our legitimate interests in ensuring that users can access appropriate facilities and that studio facilities are operated safely and respectfully.
2.5. Training preferences and health information
If you choose to provide information about your training preferences, health condition, or injuries, we process this to provide personalised recommendations and to improve your experience with us. Providing this information is optional; if you do not provide it, we may be unable to tailor recommendations or support to those preferences or conditions.
The legal basis for this processing is your explicit consent. You may withdraw your consent at any time by contacting us.
2.6. Statistical analysis and service development
We use data from your interactions with our app and services to carry out statistical analysis and to improve and develop our services.
This may include combining your data with data from other users to identify patterns and trends, and in some cases using AI-generated insights to improve recommendations. Before data is ingested into our analytics tools, it is pseudonymised so that direct identifiers are removed.
We may process information about memberships, bookings, visits and purchases to analyse how our services are used and to develop and evaluate our services and analytical methods. This may include creating and validating synthetic or aggregated datasets for analytics, testing, and controlled innovation and development projects.
The processing may be carried out on our behalf by carefully selected service providers acting under our instructions. External participants and collaboration partners will only receive datasets that have been assessed as not relating to an identified or identifiable member.
We rely on our legitimate interest in developing and improving our services and analytical methods. We limit the data used and apply appropriate technical and organisational security measures.
The legal basis for this processing is our legitimate interests in understanding how our services are used, measuring service performance, improving functionality and recommendations, planning capacity, and developing new or improved services. We also rely on our legitimate interests for operational analytics where the data is pseudonymised and used to monitor trends and service quality.
2.7. Direct marketing and profiling
We process your personal data to send you information about our services, offers, and news by email, SMS, and push notification. These communications are sent through our customer relationship management platform.
We may also create profiles based on your behaviour and preferences in order to send you targeted communications that are relevant to you.
The legal basis for this processing is your consent, which you can withdraw at any time. Marketing and CRM data is retained until you withdraw your consent, or for a maximum of 3 years after your last engagement with our marketing communications, whichever is the earlier.
2.8. Customer and partner support
When you contact us for support – or when we need to contact you in connection with your membership or a studio partnership – we process the personal data contained in or related to your communications with us, including your name, email address, phone number, account information, and the content of your messages.
We use Intercom (Intercom, Inc., USA) as our support platform. Support communications may incidentally contain special-category data if you choose to include it (for example, health information in connection with a membership pause request). The legal basis for processing support communications is the performance of our contract with you and our legitimate interests in responding to enquiries, resolving issues, documenting support interactions, preventing misuse, and improving customer and partner support. Where special-category data is involved, the legal basis is your explicit consent or, in exceptional circumstances, the protection of vital interests.
Support data is retained for 12 months following resolution of the matter, unless a longer retention period is required by law. Sensitive documents (such as medical certificates) are deleted immediately after review and registration in our administrative system.
3. Legal Obligations
We may also process your personal data to comply with legal obligations, such as bookkeeping requirements, obligations under the Money Laundering Act, or where we are required to respond to a request from a public authority.
The legal basis for this processing is a legal obligation.
4. Where Does the Data Come From?
Most of the personal data we process has been provided directly by you when registering for our services, using our app, making bookings, contacting support, or choosing to provide optional information such as training preferences or health information.
We may also receive data from Meta (Facebook and Instagram) in connection with our advertising campaigns, if you have interacted with our ads on those platforms. This data is received via the Meta Pixel, which is active on our website, and may include technical identifiers, page visits, ad interactions, and conversion events.
We may also, provided on your consent, collect behavioural and product-usage data through your use of the Bruce Studios app and website using Mixpanel analytics. This includes information about which features you use, how often you book sessions, and how you navigate the app.
Where you have a CRM record with us, your engagement data (email opens, clicks) may be processed to enable personalisation of our communications to you.
5. Who Do We Share Your Data With?
We may share your personal data with the following categories of recipients:
Our data processors – companies that process personal data strictly on our behalf and under our instructions:
- Cloud hosting and infrastructure providers – for hosting our platform and storing your data (EU and USA)
- CRM and marketing automation platforms – for managing member communications and marketing campaigns (USA)
- Customer and partner support platforms – for handling support enquiries and communications (USA)
- Product analytics and behavioural tracking services – for analysing app usage and user behaviour (USA)
- Electronic identity verification services – for verifying your identity via BankID/MitID (EU)
- Business intelligence and data visualisation tools – for internal reporting and analytics (UK/USA)
- Data transformation and pipeline services – for processing and structuring analytical data (USA)
- Internal communication and document management platforms – for team collaboration and document storage (EU/USA)
- Digital key and access-control systems at partner studios – for enabling secure access to studio premises (Sweden/EU)
- Studio integration partners (e.g. booking and access systems at partner studios): name, booking details and, where applicable, identity reference shared to enable your access and attendance
Partners and studios: where you book sessions with partner studios, we may share relevant information (such as your name and booking details) with the relevant studio and its booking or access-control systems. Where personal data is shared with a partner studio, the studio will process it as an independent data controller for its own purposes, such as managing bookings, attendance, facility access, safety, customer support and legal compliance. The studio’s own privacy information applies to that processing.
Authorities: we may share your data with public authorities where required by law.
We require third parties acting as processors on our behalf to maintain appropriate security measures and to process your data only in accordance with our instructions. We have entered into data processing agreements with all processors that process personal data on our behalf.
6. Transfer to Third Countries
Some of our service providers and partners are located outside the EU/EEA. Personal data may be transferred to the United States through our service providers/processors and their sub-processors. Where we transfer personal data outside the EU/EEA, we apply appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (SCCs), an adequacy decision issued by the European Commission, and/or the EU–US Data Privacy Framework where applicable and where the relevant recipient is certified under that framework.
For clarity, the following country-specific points apply:
- United Kingdom: where personal data is transferred to the UK, such transfers are based on the adequacy decision issued by the European Commission (Article 45 GDPR).
- United States: for transfers of personal data to the United States, Bruce Studios relies primarily on the EU–US Data Privacy Framework where the relevant recipient is certified under that framework, and otherwise relies on the European Commission’s Standard Contractual Clauses (SCCs).
You may request a copy of the applicable transfer safeguards by contacting us at the address set out in Section 10.
7. Automated Decision-Making and AI
We do not use automated decision-making as defined under the GDPR. For certain functionality however we use artificial intelligence in the following ways:
7.1. Profile picture moderation using AI
When you upload a profile picture to our app, we use an automated AI system to check that the picture complies with our community guidelines (i.e., that it contains a face and is not offensive or inappropriate). In plain terms, the system analyses visual features of the image and produces a compliance result or flag. No human reviews the image unless it is flagged as potentially non-compliant or you ask us to review the outcome. No biometrical data is processed or stored.
The legal basis for this processing is our legitimate interests in maintaining platform safety, preventing misuse, ensuring that profiles are appropriate for other users and partner studios, and protecting the quality of the service. If the system rejects or flags your picture, you may be asked to upload a different picture, and you have the right to request human review and contest the decision by contacting us.
7.2. Marketing profiling and recommendations
We use automated profiling to group members with similar behaviour and preferences in order to tailor our marketing communications and recommendations to you. This profiling is based on your booking history, visit frequency, stated preferences, engagement with our communications, and other behavioural data. The logic is to infer likely interests, such as preferred studio types, locations, or training times, and to use those in selecting messages or recommendations.
The legal basis for this processing is your consent. The profiling may affect which offers, recommendations, or messages you receive, but it does not determine your membership rights or access to the service. You can withdraw your marketing consent or object to direct marketing at any time.
8. How Long Do We Keep Your Data?
We retain your personal data for as long as is necessary for the purposes for which it was collected, and in accordance with applicable law. Our general retention periods are:
- Member data (name, contact details, booking history, etc.): retained for the duration of your membership and thereafter for as long as is necessary for the purposes described in this Privacy Policy.
- Financial data (payment information, invoices): retained for 7 years in accordance with the Swedish Bookkeeping Act.
- Data processed on the basis of consent (e.g. marketing): retained until you withdraw your consent or for a maximum of 3 years after your last engagement with our marketing communications, whichever is the earlier.
- Profile pictures: deleted together with your profile when your account is deleted, or earlier if you ask us to remove the picture, unless a legal obligation requires us to retain it for longer.
- Customer support data: retained for as long as is necessary to handle your matter and any follow-up questions or claims arising from it. Sensitive documents (e.g. medical certificates) are deleted immediately after use.
- Analytics and statistical data: before your data is used for analysis, we replace direct identifiers such as your name and contact details with a pseudonymous user identifier, and we generalise certain fields - for example, your date of birth is converted into an age group and your address into a postal code area. The resulting pseudonymised dataset may link that identifier to your bookings, payments, age group and postal code area. It is not used to contact you or to make decisions about your membership.
9. Your Rights
Under the GDPR, you have the following rights with respect to your personal data:
9.1. Right to access
You have the right to request a copy of the personal data we hold about you.
9.2. Right to rectification
You have the right to request that we correct any inaccurate or incomplete personal data.
9.3. Right to erasure
You have the right to request that we delete your personal data, subject to certain conditions.
9.4. Right to restriction of processing
You have the right to request that we restrict the processing of your personal data in certain circumstances.
9.5. Right to data portability
You have the right to request that we provide you with a copy of your personal data in a structured, commonly used and machine-readable format.
9.6. Right to object
You have the right to object to the processing of your personal data where we rely on legitimate interests or where processing is for direct marketing purposes.
9.7. Rights related to automated decision-making
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
9.8. Right to withdraw consent
Where we process your personal data on the basis of consent (including explicit consent for special-category data or health information), you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing. If you withdraw consent for an optional feature, that feature may no longer be available to you.
If you wish to exercise any of these rights, please contact us at [email protected].
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) if you believe that we have not complied with applicable data protection legislation. IMY can be contacted at [email protected].
10. How to Contact Us
If you have any questions about this Privacy Policy or our processing of your personal data, please contact us at: [email protected]
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via email or through the app. The date of the latest update is indicated at the top of this Privacy Policy.