Privacy Policy

Elite Rugby App is a trading name of BPM Performance Zone Limited, a company incorporated in New Zealand (NZBN 9429051799557), based in Christchurch, New Zealand. Version 2.0. Contact: help@eliterugbyapp.com.

This policy explains what personal information BPM Performance Zone Limited, trading as Elite Rugby App (“ERA”, “we”, “us”), collects about you, why, who we share it with, how long we keep it, and the choices and rights you have. We have tried to keep it plain and honest. Where we describe something we do not do yet, we say so.

1. Who we are and how to reach us

BPM Performance Zone Limited (NZBN 9429051799557) is a company incorporated in New Zealand and based in Christchurch. We trade as Elite Rugby App. For the purposes of privacy law we are the agency (New Zealand) and the controller (United Kingdom, European Union and elsewhere) responsible for your personal information, except where this policy says a club or school is responsible.

We have appointed a Privacy Officer as the New Zealand Privacy Act 2020 requires. For any privacy question, request or complaint, email help@eliterugbyapp.com with the subject line “Privacy” and it reaches our Privacy Officer. Our registered office address is on the New Zealand Companies Register and we will give it to you on request.

2. What this policy covers

It covers the eliterugbyapp.com website and its free tools, the Elite Rugby App mobile app, your account and billing pages, EliteClass purchases, our rewards and referral programme, our team and partner portals, our emails, in-app chat and other messages, and the way we handle enquiries from clubs, schools and coaches. Our match-video analysis service for clubs is governed by the Team, Club & School Terms and this policy together.

It does not cover the Apple App Store, Google Play, or other websites and services we link to. They have their own privacy policies.

3. Information we collect

Information you give us

• Account details. Your name, email address, password, country and the role you tell us you have (player, coach, parent, club).
• Payment details. You enter your card into fields provided by our payment provider, or pay with Apple Pay or Google Pay. We never receive your card number or security code. Our payment provider gives us your card brand, the last four digits, the expiry date, the issuing country and a card identifier that is the same each time the same card is used. We use that identifier to spot one card paying for an unusual number of accounts.
• Your answers to our questions. If you take our quiz or set up your account, you may tell us your playing position, level, goals, season, whether you are a parent buying for a child, and any injuries you want us to plan around (see section 4).
• Messages. What you write to us in the in-app chat, by email, on Instagram, Facebook or WhatsApp, and in forms on our site. If you join a video call with us, the call may be recorded and transcribed; we tell you before recording starts.
• Team and club enquiries. Your name, role, club or school, phone number and what you tell us about your squad.
• Referrals and partnerships. Your invite link activity and, if you are a coaching or affiliate partner, the details in the Partner Programme Terms.

Information collected automatically

• Device and connection. Your IP address, browser and device type, and an approximate location (country, region and city) worked out from your IP address.
• How you use the website. Pages you visit, how long you spend on them, where you came from (the referring site, campaign tags and advertising click identifiers in the link you clicked), the steps you take through sign-up and checkout, and purchases, cancellations and refunds.
• How you use the app. Our app provider tells us when you last signed in, how many training sessions you logged and completed, which lessons you finished, the total weight you lifted, and the names of your recent workouts. We use this to support you, to see whether the app is working for you, to time the messages described in section 7, and, where you have not told us your position, to guess which programme suits you.
• Sign-in records. Attempts to sign in, including the IP address, so we can slow down anyone guessing passwords.
• Cookies and identifiers. Described in section 12.

Information we get from someone else

Sometimes we receive your details from another person or organisation. When we do, this policy is our notice to you of what we collected, why, who else may receive it, who we are, and your right to see and correct it.

• Your club, school or academy. If it buys team access, it gives us the names, email addresses and roles (player or coaching staff) of the people on its roster, sometimes as a spreadsheet or a photograph of a team list. We use those details to create accounts and give access. Section 5 explains more.
• Our app provider. Your app activity and your in-app messages, as above.
• Our payment providers. Whether a payment succeeded or failed, refunds, disputes with your bank, and the card details listed above.
• The person who invited you. If you join through someone’s invite link, we record that link so they can earn their reward. The person who invited you can see your name, the email you signed up with, and whether your first payment went through.
• Advertising platforms. Click identifiers in the links you follow from an ad, so we can measure which ads work.
• Publicly available information about clubs and schools, and details a coach shares with us when introducing you.

4. Health-related information

Some information we hold can say something about your health: any injuries you tell us you want to plan around, and your training activity from the app. We treat it as sensitive.

• We collect an injury answer only if you choose to give it. We use it only to choose which recovery and training content to show you and to help our team give you relevant support. In the United Kingdom and European Union we rely on your explicit consent for this, which you give by answering, and you can withdraw it at any time by asking us to delete the answer.
• We never sell health-related information, never use it to build advertising audiences, and never send it to an advertising platform.
• You can ask us to delete your injury answer or your training activity at any time (section 15).
• Our free calculators and self-tests run entirely in your browser. What you type into them does not reach us.
• Nothing we hold or show you is medical advice. Please read our Health & Safety Notice.

5. Children, teams, clubs and schools

Minimum ages for your own account

You must be 16 or older to create your own account. Between 13 and 15 a parent or guardian must create and hold the account. We do not knowingly create individual accounts for children under 13, and if we learn we hold personal information about a child under 13 outside a team arrangement we delete it and close the account. A parent or guardian who believes their child has an account they did not agree to should email us and we will act promptly.

Team rosters

Clubs, schools and academies buy access for whole squads, and those squads often include players under 18, sometimes under 13. In that case:

• The club or school decides who is on the roster and gives us each person’s name, email address and role. We do not collect dates of birth, medical information, photographs or home addresses for team members. If a club sends more than we need, we do not use it.
• The club or school is responsible for having the authority to share those details, for obtaining the consent of a parent or guardian where a player is under the age its law requires, and for telling its players and their parents that Elite Rugby App will receive their details for this purpose. The club or school agrees to this in our Team, Club & School Terms.
• Each team member receives one activation email addressed only to them, so that no player’s address is visible to another.
• The club’s coaching staff and administrator can see, for each of their players, whether they have signed in, how many sessions and lessons they have completed and when they last trained. So can our team. Nobody outside the club and our team sees it.
• We never send marketing to team members, never put them in advertising audiences, and never profile them for advertising. Once a person has been on a team we keep that protection even after they leave the team.
• When the club’s term ends, or a player is removed, their app access ends. Their account and record remain so they can be restored, unless the club or the person asks us to delete them.
• A parent or guardian can ask to see, correct or delete their child’s information, or ask us to remove the child from a roster, by emailing us. We may check with the club that the request is genuine.

Where we hold information about young people we apply the most protective settings we have: no advertising, no marketing, no profiling, and deletion when the information is no longer needed.

6. How we use information, and our legal grounds

We use personal information for the purposes below. Where the law requires us to name a legal ground (for example in the United Kingdom and the European Union), it is shown in the right-hand column.

Where we rely on a legitimate interest, we have considered the effect on you and you can object at any time (section 15). We do not use your information for any purpose that is incompatible with the ones above without telling you first.

7. Automated checks and automated messages

• Fraud and abuse checks. We run automated checks on payment and referral activity. They look at the card identifier from our payment provider, disputes raised with banks, and reversed rewards. If they detect a pattern that looks like fraud or reward abuse they can suspend an account immediately, which ends the subscription and app access. You can ask a person to review any suspension, and we respond within 2 business days. Details are in section 21 of the Terms. We do not use these checks to profile anyone for any other purpose.
• Rewards. Some rewards are granted automatically based on how long you have been a member or what you have done in the app. The Rewards & Referral Terms explain when.
• Automated messages. During your first weeks as a member we send you messages in the app and by email at set points, chosen automatically from how long you have been a member and what you have done in the app. They are written in advance by our team. When you reply, a person reads and answers. You can stop them with the unsubscribe link in any of our emails or by emailing us.
• Prioritisation. Our team uses signals such as recent activity and payment status to decide who to check in with first. These are internal prompts for people, not decisions about you.
• Apart from the fraud checks above, we do not make decisions about you by automated means that have a legal or similarly significant effect. You always have the right to ask for a person to review any automated decision.

8. How we use AI

Our team uses artificial intelligence tools to work faster: to draft replies to your messages, to summarise conversations and meeting notes, to read documents that clubs send us such as squad lists, to suggest titles for partner uploads, and to prepare internal notes about club accounts. When we do, the information needed for that task (for example, the message you sent us and your recent activity) is processed by the AI provider to return a result.

• A person reads, edits and sends every message to you. No AI sends you anything on its own.
• No AI decides whether you get access, what you pay, whether you are refunded, or whether your account is suspended.
• We do not permit our AI providers to use your information to train their own models, and we use them under their business terms for that reason. If we ever change this, we will tell you first.
• We do not offer a chatbot. If we ever let you talk directly with an AI system, we will tell you clearly before or at the first message.
• Our match-video analysis service uses computer vision to follow players through a match. It does not use facial recognition. Section 10 of the Team, Club & School Terms explains it.

9. Who we share information with

We do not sell your personal information for money. We share it only as described here.

Our providers act under contracts that limit what they may do with your information. Some, such as payment providers, app stores, advertising platforms and our app platform provider, also process information for their own purposes under their own privacy policies. You can ask us for a current list of providers at any time.

10. The mobile app and its provider

The Elite Rugby App mobile app is built and hosted for us by LEAN ON DIGITAL, INC., a company based in the United States. It is published in the Apple App Store and Google Play. When you subscribe on our website we create your app account with the provider, which is why you are not asked to sign up again in the app. The password you set on our website is sent to the provider over an encrypted connection so the same login works in both places. Neither we nor our staff can read your password afterwards.

The provider holds your app login, your training activity and your in-app support messages in its own systems, and it may email you directly about your app account, for example with a password reset code. Its own terms say that it treats information collected through the app as its own, so it is not simply acting on our instructions. You can read its privacy policy at leanondigital.com/privacy-policy. If you ask us to delete your account, we end your access, delete our records as described in section 15, and instruct the provider to remove your app account.

The privacy details shown on the app’s App Store and Google Play listings are published by the app provider as the developer of record. If you spot a difference between them and this policy, tell us and we will resolve it.

11. Advertising, tracking and your choices

We use two kinds of advertising technology on our website.

• The Meta Pixel. A small script from Meta (Facebook and Instagram) that records that you visited our site and sets two Meta cookies in your browser, so Meta can measure whether our ads led to a visit or a sign-up and show our ads to people who have visited.
• Server-side measurement. When you do something that matters to us commercially (view a page, start a trial, become a paying member, buy a class, give us your email, start checkout, or receive a refund), we send Meta a record of that event from our servers. It includes a scrambled (hashed) version of your email address and name, your IP address, your browser details and the Meta cookie values, so Meta can match the event to an ad. We have the same capability for TikTok; it is switched off today and this policy will say when it is on.

We also upload, once a day, hashed email addresses of people who have trialled or paid for Elite Rugby App, and separately of people who gave us an email address but did not join, to Meta so that Meta can show our ads to them and to people like them. We never include anyone who is or has been on a club or school team, anyone who has asked us not to market to them, or school and university addresses that never paid. We never send training, injury or other health-related information to any advertising platform.

Your choices

• EU, UK, Iceland, Liechtenstein and Norway. The Meta Pixel and browser-based measurement are off until you click to accept them on our banner.
• Everywhere else. They are on by default and you can turn them off at any time using the button below or the “Cookie settings” link in our footer.
• Turning them off stops the Meta Pixel, deletes the Meta cookies from your browser, and stops us sending browser-based events for you to Meta or TikTok. Your choice is stored in this browser for a year.
• Turning them off does not by itself remove your hashed email from the advertising audiences described above, and events recorded from our payment system (such as a purchase) are not gated by the browser setting. To opt out of those too, email help@eliterugbyapp.com with the subject line “Do not sell or share”. We will mark your record so you are left out of future uploads and remove you from the audience lists we manage. Information already shared with an advertising platform is then governed by that platform’s own retention rules.
• Some laws call what we do with advertising platforms “selling” or “sharing” personal information, even though no money changes hands. The email above is how you opt out of it. If your browser sends the Global Privacy Control signal, we treat it as a refusal automatically: the pixel does not load and browser-based measurement stops, with no click needed. To be left out of the audience uploads as well, use the email above.
• You can also manage ad settings directly with Meta at facebook.com/adpreferences.

12. Cookies and similar technologies

Cookies are small files a website stores in your browser. We also use browser storage for the same kinds of purpose. Here is what we use.

You can control cookies in your browser settings as well. Blocking the strictly necessary ones will stop you signing in.

13. Where your information goes

We are a New Zealand company, so your information is held and used in New Zealand. If you are in the European Union or the United Kingdom, you do not need to worry about that: the European Commission has formally decided that New Zealand protects personal information adequately (Decision 2013/65/EU, confirmed again in January 2024) and the United Kingdom has made the same decision in its adequacy regulations, so no extra safeguards are needed for information sent to us.

Our providers are in other countries too, mainly the United States (our app platform provider, payment providers, email delivery, advertising platforms, AI providers and cloud hosting) and Australia (video and file storage, and our match-analysis service). When we send information to a country whose law does not protect it in the same way, we rely on the provider’s data protection terms, which include, where the provider offers them, the standard contractual clauses approved by the European Commission and the United Kingdom addendum, and we check that the provider will look after the information properly, as the New Zealand Privacy Act requires. You can ask us for details of the safeguards for any provider.

14. How long we keep information

15. Your rights and how to use them

You can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct anything that is wrong or out of date. If we disagree with a correction, you can ask us to attach a note with your version so it is always read with the information;
• delete your account and personal information;
• stop using your information for a particular purpose, or restrict what we do with it;
• stop sending you marketing, at any time and without giving a reason;
• withdraw consent you gave us, for example for advertising cookies or injury information;
• give you your information in a portable, machine-readable format;
• have a person review any automated decision about you;
• opt out of the sharing of your information with advertising platforms (section 11).

How to ask

Email help@eliterugbyapp.com from the address on your account, or tell us which account you mean. We may ask you to confirm your identity so we do not give your information to someone else. Someone acting for you (for example a parent or an authorised agent) may need to show us they have your permission. We will never treat you differently for exercising a right.

How fast we answer

• New Zealand: as soon as we reasonably can, and no later than 20 working days after we receive your request.
• United Kingdom and European Union: within one month. If your request is complex or you have made several, we may take up to two more months and we will tell you why within the first month.
• United States: within 45 days, extendable once by 45 days where reasonably necessary, with notice. If we decline a request you can appeal by replying to our decision; we answer the appeal within 45 days and tell you how to contact your state attorney general if you are still unhappy.
• Everywhere else: within the time your local law sets, and in any case within 30 days.

What deleting your account means

Deletion is handled by a person, not a button. When you ask us to delete your account we close it, end your access, delete your profile, login, subscription records, reward credits, injury answers and app activity from our systems, instruct our app platform provider to remove your app account, and remove or de-identify the website usage records that identify you. If you have paid time left, we schedule your subscription to end at the end of that period first, unless you ask us to end it immediately. We keep only what we must: billing and tax records, fraud and dispute records, records that decide money owed to someone else (such as a partner’s commission on your payments), and a minimal note that the account existed and was closed. Messages you sent us that we must keep to defend a legal claim are retained under section 14.

Some information is exempt from access or deletion under the law, for example where it would reveal information about someone else, or where we are required to keep it. If that applies we will tell you, as far as the law allows.

16. Marketing messages and how to stop them

• We send marketing email to members and to people who asked to hear from us, always with an unsubscribe link. Unsubscribing takes effect within 24 hours and also stops the automated in-app messages described in section 7.
• If you gave us your email address but never created an account and want to stop hearing from us, click the unsubscribe link in any email or email us, and we will suppress your address.
• If you report one of our emails as spam we treat that as asking us to stop.
• Service messages (sign-in codes, receipts, reminders before we charge you, price changes, payment failures, cancellations, security and legal notices) continue while your account is open. They are part of running your account.
• We never send marketing to team members or to anyone we know is under 18.
• Every marketing email identifies us as the sender and gives you a way to contact us.

17. Security and what we do if something goes wrong

We protect your information with encryption in transit, encryption of stored data by our hosting providers, strict access limits for our staff with mandatory two-step sign-in, hosted payment fields so card numbers never touch our systems, and vetted providers under written terms. Our Security statement describes what we do in plain terms and, just as importantly, what we do not claim. No method of storing or sending information over the internet is perfectly secure, and we cannot guarantee absolute security.

If a privacy breach happens that is likely to cause you serious harm, we will tell the New Zealand Privacy Commissioner and you as soon as practicable, and where the United Kingdom or European Union rules apply we will notify the relevant authority within 72 hours of becoming aware. We will explain what happened, what information was involved, what we are doing about it, and what you can do to protect yourself.

18. YouTube API Services

Elite Rugby App uses YouTube API Services. Our coaching partners submit their own coaching videos to us, and we upload those videos to our own YouTube channel as unlisted so they can be played inside our app. We do not upload to anyone else’s channel, we never publish those videos publicly, and we do not ask you to connect your own YouTube or Google account to use Elite Rugby App.

The only YouTube data we store is about the videos we upload ourselves: the video id, its unlisted watch link, and its length, so we can show how long each class runs. We do not collect, store, or process any YouTube account data belonging to you, and we never share YouTube data with third parties.

By using our services you also agree to the YouTube Terms of Service. Google’s handling of any data it receives is covered by the Google Privacy Policy. If you have ever granted an ERA application access to a Google account, you can review and revoke that access at any time on the Google security settings page. You can also ask us to delete any video we hold for you by emailing help@eliterugbyapp.com; we remove it from our systems and delete the unlisted copy from our YouTube channel.

19. Extra information for particular regions

New Zealand

We collect and hold your information under the Privacy Act 2020. You are not required to give us any information, but without your name, email address and payment details we cannot give you an account. Where we get your information from someone else, section 3 is our notice under principle 3A. You can complain to the Office of the Privacy Commissioner (privacy.org.nz).

United Kingdom and European Union

Our legal grounds are in section 6. Injury information is special category data processed on your explicit consent (section 4). You have the rights in section 15 and the right to complain to the Information Commissioner’s Office (ico.org.uk) or to the data protection authority in your country. Children in the EU: the account holder must be at least 16, or a parent or guardian must hold the account.

Australia

We handle your information in line with the Australian Privacy Principles where they apply to us. You can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

United States

Categories. In the past 12 months we have collected the categories described in section 3: identifiers, commercial information, internet activity, approximate location, inferences about your position and goals, and, if you gave it, health-related information. We collected them from the sources in section 3, for the purposes in section 6, and disclosed them to the recipients in section 9.

Sale and sharing. We do not sell personal information for money. Our use of advertising platforms may count as “sharing” for cross-context behavioural advertising or as a “sale” under some state laws. Section 11 explains how to opt out (“Do Not Sell or Share My Personal Information”). We do not knowingly sell or share the personal information of anyone under 16.

Consumer health data (Washington, Nevada, Connecticut and similar laws). The health-related information we collect is described in section 4: injury answers you choose to give, and training activity from the app. We collect it from you and from our app provider, use it to tailor content and support you, and share it only with the providers in section 9 that need it to run the service. We do not sell it and would need your separate signed authorisation to do so. You can access, delete and withdraw consent for it under section 15, and appeal any refusal as section 15 describes.

Financial incentive notice. Our referral programme gives members a free class when a friend they refer becomes a paying member, and gives the friend a free second month on the monthly plan. Joining involves the referral information in section 3. We value the information at roughly the retail price of the reward given, based on the cost of providing it. You can leave the programme at any time by not sharing your link; existing rewards follow the Rewards & Referral Terms.

Video viewing. Where we send an advertising platform a record that you bought or unlocked a specific class, we do so only with your consent given through your cookie choice (section 11), and you can withdraw it there at any time.

Canada

We handle your information in line with PIPEDA and, in Quebec, Law 25. Our Privacy Officer is the person in charge of protecting personal information. You can complain to the Office of the Privacy Commissioner of Canada.

South Africa

We handle your information in line with POPIA where it applies to us. Our Privacy Officer acts as our information officer for that purpose. You can complain to the Information Regulator.

20. Complaints

If you think we have got something wrong, please tell us first. Email help@eliterugbyapp.com with the subject line “Privacy complaint”. We acknowledge every privacy complaint within 5 working days and aim to resolve it within 30 days. You can also complain at any time to the Office of the Privacy Commissioner in New Zealand, to the Information Commissioner’s Office in the United Kingdom, to the data protection authority in your EU country, to the Office of the Australian Information Commissioner, or to the regulator where you live.

21. Changes to this policy

We may update this policy. When we do, we publish the new version here with a new date and version number. If a change materially affects how we use your information, we tell you by email or in the app before it takes effect. Earlier versions are available on request.