Privacy Policy

Last updated: 23 October 2026

1. Our commitment to your personal data

This Privacy Policy explains which categories of your personal data we process, how and why we collect them, when we transfer personal data, and the rights and choices you have. It also explains how we process personal data when managing our relationship with you as a customer, which is mostly so that we can provide a good service that meets your needs.

GetUp applies appropriate technical and organisational measures to protect its users' personal data against accidental or unlawful destruction, loss, alteration, disclosure or unauthorised access. This is especially important where processing involves sending data over a network. We also protect your data against any other form of unlawful processing.

This policy, together with our Terms and Conditions, applies from the moment you visit the GetUp website (getup.ro) or the GetUp app (app.getup.ro), and also when you register or sign up on the platform with your contact details.

It remains in force until you withdraw your consent. From that point, your personal data will be deleted from our database and you will no longer be able to use your GetUp account.

GetUp aims to protect its users' data as fully as possible against all types of risk, and takes wide-ranging technical and organisational measures to do so.

This includes protection against unauthorised connection or access, unauthorised viewing, alteration or distribution, and loss, destruction or misuse of data by third parties (including the confidentiality of electronic messages sent to us). However, because an internet connection can never be fully secured, unauthorised access cannot be completely ruled out. For this reason, we ask you to help protect your personal data by signing out before you leave the page.

2. Who is responsible for your personal data (the controller)

The controller of your personal data is GETUP S.R.L., registered office at Drumul Gura Ariesului nr. 65-67, Corp 1, Ap. 25, Sector 3, Bucharest, Romania, registered with the Trade Register under no. J2024037999009, tax identification code (CUI) 50826891.

GETUP S.R.L. holds all rights in the GetUp platform, which includes the GetUp website (getup.ro) and the GetUp app (app.getup.ro).

3. Categories of personal data we process

The personal data we process may include:

Contact details, such as your name, postal address (including your home address, if you have given it to us), phone number and email address, and data from questionnaires or medical documents, if you have sent them to us.
Browsing data from our website, collected through cookies and similar technologies.
Data from your use of the platform as a user, such as your operating system, browser type, the names and types of applications, files and plug-ins, unique identifiers, device identifiers, data from cookies stored on your device (see our Cookie Policy), and other data about the technical means and connection you use (including the host IP address, geographic location, internet service provider, contacts data, and data obtained by accessing the camera, microphone, etc.).

Health-related information from the quiz

Our free quiz (app.getup.ro/quiz) asks about your back pain so that we can recommend a suitable program. Some of your answers are information about your health, such as where you feel pain, how long you have had it and how intense it is, diagnoses (for example, a herniated disc), pregnancy, and safety warning signs ("red flags"). Under Article 9 of the GDPR, this is a special category of personal data.

Legal basis: we process this information only on the basis of the explicit consent you give in the quiz.
What we use it for: only to recommend a program to you and to tailor the emails we send you.
We never sell it.
Withdrawing consent: you can withdraw your consent at any time by emailing office@getup.ro.
How long we keep it: until you withdraw your consent or delete your account.

4. Legal bases for processing

→ Consent. Consent means any freely given, specific, informed and unambiguous indication of your wishes by which you agree, through a statement or a clear affirmative action, to the processing of your personal data. You can withdraw your consent at any time, as described in this policy.

Your freely given, specific, informed and unambiguous consent is one of the legal bases on which we process personal data for the purposes described.

→ Legitimate interest. As a secondary basis, we may rely on legitimate interest where your consent cannot be obtained straight away or would be extremely difficult to obtain. This includes our legitimate interest in providing an innovative, personalised, safe and profitable service for our users and partners, except where those interests are overridden by your interests or fundamental rights.

For people who are not adults (under 18 in most EU countries), who have limited capacity to enter into an enforceable contract on their own, we may not be able to process personal data on the basis that it is necessary for a contract. However, when these people use our Services, we rely on our legitimate interest.

→ Legal obligations and vital interests. We process data to meet our legal obligations and to protect your vital interests. The vital interests we rely on include protecting the life or physical safety of you or others. We rely on them to combat harmful content and to promote safety and security, for example when we investigate reports of harmful content or when someone needs help.

→ Where the basis for processing is a legal obligation, we generally rely on legal provisions such as obligations under tax and/or accounting law (including record-keeping and archiving obligations) and under laws on preventing fraud, money laundering and terrorism.

→ Where we ask for personal data in order to meet legal or contractual obligations, you must provide that data.

What we use your data for, and why

Your account, purchases and access to programs (email, name, sign-in codes, programs bought, progress, completed sessions, reminder settings): to perform our contract with you.
Payments and invoices (billing name and address, email, amount, country): to perform the contract and to meet our tax and accounting obligations. Card details are handled only by Stripe; we never see or store them.
The quiz and your results (your answers, including health information): on the basis of your explicit consent, given in the quiz.
Service emails (sign-in codes, access confirmations, invoices, refund confirmations, and daily exercise reminders you can switch off in your profile): to perform the contract, and for reminders our legitimate interest in helping you complete your program.
Tips and offers by email: on the basis of your consent. When you take our free quiz, agreeing to receive tips and offers by email is part of the consent you give to get your free results, and we tell you this before you start. Every such email has a one-click unsubscribe link, you can withdraw your consent or object to direct marketing at any time, and unsubscribing does not affect your account or any program you bought.
Anonymous quiz statistics: when you open our quiz, we count which steps are reached and completed, together with the country (derived from your IP address, which we do not store), the device type and the ad link that brought you. We use no cookies for this, store nothing on your device and do not link it to your email or answers.
Measuring our ads (Meta Pixel and Conversions API): only with your consent, given in the cookie banner or in the quiz consent box. Refusing cookies has no effect on using GetUp.
Security, fraud prevention and keeping the service working: our legitimate interest.

5. Who receives your personal data

Your personal data may be shared with our partners both inside and outside the EU. We require them to put in place appropriate technical and organisational security measures to process and protect personal data. Our service providers may use subcontractors to provide their services to us, as long as those subcontractors meet the same data protection obligations as the service providers themselves.

Specifically, we share some data with third parties (our suppliers and partners) to carry out the functions and services we need to run our business, such as:

our contractual partners;
providers of technical support and website maintenance;
providers of hosting and backup services for the website;
public authorities, but only where they request it for an administrative or judicial procedure;
IT service providers.

The service providers we currently use are:

Supabase – database and authentication (servers in Frankfurt, Germany);
Vercel – application hosting (EU region, Frankfurt; Vercel is a US company);
Bunny.net – video streaming (EU);
Stripe – payment processing (Stripe Payments Europe, Ireland);
Brevo – email sending and contact management (France);
Oblio.eu – invoicing (Romania).

Meta Platforms Ireland Ltd. (advertising measurement), only with your consent. If you accept marketing cookies, we use the Meta Pixel in your browser. If you accept cookies or tick the consent box in our quiz, our servers also use the Meta Conversions API. We send events such as completing the quiz, starting checkout and purchasing, with the purchase value, a hashed (encrypted, non-readable) version of your email address and basic details of the visit (IP address, browser type and the ad click identifier). We never send your quiz answers, health information or the name of the program recommended to you. Meta uses this to measure which ads work. Meta may transfer data to the US under the EU-US Data Privacy Framework.

Romanian tax and accounting authorities also receive invoice data where the law requires it.

International transfers. Some providers, or companies in their groups, are based in the United States (for example, Vercel and companies in the Stripe group). Where your personal data is transferred outside the European Economic Area, these transfers rely on the EU Standard Contractual Clauses or on the EU-US Data Privacy Framework.

6. How long we keep your personal data

We process your personal data throughout our relationship with you and, after it ends, for at least as long as the applicable laws require, including (but not limited to) archiving rules.

We therefore keep your personal data based on the following criteria, depending on the category of personal data concerned:

for as long as the applicable laws require us to;
for as long as it takes to conclude and perform a contract, until all rights and obligations arising from it have been fulfilled;

for cookies: the GetUp app uses essential cookies (your sign-in session, your language choice and your cookie choice), kept for as long as you stay signed in or up to one year. Only if you click "Accept" in our cookie banner, we also use the Meta Pixel, which sets marketing cookies (_fbp, _fbc) for up to 90 days to measure our ads; if you click "Reject", these cookies are not set and no data is sent to Meta. You can change your choice by clearing the site's cookies in your browser;

for as long as you have given us your consent, where processing is based on consent.

In practice:

invoices and accounting records: 10 years, as required by Romanian accounting law;
your account, progress and purchases: for as long as your account exists; you can ask us to delete it at any time;
quiz answers and contact details of people who did not buy: up to 24 months after your last interaction with us, unless you ask us to delete them sooner;
health information from the quiz: until you withdraw your consent or your account is deleted.

7. Data security

To keep your data confidential and secure, you sign in to your account with a 6-digit code that we send to your email address. We do not use passwords.

Our databases are stored on a secure server, protected against fraud attempts. Sending data over the internet is never completely secure. Although we will do our best to protect your data, we cannot guarantee the security of data you send through our website, and any transmission is at your own risk. Once we receive your data, we use strict procedures and security features to try to prevent unauthorised access.

8. Your rights regarding the processing of your personal data

Right to information and right of access

Under Article 15 of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), you have the right to get confirmation from us, as the controller, of whether we process personal data about you. If we do, you can access that data simply by asking us.

Where we process your data, you can ask for information such as: the purposes of the processing; the categories of personal data concerned; and the recipients or categories of recipients to whom the data has been or will be disclosed, especially recipients in third countries or international organisations. Where applicable, you can also get information about how long we expect to keep the data or, if that is not possible, the criteria we use to decide that period. Finally, you can ask whether we use automated decision-making, including profiling, and, if so, for meaningful information about the logic involved and the significance and expected consequences of that processing for you.

Right to rectification

Article 16 of the GDPR gives you the right to have inaccurate personal data about you corrected without undue delay. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement.

Right to object

You have the right to object to the processing of your personal data where the processing is necessary for a task carried out in the public interest or is based on our legitimate interest as the controller.

Right to data portability

You have the right to receive your personal data in a structured, commonly used and machine-readable format, and to have it transmitted directly to another controller where technically feasible.

Right to restriction of processing

You have the right to ask us to restrict processing in any of the following situations:

You contest the accuracy of the data, for a period that allows us to verify its accuracy; or the processing is unlawful and you oppose the erasure of your data and ask for its use to be restricted instead.
We no longer need the personal data for the purposes of the processing, but you need it to establish, exercise or defend legal claims.

Right to erasure ("right to be forgotten")

You have the right to ask us to erase your personal data from our databases without undue delay where one of the following applies:

the data is no longer needed for the purposes for which it was collected or processed;
you withdraw your consent and there is no other legal basis for the processing;
you object to the processing and there are no overriding legitimate grounds;
the personal data has been processed unlawfully;
the personal data must be erased to comply with a legal obligation;
the personal data was collected in connection with the offer of information society services.

We strictly respect and maintain professional confidentiality. We only disclose data to serve your interests or to meet legal obligations. For us, confidentiality is not just a legal obligation but a core value.

9. How to exercise your data protection rights

If you want to exercise any of these rights, you can send us a request using the following contact details:

Address: Drumul Gura Ariesului nr. 65-67, Corp 1, Ap. 25, Sector 3, Bucharest 032605, Romania
Email: office@getup.ro

To meet our legal obligations on data security and confidentiality, when you exercise one of your rights as a data subject we may ask you to prove your identity. We may ask for a copy of an identity document or any other information we need to check that the request comes from the person concerned.

We will consider every request or complaint we receive and reply within the time limits set by law. If you are not satisfied with our reply, or you believe that we are processing your data in breach of the applicable law, you can complain to the Romanian supervisory authority: the National Supervisory Authority for Personal Data Processing (ANSPDCP), Bd. Gheorghe Magheru nr. 28-30, Bucharest, Romania, www.dataprotection.ro.

10. Updates to this Privacy Policy

The date of the latest update to this Privacy Policy is shown at the top of this page.

We may update and change this Privacy Policy from time to time to reflect changes in how we process your personal data or changes in legal requirements. If we do, we will publish the updated Privacy Policy on our website and/or make it available to you in another way.

We will notify you before making any changes to this policy and give you the chance to review the revised policy before you choose to keep using our products.

Contact us

GETUP S.R.L. Drumul Gura Ariesului nr. 65-67, Corp 1, Ap. 25 Sector 3, Bucharest, Romania Trade Register no.: J2024037999009 CUI / VAT code: 50826891 Email: office@getup.ro