My Group Platform Privacy Notice

My Group is the trading style and customer-facing brand of My Staff Shop Limited and Mynurva Limited.

My Staff Shop Limited is registered in England and Wales under company number 07710593. Mynurva Limited is registered in England and Wales under company number 11021840. Our registered office is 2 Charlesworth Court, Knights Way, Battlefield Enterprise Park, Shrewsbury SY1 3AB.

This Privacy Notice applies to all users of the My Group platform and related services, including people who visit a My Group platform, use associated services, or contact us online, by telephone, by email, through our support systems or through the mobile application.

For the purposes of data protection law, My Group may act as a data controller where we determine how and why personal data is used, and as a data processor where we process personal data on behalf of an employer or another client in accordance with their instructions. Where we act as a processor, the relevant employer or client will usually be the controller and may provide additional privacy information to you.

We are bound by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations (PECR), together with any other applicable data protection and privacy legislation.

We are committed to protecting your personal information. We keep your data safe and confidential, use it only for the purposes we have explained, and do not sell it.

Our website and platform services are not intended for children and we do not knowingly collect personal data relating to children.

By using our services, you acknowledge that your personal data may be processed as described in this Privacy Notice.

1. How to contact us

You can contact us using the details below:

If you have a question about this Privacy Notice, how your personal data is used, or how to exercise your rights, please contact us using the details above.

2. What services this notice covers

We provide a range of services through the My Group platform. Availability may depend on your employer, organisation, eligibility, location and the terms and conditions that apply to the platform you access.

Services may include:

You can view the platform terms and conditions here: My Group platform terms and conditions

3. Third-party websites and linked services

When you use our services, you may be directed to websites, applications or services operated by third parties. These may include My Group branded websites that provide some services available to you, third parties who administer cashback offers and discounts, or third parties offering discounts, products or services directly to you.

You can check the URL and privacy information on the relevant page to understand whether you are using a third-party website or service.

Although some third-party partners may display My Group branding, My Group does not own or operate those third-party websites or services. Each third-party website or service is governed by its own terms and conditions and privacy notice.

Personal data that you provide to, or that is collected about you by those third parties will be used by the relevant third party in accordance with their own privacy notice and terms. If you have questions or concerns about their use of your personal data, you should contact the relevant website or service operator.

In some cases, third-party websites or service operators may disclose limited personal data to us so that we can administer, support or manage the service in accordance with this Privacy Notice.

4. Lawful bases for using your personal data

We only use personal data where we have a lawful basis to do so. The lawful basis will depend on the purpose of the processing. The main lawful bases we rely on are set out below.

Contracts

Where processing is necessary to provide a service you have requested, create and manage your account, process and order, or enable you to use the platform functionality.

Legal obligation

Where we need to comply with legal or regulatory requirements, maintain required records, respond to regulatory requests, or meet obligations imposed by law.

Legitimate interests

Where we or employer clients have a legitimate business interest, such as operating and improving the platform, maintaining business records, preventing misuse, promoting available services, monitoring usage and ensuring services work effectively, provided your rights and freedoms do not override those interests.

Consent

Where we ask for specific permission, for example for optional features or settings. Where consent is used, you may withdraw at any time.

Establishing, exercising or defending legal claims

Where we need to use information in connection with legal claims, disputes, investigations or enforcement actions.

Where we rely on legitimate interests, we balance our interests against your rights, freedoms and expectations. You can object to processing based on legitimate interests at any time. Please see section 15, Your rights.

5. Personal data we collect

We collect personal data directly from you, from the devices you use, from your employer or organisation, and from trusted third parties where this is necessary to provide, administer, support or improve the services.

5.1 Information you give us

We receive and store information you enter on the platform or give us in another way, for example when you register, shop, browse, contact us, complete surveys or use support functionality.

When you register an account, we may collect:

When you shop with us or browse the platform, we may collect:

When you contact us, or when we contact you about our services, we may collect personal data needed to help with your enquiry, verify your entitlement to receive information, respond to your request, resolve complaints, preserve a record of our communications and meet legal, regulatory and service obligations.

Where possible, we minimise the personal information retained and do not keep identifiable details, such as your name or email address, for longer than is necessary.

When you personalise or activate your account, we may collect information needed to activate your account, manage your preferences, improve your experience and show relevant content, offers or services.

You can see, review and update your personal information by signing into your account. Please update your information promptly if it changes or is inaccurate so that we use accurate and up-to-date information.

When you take part in promotions, competitions, surveys or questionnaires, we may collect personal data you provide about yourself, including competition entries, images, feedback and survey responses.

5.2 Payment, Apple Pay, Google Pay and Direct Debit information

We do not collect or store full payment card details.

Purchases made using services such as Apple Pay or Google Pay are payment transactions processed by the relevant payment provider and their authorised payment processors. We may receive limited transaction information required to confirm, manage, administer or support your purchase. The collection and processing of payment information by Apple Pay, Google Pay and their associated providers is governed by their own privacy notices and terms.

We use Fiserv to process card payments we take from you. You provide card payment details directly to Fiserv. We neither store those full card details nor have access to them.

Where you agree to set up a Direct Debit arrangement, the information you provide is passed to our bank for processing according to our instructions and we retain a copy as required to administer the arrangement.

We are registered with the Direct Debit Guarantee Scheme. This scheme provides customers with protection by enabling their bank to refund any disputed Direct Debit payment immediately while the matter is investigated. Direct Debits can only be collected by organisations approved as Direct Debit Originators. To obtain approval, organisations undergo vetting and provide indemnity guarantees through their sponsoring bank, helping to support the security and reliability of the Direct Debit system.

5.3 Calls, messages and support contacts

When you call our helpline, we collect Calling Line Identification (CLI) information and may record and monitor calls. We use this information to help improve the efficiency and effectiveness of our helpline, support service quality, handle enquiries and resolve issues.

When you send a message to our support system, we collect and use the information you provide in that message to verify your entitlement to receive the requested information and to respond to your enquiry. We maintain a record of your request and our response to help manage enquiries efficiently, improve our services, and meet legal and regulatory obligations.

5.4 Peer-to-peer messaging and recognition content

If you use the platform's colleague recognition feature (sometimes referred to as Fanmail), any recognition messages you send or receive may be stored and displayed within the platform. Subject to your organisation's settings, these messages may be visible to other authorised users within your organisation for a period determined by your employer. We do not share or make available users' email addresses through Fanmail.

5.5 Biometric authentication

The My Group mobile application may offer the option to use biometric authentication features available on your device, such as fingerprint or facial recognition login. Biometric information is not collected, stored, accessed or processed by My Group. Biometric authentication is performed locally by your device operating system, such as Apple iOS or Android. My Group receives only confirmation that authentication has been successful and does not have access to biometric data or biometric templates. Use of biometric authentication is optional and can be enabled or disabled through your device or application settings.

5.6 Location data

We may use location data provided by your device to support certain features and services available through the My Group platform, such as identifying relevant offers, services, content or resources available in your area. Location data will only be collected where you have granted permission through your device settings. You can withdraw or manage location permissions at any time through your device settings. We will only use location data where necessary for the functionality of the service requested or where we have a lawful basis to do so.

5.7 Automated information, cookies and similar technologies

We receive and store certain types of information automatically whenever you use My Group, including technical and usage information from your browser or device. For example, we use cookies and similar technologies and obtain certain types of information when your web browser accesses My Group.

For more information, please see our Cookie Policy

5.8 Information from your employer

Where your employer engages us to provide services to you, your employer may provide information about you so that we can recognise you, confirm your eligibility and allow you to register or access the relevant platform services. This may include your name, employee number, date of birth, surname or other agreed eligibility information.

Alternatively, when you register with us, we may provide identification information you give us, such as your surname, date of birth or employee number, to your employer so that they can confirm you are an eligible employee or user.

If your employer provides a reward and recognition scheme through the platform, we may receive information about you from your employer if you receive an award. This may include your name, details of the award and, where needed, delivery address information.

5.9 Information from service providers and other third parties

We may receive personal information about you from third parties where this is necessary to provide our services, where your employer has authorised the sharing of information, or where you have given consent. This may include:

When we send promotional emails, we may receive information from our email service provider, such as whether you opened the email, placed the email in your spam folder, or clicked a link in the email. We use this information to evaluate the relevance and proportionality of communications. Every marketing email we send includes an option to opt out of future emails.

We only collect personal data from third parties where they are legally permitted to share it with us and where there is an appropriate lawful basis for us to process it.

6. How and why we use your personal data

We use and retain personal data for the purposes set out below. The exact information used will depend on the service, feature or interaction involved.

Purpose Examples of use Types of information Typical lawful basis
Provide platform services Create and manage accounts; verify eligibility; enable platform features; administer benefits, rewards, recognition, competitions and wellbeing services. Name, contact details, employee number, date of birth, email address, eligibility information, account information. Contract; legitimate interests; employer-client contract; legal obligation where applicable.
Process purchases and transactions Process orders, purchases, transactions, cashback, rewards and related activity. Order details, delivery information, limited transaction information, payment confirmation, reward/cashback records. Contract; legal obligation; legitimate interests.
Support and communications Respond to queries, support requests, complaints, feedback and service updates. Contact details, messages, call recordings, support records, complaint details. Contract; legitimate interests; legal obligation.
Personalisation and user experience Personalise content, offers, communications and platform experience where appropriate. Account preferences, usage information, browsing activity, location data where permitted. Legitimate interests; consent where required.
Marketing and promotion Promote offers, products and services which may interest you, including by email and push notification. Contact details, preference information, engagement information. Legitimate interests; consent where required by PECR or platform settings.
Monitor and improve services Understand how services are used, which offers are valued, and how the platform can be improved. Usage information, browsing activity, purchase trends, feedback, survey responses, anonymised or aggregated data where possible. Legitimate interests.
Security and compliance Maintain platform security, integrity and performance; prevent misuse; comply with legal and regulatory obligations. Technical information, audit records, account records, correspondence and transaction information. Legal obligation; legitimate interests.
Legal claims and business records Maintain records, resolve disputes, establish, exercise or defend legal rights, support business continuity and transactions. Relevant account, transaction, communication and complaint information. Legal obligation; legitimate interests; legal claims.

Where we receive a complaint, we record the information you provide and use it to resolve the complaint. If resolving a complaint reasonably requires us to contact another person or organisation, we may share relevant information where appropriate. We do this as infrequently as possible and only share what is necessary.

We may compile statistics to assess the level of service we provide, but we aim to do this in anonymised or aggregated form wherever possible so that you cannot be identified.

7. Legitimate business interests

The platform is provided at the request of employers and organisations who wish to make benefits available to their employees, workers, members or users and who are also our clients. To ensure the platform works well for those clients and their users, we undertake promotional, monitoring, reporting, security and improvement activities.

This is in both our legitimate interests and our clients' legitimate interests. Before using your data in this way, we balance those interests against your rights and freedoms and consider the impact processing may have on your privacy.

You can object to processing based on legitimate interests at any time. Please see section 15, Your rights.

8. Marketing, offers and push notifications

We may use your contact details to provide marketing communications, including push notifications and emails, about promotional offers, products and services which we think may interest you or help you receive the full benefit of the platform.

We agree with employer clients that we will promote the platform so that it reaches as many eligible users as possible and so that users are aware of available offers and services. We may use carefully selected third parties to manage these communications on our behalf.

Before using your data in this way, we consider the impact on your privacy and take into account that the purpose is to make users aware of offers and services available through the platform. You can ask us to stop this processing at any time. All marketing emails sent by My Group include instructions on how to unsubscribe from future marketing correspondence. You can also manage push notification permissions through your device.

9. Monitoring how the platform works for you

We use information about how the platform is used to monitor how My Group delivers value to users and employer clients. For example, usage information may show which offers are used most, how often the platform is used, and which services are most valued.

We may also ask for feedback through a feedback forum, survey or questionnaire. Your browsing behaviour, purchases and feedback help us understand what users value and what we can improve. We aim to use anonymised data wherever possible.

10. Who we share personal data with
10.1 Your employer or organisation

Where your employer or organisation has asked us to provide services to you, we may share certain information with them so that we can administer the services in accordance with their requirements and so they can monitor how the services are performing.

Information shared may include:

10.2 Third-party providers and group companies

We work with third parties, including group companies such as My Health Xtras Limited, Mynurva Limited and Gee 7 Wealth, Management Limited, to provide some benefits and services on the My Group platform. Where you submit information to those third parties through the platform, our partners may collect and use that information to respond to your request, provide quotations, process a purchase or deliver a service.

We also use third parties who provide services such as email distribution, package delivery, payment processing, live chat, fulfilment and co-branded discount facilities.

We use live chat software on our website provided by Click4Assistance, a UK-based software company. Information about how Click4Assistance processes and stores data can be viewed here: Click4Assistance cookie and privacy information

10.3 Single Sign-On (SSO) partners

My Group provides Single Sign-On functionality with trusted third-party service providers. This enables users to access certain services without creating separate login credentials. Current SSO partners may include:

This is not an exhaustive list. My Group may introduce additional SSO-enabled partners from time to time to enhance the range of services available through the platform. Where SSO is used, limited personal information may be shared between My Group and the relevant provider to facilitate secure authentication and access to the service. Any such processing will be carried out in accordance with applicable data protection laws and the privacy practices of the relevant provider.

10.4 Publication on the platform

We may publish limited personal information when you win a competition or take part in a recognition feature. We will tell you before you enter or participate where this applies.

10.5 Business transfers and reorganisation

If we sell or buy any business or assets, we may share customer personal data with the prospective seller or buyer where needed. If My Group is sold, reorganised, or transfers all or part of its business or assets, customer personal data may be transferred as part of that change. Where the law allows, we may do this without asking for further consent.

11. How long we keep personal data

We keep personal data for as long as needed to provide services, maintain records, meet legal and regulatory obligations, resolve queries or complaints and protect our legal rights. We do not keep personal data for longer than necessary.

Your personal data will normally be stored while your account is active, which means until you or your employer has cancelled your account. Following cancellation:

We may retain limited records for longer where this is necessary for legal, regulatory, financial, audit, security or dispute-resolution purposes. Where possible, we will anonymise or aggregate information so that it no longer identifies you.

12. Keeping your personal data secure

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures include access controls, secure systems, supplier oversight, staff awareness and review of processing activities.

No system can be guaranteed to be completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will take appropriate action in line with applicable data protection law.

13. Data storage

Our websites are hosted in England.

14. Your choices and account controls

You can review and update certain account details by signing into your account. You can manage device permissions, including biometric authentication, location services and push notifications, through your device or application settings. You can unsubscribe from marketing emails using the link or instructions included in those emails.

15. Your rights

Under UK data protection law, you have rights in relation to your personal data. These rights are exercisable free of charge unless a request is manifestly unfounded or excessive.

Right What it means
Access You can ask what personal data we hold about you and request a copy.
Rectification You can ask us to correct inaccurate or incomplete personal data.
Erasure You can ask us to delete or remove personal data where there is no compelling reason for continued processing.
Restriction In certain circumstances, you can ask us to restrict processing, for example if you think the personal data is inaccurate or we no longer need it.
Objection You can object to processing carried out on the basis of legitimate interests, including certain marketing activities.
Withdraw consent Where we rely on consent, you can withdraw that consent at any time.

To exercise your rights, please contact us using the details in section 1. We may need to verify your identity before responding. Some rights are not absolute and may not apply in every situation. If we cannot comply with a request, we will explain why, where required by law.

16. Complaints

If you are not satisfied with how we use your personal data, please contact us first so that we can try to resolve your concern through our internal complaints procedure.

If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection. You can visit the ICO website here: Information Commissioner's Office

17. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to our services, processing activities, legal requirements, regulatory guidance or business operations. The latest version will be made available through the relevant My Group platform.

18. Quick summary

This section is provided to help users understand the notice quickly. It does not replace the full Privacy Notice.