1. Data Controller

2. Legal Bases for Processing

We process your personal data under the following GDPR bases:

• Contractual necessity (Art. 6(1)(b)): To manage registrations, T-shirt orders, and token participation.
• Legal obligation (Art. 6(1)(c)): For tax and audit compliance, including the school donation model.
• Legitimate interest (Art. 6(1)(f)): For fraud prevention and platform improvement.
• Consent (Art. 6(1)(a)): For newsletters, updates, and non-essential cookies.

3. Information We Collect

• Identity & Contact Data: Name and email during registration or purchases.
• Participation Data: Steps submitted for challenges (e.g. 10,000-step goal, Global Action Day).
• Transaction Data: T-shirt purchases and tree-boosting contributions (via secure third-party processors).
• Institutional Data (Schools): Donation totals to apply the 90% retention rule.
• Technical Data: IP address, browser, and activity logs (via cookies, see our Cookie Policy).

4. How We Use Your Data

We use your information to:

• Register and manage walk participation and track the 100 Million Step Global Goal.
• Administer Prestigious Tokens, including tree-boost tracking (up to 1,000 trees per token).
• Empower schools to manage their 90% donations and support their chosen environmental causes.
• Provide transparent reporting for schools, companies, and ESG records.
• Maintain security, prevent misuse, and improve platform performance.

5. Data Sharing

We may share limited data with:

• Schools: For impact validation and to manage their retained funds.
• Service Providers: GDPR-compliant IT, payment, and analytics vendors (under strict confidentiality).

No data sales. No user ever gains ownership over physical trees or any PlanetHike assets.

6. Data Retention

We retain data only as long as needed to:

• Maintain your impact and token history.
• Fulfill accounting, audit, and legal requirements.

Data is deleted or anonymized when no longer required.

7. Your Rights (GDPR)

You have the right to:

• Access – View your personal data.
• Rectify – Correct inaccurate data.
• Delete – Request erasure of your information.
• Portability – Request your data in structured format.
• Object/Restrict – Limit how we use your data.
• Lodge a Complaint – Contact Andmekaitse Inspektsioon (Estonia's Data Protection Authority).

To exercise your rights, email us at: hello@planethike.org

8. Children's Privacy

We do not knowingly collect data from children under 16 without school or guardian authorization. If you believe a child has shared personal data without permission, please contact us.

9. International Transfers

Your data is stored in the European Economic Area (EEA). If transferred outside the EEA, we use Standard Contractual Clauses (SCCs) to ensure protection.