top of page

Privacy Policy

Effective Date: 23 June 2025

 

Steps for Trees Ltd. (“we”, “us”, “our”) is committed to protecting your privacy and ensuring your personal data is handled responsibly and transparently. This Privacy Policy explains what information we collect, how we use it, your rights, and how you can contact us.
 

1. Who We Are

Steps for Trees Ltd.
Registered Address: 4 Beech Grove, Epsom, Surrey, KT18 5UD
Contact: hello@stepsfortrees.com 
Website: www.stepsfortrees.com
 

2. What Information We Collect

We only collect information necessary for the functioning and improvement of the Steps for Trees app and related services:
 

  • Email address (for account creation, verification, communication, and notifications)

  • Step count (via your device’s pedometer/GPS, with your consent)

  • Location data (to show tree planting locations and issue certificates, with your consent)

  • Group participation data (usernames, group membership)

  • App usage data (engagement metrics, offers redeemed, trees planted)

  • Device information (for analytics and troubleshooting; does not include personal identifiers)
     

We do not collect or process sensitive health or biometric data.
 

3. Lawful Basis for Processing

We process your data under the following legal grounds:
 

  • Consent: For step tracking, location sharing, email communications, and group participation. You may withdraw consent at any time via app settings or by contacting us.

  • Legitimate Interest: To improve our services, gamification, for tree planting purposes and environmental impact reporting, provided this does not override your rights.

  • Legal Obligation: To comply with UK data protection laws.
     

4. How We Use Your Information

  • To operate and improve the Steps for Trees app

  • To track steps, plant trees, and issue certificates

  • To enable group features and competitions

  • To send you updates, notifications, and marketing communications (with your consent)

  • To provide aggregated, anonymised analytics to brand partners (cannot identify individuals)

  • To maintain the security and integrity of our services
     

5. Data Sharing & Third Parties

We only share your data in the following ways:
 

  • Tree Nation: For tree planting and certificate generation (no personal data shared)

  • Brand Partners: Receive only aggregated, anonymised analytics (cannot identify you)

  • Service Providers: Such as analytics and hosting providers, strictly for service delivery and improvement, under Data Processing Agreements ensuring GDPR compliance

  • Legal Requirements: If required by law or to protect our rights
     

We do not sell or share your personal data with advertisers for direct marketing.
 

6. International Transfers

All data is stored and processed in the UK or with providers who meet GDPR adequacy standards. If data is transferred outside the UK, we ensure appropriate safeguards are in place.
 

7. Data Security

We use industry-standard security measures, including encryption, secure servers, access controls, and regular data backups. We regularly review our security practices.
 

8. Data Retention

We retain your data only as long as necessary for the purposes outlined in this policy or as required by law. If you delete your account or withdraw consent, your data will be deleted or anonymised within 30 days.

​

9. Your Rights

You have the following rights under UK GDPR:
 

  • Access: Request a copy of your data

  • Rectification: Correct inaccurate or incomplete data

  • Erasure: Request deletion of your data (“right to be forgotten”)

  • Restriction: Ask us to stop processing your data in certain circumstances

  • Portability: Request your data in a structured, machine-readable format

  • Objection: Object to certain processing activities

  • Withdraw Consent: At any time, without affecting prior processing
     

To exercise your rights, contact us at hello@stepsfortrees.com.
 

10. Automated Decision-Making

We use automated processes for gamification features (such as leaderboards and rewards). These do not have legal or significant effects on you.
 

11. Children’s Privacy

If you are under 16, please obtain your parent or guardian’s consent before using the app. 
 

12. Data Protection Impact Assessments (DPIA)

We regularly conduct DPIAs to assess and mitigate privacy risks, and we update our practices as our services evolve.
 

13. Data Breach Notification

In the unlikely event of a data breach affecting your personal data, we will notify you and the relevant authorities as required by law, within 72 hours.
 

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via the app or email.
 

15. Contact Us

For questions, concerns, or to exercise your rights, contact:
hello@stepsfortrees.com
 

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) in the UK.

bottom of page