Effective date: 11 August 2025

    1) Who we are

    This website/app (“SR Connect”) is operated by Success Resources Pte. Ltd. (UEN 198500707N), 33 Ubi Avenue 3, #05-51, Vertex Tower A, Singapore 408868 (“Success Resources”, “SR”, “we”, “us”, “our”). We act as data controller for the personal data processed via SR Connect.
    Privacy contact / DPO: [email protected]. General contact: [email protected]. Telephone: +65 6299 4677.

    2) What this policy covers

    This policy explains what we collect, why and how we use it, our legal bases, who we share it with, international transfers, retention, your rights, and how to contact us. A separate Cookie Policy is provided by our Complianz plugin.

    3) What we collect

    Depending on how you use SR Connect, we process:

    • Account & identity: first name, last name, display name, country, profile photo, timezone, language.
    • Contact: email, phone (kept private by default), mailing address (if provided).
    • Authentication: password (hashed) or social login tokens if you sign in with Google, Facebook or X (via Nextend Social Login). Social providers share your name, email and profile photo with us when you grant permission.
    • Event & community data: submissions you make through Formidable Forms (e.g., 90-Day Challenge entries; Event Walls posts for ride/room/meetups; Moments & Circles listings and messages), plus timestamps, streak counters, ratings (“showed up/no-show”), and moderation flags.
    • Payments (optional, when a host enables cost-split): payment intent metadata, amounts, currency, payer/host IDs, and status. Card data is handled by Stripe; we do not store full card numbers.
    • Support/communications: messages you send us, preferences, consents.
    • Device/usage: IP address, device, browser, country/region, log data, and cookie IDs (see Cookie Policy).
    • CRM enrichment: if you’ve interacted with SR before, we may retrieve your existing contact and engagement data from ActiveCampaign (e.g., name, email, past events and interests) to keep records consistent and personalise your experience.

    We do not require special-category data. If you voluntarily share health or access needs in a form, we use it only to support attendance or safety.

    4) Why we use your data (legal bases)

    • Provide SR Connect & our services (create accounts; enable 90-Day Challenge, Event Walls, Moments & Circles; process cost-split payments; prevent abuse): contract and legitimate interests.
    • Personalise & improve (suggest relevant events/groups; measure and improve features; prevent fraud): legitimate interests (balanced with your rights).
    • Marketing (updates, offers, event news): consent (you can opt-in and opt-out anytime).
    • Legal/Compliance (security, audits, tax, record-keeping): legal obligation and legitimate interests.

    Where local law requires consent (e.g., certain cookies or email marketing), we’ll request it via Complianz and respect your choices.

    5) How we process your data (key integrations)

    • Formidable Forms Pro stores your submissions (Challenge, Event Walls, Moments & Circles, registrations).
    • Formidable AI (OpenAI): when you use AI-assisted features (e.g., smart suggestions or summaries), the prompt text you submit and necessary context are sent to OpenAI for inference. We minimise fields, exclude payment data, and avoid sending contact details unless essential for the feature you trigger.
    • Stripe Connect Standard handles payments for host-led cost splits; funds go directly to the host’s Stripe account, and SR applies a small handling fee via Stripe’s application fee. We receive transaction metadata and status from Stripe.
    • ActiveCampaign (CRM) synchronises your SR contact record (e.g., if you previously registered for SR events/newsletters) so we don’t ask you for details twice and can keep communications consistent.
    • Nextend Social Login lets you sign in with Google, Facebook or X. Those providers are independent controllers of your social account data; we receive only what you permit.
    • Security, hosting & analytics: standard web hosting, logging, and security tooling to keep SR Connect reliable and safe.

    6) Sharing your data

    We share data only with:

    • SR group companies (to deliver events/services and customer support).
    • Processors acting on our instructions (examples above).
    • Payment partners (Stripe) to process payments and prevent fraud.
    • Moderation & safety: if content is reported, SR moderators may review it; we may share data where needed to respond to harmful or unlawful behaviour.
    • Legal/Compliance: regulators, law enforcement, or to establish/exercise/defend legal claims, as required by law.

    We do not sell your personal data.

    7) International transfers

    SR is global. Where data moves outside Singapore or your country (e.g., to the EEA/UK or US), we use lawful safeguards such as Standard Contractual Clauses, and apply PDPA transfer requirements and robust technical/organisational measures.

    8) Retention

    We keep:

    • Account/profile and community records while your account is active.
    • Payment/transaction records for up to 7 years (tax/audit).
    • Moderation logs as long as necessary for platform integrity.
    • Marketing consent logs until you withdraw (and then only minimum suppression data).
      When no longer needed, we securely delete or anonymise data.

    9) Your rights

    Depending on where you live, you can: access, rectify/correct, erase, restrict/object, port your data, and withdraw consent. You can manage many settings in your account or by contacting [email protected].

    • Singapore (PDPA): you have rights to access and correct personal data and to withdraw consent at any time, subject to legal/operational limits. You may contact the Personal Data Protection Commission (PDPC) if you believe your rights have been infringed.
    • EEA/UK (GDPR/UK-GDPR): you also have rights to erasure, restriction, objection, portability, and not to be subject to decisions based solely on automated processing where applicable; you may contact your local supervisory authority (e.g., a DPA or ICO).
    • California (CPRA): SR Connect honours access, delete, correct, and opt-out of “sharing” for cross-context behavioural advertising. We do not “sell” personal information. Requests: [email protected] or [email protected].

    10) Children

    SR Connect is not intended for users under 16. If you believe a child has provided data, contact us and we’ll delete it.

    11) Security

    We use appropriate technical and organisational measures (encryption in transit, access controls, logging, least-privilege, and vendor DPAs). No system is 100% secure, but we work to protect your data and promptly address incidents.

    12) Contact

    Controller: Success Resources Pte. Ltd. (UEN 198500707N), 33 Ubi Avenue 3, #05-51, Vertex Tower A, Singapore 408868.
    Privacy/DPO: [email protected].
    General: [email protected] | +65 6299 4677.

    We may update this policy; the latest version will always be posted here with a new effective date.