Privacy Policy
Last updated: 29 September 2026

At CRAOI, we believe wellbeing should feel personal, supportive and safe. Protecting your privacy is an important part of that.

This Privacy Policy explains how CRAOI Theory Limited (“CRAOI”, “we”, “us” or “our”) collects, uses, stores and protects personal information when you use our website, CRAOI platform and mobile application, participate in our coaching, workshops or wellbeing experiences, contact us, or otherwise engage with our services.
It also explains your rights in relation to your personal information.

1. About CRAOI
CRAOI Theory Limited provides workplace wellbeing services designed to help people feel better, connect with others and take positive action.
Our services may include:

• the CRAOI digital wellbeing platform and mobile application;

• workplace wellbeing programmes and partnerships;

• wellbeing activations and challenges;

• workshops, masterclasses and wellbeing experiences;

• Health & Wellness Coaching;

• employee and workplace wellbeing insights;

• community, giving-back and sustainability-related wellbeing activities; and

• related communications, resources and support.
   

For personal information that CRAOI collects and uses for its own purposes, CRAOI Theory Limited acts as the data controller.
In some circumstances, particularly where CRAOI provides services to an organisation and processes information on that organisation's instructions, CRAOI may act as a data processor. The respective responsibilities of CRAOI and the organisation will depend on the service being provided and the nature of the processing involved.

If you have any questions about this Privacy Policy or how we use your personal information, you can contact us at:
CRAOI Theory Limited
Email: hello@craoi.com
Website: craoi.com

2. Who this Privacy Policy applies to

This Privacy Policy may apply to you if you:

• visit or interact with the CRAOI website;

• contact CRAOI or submit an enquiry;

• book a meeting or discovery call with us;

• receive access to CRAOI through your employer or another organisation;

• create or use a CRAOI platform or mobile app account;

• purchase or subscribe to CRAOI directly;

• participate in a CRAOI challenge, activity, workshop, masterclass or event;

• receive Health & Wellness Coaching from CRAOI;

• represent an organisation that works with, or is considering working with, CRAOI;

• subscribe to CRAOI marketing or communications; or

• otherwise interact with CRAOI or our services.
   

CRAOI's services are intended for adults aged 18 years and over.

3. Personal information we may collect
The information we collect depends on how you interact with CRAOI.
Website and enquiry information
When you contact us through our website or otherwise make an enquiry, we may collect information such as:

• your name;

• work email address;

• organisation or company name;

• the CRAOI service you are interested in;

• information you choose to include in your enquiry; and

• records of our correspondence with you.
   

Our website is currently provided using Wix. Website enquiries may be processed through our website systems and sent to CRAOI by email.

Meeting and booking information
If you book a call or meeting with us, including through Calendly, we may collect:

• your name;

• email address;

• organisation and role, where relevant;

• information you provide about the reason for the meeting;

• your selected meeting date and time; and

• other information you choose to provide during the booking process.
   

Meetings may be held using Google Meet or Zoom.

CRAOI account information
If you create an account on the CRAOI platform and mobile application, we may collect information such as:

• your name;

• email address;

• age or age-related information;

• your general location, such as county or region;

• your working arrangement, such as remote, onsite or hybrid;

• company or organisation, where relevant; and

• information needed to create, manage and secure your account.
   

Where CRAOI is provided through your employer, we may also receive limited information from your employer where necessary to enable access to the service.

Wellbeing information
When using CRAOI, you may choose to provide information about your wellbeing and your experience of wellbeing at work and outside work.
This may include:

• ratings of your physical, mental and emotional wellbeing, including ratings provided on a 1–10 scale;

• mood or wellbeing sentiment;

• goals you set and progress towards them;

• wellbeing activities you schedule or complete;

• challenges you join;

• content or activities you rate;

• timers or wellbeing practices you complete;

• positive actions you record relating to personal, social or environmental wellbeing; and

• other information you choose to provide through CRAOI's wellbeing features.
   

Some wellbeing information may constitute data concerning health or other special-category personal data under applicable data-protection law.
Where this applies, CRAOI will only process that information where an appropriate legal basis and an applicable condition for processing special-category data are available, including explicit consent where appropriate.

Where consent is required, information about the processing is provided to users and consent is requested through the CRAOI platform or mobile application.

Platform activity
We may collect information about how you interact with CRAOI, including:

• challenges joined and challenge activity;

• activities scheduled, created or completed;

• goals and progress;

• mood or wellbeing sentiment;

• Hearts or other in-platform recognition earned;

• garden items or other in-platform features selected;

• timers completed;

• content and activities used or rated;

• group activities created or joined; and

• positive actions recorded across personal wellbeing, social wellbeing and environmental wellbeing.
   

We use this information to provide and operate CRAOI, enable relevant platform features, understand engagement, improve the experience and, where appropriate, create aggregated or anonymised workplace insights.

Coaching information
If you participate in Health & Wellness Coaching with CRAOI, we may collect:

• your name and contact details;

• booking and attendance information;

• goals or areas you would like to explore through coaching;

• information you choose to share during the coaching relationship; and

• coaching notes created in connection with your sessions.
   

Because coaching is personal, information shared during coaching may include information about your health, wellbeing, work, relationships or other aspects of your life.
Coaching records and notes are treated as confidential and are stored with access controls, including through Google Drive where applicable.
Workshops, masterclasses and events

If you register for or participate in a CRAOI workshop, masterclass, event or wellbeing experience, we may collect:

• your name;

• email address;

• organisation;

• registration and attendance information;

• responses or feedback you choose to provide; and

• information required to administer the event.
   

Marketing information
If you choose to receive CRAOI news, resources, invitations or other marketing communications, we may collect:

• your name;

• email address;

• organisation, where relevant;

• your marketing preferences; and

• information relating to your interaction with our communications.
   

We currently use MailerLite to help manage some CRAOI email communications.

4. How we collect personal information
We may collect personal information:

• directly from you;

• through the CRAOI website;

• when you create or use a CRAOI account;

• when you download or use the CRAOI mobile application;

• when you participate in a challenge, activity or other CRAOI experience;

• when you book or participate in coaching;

• when you register for a workshop, masterclass or event;

• when you book a meeting through a scheduling service such as Calendly;

• through communications with us;

• from an organisation providing you with access to CRAOI, where appropriate; and

• automatically through our website or digital services, where permitted, through cookies and similar technologies.
   

5. Why we use your information
Depending on your relationship with CRAOI, we may use personal information to:

• create and manage your CRAOI account;

• provide access to CRAOI and its features;

• deliver workplace wellbeing services;

• provide coaching, workshops, masterclasses and other experiences;

• enable challenges, activities, goals, timers and other wellbeing features;

• respond to enquiries and requests;

• manage meetings, bookings and client relationships;

• provide customer and technical support;

• understand how CRAOI is being used;

• improve our platform, content, services and user experience;

• communicate important information about the services you use;

• produce appropriate aggregated or anonymised insights for organisational clients;

• administer subscriptions and commercial relationships;

• send marketing communications where we are permitted to do so;

• protect the security and integrity of our services;

• prevent misuse or fraudulent activity;

• comply with our legal, regulatory, accounting and tax obligations; and

• establish, exercise or defend legal claims where necessary.
   

We will not use personal information for purposes that are incompatible with the purpose for which it was collected unless permitted or required by law.

6. Our legal bases for using personal information
Under data-protection law, CRAOI must have a lawful basis for processing personal information.
Depending on the circumstances, we may rely on:
Performance of a contract — where processing is necessary to provide a service you have requested or to take steps at your request before entering into a contract.
Legitimate interests — where processing is reasonably necessary for CRAOI's legitimate business interests, such as operating and improving our services, managing client relationships, responding to business enquiries and maintaining the security of our services, provided those interests are not overridden by your rights and interests.
Consent — where you have given us permission to use your information for a particular purpose, such as certain marketing activities or where consent is an appropriate basis for a particular feature or processing activity.
Legal obligation — where we need to process information to comply with applicable laws or regulatory requirements.
Where we process special-category personal data, including certain information concerning health or wellbeing, we will also rely on an applicable condition permitted under Article 9 of the GDPR.
Where that condition is your explicit consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before consent was withdrawn.

7. Your wellbeing information and your employer
We understand that people need to be able to trust a workplace wellbeing service.
Your individual wellbeing information is treated as confidential.
Where your employer or another organisation provides access to CRAOI, that does not mean the organisation has access to everything you do within CRAOI.
CRAOI may provide an organisation with aggregated or anonymised insights designed to help it understand overall engagement, participation and wellbeing trends.
Depending on the programme, these may include:

• the collective number of positive actions taken;

• overall challenge participation;

• aggregated challenge activity;

• overall mood or wellbeing sentiment;

• popular content, activities or wellbeing topics;

• engagement trends;

• collective achievements; and

• high-level themes that may help the organisation understand what employees find useful or where further support may be valuable.
   

We do not provide employers with individual employees' personal wellbeing inputs, individual mood entries, personal goals or other identifiable wellbeing information as part of standard organisational reporting.
We also take account of group size and other circumstances when providing organisational insights, as aggregated information can still create identification risks where groups are very small.
In limited circumstances, you may choose to allow specific information to be shared.
For example, if a challenge includes a prize, we may ask for your permission to identify you as a winner so that the prize can be provided.
Where consent is required for such disclosure, we will ask you before sharing the relevant information.
Information may also be disclosed where required by law.

8. Coaching confidentiality
Information shared during Health & Wellness Coaching is treated as confidential.
Where your employer pays for or provides access to coaching, your employer does not receive details of what you discuss during your individual coaching sessions as part of standard programme reporting.
Where CRAOI coaches a number of people within the same organisation, we may provide the organisation with high-level, non-identifying themes or recommendations where appropriate.
For example, CRAOI may identify that manager training, greater opportunities for connection or another organisational initiative could be worth exploring.
We take care not to intentionally attribute comments, experiences or coaching information to identifiable individuals when providing these high-level insights.
There may be limited circumstances in which confidentiality cannot be maintained, including where disclosure is required by law or where another overriding legal obligation applies. Where possible and appropriate, we will explain this to you.

9. Aggregated and anonymised information
CRAOI may combine information to understand broad patterns, participation or trends.
Where information is genuinely anonymised so that an individual can no longer be identified, it is no longer personal data for the purposes of the GDPR.
Where information can still be linked to an identifiable person, even if identifiers have been removed or replaced, we continue to treat it as personal data and protect it accordingly.
We may use genuinely anonymised statistical information to understand and improve CRAOI, evaluate participation and communicate the collective impact of wellbeing activities.
10. Who we may share information with
We do not sell your personal information.
We may use trusted service providers to help us operate CRAOI and deliver our services.

Depending on the service you use, these may include providers supporting:

• website hosting and website functionality, including Wix;

• cloud infrastructure, database and application services, including Google Cloud and Firebase;

• business email and communications, including Microsoft 365;

• secure file storage and collaboration, including Google Drive;

• scheduling, including Calendly;

• online meetings, including Google Meet and Zoom;

• email communications, including MailerLite;

• mobile application distribution and subscriptions, including Apple App Store and Google Play;

• IT, security and technical support; and

• professional services such as legal, accounting or compliance support.
   

Where a third party processes personal information on CRAOI's behalf, we take appropriate steps to ensure that the relationship is governed by appropriate data-protection arrangements.

We may also disclose personal information where:

• you have asked or authorised us to do so;

• it is necessary to provide a service you have requested;

• we are required to do so by law or a competent authority;

• it is necessary to protect our legal rights or the rights of another person; or

• it is necessary in connection with a corporate transaction, subject to appropriate safeguards.
   

Third-party services may also process personal information under their own privacy policies where they act as independent controllers.

11. International data transfers
Some of the technology and service providers we use may process or store personal information outside Ireland or the European Economic Area (“EEA”).
Where personal information is transferred outside the EEA, we will take steps required by applicable data-protection law to ensure an appropriate level of protection.
Depending on the destination and provider, this may include relying on a European Commission adequacy decision or appropriate contractual and organisational safeguards, such as approved Standard Contractual Clauses.
You can contact us at hello@craoi.com if you would like further information about safeguards relevant to your personal information.

12. Payments
Corporate clients generally pay CRAOI directly in accordance with their agreement with us.
Where an individual purchases a CRAOI subscription through a mobile application marketplace, payment may be processed by the relevant platform provider, such as the Apple App Store or Google Play.
Those providers process payment information in accordance with their own terms and privacy policies.
CRAOI does not receive or store full payment-card details where payment is processed entirely by the relevant app marketplace.

13. Marketing communications
We may send you CRAOI news, resources, event invitations or other marketing communications where you have requested them or where we are otherwise permitted to do so under applicable law.
For example, you may choose to join our mailing list through the CRAOI website or when registering for a free CRAOI masterclass.
You can unsubscribe from marketing communications at any time by using the unsubscribe link contained in the email or by contacting hello@craoi.com.
Withdrawing from marketing communications will not prevent us from sending you service-related communications that are necessary to provide a service you use.

14. Cookies and website analytics
Our website may use cookies and similar technologies that are necessary for the website to function and, where applicable and permitted, to help us understand how visitors interact with our website.
Where consent is required for non-essential cookies or similar technologies, we will request that consent through our website's cookie controls.
As our website and analytics tools develop, we may update the technologies we use and this Privacy Policy accordingly.
More detailed information about the cookies used on our website, including how to manage your preferences, may be provided in our Cookie Policy and cookie settings.

15. How long we keep personal information
We do not keep personal information for longer than we reasonably need it.
The appropriate retention period depends on the type of information, why we collected it, the services involved, whether our relationship with you is continuing, and any legal, accounting, regulatory or contractual requirements that apply.

In determining retention periods, we consider factors including:

• the purpose for which the information was collected;

• how long the information is needed to provide the relevant service;

• the sensitivity of the information;

• the potential risk associated with retaining it;

• whether the information can be anonymised;

• contractual requirements; and

• applicable legal, tax, accounting or regulatory obligations.
   

For example, business and accounting records may need to be retained for legally required periods, while wellbeing information will be reviewed with particular regard to its sensitivity and whether continued retention is necessary.
When personal information is no longer required, we will delete it, securely dispose of it or anonymise it, as appropriate.
We are continuing to formalise our internal retention schedule across CRAOI's services and will update this Privacy Policy where appropriate as those periods are established.

16. How we protect your information
We take the security and confidentiality of personal information seriously.
We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include, where appropriate:

• access controls;

• authentication measures;

• encryption provided through our technology infrastructure;

• secure cloud services;

• restrictions on who can access information;

• confidentiality requirements;

• security monitoring and backup processes; and

• procedures for responding to suspected personal-data breaches.
   

Access to personal information is limited to people and service providers who require it for legitimate business purposes.
No digital service can guarantee absolute security. We therefore regularly review the measures appropriate to the nature of the information we process and the risks involved.

17. Automated decision-making
CRAOI does not currently use personal information to make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.
Our platform may use information you provide to operate features, display progress, provide feedback or support your experience of CRAOI. This does not mean that CRAOI makes automated employment decisions about you.
CRAOI does not use your wellbeing information to make employment decisions on behalf of your employer.
If this position changes, we will update our privacy information and provide any additional information or safeguards required by law.

18. Your data-protection rights
Depending on the circumstances and applicable law, you may have the right to:
Access your information
Ask us for a copy of the personal information we hold about you.
Correct your information
Ask us to correct information that is inaccurate or incomplete.
Erase your information
Ask us to delete personal information in certain circumstances.
Restrict processing
Ask us to restrict how we use your personal information in certain circumstances.
Object to processing
Object to certain uses of your information, including processing based on legitimate interests and direct marketing.

Data portability
Request certain personal information in a structured, commonly used and machine-readable format and, where applicable, have it transferred to another organisation.

Withdraw consent
Where we rely on your consent, you can withdraw it at any time. This does not affect processing that was lawful before you withdrew your consent.

Rights relating to automated decision-making
You have rights in relation to certain decisions made solely by automated means where those decisions have legal or similarly significant effects.
These rights are not absolute and may be subject to conditions or exemptions under applicable law.

19. How to exercise your rights
If you would like to exercise a data-protection right or have a question about the personal information CRAOI holds about you, contact:
hello@craoi.com

Please tell us enough about your request to allow us to understand and respond to it.
We may need to ask you for information to verify your identity before acting on certain requests. We will only request information reasonably necessary for that purpose.
We will respond to valid requests in accordance with the timeframes required by applicable data-protection law.

20. Data breaches
CRAOI maintains procedures for identifying, assessing and responding to suspected personal-data breaches.
Where a personal-data breach occurs, we will assess the nature and potential impact of the breach and take appropriate action.
Where required by law, we will notify the relevant supervisory authority and/or affected individuals within the applicable legal timeframes.

21. Links to other websites and services
The CRAOI website, platform or communications may contain links to websites or services operated by other organisations.
CRAOI is not responsible for the privacy practices of third-party websites or services that we do not control.
We encourage you to read the privacy information provided by those organisations before providing them with personal information.

22. Changes to this Privacy Policy
We keep this Privacy Policy under review and may update it as CRAOI develops, our technology or services change, or legal and regulatory requirements evolve.
The latest version will be made available on our website and the date at the top of this page will show when it was last updated.
Where a change materially affects how we use your personal information, we will take appropriate steps to bring that change to your attention where required.

23. Questions, concerns and complaints
If you have a question or concern about how CRAOI handles your personal information, please contact us at:
hello@craoi.com

We will do our best to understand and address your concern.
You also have the right to raise a concern or lodge a complaint with the Irish Data Protection Commission.
Data Protection Commission
6 Pembroke Row
Dublin 2
D02 X963
Ireland
Data Protection Commission

CRAOI Theory Limited
Email: hello@craoi.com
Website: craoi.com