Privacy Policy & Data Processing Agreement

This Privacy Policy and Data Processing Agreement (the "Policy") constitutes a legally binding and enforceable instrument between the natural person accessing, downloading, registering for, or otherwise utilising the B'local mobile application and its associated services (the "User", " Data Subject" or "You") and BL PLATFORM S.L., a limited liability company duly organised and existing under the laws of the Kingdom of Spain, with registered domicile in Barcelona, acting in its capacity as Data Controller (the "Controller", "Company", "We" or " Us").

By affirmatively interacting with the B'local mobile application, its application programming interfaces, software development kits, and supporting backend infrastructure (collectively, the "Services"), the User unequivocally stipulates to having read, fully understood, and freely consented to the data processing methodologies set out herein. Where the User does not concur with any provision, clause or technical mechanism, the User's exclusive remedy is the immediate cessation of use of the Services and the deletion of the application from all User-controlled hardware.

This Policy is drafted in compliance with, and shall be construed by reference to: (i) Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR"); (ii) the United Kingdom GDPR and the Data Protection Act 2018 ("UK GDPR"); (iii) the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD"); (iv) the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"); (v) the South African Protection of Personal Information Act, 4 of 2013 ("POPIA"); (vi) the Nigeria Data Protection Act 2023 ("NDPA"); (vii) the Kenya Data Protection Act, 2019; (viii) the Brazilian General Data Protection Law (Lei 13.709/2018, "LGPD"); (ix) the Canadian PIPEDA and Québec Law 25; (x) the Swiss Federal Act on Data Protection ("FADP"); (xi) the comprehensive privacy statutes of the United States States identified in Article XV; (xii) the Singapore Personal Data Protection Act, the Indian Digital Personal Data Protection Act 2023, the Japanese APPI, the South Korean PIPA and the Australian Privacy Act 1988; and (xiii) any further mandatory local laws of the User's jurisdiction, the more protective provision prevailing in the event of conflict.

For the purposes of this Policy, the capitalised terms below shall bear the ascribed meanings:

Pursuant to Article 4(7) GDPR and parallel international frameworks, BL PLATFORM S.L. acts as the primary Data Controller. The Company maintains its principal place of business and registered corporate domicile in Barcelona, Spain.

No representative is designated pursuant to Article 27 GDPR, and none is required: the Controller is established within the European Economic Area (Barcelona, Spain) and Article 27 applies only to controllers not established in the Union.

Statutory inquiries, Data Subject Access Requests ("DSARs"), erasure or portability requests, and regulatory correspondence shall be directed to the Controller.

The Controller has carried out a Data Protection Impact Assessment ("DPIA") pursuant to Article 35 GDPR in respect of those Processing operations which, individually or in combination, are likely to result in a high risk to the rights and freedoms of natural persons, namely: (i) behavioural interaction analysis and honey-pot telemetry (Article IX); (ii) automated threat mitigation, including the automated restriction of account access (Article X); (iii) the Processing of precise geolocation data (Article VIII); and (iv) AI-assisted challenge verification and content generation (Article XXI). The assessment additionally addresses the criteria listed in the AEPD's mandatory DPIA list adopted under Article 35(4) GDPR.

The DPIA describes the Processing operations and their purposes, assesses their necessity and proportionality, identifies the risks to Data Subjects, and records the technical and organisational measures adopted to mitigate those risks (including data minimisation, coordinate truncation, pseudonymous logging, retention limits and the human-review pathway described at Article X bis). The DPIA is reviewed at least annually, and whenever a material change occurs in the nature, scope, context or purposes of the Processing. A copy is available to the AEPD, or to any other competent supervisory authority, on request.

The Controller likewise maintains a Record of Processing Activities under Article 30 GDPR; a public-facing extract of that register is reproduced at Annex I to this Policy.

This Policy applies extraterritorially to the Processing of Personal Data of all Users of the Services, irrespective of the User's place of residence, and irrespective of whether the Processing itself takes place within the European Economic Area. The Controller asserts compliance with the extraterritorial reach provisions of GDPR Article 3, POPIA section 3, NDPA section 2, and CCPA §1798.140.

The Controller, observing the principle of data minimisation under Article 5(1)(c) GDPR, processes the following categories of Personal Data:

The Controller does not intentionally Process Sensitive / Special Category Data within the meaning of Article 9 GDPR, save where strictly necessary and supported by an Article 9(2) lawful basis, in particular explicit consent.

Users authenticated under a verified business account ("Business Users") may, within the business dashboard, voluntarily upload additional content and use camera-based redemption tools for the purpose of enriching the public profile of their venue and operating events. Such uploads and scans are Processed under Article 6(1)(b) GDPR (performance of the business-account contract) and are subject to the following safeguards:

End-Users consuming a venue's profile may be exposed to short, looping audio snippets of the Business User's Vibe Playlist. Such playback is performed locally on the End-User's handset; no audio data is transmitted from the End-User to the Controller in connection with this feature.

Business Users receive aggregated analytics to help them understand the performance of their venue and events on the Services. These metrics are derived from End-User interactions and are presented to the Business User in a non-identifiable, aggregated form. The following analytics are collected:

The Controller does not share the identities of individual End-Users with Business Users unless the End-User has voluntarily published identifiable content (for example, a public review with a display name).

Personal Data is Processed exclusively for the following enumerated purposes:

1. Provision, maintenance and improvement of the Services;
2. Account creation, authentication, identity verification, and sending transactional communications (e.g., reward purchase confirmations) via email;
3. Personalisation of recommendations, challenges and rewards;
4. Operation of the gamification, points, leaderboard and trip-award eligibility infrastructure, including the seven-day acceptance window and automatic transfer of unclaimed eligibility to the next eligible User;
5. Synchronisation of challenges between friends via QR-code scanning, using only the User's chosen display name in the friend context;
6. Publication, moderation, reporting and reply functionality in respect of reviews and other public content, with no private in-app messaging attached to reviews or replies;
7. Provision of aggregated analytics to verified Business Users regarding their venue and event performance, including challenge completions, reviews, saves, views and review averages;
8. Redemption of venue freebies and validation of event guest-list entries through QR-code scanning by Business Users;
9. Detection, prevention and investigation of fraud, abuse and security incidents;
10. Compliance with legal, regulatory, accounting and tax obligations;
11. Establishment, exercise or defence of legal claims;
12. Processing account-deletion requests submitted through the Controller's website, including verification of the requester and communication of the outcome;
13. With separate opt-in consent: direct marketing and product research.

When you participate in B'local challenges and rewards, the Controller collects and processes additional Personal Data to operate the gamification infrastructure and to ensure fairness across the rewards programme. The categories described below are Processed under the statutory bases set out in Article VI and retained in accordance with Article XIII.

Your data is kept secure, is used only for the operation of the rewards programme and related anti-fraud controls, and is never sold to third parties.

6bis.1 Nature and purpose. The Controller operates a crash- and error-diagnostics service (Sentry, processed in the Federal Republic of Germany) together with a limited sample — not exceeding ten per cent (10%) — of screen-session recordings and any in-app feedback text the User chooses to submit. Session recordings are captured with all text, input fields, images and vector content masked at source so that free-text content is not transmitted. This Processing is undertaken exclusively to detect defects, diagnose crashes, understand which features are used, and prioritise remediation and improvement of the Services. The data is not sold, is not used for advertising, and is not used to build a marketing or cross-context profile of the User.

6bis.2 Legal basis. This Processing is carried out on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR and equivalent provisions under the UK GDPR, LGPD, POPIA, NDPA and other applicable frameworks) in the security, stability, reliability and continuous improvement of the Services. The Controller has carried out and documented a balancing test (a "legitimate interests assessment") which concludes that this interest is not overridden by the interests or fundamental rights and freedoms of the User, having regard to the diagnostic-only purpose, the source-level masking, the pseudonymous nature of the identifiers used, the short retention period, and the User's ability to object and disable the Processing at any time.

6bis.3 Right to object and to disable. The User may object to this Processing and switch it off at any time, with immediate effect and without detriment to the availability of the core Services, from within the application at Profile → Privacy. Where the User does so, the diagnostics and session-replay software development kits are disabled on that device and no further diagnostic data is collected. The Controller records the User's current preference (enabled or disabled), together with the date on which it was last changed and the version of this Policy then in force, as evidence of compliance with the accountability principle.

6bis.4 Jurisdiction-specific consent requirements. The Controller acknowledges that the law of certain jurisdictions — including European Economic Area Member States under Article 5(3) of Directive 2002/58/EC (as transposed) — may require the User's prior consent for diagnostic and session-replay Processing of this kind. A User in any such jurisdiction who does not wish this Processing to take place may disable it at any time, before or after it begins, at Profile → Privacy, and the Controller will give effect to that choice immediately and retain a record of it. The Controller keeps the basis and mechanism for this Processing under review and will move to a prior-consent model for the relevant jurisdictions where required to do so.

6ter.1 First-layer information. In accordance with Article 11 of Spanish Organic Law 3/2018 (LOPDGDD), basic information is provided to the User at the point of collection, on a single screen presented during registration, in concise and plain language. That first-layer notice identifies: (i) the identity of the Controller and the contact details of the Data Protection Officer; (ii) the categories of data collected and the purposes for which they are Processed; (iii) the legal bases relied upon; (iv) the existence of the rights of access, rectification, erasure, restriction, portability, objection and the right to lodge a complaint with the AEPD; and (v) a direct, prominent hyperlink to this complete Policy, which constitutes the second information layer. Consent to optional Processing is not obtained through the first-layer notice alone.

6ter.2 Records of consent and preference. Where the Controller relies on the User's consent for a particular Processing purpose (for example marketing communications, push-notification categories, or referral attribution), it records, as evidence of compliance with Article 7(1) GDPR: the purpose to which the consent or refusal relates; the action taken and the resulting state; the date and time of the action; the version identifiers of this Policy and of the Terms then in force; and the surface through which the action was taken (for example onboarding, in-app privacy settings, or an unsubscribe link). For the diagnostics and session-replay Processing described in Article VI bis, which is carried out on the basis of legitimate interest, the Controller records the User's current preference (enabled or disabled) together with the date it was last changed.

6ter.3 Withdrawal and objection. A consent may be withdrawn, and an objection to legitimate-interest Processing may be raised, at any time from within the application, with the same ease as the setting was given and without detriment to the availability of the core Services. Withdrawal or objection takes effect promptly and without retroactive prejudice to the lawfulness of Processing carried out before it.

The Services are rated and offered exclusively to adults and are not directed at, nor available to, any person under the age of eighteen (18) years, or such higher age of majority or lawful drinking age as applies in the User's jurisdiction of residence. The Controller does not knowingly collect or Process the Personal Data of any person under that age. Where the digital age of consent under a particular law is lower than eighteen (for example fourteen (14) under Article 7 of Spanish Organic Law 3/2018 (LOPDGDD), or sixteen (16) under Article 8 GDPR), that lower threshold is not relied upon, because the product itself is age-restricted to adults. Upon verified notification that a person under the applicable adult threshold has registered, the Controller will expeditiously delete the account and all associated Personal Data and, where required, notify a parent or guardian.

The Services collect precise location information (GPS coordinates) from the User's mobile device in order to provide the most accurate recommendations for the city the User is currently in, to suggest nearby venues (such as clubs, cafés, restaurants and cultural sites), and to ensure that localized content, challenges and rewards are relevant to the User's current physical position. The Controller employs a tiered hierarchy designed to privilege User autonomy and enforce privacy-by-design:

• Persistent Domicile (Home Base): The User's permanently declared geographic residence, stored in our database to bootstrap recommendations on first launch.
• Precise Hardware Telemetry (GPS): Subject to explicit, revocable OS-level authorisation. Precise GPS coordinates are read on demand and never silently polled in the background. The User retains the right to revoke this permission at any time through the device's system settings, although revocation may degrade or disable location-dependent features.
• Ephemeral Session Overrides (Travelling Status): The User may manually declare a temporary location which takes absolute priority over GPS telemetry. Stored in volatile memory only and purged on application termination.

To preserve infrastructural integrity, the Controller deploys hidden cryptographic honey-pot fields within authentication matrices and records the timing and spatial coordinates of the User's last ten (10) screen interactions. This data is processed locally where possible and cross-referenced with backend heuristics to differentiate bona fide human operation from automated scripts. No biometric template uniquely identifying a natural person within the meaning of Article 9 GDPR is generated, stored or shared.

Where the User enables it, the Application uses the biometric authentication mechanism of the operating system — Face ID, Touch ID or the Android biometric prompt — solely as a local gate to unlock the Application or the business console. The biometric comparison is performed entirely by the operating system within the secure hardware of the device. The Controller receives only a pass/fail result and at no time obtains, transmits, stores or has the capacity to reconstruct the User's fingerprint, facial geometry or any other biometric identifier.

Accordingly, no biometric data and no biometric template within the meaning of Article 9(1) GDPR, section 1 of POPIA, Article 30 of the NDPA or comparable provisions is created or Processed by the Controller in connection with this feature. The User may disable biometric unlock at any time in the Application's security settings or in operating-system settings, in which case the Application reverts to passcode or credential authentication.

The Services are governed by an automated cybersecurity framework designed to protect the platform from denial-of-service, brute-force, sybil and account-takeover incursions.

Where the Controller's security team, acting on the automated alerts described in Article X, determines that an account or device must be subjected to access restriction, the mobile application will render a full-screen, non-dismissible notice (the "Restricted-Access Notice") indicating that the User's access to the Services has been suspended. The notice:

• does not reveal the specific signals or telemetry that triggered the restriction, in order to preserve the integrity of the anti-fraud system;
• offers a "Close Application" control which, on Android devices, gracefully terminates the application process;
• offers a "Contact Support" control which opens a pre-addressed message to support@blocalapp.com and permits the User to lodge an appeal, request human review of the automated decision (Article 22(3) GDPR), or submit a Data Subject Access Request;
• advises the User of their right to obtain meaningful information about the logic involved, to contest the restriction, and to lodge a complaint with the competent supervisory authority.

The Restricted-Access Notice does not, in itself, Process additional Personal Data beyond that which is already held in connection with the User's account.

The Controller engages the following categories of Sub-Processor under Article 28 GDPR-compliant agreements:

Sharing within the Services. When a User connects with friends to synchronise challenges, the Controller discloses only the display name the User has chosen for that friend-group context. Email addresses, telephone numbers and precise location coordinates are not shared with friends.

The Controller does not sell Personal Data, does not share Personal Data for cross-context behavioural advertising within the meaning of CCPA/CPRA, and does not rent Personal Data to data brokers.

The Controller applies request rate-limiting across the entirety of its callable backend functions and public HTTP endpoints, including webhooks. The mechanism is implemented by means of short-lived counters keyed, in respect of authenticated calls, on the User's pseudonymous account identifier (UID) and, in respect of unauthenticated calls (including webhook deliveries), on the originating IP address. Where a defined threshold is exceeded within a rolling window, the corresponding request is rejected with an HTTP 429 Too Many Requests status or, for callable functions, an equivalent resource-exhausted error.

The processing of the UID and IP address for this purpose is grounded in the Controller's legitimate interest (Article 6(1)(f) GDPR) in preventing automated abuse, credential-stuffing, denial-of-service and webhook-replay incidents. Counter records are retained only for the duration of the relevant window and are not used for marketing, profiling or any purpose unrelated to abuse mitigation.

Where a business account holder (a venue, restaurant, bar, shop or event promoter — a "Business User") Processes Personal Data of its own staff or customers by means of the Services, the Business User acts as an independent Data Controller in respect of that data and the Controller acts as its Processor within the meaning of Article 4(8) GDPR.

That relationship is governed by a binding Data Processing Agreement ("DPA") satisfying the mandatory content of Article 28(3) GDPR, which the Business User must accept as a condition of onboarding and which is presented as a distinct, separately accepted contractual instrument — not merely as a paragraph of this consumer-facing Policy. The DPA sets out, at minimum: the subject-matter, duration, nature and purpose of the Processing; the categories of Data Subject and of Personal Data; the obligation to Process only on documented instructions; confidentiality undertakings; the technical and organisational security measures applied; the conditions for engaging sub-processors and the general written authorisation regime; assistance with Data Subject rights, security, breach notification and impact assessments; the obligations on deletion or return of data at the end of the relationship; and the audit and information rights of the Business User.

The Business User remains responsible for the lawfulness of the Processing it instructs, for informing its own staff and customers, and for establishing an appropriate legal basis for that Processing. A copy of the DPA accepted by the Business User is retained by the Controller for the duration of the relationship and for the applicable limitation period thereafter.

Where Personal Data is transferred outside the EEA, UK or other adequacy jurisdiction, the Controller relies upon: (i) European Commission adequacy decisions; (ii) the European Commission's Standard Contractual Clauses (Module 1–4) of 4 June 2021, supplemented by a Transfer Impact Assessment; (iii) the EU-US Data Privacy Framework where the recipient is certified; or (iv) the User's explicit, informed consent under Article 49(1)(a) GDPR. For African Users, equivalent transfer mechanisms under POPIA section 72 and NDPA section 41 are applied.

12.1 Transfer Register. The following table identifies, for each principal Sub-Processor, the jurisdiction in which Processing takes place and the transfer mechanism relied upon:

Pursuant to Articles 15–22 GDPR and the UK GDPR, the User is entitled to exercise:

• The right of access to their Personal Data;
• The right to rectification of inaccurate or incomplete data;
• The right to erasure ("right to be forgotten");
• The right to restriction of Processing;
• The right to data portability in a structured, commonly-used, machine-readable format;
• The right to object to Processing based on legitimate interest;
• The right not to be subject to solely automated decisions producing legal effects;
• The right to withdraw consent at any time without retroactive effect;
• The right to lodge a complaint with the competent supervisory authority — in Spain, the Agencia Española de Protección de Datos ( www.aepd.es ).

Exercise of the right to erasure. Deletion is available by two routes: (i) in-app, at Profile → Delete Account, which upon confirmation performs an immediate hard deletion of the User's account and its dependent records and revokes all authentication sessions and push tokens; and (ii)through the website, by submitting a deletion request which is verified and actioned by the Controller. In both cases, a backend routine triggered on account deletion removes the User's primary profile and business documents together with their subcollections and propagates the erasure to records derived from or referencing the account elsewhere in the database — including reviews, view and save logs, challenge-completion logs, reward-purchase and manual-redemption records, favourite-place entries, security-event logs, submitted reports, deletion-request and application records, server-side verification secrets, and rate-limiting counters. Only a minimal request and audit record is retained for compliance purposes as set out at Article XIII.

Requests are honoured free of charge within thirty (30) calendar days, extendable by sixty (60) days where necessary.

California residents enjoy, in addition to the rights enumerated above: (a) the right to know the categories and specific pieces of Personal Information collected; (b) the right to delete Personal Information; (c) the right to correct inaccurate Personal Information; (d) the right to opt-out of the sale or sharing of Personal Information (the Controller does neither); (e) the right to limit use of Sensitive Personal Information; and (f) the right to non-discrimination for exercising these rights.

15.1 Other US State Laws. Equivalent rights are extended to residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana and Kentucky, and to residents of other US States as their respective comprehensive privacy statutes enter into force.

15.2 Opt-Out Preference Signals. The Controller honours the Global Privacy Control (GPC) and comparable browser or device opt-out preference signals as a valid request to opt out of sale or sharing in jurisdictions that so require.

15.3 Consumer Health Data. The Controller does not knowingly collect "consumer health data" within the meaning of the Washington My Health My Data Act, the Nevada consumer-health-data law or the Connecticut amendments, does not derive health inferences from dietary preferences or venue activity for any purpose beyond filtering content at the User's request, and does not sell any such data.

15.4 Nevada. Nevada residents may direct the Controller not to make any covered sale of their covered information by contacting dpo@blocalapp.com; the Controller does not engage in such sales.

15.5 Shine the Light (Cal. Civ. Code §1798.83). The Controller does not disclose Personal Information to third parties for those third parties' own direct-marketing purposes.

Brazil (LGPD — Lei 13.709/2018): Users may exercise the rights set out in Articles 17 to 22 LGPD, including confirmation of Processing, access, correction, anonymisation or deletion, portability, information about sharing, and revocation of consent, and may petition the Autoridade Nacional de Proteção de Dados (ANPD). The legal bases relied upon correspond to those in Article VI of this Policy.

Canada (PIPEDA & Québec Law 25): Users may withdraw consent (subject to legal or contractual restrictions), access and correct their Personal Information, request portability, and complain to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec. The Controller reports data breaches presenting a real risk of significant harm as required by those laws.

South Africa (POPIA): Users are entitled to the rights set out in sections 23–25 of POPIA and may lodge complaints with the Information Regulator ( inforegulator.org.za ).

Nigeria (NDPA 2023): Users may exercise rights under sections 34–37 of the NDPA and refer complaints to the Nigeria Data Protection Commission.

Kenya (DPA 2019): Users may exercise rights under Part V of the Kenya Data Protection Act and refer complaints to the Office of the Data Protection Commissioner.

Ghana (Data Protection Act 843/2012): Users may exercise rights before the Data Protection Commission. Other African Jurisdictions: equivalent protections under the data-protection laws of Uganda, Rwanda, Tanzania, Zambia, Zimbabwe and Angola, under Egyptian Law 151/2020 and Moroccan Law 09-08, and under the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) are honoured where applicable.

The Controller gives effect to the substance of the following regimes for Users to whom they apply, and Users may in each case complain to the named authority:

This Policy is intended to meet the substance of the principal data-protection regimes worldwide, including (without limitation) the GDPR and UK GDPR; the Spanish LOPDGDD; the Swiss FADP; the California CCPA/CPRA and the comprehensive privacy statutes of other United States States as they enter force; the Brazilian LGPD; the Canadian PIPEDA and Québec Law 25; the South African POPIA; the Nigerian NDPA; the Kenyan DPA; the Ghanaian Data Protection Act; the Singapore PDPA; the Indian Digital Personal Data Protection Act 2023; the Japanese APPI; the South Korean PIPA; the Australian Privacy Act; and the UAE and Saudi PDPLs.

Where the mandatory law of the User's jurisdiction affords the User a right, a protection or a remedy that is greater than, or additional to, those set out in this Policy, that mandatory law prevails to the extent of the difference, and nothing in this Policy shall be read as a waiver of it. Where such law requires the designation of a local representative, the registration of a data-processing activity, a specific cross-border transfer mechanism, or a distinct form of consent, the Controller undertakes to put that measure in place before, or upon, commencing the relevant Processing in that jurisdiction. Complaints may in every case be addressed to the Controller at dpo@blocalapp.com and, in addition, to the User's local supervisory or data-protection authority.

The Controller has implemented appropriate measures pursuant to Article 32 GDPR, including:

• AES-256 encryption at rest;
• TLS 1.3 encryption in transit, with HSTS preloading;
• Managed identity-provider credential hashing with per-user salt; the Controller never receives or stores plaintext passwords;
• One-time verification codes (login, PIN reset, redemption codes) generated with a cryptographically secure random number generator and stored only as a one-way SHA-256 digest, with short expiry, attempt limits and per-account rate limiting;
• Behavioural PIN stored solely as a SHA-256 digest computed on-device;
• Encrypted (AES-256) storage of push-notification tokens;
• Database access rules enforcing per-record ownership: a User's profile document is readable only by that User (and authorised staff) and cannot be enumerated; review authorship is bound to the authenticated account; aggregate configuration is writable by administrators only;
• Media uploads restricted to image content types and a maximum size of 8 MB;
• Operational security alerts to the internal SOC channel are data-minimised and exclude email addresses and device identifiers (see Articles XI and XII); account-affecting enforcement is subject to human review (Article X);
• Role-based access control with least-privilege provisioning;
• Server-side per-identifier and per-IP rate limiting on sensitive endpoints;
• Stripe and RevenueCat webhooks verified by cryptographic signature / bearer secret before processing;
• Periodic penetration testing and continuous vulnerability & dependency monitoring;
• Documented Incident Response Plan and Business Continuity Plan;
• Mandatory data protection training for all personnel.

In the event of a Personal Data breach likely to result in a risk to the rights and freedoms of natural persons, the Controller shall notify the competent supervisory authority without undue delay and, where feasible, not later than seventy-two (72) hours after becoming aware of the breach, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk, affected Users shall be notified directly without undue delay pursuant to Article 34 GDPR.

The mobile application does not employ HTTP cookies in the traditional browser sense, but does utilise functionally-equivalent persistent local storage, secure keychain entries, and SDK identifiers. Specifically, the Application stores authentication tokens locally using AsyncStorage (to safely persist Firebase credentials across app launches) and tracks application session state using a unique session ID persisted in the OS-level encrypted SecureStore. The local storage and identifiers used by the Application fall into two classes. Strictly-necessary storage — authentication tokens, session identifiers, the on-device city catalogue (Article XIX quinquies), and the preference and saved-item caches (Article XIX ter) — is used without consent because it is required to deliver a service the User has requested. Non-essential storage and processing — namely the diagnostics, error-monitoring and session-replay integration (Article VI bis) and any marketing tracker — is operated on the legitimate-interest basis and may be switched off by the User at any time at Profile → Privacy; any marketing tracker is activated only following the User's opt-in. Where Article 5(3) of Directive 2002/58/EC ("ePrivacy"), as transposed by Spanish Law 34/2002 (LSSI) or by the law of the User's Member State, requires prior consent for a given item, the Controller relies on consent for that item as described in Article VI bis §6bis.4.

In furtherance of the principles of data minimisation (Article 5(1)(c) GDPR) and privacy-by-design (Article 25 GDPR), the Services implement a client-side personalisation mechanism, colloquially denominated the "Unseen First" logic, which operates exclusively within the local storage environment of the User's handset and does not entail any additional server-side Processing of Personal Data.

19bis.2 Operational Logic. Upon each fetch operation, the application partitions the candidate content set into "unseen" and "seen" sub-collections, randomises the ordering within each sub-collection, and concatenates them such that previously-unviewed items are prioritised in the User's feed. Where the locally-cached content set is composed entirely of previously-seen identifiers, the fifteen (15) minute in-memory cache is bypassed and a fresh request is dispatched to the backend in order to surface novel content.

19bis.3 Data Locality & Non-Transmission. The identifiers comprising the Unseen First register are never transmitted to, persisted by, or otherwise made available to the Controller's backend infrastructure, Sub-Processors or any third party. They remain at all times under the exclusive custody of the User's device and outside the technical reach of the Controller.

19bis.4 User Control & Erasure. The User may, at any time and without justification, extinguish the Unseen First register by (i) clearing the application's local data through the operating system settings; (ii) uninstalling the application; or (iii) invoking the in-app "Clear Cache" functionality where exposed. Such action will reset the personalisation logic and cause previously-viewed content to be eligible for re-surfacing.

19bis.6 Lawful Basis. To the extent that the Unseen First register constitutes Processing within the meaning of Article 4(2) GDPR, such Processing is grounded in the Controller's legitimate interest (Article 6(1)(f) GDPR) in providing a non-repetitive, content-fresh User experience, which interest is not overridden by the rights and freedoms of the User given the strictly on-device, pseudonymous and User-controllable nature of the mechanism.

In furtherance of data minimisation, performance and battery-economy objectives, the mobile application maintains a series of additional local caches within the device's persistent key-value store (AsyncStorage), orchestrated by a client-side state-management layer (Zustand). These caches operate as a read-through copy of data that already lawfully resides within the User's account and do not give rise to any new category of Personal Data.

19ter.4 Batched Analytics Writes. View-count and save-count telemetry generated by the User's interactions (e.g. viewing a venue or event) is buffered on the device and dispatched to the backend in atomic batches once a small threshold of events is reached. The pending-event buffer is written to the device's persistent key-value store so that events survive application termination; each buffered entry comprises the event type, the identifier of the venue or event concerned, a timestamp and the User's pseudonymous account identifier. Buffered entries are cleared once transmitted, and on sign-out or cache purge. Each underlying view is still recorded individually server-side so that dashboard accuracy is preserved; only the network-transport layer is optimised.

19ter.5 User Control. The User may extinguish any of the above caches at any time by clearing the application's local data, uninstalling the application, or signing out, which triggers a programmatic reset of the local stores.

Where a User activates a control which would cause the operating system to open a third-party destination outside the Services (including, without limitation, third-party booking systems, event ticketing pages, Apple Maps, Google Maps, the Controller's public website for the purposes of consulting the present Policy or the Terms & Conditions, or the business-onboarding portal), the mobile application first renders a branded, modal "Leaving Application" notice. The notice identifies the third-party destination, informs the User that they are about to be redirected outside the Controller's environment, and requires affirmative confirmation before the redirection is performed.

The Controller is not responsible for, and this Policy does not apply to, the data-processing practices of any third-party destination so accessed. The Controller does not track the User's activity on these external destinations or engage in cross-site tracking when traversing outbound links. Users are encouraged to consult the privacy policy of the recipient service prior to confirming the redirection.

Direct marketing communications are dispatched only following the User's explicit, freely given, specific, informed and unambiguous opt-in. Each communication includes a one-click unsubscribe mechanism in conformity with Article 21(3) GDPR and Article 22 LSSI. Withdrawal of consent does not affect the lawfulness of Processing prior to such withdrawal.

20bis.1 Contextual Advertising

To help provide the User with the best local recommendations, the Application may display promotional content, partner offers and advertisements (such as ride-sharing discounts or travel services). The Controller operates a strictly contextual advertising system: the advertisements displayed are determined solely by the User's current activity within the Application — namely the specific City or Continent then being viewed.

20bis.2 No Cross-App Tracking Profile

The Controller does not combine the User's activity across other companies' applications or websites into an advertising profile, does not present an App Tracking Transparency prompt, does not access the User's Identifier for Advertisers (IDFA) or Android Advertising ID within the Application, and does not share any such identifier with data brokers. The Application does not embed a third-party advertising or behavioural-tracking software development kit.

20bis.3 Data Sharing with Partners

When the User views an advertisement within the Application, the Controller does not share personal identifying information — including name, email address, telephone number or precise GPS coordinates — with the third-party advertiser.

20bis.4 Third-Party Links

Should the User elect to click a promotional offer or advertisement, the User may be redirected to a third-party website or application (for example, the Uber or Airalo app). Once the User leaves the Application, their interactions are governed by the privacy policies and terms of service of those third parties. The Controller encourages the User to review such policies before completing any transaction.

20bis.5 Install Attribution (SKAdNetwork / Privacy Sandbox)

The Controller advertises the Application on third-party platforms and measures the effectiveness of that advertising by means of the privacy-preserving, on-platform attribution frameworks provided by Apple (SKAdNetwork / AdAttributionKit) and Google (Privacy Sandbox Attribution). These frameworks return to the Controller only aggregated, delayed and noise-injected conversion signals. They do not transmit to the Controller the User's identity, the User's advertising identifier, or the User's activity in other applications, and the Controller does not receive or assemble a cross-context advertising profile from them. Where an advertising platform (for example a social or video network on which the Application is promoted) carries out its own attribution, that Processing is carried out by that platform as an independent controller under its own policies; the Controller does not embed that platform's tracking software development kit in the Application. If the Controller introduces such a software development kit in future, it will update this Policy and the applicable app-store privacy disclosures, and will obtain consent where required, before deployment.

The Controller employs algorithmic systems and Artificial Intelligence (AI) for fraud scoring, recommendation generation and eligibility validation in the gamification framework. AI is additionally used for challenge verification through three methods — AI Photo (analysis of a photograph taken or uploaded by the User to confirm the challenge was performed), AI Voice (analysis of a short voice recording captured via the device Microphone) and AI Answer (evaluation of a written response submitted by the User) — and for generating the historical and factual narration presented in the AR feature once a building, monument or landmark has been scanned. Media submitted for verification is processed for that purpose only, is not used to train third-party foundation models, and is retained in accordance with Article IX. Decisions producing legal effects or significantly affecting the User (notably, the Auto-Kill protocol) are subject to human review on request. The User is entitled to obtain meaningful information about the logic involved, as well as the significance and envisaged consequences of such Processing, pursuant to Article 22 GDPR. The Controller commits to compliance with the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) as its provisions enter into force.

The order in which venues, events and challenges appear to the User is determined by a combination of the following main parameters:

• proximity to the User's current or selected location;
• the dietary preferences and atmosphere ("vibe") preferences the User has declared, and the categories the User has chosen for the navigation bar;
• whether the item has already been shown to the User on the current device — previously-unseen items are prioritised (Article XIX bis);
• how recently the item was created or updated;
• aggregate popularity, save-count and average rating on the Services;
• whether the venue is currently open, based on its published opening hours and the device's local time.

The User can influence this ordering by changing their declared preferences, their location and their category selections, and by hiding individual venues. Ordering is not based on any payment by a venue or event organiser for placement or prominence, and there is no paid ranking. A separate, disclosed fee may be charged to a business for the right to publish an event listing, but that fee does not affect the position of the listing relative to other content.

22.1 Inherent Fallibility. Notwithstanding the implementation of AES-256 encryption, TLS transit protocols and automated threat frameworks, the User acknowledges that no digital architecture is wholly impervious to zero-day exploits or cyber-kinetic events.

22.2 Maximum Cap. To the maximum extent permissible under applicable mandatory law, and without prejudice to non-waivable consumer rights, the Controller's cumulative liability arising out of or in connection with this Policy shall be capped at the greater of (i) the total consideration paid by the User to the Controller in the twelve (12) months preceding the event giving rise to liability, or (ii) Fifty Euros (€50.00).

The Controller reserves the right to amend, alter or supplement this Policy at any time. Material amendments shall be communicated via in-app notification at least thirty (30) days prior to entry into force. Continued use of the Services following such notice constitutes binding ratification of the revised instrument.

This Policy shall be governed by and construed in accordance with the laws of the Kingdom of Spain. The Courts of Barcelona shall have exclusive jurisdiction over any dispute arising from or in connection with this Policy, without prejudice to the User's non-waivable right to bring proceedings in the courts of their place of residence pursuant to Regulation (EU) 1215/2012 (Brussels I bis) or equivalent local consumer protection statutes.

This Annex I is incorporated into, and forms an integral and operative part of, this Policy. It constitutes the Controller's record of processing activities maintained pursuant to Article 30 of Regulation (EU) 2016/679 ("GDPR") and, so far as applicable, section 17 of the Protection of Personal Information Act 4 of 2013 (South Africa) and section 39 of the Nigeria Data Protection Act 2023. It is published in the interests of transparency under Articles 12, 13 and 14 GDPR and is intended to furnish the Data Subject with an exhaustive, module-by-module description of (i) the categories of personal data processed, (ii) the operations performed upon such data, (iii) the determinate purposes served, (iv) the statutory basis relied upon, and (v) the applicable conservation period.

Where any provision of this Annex conflicts with the body of the Policy, the provision affording the Data Subject the greater degree of protection shall prevail. Defined terms bear the meanings ascribed to them in Article I. References to "AsyncStorage", "Firestore", "Firebase Auth", "RevenueCat", "Stripe", the transactional email provider, "Expo", "Google Cloud Vision" and "OpenAI" are references to the technical components and sub-processors identified in Articles XI and XII, whose engagement is governed by written data processing agreements incorporating the Standard Contractual Clauses where required.