PRIVACY POLICY

In compliance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD) of 5 December 2018, we inform you as follows:

DATA CONTROLLER

Identity: Pedro Jesús Parada Avendaño, NIF 03129787Q, hereinafter “the Controller”

Contact email: privacy@idlingapp.com

PURPOSE OF PROCESSING

Personal data will be processed to manage registration, access, maintenance, configuration, pausing and deletion of the account, and to enable use of the functionalities offered by the Platform.

The Platform uses a system of rules and scores to rank and display potentially compatible profiles based on profile information, preferences and location provided by users. The system offers recommendations, but it is always for the User to decide whether to establish a connection.

Information provided by the User will be used to create and manage their profile, facilitate connections between users and allow the exchange of messages, photographs and voice notes.

When the User chooses to complete the personality questionnaire, their answers may be used to better understand their preferences, values, communication style and relationship style, and to personalise profile recommendations. From these answers, traits, results or summaries related to compatibility may be generated. The questionnaire is optional and its results are not medical, psychological or diagnostic in nature.

Photographs and the presentation video may be used to check that they correspond to the same person and that the images provided meet the basic requirements set for completing the profile. These checks will also be used to strengthen profile authenticity and prevent fraudulent or improper use of the Platform. The photographs, video and voice notes requested are necessary to complete the profile and access compatibility and connection functionalities.

When the check involves processing facial characteristics to verify that the photograph and video correspond to the same person, that processing will be carried out with the User’s explicit consent. Information generated to perform the comparison will not be retained once the process is finished.

The Platform may process data relating to sexual orientation in order to provide the compatibility and connection functionalities requested by the User. It may also process other specially protected information that the User voluntarily chooses to include in their profile, in order to personalise their experience and, when so configured, improve profile recommendations.

The User’s location will be used to show nearby profiles and offer functionalities based on geographic proximity. The User may manage location permissions from their device settings, although disabling them may limit certain functionalities.

Data may also be processed to send verification codes, account notices, notifications and other communications necessary for the operation of the service; to handle queries, requests, incidents and complaints; to manage reports and moderation tasks; to prevent abuse; to adopt proportionate measures against breaches, including temporarily limiting access to new suggestions or connections; and to protect the security and proper functioning of the Platform.

Automated tools may also be used to support profile verification, check certain photograph requirements, facilitate some service functionalities and support security and moderation tasks.

Where the User has given consent, their data may be used to carry out analysis and statistics on use of the Platform and, where applicable, to send commercial communications related to IDLING.

LEGAL BASIS FOR PROCESSING

Processing of the User’s personal data is based, as a general rule, on performance of the contractual relationship arising from registration and use of the Platform, and on provision of the services requested by the User.

Processing of special categories of data, including sexual orientation, other specially protected data that the User chooses to include in their profile, and data derived from facial comparison used to verify profile authenticity, will be based on the User’s explicit consent. Consent will also be the basis for carrying out usage analysis and statistics and, where applicable, sending commercial communications.

Certain processing may be based on the Controller’s legitimate interest in ensuring the security of the Platform, preventing fraud and improper use, managing incidents and maintaining proper operation of the service, provided that the rights and freedoms of users do not override those interests.

Processing may also be necessary to comply with legal obligations applicable to the Controller and to respond to requests from competent authorities.

The User may withdraw consent at any time, without affecting the lawfulness of processing carried out previously. Where withdrawn consent relates to data necessary to provide certain functionalities, those functionalities may cease to be available.

PERSONAL DATA PROCESSED AND SOURCE

To provide the services offered through the Platform, the following categories of personal data may be processed:

• Identifying and contact data, such as name, email address, telephone number, age, gender and account identifiers.

• Data relating to the User account, access and the profile created on the Platform.

• Information on preferences, interests, search criteria, dating intentions, languages and other characteristics included in the profile.

• Information relating to sexual orientation, necessary to use the Platform’s compatibility and connection functionalities.

• Other specially protected data that the User voluntarily chooses to include in their profile, such as information relating to ethnic origin, religious beliefs or political opinions.

• Answers to the personality questionnaire and traits, results or summaries derived from those answers, when the User chooses to complete it.

• Three profile photographs, the presentation video and voice notes requested; data derived from facial comparison performed to check profile authenticity; and the result of checks carried out on the photographs and video.

• Location or geolocation data necessary to show nearby profiles and provide certain proximity-based functionalities.

• Text messages, photographs, voice notes and other content sent through chat, when the User uses this functionality.

• Information related to interactions, connections, reports, incidents, moderation activities and temporary measures applied to access to matching or certain Platform functionalities.

• Technical data necessary for the operation and security of the Platform, such as IP address, device identifiers, access logs, last activity and other data generated during use.

• Data on use of the Platform and interaction with its functionalities, only when the User has authorised usage analysis and statistics.

Personal data come mainly from the User, through information provided during registration, profile configuration, use of the various functionalities and communications maintained through the Platform.

When the User uses a third-party sign-in system, the Platform may receive the data the User has authorised to share, such as identifier, name, email address or profile photograph, in accordance with the terms applicable to the service used.

During use of the Platform, data may also be generated from its operation, such as compatibility results, profile recommendations, traits or summaries derived from the personality questionnaire, verification process results, information related to service security and moderation, temporary limitations applied to matching access, and technical logs necessary for proper operation.

During registration the Platform will indicate which data and content are necessary to create the account or use certain functionalities and which may be provided voluntarily. In particular, compatibility and connection functionalities require completing basic profile information and providing three photographs, including one face photograph, one full-body photograph and a third chosen by the User, as well as the requested presentation video and voice notes. Lack of any of these elements may prevent completing the profile or accessing the matching system.

The User warrants that the data provided are true, accurate and up to date, and undertakes to communicate or correct any necessary changes.

Certain profile data, photographs, presentation voice notes and other content configured as visible may be shown to other users in accordance with the Platform’s operation and privacy options.

The presentation video may be shown to other users during the recommendation and connection process. To help protect this content, IDLING may incorporate a watermark or other measures intended to make downloading, use or dissemination outside the Platform more difficult.

These measures help reduce the risk of improper use, but cannot absolutely guarantee that third parties cannot make captures or recordings by external means. Users must not copy, record, download, share or use outside IDLING the photographs, videos, audio or content of other people without their authorisation or without a legal basis that permits it.

If the User provides personal data of third parties, they must have a sufficient legal basis to do so and must avoid publishing or communicating information about other people without their authorisation. When using a feature intended to avoid certain matches with their contacts, telephone numbers provided will be processed exclusively to perform that check.

LINKS AND SOCIAL MEDIA POLICY

The Platform may include links to websites, app stores, social networks or other third-party services.

Access to and use of those services will be under the User’s responsibility and subject to the terms of use and privacy policies established by their respective owners.

The Controller is not responsible for personal data processing carried out by those third parties once the User leaves the Platform and accesses their services.

Users are advised to review the privacy policies and terms of use of those services before providing any personal data.

RETENTION PERIODS FOR PERSONAL DATA

Personal data will be retained for the time necessary to fulfil the purposes for which they were collected and to meet applicable legal obligations in each case. In particular:

• Account data, profile, preferences, connections, messages and other operational data will be retained while the account remains active. When the User requests deletion, the profile will cease to be accessible and the process of deleting associated data will begin, which will be completed within a maximum of thirty days.

• Photographs, video, voice notes and other content incorporated by the User will remain associated with their profile while the account remains active or until they are deleted when the Platform allows individual deletion. After account cancellation, this content will be deleted or anonymised in accordance with the Controller’s internal procedures, without prejudice to temporary retention when necessary to comply with legal obligations, manage incidents or handle possible claims.

• Verification results will be retained while the account remains active and will be deleted during the account deletion process, unless it is necessary to retain certain blocked information to handle an incident, claim or possible liability.

• Technical logs, access data, reports, security incidents, moderation measures, temporary matching limitations and data related to fraud prevention will be retained for the time necessary to manage the incident, apply or review the corresponding measure and handle possible claims or liabilities. Data included in backups will be deleted in accordance with their technical rotation cycle, set at a maximum of thirty days.

Once the applicable retention periods have ended, data will be deleted or, where necessary, retained duly blocked for the legally established periods to address possible administrative, judicial or legal liabilities.

PROTECTION OF MINORS’ DATA

The Platform is not directed at minors and registration is reserved exclusively for persons aged 18 or over.

The Controller may adopt reasonable measures to verify users’ age and to prevent, suspend or cancel accounts regarding which it has knowledge or well-founded indications that they belong to minors.

If provision of personal data of a minor is detected, such data will be deleted and the corresponding account may be cancelled, in accordance with applicable law.

SECRECY AND SECURITY OF PERSONAL DATA

The Controller adopts appropriate technical and organisational measures to protect personal data and prevent unauthorised access, loss, alteration or improper processing, taking into account the nature of the data processed and the risks associated with each processing activity.

Measures are also applied to ensure the confidentiality, integrity and availability of information, as well as procedures aimed at strengthening Platform security and preventing fraudulent or unauthorised use.

Personal data will be treated confidentially by the Controller and by authorised persons or entities involved in providing services related to the Platform when necessary for its operation.

DISCLOSURES AND RECIPIENTS OF PERSONAL DATA

Your personal data may be communicated to third parties when there is a legal obligation or when necessary for the proper provision of the services offered through the Platform.

Likewise, for the Platform to function it may be necessary for providers to intervene that supply services related to hosting and storage of information, electronic communications, user authentication, location, analytics, technical support, monitoring and other services necessary for provision of the service.

Depending on the nature of each service, these third parties may act as processors following the Controller’s instructions or as independent controllers in respect of processing carried out under their own terms and purposes.

Where required, the Controller will formalise the corresponding contracts or other safeguards provided for by data protection law.

Some of these providers may be located outside the European Economic Area or use international infrastructure to provide their services. In such cases, the Controller will adopt appropriate measures and safeguards to ensure a level of protection equivalent to that required by European data protection law.

The User may request additional information on the categories of recipients of their data and on the safeguards applicable to international transfers, where relevant.

USERS’ RIGHTS

The User may at any time exercise the rights recognised by data protection law.

In particular, they have the right to:

Access their personal data and know how they are being processed.

Request rectification of inaccurate or incomplete data.

Request erasure of their data when they are no longer necessary for the purposes for which they were collected.

Request restriction of processing of their data in the cases provided for by law.

Object to processing of their data when the legally provided circumstances apply.

Request data portability where applicable.

Withdraw consents given at any time, without affecting the lawfulness of processing carried out prior to such withdrawal.

Likewise, where applicable, the User will have the right to request human intervention, express their point of view and contest decisions based solely on automated processing that produce legal effects or similarly significantly affect them.

To exercise their rights they may contact the Controller at privacy@idlingapp.com, stating in the subject line “Exercise of data protection rights” and identifying themselves adequately so that the request can be handled.

Exercise of these rights is personal and must be carried out by the data subject or, where applicable, by a duly accredited representative.

In order to protect the security and confidentiality of personal data, the Controller may request the documentation necessary to verify the identity of the requester and, where applicable, the representation under which they act.

If you consider that processing of your personal data does not comply with applicable law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) via its website: www.aepd.es