Version 1.0 · Last updated: [DATE]

Privacy Policy

1. Data Controller

The data controller for personal data collected through the Zzmove application is [NAME], with Spanish tax identification number (NIF) [TAX ID], registered address at [ADDRESS] (Spain).

You can contact the data controller at: [LEGAL EMAIL].

This Privacy Policy has been drafted in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR), Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI).

2. Personal Data Collected

Zzmove collects and processes the following categories of personal data:

2.1 Data you provide

• Identity data: email address, name or username (handle), profile photograph (optional).
• Declarative location data: city or region entered by the user for class search and publishing purposes. Real-time GPS location is not collected.
• Profile data: biographical description (bio), fitness interests and activity preferences.
• Settings preferences: notification preferences, visual theme (light/dark) and regional settings (locale/language).

2.2 Data collected automatically

• Device identifiers: push notification registration token (Firebase Cloud Messaging — FCM), available from Phase 4 of development.
• Security tokens: Firebase App Check tokens used to verify application integrity and prevent API misuse.
• Anonymous usage metrics: aggregated data about application interaction via Firebase Analytics and Firebase Crashlytics. This data is collected in aggregated or pseudonymised form and does not directly identify the user when analysed for service improvement purposes.

2.3 Payment data (Phase 2)

When payment features are activated in Phase 2 of development, data relating to payment instruments (cards, bank accounts) will be processed exclusively by Stripe. Zzmove does not store payment data in its own systems.

3. Purposes of Processing

Zzmove processes personal data for the following purposes:

1. Service provision: managing user accounts, authentication, publishing and searching for classes, managing bookings and facilitating communication between students and instructors through the Platform.
2. User communication: sending service-related notifications (booking confirmations, cancellation notices, account updates).
3. Fraud prevention and security: detecting and preventing fraudulent, abusive or unauthorised use of the Platform via Firebase App Check and other security mechanisms.
4. Legal compliance: retaining data where required by applicable law (e.g. tax invoicing obligations in Phase 2+).
5. Product improvement: analysing aggregated and anonymised usage metrics to identify bugs, improve the user experience and develop new features.
6. Marketing communications (only with prior consent): sending news, promotions or other non-essential communications about the service.

4. Legal Basis for Processing

• Performance of a contract (Art. 6.1.b GDPR): the processing necessary to create and manage your account, provide the intermediation service, manage bookings and send essential service communications is based on the performance of the service contract you accepted upon registration.
• Compliance with a legal obligation (Art. 6.1.c GDPR): processing required to meet applicable legal obligations (e.g. retention of tax documentation).
• Legitimate interests (Art. 6.1.f GDPR): processing for fraud prevention, Platform security and service improvement through aggregated anonymous metrics, provided that these interests are not overridden by your rights and freedoms.
• Consent (Art. 6.1.a GDPR): processing of data for marketing or advertising communications that are not essential to the service. You may withdraw your consent at any time from the application settings.

5. Recipients of Personal Data

Personal data may be shared with the following recipients or categories of recipients:

• Google LLC (Firebase): Firebase Authentication (identity management), Cloud Firestore (database), Firebase Storage (file storage), Cloud Functions (server-side logic), Firebase Analytics (anonymous metrics), Firebase Crashlytics (crash reporting), Firebase Remote Config (remote configuration), Firebase App Check (API protection). Google LLC has executed Standard Contractual Clauses (SCCs) with the European Commission.
• Stripe Inc. (Phase 2): from the activation of payments in Phase 2 of development, payment data will be processed by Stripe pursuant to its own privacy policy and security practices.
• Technical support providers: other cloud or transactional email service providers that may be required for Platform operations, bound by data processing agreements compliant with the GDPR.
• Competent authorities: where required by law or to defend the legitimate legal interests of Zzmove.

Zzmove does not sell personal data to third parties or share it for advertising purposes with parties not contractually bound to the Platform.

6. International Data Transfers

Google Cloud Platform stores Zzmove's data in the European region eur3 (Europe). Notwithstanding this, Google LLC may process certain data in jurisdictions outside the European Economic Area (EEA) under Standard Contractual Clauses (SCCs) adopted by the European Commission, which constitute an adequate safeguard pursuant to Article 46 of the GDPR.

Stripe Inc. is headquartered in the United States and conducts international data transfers under the EU-US adequacy mechanism and/or SCCs, as applicable at any given time.

For further information about these transfers and the applicable safeguards, please contact us at [LEGAL EMAIL].

7. Retention Periods

Personal data will be retained for as long as your account remains active on the Platform.

When you delete your account (see Section 9), your personal data will be deleted immediately, except for data that must be retained pursuant to a legal obligation. In particular, from Phase 2 of development (payments), billing data may be retained for the period required by applicable Spanish tax law (currently four years as a general rule under the General Tax Law).

Anonymised or aggregated data used for statistical analysis may be retained indefinitely as it does not constitute personal data within the meaning of the GDPR.

8. Your Rights (GDPR Rights)

Under Articles 15 to 22 of the GDPR and the LOPDGDD, you have the following rights:

• Access: obtain confirmation of whether your personal data is being processed and, if so, access a copy of it.
• Rectification: request the correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your data when, among other grounds, it is no longer necessary for the purposes for which it was collected.
• Objection: object to the processing of your data in certain circumstances, in particular where processing is based on legitimate interests or for marketing purposes.
• Restriction of processing: request that processing of your data be restricted in the circumstances provided for under the GDPR.
• Data portability: receive your data in a structured, commonly used, machine-readable format where processing is based on consent or a contract and is carried out by automated means.

To exercise any of these rights, please contact us at [LEGAL EMAIL], stating the right you wish to exercise and enclosing documentation to verify your identity.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if you believe that your data is not being processed in accordance with the GDPR.

9. Account Deletion

You may delete your account at any time, directly and irreversibly, from Settings → Delete account within the application.

Deleting your account has the following immediate effects:

• Permanent and irreversible deletion of your personal data from Zzmove's systems (name, email, profile photo, bio, booking history, reviews and all other profile data), except for data that must be retained pursuant to a legal obligation.
• Termination of all active user sessions.
• Revocation of access to the Platform.
• Removal of classes published by you as an instructor (except those with active bookings pending resolution under the cancellation policy in force at the time).

This action is irreversible. Once deleted, your account data and access cannot be recovered.

10. Data Security

Zzmove implements appropriate technical and organisational measures to ensure the security of personal data and to prevent unauthorised access, alteration, loss or unlawful processing, including:

• Firestore and Firebase Storage security rules: access is restricted by security rules ensuring that each user can only access their own data and the public data defined by the Platform.
• Firebase App Check: application integrity verification mechanism that prevents unauthorised access to backend services by unverified clients.
• Encryption in transit: all communications between the application and servers are conducted over secure protocols (TLS/HTTPS).
• Encryption at rest: data stored in Google Cloud is encrypted at rest by default by Google Cloud Platform.
• Authentication: identity management is delegated to Firebase Authentication, with support for third-party authentication providers (Google Sign-In and others).

However, no security system is infallible. Zzmove cannot guarantee the absolute security of your data and accepts no liability for unauthorised access events beyond its reasonable control.

11. Minors

Zzmove is not directed at children under the age of 14. In accordance with Article 8 of the GDPR and Article 7 of the LOPDGDD, the processing of personal data of children under 14 requires the consent of the holder of parental responsibility or guardianship.

If a parent or legal guardian discovers that a child under 14 has created an account on Zzmove, they should contact us at [LEGAL EMAIL] to arrange for its immediate deletion.

12. Cookies and Similar Technologies

Zzmove is a mobile application and does not use web cookies in the traditional technical sense.

The application uses the following technologies with functions similar to cookies:

• Device identifiers for analytics: Firebase Analytics uses application instance identifiers (in pseudonymised form) to collect aggregated usage metrics. These identifiers can be reset from your device settings.
• Push notification tokens (FCM): from Phase 4 of development, the application will register a device token with Firebase Cloud Messaging for push notification delivery. This token can be revoked by disabling notifications from within the application or device settings.

13. Changes to This Policy

Zzmove reserves the right to update this Privacy Policy at any time, in particular to reflect changes in legislation, new Platform features or modifications to provider services.

Material changes will be communicated to users via in-app notification or email with reasonable advance notice before taking effect. The date of the most recent update always appears at the top of this document.

14. Contact

For any enquiries regarding the processing of your personal data or the exercise of your rights, please contact us at: [LEGAL EMAIL].

15. Last Updated

This Privacy Policy was last updated on [DATE].