PART A – General Privacy Information and Shared Services

TANO TRADING LTD OOD
Scope: Website, Web App, iOS App, Android App, and Shared Backend Services
Last updated: 18 October 2026

A.1 Data Controller pursuant to Article 4(7) GDPR

The controller responsible for processing your personal data is:

TANO TRADING LTD OOD (ТАНО ТРЕЙДИНГ ООД)
Company Registration Number (EIK / UIC): 204784209
ul. Hadzhi Dimitr 3
4700 Smolyan
Bulgaria

Privacy Contact: [email protected]

You may submit questions concerning the processing of your personal data and requests to exercise your data protection rights by contacting the email address above or using the "Exercise your data rights" form available in our Legal Center.

The designation of this contact address does not imply that a Data Protection Officer has been appointed within the meaning of Articles 37–39 GDPR.

A.2 Scope and Sources of Personal Data

These general privacy provisions apply to all digital services operated by TANO TRADING insofar as they use our shared account, security, communication, payment, and data infrastructure.

We process personal data obtained from the following sources:

• Information you provide directly when registering, using our services, or contacting us.
• Technical and usage information generated during your interaction with our services.
• Information received from Apple or Google when you choose to use a third-party sign-in method.
• Information provided by other users through place listings, reviews, messages, or content reports.
• Publicly available location and business information, including information obtained from integrated catalog services such as Google Places.

Where personal data has not been obtained directly from the individual concerned, the information obligations under Article 14 GDPR apply. We provide the legally required information within the periods specified in Article 14(3) GDPR unless a statutory exception applies.

Providing optional personal data is generally voluntary. However, certain information, particularly an email address, username, and authentication credentials, is necessary to create and maintain a user account.

Without this information, certain services or features may be unavailable.

A.3 Technical Infrastructure, Hosting, and Cloudflare

A.3.1 Backend and Server Infrastructure

Purpose of Processing: Operating our digital services, storing user and application data, processing API requests, maintaining technical functionality, and preventing unauthorized access.

Categories of Personal Data: IP addresses, request timestamps, technical connection data, API endpoints, session and authentication information, and usage or content data necessary for the requested service.

Legal Basis: Article 6(1)(b) GDPR where processing is necessary to perform a contract or provide requested contractual features; additionally, Article 6(1)(f) GDPR based on our legitimate interest in maintaining secure, reliable, and functional services.

Recipients and International Data Transfers: Our internally operated server infrastructure and, where applicable, technical hosting and infrastructure providers. The specific server locations and any additional hosting processors must be confirmed before publication. Connections routed through Cloudflare are additionally subject to Section A.3.2.

Retention Period: Retention depends on the specific processing activity and the account, content, security, and billing retention periods described below. A specific deletion period for independent server access logs remains to be established.

A.3.2 Cloudflare – DNS, CDN, and DDoS Protection

We use services provided by Cloudflare, Inc., USA, or the relevant Cloudflare contracting entity.

Purpose of Processing: Secure and efficient delivery of our online services, DNS resolution, DDoS mitigation, detection of malicious requests, and protection of our server infrastructure.

Categories of Personal Data: IP addresses, request timestamps, requested hostnames and resources, HTTP request data, browser information, User-Agent strings, security indicators, and security identifiers generated by Cloudflare where applicable.

Legal Basis: Article 6(1)(f) GDPR, based on our legitimate interest in maintaining the security, availability, and integrity of our services. Where access to information on a user's terminal equipment is strictly necessary for security functionality, Section 25(2)(2) TDDDG applies.

Recipients and International Data Transfers: Cloudflare and its contractually engaged subprocessors. Processing in the United States may occur. Cloudflare states that it participates in the EU-US Data Privacy Framework (DPF). Transfers covered by the applicable adequacy decision may rely on Article 45 GDPR. Where applicable, Standard Contractual Clauses under Article 46(2)(c) GDPR may provide additional safeguards.

Retention Period: Data retained on our infrastructure is subject to the applicable backend retention rules. Cloudflare's independent security and access logs are retained according to the applicable contractual and product-specific policies. The exact retention periods for our subscribed Cloudflare services must be verified and added.

Further information: https://www.cloudflare.com/privacypolicy/

A.4 Registration and User Accounts

A.4.1 Registration and Email Verification

Purpose of Processing: Creating and managing user accounts, verifying email addresses, preventing fraudulent registrations, and securing account access.

Categories of Personal Data:

• Username
• Email address
• Password stored exclusively as a cryptographic hash
• Email verification codes and expiration timestamps
• Number of unsuccessful verification attempts
• Registration and account status information

Passwords are not stored in plaintext.

Legal Basis: Article 6(1)(b) GDPR for account registration and provision; Article 6(1)(f) GDPR for preventing account compromise and unauthorized registrations.

Recipients and International Data Transfers: Our authentication and database infrastructure and our self-hosted Mailcow email infrastructure. Our SMTP relay provider also processes information necessary to deliver verification emails. Its identity, hosting location, and international transfer arrangements must be specified.

Retention Period: Account data is retained until the account is deleted, unless a statutory retention obligation applies. Verification codes expire according to their configured validity periods. The subsequent deletion period for expired verification-code records must be confirmed.

A.4.2 Sign in with Apple and Google

If you select a third-party sign-in option, authentication is performed through the respective identity provider.

Purpose of Processing: Simplified and secure registration, authentication, and linking of existing user accounts.

Categories of Personal Data: Identity provider, provider-specific user identifier (Subject ID), transmitted email address, name where provided, and the association with your TANO TRADING account. For Apple authentication, an encrypted refresh token may also be stored.

Legal Basis: Article 6(1)(b) GDPR, as processing is necessary to provide the authentication method selected by you.

Recipients and International Data Transfers:

• Apple for Sign in with Apple
• Google for Sign in with Google
• Our internal authentication infrastructure

Google may process data in the United States. Google LLC is certified under the EU-US Data Privacy Framework. Apple processes data relating to users in the European Economic Area through entities including Apple Distribution International Limited, Ireland, and describes safeguards including Standard Contractual Clauses for relevant international transfers.

Retention Period: Identity links are retained until the authentication method is disconnected or the user account is deleted. Stored Apple refresh tokens are revoked and deleted when the connection is removed or the account is deleted, where technically possible. Independent processing by Apple and Google is governed by their respective privacy policies.

A.4.3 Profile Information, Business Details, and Permissions

Purpose of Processing: Account personalization, provision of business features, management of access rights, Premium subscriptions, testing groups, and community integrity.

Categories of Personal Data: Display name, profile picture or company logo, telephone number, company name, company registration number (EIK), VAT identification number, Premium status, Premium expiration date, test channel, group membership, reputation points and associated notes, and account restrictions with recorded reasons.

Legal Basis: Article 6(1)(b) GDPR for contractual account, business, and Premium services; Article 6(1)(f) GDPR for abuse prevention, permission management, community quality, and traceable moderation decisions.

Recipients and International Data Transfers: Authorized internal systems, personnel, and administrators. Profile information designated as public may be visible to other users. Cloudflare-related infrastructure processing is described in Section A.3.2.

Retention Period: Generally until account deletion. Restriction and moderation data is removed when no longer necessary for legitimate enforcement purposes, unless a documented legal obligation or legal defense requirement justifies continued retention. The specific review period for historical restriction and reputation notes remains to be established.

A.5 Authentication, Sessions, and Account Security

A.5.1 Sessions and Password Recovery

Purpose of Processing: Maintaining secure login sessions, detecting unauthorized access, and restoring account access.

Categories of Personal Data: Hashed session tokens, associated account identifiers, technical session data, expiration timestamps, and hashed password-reset tokens.

Legal Basis: Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. Strictly necessary storage or access to authentication information on terminal equipment is governed by Section 25(2)(2) TDDDG.

Recipients and International Data Transfers: Our authentication infrastructure and, where applicable, Cloudflare as described in Section A.3.2.

Retention Period:

• Regular Web and App sessions: 30-day validity
• Administrator sessions: 12-hour validity
• Automatic deletion of server-side session records: 7 days after expiration
• Password-reset tokens: until successful use or expiration; the exact token validity and subsequent deletion periods must be specified.

A.5.2 Rate Limiting, Automated Attack Prevention, and Abuse Protection

Purpose of Processing: Preventing brute-force attacks, spam, automated misuse, unauthorized access, and infrastructure overload.

Categories of Personal Data: Pseudonymized hash values derived from account, device, or network characteristics, including IP address and User-Agent where applicable, unsuccessful attempt counters, and temporary restriction timestamps.

A hash value is not automatically anonymous merely because the original identifier cannot be readily reconstructed.

Legal Basis: Article 6(1)(f) GDPR, based on our legitimate interest in securing our infrastructure and protecting users. Where terminal-equipment access is strictly necessary, Section 25(2)(2) TDDDG applies.

Recipients and International Data Transfers: Our security infrastructure and, where involved, Cloudflare in accordance with Section A.3.2.

Retention Period: Rate-limit records are deleted after a few minutes or, at the latest, after 48 hours. Failed administrator login counters are retained for 1 hour.

Platform-specific device integrity verification using Apple App Attest and Google Play Integrity is addressed in Part C.

A.6 Published Places and User-Generated Content

A.6.1 Places, Points of Interest, Images, and Routes

Purpose of Processing: Operating a community-based place directory, displaying attractions and establishments, providing navigation, and maintaining accurate place information.

Categories of Personal Data: Place name, address, description, photographs, geographic coordinates, contact person's name, telephone number, email address, author or account association, and timestamps.

Legal Basis: Article 6(1)(b) GDPR for publishing and managing content submitted by users as part of the requested service. Where personal data of third parties or publicly available business contact details are processed, Article 6(1)(f) GDPR may apply, subject to the rights and interests of affected individuals.

Recipients and International Data Transfers: Other users and website visitors where content is publicly displayed, as well as our backend and technical infrastructure. Public information may also be accessed from outside the European Union; such accessibility is distinct from a targeted transfer to a specific third-country recipient.

Retention Period: Place information is retained for as long as the listing is required for the directory. Upon account deletion, personal account associations and personal contact information are removed or anonymized. A specific review period for outdated public listings remains to be established.

You should submit personal information relating to other individuals only where you are legally entitled to do so.

A.6.2 Ratings and Reviews

Purpose of Processing: Enabling public reviews and improving the quality and usefulness of place information.

Categories of Personal Data: Star rating, review text, associated place, internal user identifier, timestamp, and limited public name information.

Publicly displayed names are restricted to the first name component, with a maximum length of 30 characters. Email addresses are never displayed as part of a review.

Displaying a shortened name does not guarantee anonymity.

Legal Basis: Article 6(1)(b) GDPR for providing the review functionality; Article 6(1)(f) GDPR for maintaining the integrity of the review system and preventing misuse.

Recipients and International Data Transfers: Public review information is accessible to other visitors. Internal account associations are restricted to authorized systems and administrators. Infrastructure processing is governed by Section A.3.

Retention Period: Until deletion of the review or the associated user account, subject to legally necessary evidence preservation under Section A.9.

A.7 Visit History

Purpose of Processing: Managing place-visit functionality and displaying previously visited locations.

Categories of Personal Data: User account ID, place ID, and visit timestamp stored in place_visits.

Legal Basis: Article 6(1)(b) GDPR, where processing is necessary for the requested account-based history feature.

Recipients and International Data Transfers: Our backend and database infrastructure. Publication to other users is not intended. Infrastructure transfers are addressed in Section A.3.

Retention Period: Until the individual visit record or user account is deleted. Associated visit records are deleted upon account deletion.

A.8 Direct Messages and Communication Features

Purpose of Processing: Enabling direct communication between users and providing reporting and blocking functionality.

Categories of Personal Data: Sender and recipient identifiers, message content, timestamps, technical delivery information, and relevant blocking or reporting information.

Messages are stored in encrypted form on our servers. This does not necessarily mean that end-to-end encryption is implemented.

Legal Basis: Article 6(1)(b) GDPR for message functionality and Article 6(1)(f) GDPR for enforcing community rules and preventing misuse.

Recipients and International Data Transfers: Intended message recipients and our backend infrastructure. Authorized administrators may access data only where justified by legal or security-related requirements. Infrastructure transfers are governed by Section A.3.

Retention Period: Generally until deletion of the relevant account or message through the available deletion functions. Legally necessary evidence preservation may justify exceptions. Messages associated with a deleted account are removed in accordance with the implemented deletion procedures.

A.9 Content Reports, Moderation, and the Digital Services Act

Purpose of Processing: Handling reports of potentially unlawful content, reviewing user-generated material, documenting moderation decisions, ensuring accountability, and preserving evidence where necessary for establishing, exercising, or defending legal claims.

Categories of Personal Data:

• Reporting person's email address and, where applicable, account association
• Reported content and related user or place information
• Report timestamp and justification
• Preserved content snapshot (content_reports.snapshot)
• Review notes, decisions, reasoning, and notices
• Where applicable, information regarding the affected individual and available remedies

Legal Basis: Article 6(1)(c) GDPR, where specific obligations under applicable law, including Regulation (EU) 2022/2065 (Digital Services Act), apply; additionally, Article 6(1)(f) GDPR for investigating potential violations and defending legal claims. Where special categories of personal data are exceptionally involved, Article 9(2)(f) GDPR may also apply insofar as processing is necessary for legal claims.

Recipients and International Data Transfers: Authorized staff and administrators, legal advisers, courts, law enforcement authorities, and regulatory bodies where legally required or justified. Technical infrastructure is described in Section A.3.

Retention Period: According to the described technical implementation, content reports and evidence snapshots are currently stored without automatic expiration.

However, indefinite retention of every report cannot be justified solely by a general interest in evidence preservation. A documented, case-specific retention and review policy must therefore be established before publication. Relevant criteria include necessity, pending proceedings, applicable limitation periods, and statutory documentation obligations.

Deleting the original user account does not automatically require deletion of an evidence record that must lawfully be retained.

A.10 Place Ownership Verification (Place Claim)

Purpose of Processing: Verifying that a user is authorized to manage a business or place listing and preventing unauthorized ownership claims.

Categories of Personal Data: Video recordings of entrances or premises, uploaded supporting documents, verification codes, account information, place details, and verification status.

Uploaded material may contain identifiable individuals or other personal information visible in images, videos, or documents.

Legal Basis: Article 6(1)(b) GDPR for processing the requested ownership verification; Article 6(1)(f) GDPR for preventing impersonation and unauthorized control over listings.

Recipients and International Data Transfers: Authorized administrators and our file storage and backend infrastructure. Files are maintained in our upload storage. Applicable infrastructure transfers are addressed in Section A.3.

Retention Period: Verification files are physically removed from active upload storage no later than account deletion. An earlier regular deletion period following verification should be defined; the exact period remains outstanding. Encrypted backup copies expire automatically within 56 days.

A.11 Feedback and Product Improvement

Purpose of Processing: Receiving bug reports, improving usability, and evaluating feature suggestions.

Categories of Personal Data: Feedback text, category, star rating, screen or affected feature, operating system, application build, application version, language, device type, and optional email address.

Where users are logged in, feedback may be associated with their accounts. IP addresses are not stored as part of the feedback record.

Legal Basis: Article 6(1)(f) GDPR for improving technical functionality; Article 6(1)(a) GDPR for a voluntarily supplied email address where consent is used for optional follow-up communication.

Recipients and International Data Transfers: Our internal product development and support systems and the infrastructure described in Section A.3.

Retention Period: Until the feedback has been processed and any reasonably necessary follow-up period has ended. A specific deletion period for closed feedback records remains to be established. Data that is no longer required is deleted or irreversibly anonymized.

A.12 Ski Slope Tracking by Authorized Users

Purpose of Processing: Recording, verifying, and updating geographic routes and ski slope information.

Categories of Personal Data: Recorded coordinates, timestamps where available, recording user's account association, and related route information.

This feature is accessible only to authorized recorders and administrators.

Legal Basis: Article 6(1)(b) GDPR, where recording is part of the requested functionality; additionally, Article 6(1)(f) GDPR for maintaining subsequently anonymized route information.

Recipients and International Data Transfers: Our geographic backend services and authorized administrators. Published, sanitized route information may be made available to other users.

Retention Period: Identifiable raw records are retained only as long as necessary for verifying and processing the recorded route. A specific raw-data retention period remains to be established. Upon account deletion, published routes are disconnected from the originating account and personal information is anonymized, provided the remaining information cannot reasonably identify the original user.

A.13 Newsletter, Waiting List, and Beta Applications

A.13.1 Newsletter

Purpose of Processing: Sending voluntarily subscribed updates, product announcements, and marketing communications where applicable.

Categories of Personal Data: Email address, subscription status, double opt-in confirmation, registration and confirmation timestamps, and necessary consent evidence.

Legal Basis: Article 6(1)(a) GDPR, together with applicable electronic marketing requirements. Retention of necessary consent evidence is based on Article 6(1)(c) GDPR, where a legal documentation obligation applies, or Article 6(1)(f) GDPR for defending legal claims.

Recipients and International Data Transfers: Our self-hosted Mailcow infrastructure and SMTP relay provider. The provider's identity and any applicable international transfers must be specified.

Retention Period: Until unsubscribe or withdrawal of consent. Following withdrawal, the email address is removed from the active mailing list. Necessary consent evidence is retained only for the legally justified documentation or defense period; the precise period remains to be established.

A.13.2 Website Waiting List

Purpose of Processing: Managing expressions of interest and notifying users when announced products or services become available.

Categories of Personal Data: Email address, waiting-list status, and double opt-in confirmation records.

Legal Basis: Article 6(1)(a) GDPR.

Recipients and International Data Transfers: Mailcow, the SMTP relay provider, and our internal management systems as described in Section A.13.1.

Retention Period: Until withdrawal of consent or fulfillment of the specified waiting-list purpose. Entries are deleted after the waiting-list purpose ends, except where consent evidence must lawfully be retained.

A.13.3 Beta Applications and Invitation Codes

Purpose of Processing: Reviewing beta applications, selecting and managing test access, and protecting invitation codes against unauthorized or repeated use.

Categories of Personal Data: Name, email address, optional application note, assigned test group or channel, and hashed invitation codes.

Legal Basis: Article 6(1)(b) GDPR for processing requested participation or taking pre-contractual steps; Article 6(1)(f) GDPR for maintaining the integrity of invitation systems.

Recipients and International Data Transfers: Our internal beta management and authentication infrastructure and, where applicable, the email providers described in Section A.13.1.

Retention Period: Until completion of the application process or beta participation, unless the user continues to maintain an account. Specific deletion periods for rejected or unanswered applications and unused invitation-code hashes remain to be established.

A.14 Usage Statistics and Analytics

A.14.1 Internal Web and App Analytics

We operate an internal analytics system (analytics_hits) that does not require analytics cookies.

Purpose of Processing: Measuring usage frequency, analyzing pages and features, and improving our services.

Categories of Personal Data:

• Calendar day and hour
• Requested path
• Referrer
• Language
• Device type
• Country
• Daily rotating pseudonymous visitor identifier

The visitor identifier is derived from the IP address and User-Agent using a salt that rotates every day at 00:00 UTC.

This identifier is not automatically anonymous simply because it does not directly contain the user's name or other obvious identifiers.

We respect Do Not Track (DNT) and Global Privacy Control (GPC) signals in accordance with our technical implementation.

Legal Basis: Article 6(1)(f) GDPR based on our legitimate interest in privacy-conscious audience measurement and technical improvement. Where collection or calculation involves access to terminal-equipment information requiring consent, such access is performed only in accordance with Section 25(1) TDDDG. Analytics based exclusively on ordinary network communication data must be assessed according to their actual technical implementation.

Recipients and International Data Transfers: Our internal analytics systems. We do not intend to disclose these analytics records to external advertising platforms. Infrastructure-related processing under Section A.3 remains possible.

Retention Period: 395 days (13 months), followed by automatic deletion of the personal or pseudonymous analytics records.

A.14.2 Self-Hosted Matomo

Purpose of Processing: Analyzing usage patterns and improving the usability and performance of our digital services.

Categories of Personal Data: Technical HTTP request information, including IP address and User-Agent, and page or usage information processed according to the Matomo configuration.

Matomo is self-hosted and configured without analytics cookies or persistent Matomo visitor identifiers (_id). Technical request data may nevertheless be processed for server-side aggregation.

Legal Basis: Article 6(1)(f) GDPR, provided the implementation remains privacy-conscious, does not use terminal-equipment access requiring consent, and is supported by an appropriate balancing of interests. Otherwise, Article 6(1)(a) GDPR together with Section 25(1) TDDDG applies.

Recipients and International Data Transfers: Our self-hosted Matomo instance. We do not use Matomo Cloud as an external analytics service. Infrastructure processing under Section A.3 remains possible.

Retention Period: A specific retention and automatic deletion period for the self-hosted Matomo database must be established. Genuinely anonymous aggregate statistics may be retained beyond the raw-data retention period.

A.15 Push Notifications

Purpose of Processing: Delivering account-related notifications, service messages, and voluntarily enabled information or announcements.

Categories of Personal Data: Push token, operating system, language, app version, account ID, registration and update timestamps, and notification log information such as title, message body, recipient group, and dispatch timestamp.

Legal Basis: Article 6(1)(b) GDPR for notifications directly connected with requested service functionality; Article 6(1)(a) GDPR for voluntary marketing or other consent-based notifications. Where terminal-equipment access requires consent, Section 25(1) TDDDG also applies.

Recipients and International Data Transfers:

• iOS: Apple Push Notification service (APNs)
• Android: Firebase Cloud Messaging (FCM), operated by Google
• Our backend notification management systems

Google may process data in the United States, and Google LLC participates in the EU-US Data Privacy Framework. Apple may process personal data internationally using the safeguards described in its privacy documentation, including Standard Contractual Clauses where applicable.

Retention Period: Push tokens are retained until the relevant device is deregistered, notification services are withdrawn, or the associated account is deleted. Specific deletion periods for inactive or undeliverable tokens and push_log records remain to be established.

Notification permissions can be disabled in the device's operating system settings. Disabling a system permission does not necessarily cause immediate server-side deletion of the associated push token; this is handled through our deregistration or cleanup processes.

A.16 Payments, Subscriptions, and Premium Services

A.16.1 Subscription and Entitlement Management

Purpose of Processing: Managing subscriptions, Premium status, subscription periods, access entitlements, purchases, passes, and acquired services.

Categories of Personal Data: Account ID, product and subscription information, purchase and transaction identifiers, payment status, contract and validity information, Premium expiration date, and applicable invoice information.

Legal Basis: Article 6(1)(b) GDPR for purchase and contract performance; Article 6(1)(c) GDPR for statutory accounting and tax obligations.

Recipients and International Data Transfers: Our billing and backend infrastructure, applicable payment providers, Apple or Google for in-app purchases, and authorized tax advisers or authorities where necessary.

Retention Period: Contract and entitlement information is processed for the duration of the contractual relationship and as necessary to complete the relevant transaction. Accounting records and tax-relevant documents are retained for 10 years, where this period applies under the relevant legislation to the specific category of record.

A.16.2 Web Payments through the Payment Center

For paid web services, we use our Payment Center at:

https://paymentcenter.tanotrading.com

Purpose of Processing: Processing B2C subscriptions, passes, and other paid services.

Categories of Personal Data: Customer and account association, purchased services, price, currency, payment and contract status, transaction numbers, invoice information, and tax-related details where applicable.

Legal Basis: Article 6(1)(b) GDPR and Article 6(1)(c) GDPR.

Recipients and International Data Transfers: Our Payment Center, associated technical infrastructure providers, and the payment processor actually integrated into the payment system. The payment processor, its role, and applicable international transfer arrangements must be named before publication.

Retention Period: Contract and payment information is retained as necessary to fulfill the relevant transaction and contractual obligations. Tax and accounting records are generally retained for 10 years, subject to the specific requirements of applicable law.

A.17 Server-Side Google Places Integration

Purpose of Processing: Providing, searching, and updating publicly available geographic and business information.

Categories of Personal Data: Place names, search parameters, place identifiers, catalog information, and geographical search areas where applicable.

Requests to Google Places are made through our server-side backend infrastructure. Under the described implementation, users' devices do not establish direct client-side connections to Google Places.

Legal Basis: Article 6(1)(f) GDPR, based on our legitimate interest in maintaining complete and current place information. Where the request is directly necessary to deliver a function requested by the user, Article 6(1)(b) GDPR may additionally apply.

Recipients and International Data Transfers: Google, including Google LLC, USA, or the Google entity responsible for the service. Transfers covered by Google LLC's EU-US Data Privacy Framework certification may rely on the adequacy decision under Article 45 GDPR.

Retention Period: Requests and results are processed only for the relevant search, update, or permitted caching purpose. Specific retention periods must be determined from the actual technical implementation and applicable Google Places terms.

A.18 Email Infrastructure and System Communications

Purpose of Processing: Sending and receiving registration, security, support, reporting, termination, and other transaction-related emails.

Categories of Personal Data: Sender and recipient addresses, subject lines, message content, dispatch timestamps, delivery status, and technically necessary email headers.

Legal Basis: Article 6(1)(b) GDPR where communications are necessary for a contract or requested function; Article 6(1)(c) GDPR where legally required communications are involved; additionally, Article 6(1)(f) GDPR for secure and traceable communication.

Recipients and International Data Transfers: Our self-hosted Mailcow infrastructure, the SMTP relay provider, and the email providers of the recipients. International processing may result from the location of the recipient's email provider or the SMTP relay.

Retention Period: Until the communication purpose has been fulfilled and any applicable statutory retention obligations have expired. Specific deletion periods for mailbox contents and SMTP delivery logs must be established.

A.19 Backups and Data Recovery

Purpose of Processing: Restoring data and services following technical failures, security incidents, or data loss.

Categories of Personal Data: Encrypted backup copies of the relevant datasets, potentially including personal data contained in production systems at the time of backup.

Legal Basis: Article 6(1)(f) GDPR based on our legitimate interest in data security, resilience, and recoverability; additionally, Article 6(1)(c) GDPR in conjunction with applicable statutory security obligations, including Article 32 GDPR, where appropriate.

Recipients and International Data Transfers: Local backup infrastructure and Cloudflare R2 object storage. Backup data is encrypted using rclone crypt. International processing associated with Cloudflare is governed by the safeguards described in Section A.3.2.

Retention Period:

• 14 daily backup versions
• 8 weekly backup versions
• Automatic backup rotation and deletion no later than 56 days

Deleting personal data from our production systems does not immediately modify previously created backup copies. These copies expire within the stated maximum period. Where a backup is restored, deletions completed after its creation must be reapplied.

A.20 Account Deletion

Users may request deletion of their accounts through the available account deletion functionality or by submitting a privacy request.

Our deletion procedures include removing:

• User accounts and associated profile data
• Active and stored sessions
• Linked Apple and Google identities
• Reviews and associated messages
• Visit history
• Push tokens
• Verification and authentication codes
• Personal verification documents from active upload storage

Uploaded place and route information may be retained only where account associations and identifying personal information have been removed and the remaining content is genuinely anonymous.

Account identifiers and personal contact details are deleted or neutralized during this process.

Replacing a user identifier with the value 0 is not sufficient if the remaining data could still identify the original individual.

Exceptions to immediate deletion may include:

• Invoices and accounting records subject to statutory retention requirements
• Content-report evidence lawfully required for defending legal claims
• Encrypted rotating backups retained for a maximum of 56 days

Where necessary, retained records are restricted from use for unrelated purposes.

A.21 Your Data Protection Rights

Subject to the conditions established by applicable law, you have the following rights:

1. Right of Access – Article 15 GDPR: You may request information about the processing of your personal data and obtain a copy of the relevant data.
2. Right to Rectification – Article 16 GDPR: You may request correction of inaccurate information and completion of incomplete information.
3. Right to Erasure – Article 17 GDPR: You may request deletion of your personal data unless a statutory exception applies.
4. Right to Restriction – Article 18 GDPR: You may request restriction of processing under certain circumstances.
5. Right to Data Portability – Article 20 GDPR: You may receive personal data you have provided in a structured, commonly used, machine-readable format where the statutory requirements are satisfied.
6. Right to Object – Article 21 GDPR: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without providing such grounds.
7. Right to Withdraw Consent – Article 7(3) GDPR: You may withdraw previously given consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Requests can be submitted to [email protected] or through the "Exercise your data rights" form in our Legal Center.

We generally respond within one month of receiving a request. This period may be extended under the conditions specified in Article 12(3) GDPR. Where reasonable doubts exist regarding the requester's identity, we may request additional information necessary to verify their identity.

Right to Lodge a Complaint

Under Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, workplace, or the place of the alleged infringement.

The supervisory authority responsible for our registered establishment in Bulgaria is:

Commission for Personal Data Protection (CPDP / КЗЛД)
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia
Bulgaria
Email: [email protected]
Website: https://www.cpdp.bg/

A.22 Automated Decision-Making and Profiling

Our systems may perform automated security checks, rate limiting, device integrity verification, authorization checks, and statistical analysis.

Based on the technical implementation described here, we do not intend to make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them within the meaning of Article 22 GDPR.

Automated security and risk assessments may nevertheless lead to technical restrictions. Permanent or substantially adverse measures must remain reviewable in accordance with applicable legal requirements.

Advertising-related profiling by third parties, where used, is permitted only where the relevant legal requirements and necessary consent conditions have been satisfied.

A.23 International Data Transfers

We transfer personal data outside the European Economic Area only where an appropriate legal basis exists under Chapter V GDPR.

Relevant transfer mechanisms include:

• Article 45 GDPR: Adequacy decisions, including the EU-US Data Privacy Framework for appropriately certified recipients.
• Article 46 GDPR: Appropriate safeguards, particularly the European Commission's Standard Contractual Clauses.
• Additional technical and organizational safeguards where necessary.

A company's certification can only be relied upon for the specific legal entity and processing activities covered by that certification.

You may request information about applicable safeguards and how to obtain a copy by contacting [email protected].

A.24 Technical and Organizational Security Measures

We implement technical and organizational measures appropriate to the risks associated with the processing of personal data.

The described safeguards include:

• Cryptographic password hashing
• Hashed authentication and session tokens
• Encrypted storage of selected authentication credentials
• Restricted administrative access
• Device integrity verification
• Rate limiting and abuse detection
• Encrypted backups
• Separation of user roles and access permissions
• Automated expiration and deletion mechanisms

Absolute protection against security incidents cannot be guaranteed.

A.25 Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in legal requirements or actual data processing activities.

Where changes are material, we will provide appropriate notice.

The version published in our Legal Center at the relevant time is the applicable version.

PART B – Website and Web App Privacy Information

TANO TRADING LTD OOD
Scope: Website, browser-based applications, and web services
Last updated: 18 October 2026

This section supplements the general privacy provisions in Part A. Parts A and B together constitute the Privacy Policy for our Website and Web App.

B.1 Website Access and Technical Connection Data

When you access our Website, certain technical information is processed to deliver the requested content.

Purpose of Processing: Providing the Website, establishing network connections, transmitting requested content, diagnosing technical errors, and securing our web servers.

Categories of Personal Data: IP address, access date and time, requested URL or resource, HTTP method, HTTP status code, amount of data transferred, User-Agent, browser and operating system information, and Referrer where applicable.

Legal Basis: Article 6(1)(f) GDPR, based on our legitimate interest in operating a secure and functional Website; additionally, Article 6(1)(b) GDPR for contractually required Web App functionality.

Recipients and International Data Transfers: Our web servers and backend infrastructure, as well as Cloudflare acting as an upstream infrastructure and security provider. International transfers are governed by Part A.3.

Retention Period: Data is processed for as long as technically necessary. Where independent server logs are stored, a specific automatic deletion period must be established. The separate pseudonymous usage statistics are subject to the 395-day retention period described in Part A.14.

B.2 Cookies, Local Storage Technologies, and Consent Management

We distinguish between strictly necessary storage and access operations and optional technologies used for analytics, advertising, and additional features.

B.2.1 Strictly Necessary Technologies

Purpose of Processing: Maintaining authenticated sessions, storing essential security and session settings, and providing features explicitly requested by users.

Categories of Personal Data: Session identifiers, authentication information, necessary security identifiers, and functional settings.

Legal Basis: Article 6(1)(b) GDPR or Article 6(1)(f) GDPR; strictly necessary storage or access to information on terminal equipment is governed by Section 25(2)(2) TDDDG.

Recipients and International Data Transfers: Our backend infrastructure and, where applicable, Cloudflare as described in Part A.3.

Retention Period: Regular server-side sessions remain valid for 30 days and are deleted 7 days after expiration. Individual browser storage entries follow their technically configured lifetimes. A complete inventory of actual storage keys and their expiration periods must be included in the Consent Center.

B.2.2 Consent Management

Purpose of Processing: Obtaining, managing, technically enforcing, and documenting user privacy preferences.

Categories of Personal Data: Granted or refused consents, selected purposes, consent timestamps, version of the consent interface, and any identifiers necessary to document consent.

Legal Basis: Article 6(1)(c) GDPR, in connection with applicable accountability and documentation obligations; additionally, Article 6(1)(f) GDPR for legitimate evidentiary purposes. Strictly necessary storage of your privacy preferences on your device is governed by Section 25(2)(2) TDDDG.

Recipients and International Data Transfers: Our own consent management system. Information is shared with external advertising providers only to the extent necessary for the advertising and consent functions actually activated.

Retention Period: Your preferences are stored until they are changed or the configured consent validity period expires. Necessary consent evidence may be retained for a longer legally justified period. The exact retention periods must be established.

Optional technologies are activated only where the required consent has been obtained.

You may change or withdraw your consent at any time through the Privacy Settings in our Legal Center or Consent Center.

Refusing optional consent does not prevent access to essential Website functionality.

B.3 Internal Analytics and Matomo

We use our own analytics solution and a self-hosted Matomo instance to understand how our Website is used.

Purpose of Processing: Audience measurement, technical improvement, and statistical evaluation of our services.

Categories of Personal Data: Visit day and hour, path, Referrer, language, device type, country, daily pseudonymous visitor identifier, and technical IP address and User-Agent data processed by Matomo.

Legal Basis: Article 6(1)(f) GDPR where the implementation is legally permissible, privacy-conscious, and does not involve terminal-equipment access requiring consent. Otherwise, Article 6(1)(a) GDPR, together with Section 25(1) TDDDG, applies.

Recipients and International Data Transfers: Our internal analytics systems and self-hosted Matomo installation; Cloudflare may process technical transmission data.

Retention Period: Records in our own analytics system are deleted after 395 days. The retention period for Matomo must be established.

Our analytics setup does not rely on analytics cookies and respects technically detected DNT and GPC signals.

Further information is provided in Part A.14.

B.4 Google AdSense – Website Advertising

We use Google AdSense to help finance free Website features.

Purpose of Processing: Delivering advertisements, financing free services, potentially personalizing advertisements, managing advertising frequency, detecting invalid advertising interactions, and measuring advertising performance.

Categories of Personal Data: Depending on the consent provided, Google may process IP addresses, browser and device information, viewed pages, advertising interactions, cookies, local identifiers, and advertising interest information.

Legal Basis: Article 6(1)(a) GDPR and Section 25(1) TDDDG for advertising technologies requiring consent. Other legal bases relied upon by Google for its independently controlled processing are described in Google's applicable privacy information and the purposes presented in the consent interface.

Recipients and International Data Transfers: Google Ireland Limited, Ireland, Google LLC, USA, and other advertising technology partners identified in the consent management system where applicable. Transfers to Google LLC covered by its certification may rely on the EU-US Data Privacy Framework under Article 45 GDPR.

Retention Period: Retention by Google depends on the advertising technologies in use and the durations disclosed through the consent management system. These periods must be verified against the cookies and identifiers actually used. Users may withdraw locally recorded advertising consent at any time.

Our Advertising Principles

• Google AdSense is not integrated into legal information pages, including this Privacy Policy and other mandatory legal notices.
• Logged-in Premium subscribers do not receive Google AdSense advertisements.
• Google advertising scripts requiring consent are not activated before the necessary permission is granted.
• Non-personalized advertisements may be delivered where the required consent for any cookies or identifiers used has been obtained.
• Where consent-dependent advertising technologies are rejected, those technologies are not loaded. Any technically possible form of highly restricted advertising without consent requires a separate legal and technical assessment.

Privacy preferences can be changed through the Consent Center.

Further information: https://policies.google.com/privacy

B.5 Optional Browser Fingerprinting

We offer a separate optional consent setting called "Count Google searches more accurately".

Without this consent, we do not perform active Canvas, WebGL, or screen-based fingerprinting for the additional counting function described below.

Purpose of Processing: Improving the statistical counting and differentiation of search events when this feature is enabled by the user.

Categories of Personal Data: Browser and display characteristics, Canvas and WebGL properties, screen configuration, and resulting hash or recognition values.

Without consent, the function is limited to permissible passive network characteristics. No active device fingerprint is calculated.

Legal Basis: Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Recipients and International Data Transfers: Our own analytics and backend infrastructure. Under the described implementation, browser fingerprints are not directly transmitted to Google. The name of the function does not imply that fingerprint data is sent to Google.

Retention Period: A specific period for deleting or regenerating fingerprint hashes remains to be established. After withdrawal, previously collected identifiers may not continue to be used for recognition without an independent legal basis.

Consent may be withdrawn through the Consent Center at any time.

B.6 Cloudflare Turnstile – Form Protection

We use Cloudflare Turnstile on selected forms and security-sensitive interactions.

Purpose of Processing: Distinguishing legitimate interactions from automated access and protecting forms against spam, account attacks, and abusive submissions.

Categories of Personal Data: IP address, User-Agent, technical browser and interaction characteristics, information associated with the security verification, and necessary verification identifiers.

Legal Basis: Article 6(1)(f) GDPR, based on our legitimate interest in protecting our forms and technical infrastructure. Where access to information on terminal equipment is strictly necessary for the expressly requested protected service, Section 25(2)(2) TDDDG may apply. Non-essential terminal-equipment access requires separate consent.

Recipients and International Data Transfers: Cloudflare, Inc., or the relevant Cloudflare entity. Possible transfers to the United States are described in Part A.3.2.

Retention Period: Security information is processed according to the applicable Cloudflare Turnstile configuration and product-specific retention rules. The specific retention period must be verified before publication.

B.7 OpenStreetMap and Leaflet Maps

We use Leaflet with map data or map tiles provided by the OpenStreetMap Foundation (OSMF).

External map tiles are loaded only after the user actively authorizes the map connection through a preceding dialog.

Purpose of Processing: Displaying interactive maps, geographic places, routes, and location-based information.

Categories of Personal Data: IP address, technical request information, User-Agent, Referrer, requested map regions, and zoom levels.

Legal Basis: Article 6(1)(a) GDPR for voluntary authorization of the external map connection; Section 25(1) TDDDG for terminal-equipment access requiring consent.

Recipients and International Data Transfers: OpenStreetMap Foundation, United Kingdom. The European Commission has adopted an adequacy decision for the United Kingdom under Article 45 GDPR.

Retention Period: We do not independently store the direct connection data processed by OSMF as a separate map usage history. The map provider's privacy and retention rules apply to its technical logs. Any local map cache or stored map authorization must be assigned a retention period based on the actual implementation.

Further information: https://osmfoundation.org/wiki/Privacy_Policy

B.8 Web Search, Routes, and Location Features

Purpose of Processing: Searching for places, calculating routes, displaying destinations, and providing geographical information.

Categories of Personal Data: Search terms, selected places, starting and destination coordinates or entered addresses, and technical information necessary for the respective request.

Legal Basis: Article 6(1)(b) GDPR for the explicitly requested search or routing function. Additional requirements under Section 25 TDDDG must be considered where a voluntary device location function is accessed.

Recipients and International Data Transfers: Our geographical backend services and, depending on the requested function, Photon and OSRM services accessed through our backend. The specific operators and server locations of the external Photon and OSRM instances must be identified. OSMF may additionally receive information if the user separately authorizes external map tiles.

Retention Period: Routing and search responses are cached for up to 24 hours. Cache keys are generated from hashed coordinates. Independent server access logs, where maintained, are subject to the retention rules still to be established under Section B.1.

Where you explicitly save visits or other account-related information, the corresponding provisions in Part A also apply.

B.9 Web Error Reporting through GlitchTip

We use a self-hosted GlitchTip instance based on Sentry technology for our Web App.

Purpose of Processing: Detecting, investigating, and correcting technical errors and application failures.

Categories of Personal Data: Error type, stack trace, technical browser and operating system information, application version, timestamp, and relevant technical context information.

Our configuration uses sendDefaultPii = false.

Screenshots are not submitted to GlitchTip. URLs are transmitted without query parameters.

Legal Basis: Article 6(1)(f) GDPR, based on our legitimate interest in identifying and correcting errors and maintaining a functional online service. This legal basis does not automatically cover additional terminal-equipment access requiring consent.

Recipients and International Data Transfers: Our self-hosted GlitchTip instance and authorized developers or administrators. Infrastructure processing is governed by Part A.3.

Retention Period: Error reports are retained for the time necessary to investigate the issue and for an appropriate technical verification period. The exact automatic deletion period for our GlitchTip instance remains to be established.

B.10 Forms, User Accounts, and Web Payments

Our Web App enables users to manage accounts, publish content, submit feedback, subscribe to newsletters or waiting lists, exercise privacy rights, and purchase paid services.

Purpose of Processing: Providing the requested function and communicating with the user.

Categories of Personal Data: Information submitted through the relevant form, associated account information, and necessary technical security data.

Legal Basis: Depending on the functionality, Article 6(1)(a), (b), (c), or (f) GDPR, as specified for each relevant processing activity in Part A.

Recipients and International Data Transfers: Our backend infrastructure, Mailcow, SMTP relay, Cloudflare, and, where applicable, external identity providers and payment service providers. Further details are provided in Part A.

Retention Period: According to the specific functionality and retention periods described in Part A. Statutory accounting requirements apply to relevant invoice and transaction records.

B.11 Locally Hosted Fonts and Scripts

The fonts used by our Website and our regular first-party application scripts are hosted locally.

No connection to Google Fonts or any other external font CDN is established to provide these resources.

Technically necessary requests for locally hosted resources are processed according to Section B.1.

Separately described third-party features, particularly advertising, maps, and bot protection, remain subject to their respective privacy provisions.

PART C – Mobile Application Privacy Information

TANO TRADING LTD OOD
Scope: iOS App and Android App
Last updated: 18 October 2026

This section supplements the general privacy information contained in Part A.

The following provisions distinguish between data processing activities common to both mobile platforms and technologies specific to each operating system.

• C.0: Processing activities common to both mobile applications
• C.1: iOS-specific processing activities
• C.2: Android-specific processing activities

C.0 Processing Activities Common to Both Mobile Applications

C.0.1 Location Processing, Nearby Search, and Navigation

Our mobile applications offer location-based features, including nearby search, route calculation, navigation, and geographic route recording for authorized users.

Purpose of Processing: Displaying nearby places, calculating routes, providing active navigation, and delivering location-based information.

Categories of Personal Data:

• Current geographic coordinates
• Precise or approximate location, depending on the permission granted
• Entered or selected starting points and destinations
• Destination coordinates
• Selected transportation modes and routing preferences
• Technical request and functionality information
• Geographic coordinates recorded during authorized ski slope tracking

Location processing depends on the system permissions granted and the specific functionality being actively used.

Legal Basis: Article 6(1)(b) GDPR, where processing is necessary to provide a location-based feature requested by the user. For additional optional location processing, Article 6(1)(a) GDPR applies.

Where access to location information on terminal equipment falls within the scope of Section 25 TDDDG, Section 25(2)(2) TDDDG applies if access is strictly necessary to provide the expressly requested feature. Otherwise, consent under Section 25(1) TDDDG is required.

Granting an operating system permission does not automatically replace every legally required consent under data protection law.

Recipients and International Data Transfers: Our backend infrastructure and the Photon and OSRM services used for geographic search and routing.

Requests to /geo/route, /geo/search, and /transit/plan are processed through our backend infrastructure.

The specific operators and server locations of external Photon and OSRM instances must be identified.

Where operating system-specific map providers are used, information may additionally be transmitted to Apple or OpenStreetMap as described in Sections C.1 and C.2.

Retention Period: Routing and geographic search responses are cached for 24 hours. Cache keys are generated from hashed coordinates.

Permanent storage of complete navigation histories is not intended for ordinary routing functions. Separately saved visit records and authorized ski slope recordings are governed by Parts A.7 and A.12.

Location permissions may be changed or withdrawn at any time through the operating system settings.

C.0.2 Regional Country Detection

Purpose of Processing: Determining the relevant country or region, selecting country-specific application functionality, and managing regional service availability.

Categories of Personal Data: Country code derived from location data, location information required for local country detection, and technical request information.

On iOS, the country is determined through the iOS geocoder.

For this function, our API receives only the country code through the X-Region header, rather than the precise geographic coordinates used for determining the country.

Legal Basis: Article 6(1)(b) GDPR for providing region-specific application functionality; additionally, Article 6(1)(f) GDPR for maintaining appropriate and reliable regional service configuration.

Recipients and International Data Transfers: Our backend infrastructure. Where the operating system's geocoding service communicates with Apple or Google services, the provider's applicable privacy information and international transfer mechanisms also apply.

Retention Period: The country code is processed for the relevant regional request. Permanent storage of a precise location history for this feature is not intended. The retention period for any regional request logs remains to be established.

C.0.3 Destination Analytics

We operate a privacy-conscious destination analytics feature to improve our navigation and place services.

Purpose of Processing: Analyzing destination preferences, destination categories, and transportation modes to improve geographic information and routing features.

Categories of Personal Data: Destination, destination category or type, and selected transportation mode.

The starting location and a user identifier are not stored as part of the destination analytics record.

Address-related information is generalized to a spatial resolution of approximately 1 kilometer.

Legal Basis: Article 6(1)(f) GDPR, provided processing is necessary to produce privacy-conscious, non-identifying usage statistics and is not overridden by the rights or interests of the individuals concerned.

Recipients and International Data Transfers: Our internal analytics infrastructure. Individualized destination statistics are not intended to be disclosed to advertising providers.

Retention Period: Genuinely anonymized aggregate data that can no longer be linked to an individual may be retained without a personal-data retention limit. Where information remains personal data during collection or intermediate processing, a specific deletion period for those intermediate records must be established.

Geographic generalization to a one-kilometer grid does not, by itself, guarantee that data is anonymous.

C.0.4 Diagnostic Requests from Restricted Regions

If the application is accessed from a region where certain functionality is unavailable, diagnostic information may be collected to investigate regional restrictions.

Purpose of Processing: Investigating regional availability issues, detecting misuse, and diagnosing technical problems.

Categories of Personal Data: Device identifier or device number, geographic location, diagnostic timestamp, and information relating to the regional restriction.

Legal Basis: Article 6(1)(f) GDPR may apply only where transmitting the specific device and location information is necessary, proportionate, and supported by a documented legitimate security or diagnostic interest that is not overridden by the individual's rights.

For additional transmission of precise location data beyond what is strictly necessary, Article 6(1)(a) GDPR, together with the applicable requirements under Section 25 TDDDG, must be considered.

Recipients and International Data Transfers: Authorized administrators and our secured backend infrastructure only. Infrastructure-related processing is governed by Part A.3.

Retention Period: Automatic deletion no later than 90 days after collection.

Automatic transmission of precise coordinates together with a persistent device identifier, without prior consent, requires a separate assessment of necessity and proportionality.

Until that assessment has been completed, processing must be restricted to information necessary for the diagnostic purpose.

C.0.5 Mobile Usage Analytics

Purpose of Processing: Improving application functionality, measuring usage, and identifying general usage patterns.

Categories of Personal Data: Day, hour, application feature path, language, device type, country, Referrer where applicable, and the daily rotating pseudonymous visitor identifier generated by our internal analytics system.

Legal Basis: Article 6(1)(f) GDPR for legally permissible privacy-conscious analytics. Where information is accessed on the user's device in a manner requiring consent, Article 6(1)(a) GDPR, together with Section 25(1) TDDDG, applies.

Recipients and International Data Transfers: Our internal analytics infrastructure and the technical infrastructure described in Part A where applicable.

Retention Period: Internal pseudonymous analytics records are automatically deleted after 395 days.

Additional information is provided in Part A.14.

C.0.6 Accounts, User Content, and Shared Backend Functionality

Both mobile applications use our shared backend infrastructure for user accounts, profiles, places, reviews, direct messages, feedback, ownership verification, and selected Premium features.

Purpose of Processing: Providing consistent functionality across devices and operating systems.

Categories of Personal Data: The account, content, communication, history, and transaction information described in Part A, depending on the functionality used.

Legal Basis: Article 6(1)(b), (c), or (f) GDPR, depending on the relevant function; Article 6(1)(a) GDPR where processing requires consent.

Recipients and International Data Transfers: Our backend services, Cloudflare, and the authentication, payment, or communication providers identified in Part A where applicable.

Retention Period: The specific retention periods described in Part A apply, particularly those concerning account deletion and backups.

C.1 Additional Privacy Information for the iOS Application

C.1.1 Location Permission and Background Navigation

Our iOS application may request the "While Using the App" location permission.

The Location and Audio background modes are configured to support active turn-by-turn navigation.

Purpose of Processing: Nearby search, route guidance, active navigation, necessary background functionality, and audible navigation instructions where applicable.

Categories of Personal Data: Current location, position and movement changes during active navigation, requested route, navigation status, and technical information required for navigation audio output.

Legal Basis: Article 6(1)(b) GDPR for the navigation service requested by the user. Optional additional location processing is based on Article 6(1)(a) GDPR. Terminal-equipment access is subject to Section 25 TDDDG according to the necessity of the specific function.

Recipients and International Data Transfers: Our routing backend infrastructure and, where applicable, Apple through iOS location and mapping services. Apple may process personal data internationally and describes safeguards including Standard Contractual Clauses.

Retention Period: Location information is processed while the relevant location or navigation feature is active. Backend routing responses are cached for 24 hours.

Permanent storage of complete navigation histories outside separately activated recording features is not intended.

Permissions can be changed at any time under iOS Settings → Privacy & Security → Location Services.

The presence of a background mode does not mean that the application is intended to create permanent movement profiles independently of active navigation.

C.1.2 Apple MapKit

Purpose of Processing: Displaying maps, enabling geographic search, and supporting location-based navigation.

Categories of Personal Data: Displayed map region, search queries, selected places, location where applicable, starting points, destinations, route requests, and technical device information.

Legal Basis: Article 6(1)(b) GDPR for requested mapping and navigation services. Article 6(1)(a) GDPR may additionally apply to voluntary location features.

Recipients and International Data Transfers: Apple, including Apple Distribution International Limited, Ireland, and affiliated Apple entities. Apple may process data in the United States; international transfers are governed by its relevant privacy policies and safeguards, including Standard Contractual Clauses where applicable.

Retention Period: Processing through the iOS application occurs while the relevant map functionality is being used. Apple's independent retention practices are described in its Apple Maps privacy information and the terms applicable to its services.

Further information: https://www.apple.com/legal/privacy/data/en/apple-maps/

C.1.3 Sign in with Apple and Google Sign-In

Purpose of Processing: Offering alternative sign-in methods and securely linking external identities to user accounts.

Categories of Personal Data: Identity provider, Subject ID, transmitted email address, name where available, and an encrypted Apple refresh token where applicable.

Legal Basis: Article 6(1)(b) GDPR.

Recipients and International Data Transfers: Apple or Google, depending on the authentication option selected. International processing is described in Part A.4.2.

Retention Period: Until the sign-in method is disconnected or the user account is deleted. Apple refresh tokens are revoked and deleted upon disconnection or account deletion.

C.1.4 Apple App Attest

Purpose of Processing: Verifying the authenticity of our iOS application, detecting manipulated clients, and protecting security-sensitive API requests.

Categories of Personal Data: Cryptographic attestations generated by Apple App Attest, attestation-related identifiers, technical verification results, and any necessary association with an app installation or session.

Legal Basis: Article 6(1)(f) GDPR, based on our legitimate interest in preventing application manipulation and fraudulent access. Strictly necessary terminal-equipment access is governed by Section 25(2)(2) TDDDG.

Recipients and International Data Transfers: Apple through the attestation service and our backend security infrastructure. International processing by Apple may occur.

Retention Period: Attestation information is processed for the technical verification and security purpose. A specific retention period for stored server-side attestation identifiers must be established. Temporary rate-limit information is deleted within 48 hours in accordance with Part A.5.2.

C.1.5 Apple StoreKit 2 – In-App Purchases

Purpose of Processing: Processing, validating, associating, and managing purchases of paid features and subscriptions.

Categories of Personal Data: Apple transaction identifier, product identifier, purchase and expiration timestamps, transaction status, appAccountToken, and refund or cancellation information where applicable.

These records are processed in apple_transactions where necessary.

Legal Basis: Article 6(1)(b) GDPR for purchase and contract performance; Article 6(1)(c) GDPR for legally required record retention.

Recipients and International Data Transfers: Apple as the App Store and in-app purchase operator, and our backend and billing infrastructure. Apple's international processing is governed by its applicable privacy and international transfer provisions.

Retention Period: Transaction information is retained for as long as necessary to manage and verify purchased services. Tax-relevant accounting documents are generally retained for 10 years, in accordance with the applicable statutory requirements.

App Store subscriptions can be managed through the subscription settings of your Apple Account.

C.1.6 Google AdMob, Google UMP, and App Tracking Transparency

Our iOS application may display advertising through Google AdMob.

For managing data protection consent in the European Economic Area and the United Kingdom, we use the Google User Messaging Platform SDK (UMP).

Where tracking within the meaning of Apple's requirements is performed, we also request permission through App Tracking Transparency (ATT).

The application declares NSPrivacyTracking = true.

Purpose of Processing: Financing free functionality, delivering advertisements, potentially personalizing ads, measuring advertising performance, detecting fraud, and managing associated consent decisions.

Categories of Personal Data: Depending on consent and SDK configuration, IP address, device and application information, advertising identifier (IDFA), technical advertising identifiers, advertising interactions, consent status, and other information used for personalized advertising where applicable.

Legal Basis: Article 6(1)(a) GDPR and Section 25(1) TDDDG for advertising and tracking activities requiring consent. Other legal bases may apply to separately identified, strictly necessary security processing, provided their requirements are satisfied.

Recipients and International Data Transfers: Google Ireland Limited, Google LLC, and advertising partners identified in the UMP consent interface where applicable.

Transfers to Google LLC in the United States that are covered by its certification may rely on the EU-US Data Privacy Framework under Article 45 GDPR.

Retention Period: Retention of advertising identifiers and advertising data depends on the technologies used and the information provided in the UMP interface. The relevant SDK and consent retention periods must be confirmed before publication.

The following principles apply:

• Premium subscribers do not receive AdMob advertisements.
• Advertising activities requiring consent are activated only in accordance with the applicable consent decisions.
• ATT permission does not replace consent required under the GDPR.
• Refusal of ATT permission is not circumvented through alternative tracking methods.
• Personalized advertising activities requiring consent are not activated without the necessary permission.

ATT settings may be changed under iOS Settings → Privacy & Security → Tracking.

Other consent preferences may be changed using the application's available privacy settings.

C.1.7 iOS App Privacy – Data Categories

Based on the technical information provided, the following data categories are relevant to the privacy disclosures in the Apple App Store.

Data Categories Declared as Linked to the User's Identity:

• Email address
• Name
• User ID
• Purchase history
• Telephone number
• User-uploaded media
• Precise location

Data Categories Declared as Not Linked to the User's Identity:

• Approximate location
• Search history
• Diagnostic data

The classification of data as linked to an individual's identity does not automatically mean that every listed category is transmitted to Google AdMob.

The actual use of information for advertising or tracking purposes depends on the implementation and the consent provided.

The purpose classifications disclosed in the App Store, particularly those concerning advertising and tracking, must accurately reflect the application's SDK configurations and actual data flows.

C.1.8 iOS Error Reporting through GlitchTip

Purpose of Processing: Detecting application crashes, investigating technical errors, and improving stability.

Categories of Personal Data: Error type, stack trace, device and operating system information, app version, timestamp, and relevant technical diagnostic context.

Our GlitchTip configuration uses sendDefaultPii = false.

Screenshots are not transmitted. URLs are processed without query parameters.

Legal Basis: Article 6(1)(f) GDPR, based on our legitimate interest in maintaining a secure and stable application.

Recipients and International Data Transfers: Our self-hosted GlitchTip instance and authorized developers or administrators. Technical infrastructure processing is described in Part A.3.

Retention Period: Error records are kept for the investigation period and an appropriate subsequent verification period. The exact GlitchTip deletion period remains to be established.

C.1.9 Apple Push Notification Service (APNs)

Purpose of Processing: Delivering enabled push notifications to iOS devices.

Categories of Personal Data: APNs push token, app and device association, language, app version, and necessary notification content.

Legal Basis: Article 6(1)(b) GDPR for requested service-related notifications; Article 6(1)(a) GDPR for voluntary or promotional notifications, subject to any additional requirements under Section 25 TDDDG.

Recipients and International Data Transfers: Apple Push Notification service and our notification backend infrastructure. International processing by Apple is subject to its applicable privacy provisions.

Retention Period: Push tokens are retained until deregistration, account deletion, or technical cleanup. A specific retention period for notification delivery logs remains to be established. Part A.15 also applies.

C.2 Additional Privacy Information for the Android Application

C.2.1 Android Location Permissions and Foreground Service

Our Android application may request access to approximate and precise location.

A Foreground Service may be used to provide ongoing navigation guidance.

Purpose of Processing: Nearby search, active navigation, route guidance, and geographic recording for authorized users.

Categories of Personal Data: Approximate or precise location depending on permissions, position changes during active navigation, navigation status, and recorded route coordinates where applicable.

Legal Basis: Article 6(1)(b) GDPR for requested navigation functionality. Additional optional location processing is based on Article 6(1)(a) GDPR. Terminal-equipment access is subject to Section 25(1) or Section 25(2)(2) TDDDG, as applicable to the particular feature.

Recipients and International Data Transfers: Our backend infrastructure and, where applicable, integrated routing and geographic service providers. Details are provided in Section C.0.1.

Retention Period: Processing takes place during the relevant location or navigation functionality. Backend routing responses are cached for 24 hours. Separately stored route recordings are subject to the feature-specific retention rules in Part A.

Permissions may be changed through Android's application and location permission settings.

The use of a Foreground Service supports continuous navigation but does not mean that the application is intended to store a movement history independently of active use.

C.2.2 MapLibre and OpenStreetMap Maps

Our Android application uses MapLibre to display interactive maps and obtains map tiles from the OpenStreetMap Foundation.

Purpose of Processing: Displaying maps, supporting geographic orientation, and providing visual navigation and place information.

Categories of Personal Data: IP address, technical request information, User-Agent, requested map regions, and zoom levels.

Legal Basis: Article 6(1)(b) GDPR where map transmission is necessary for an expressly requested functionality. Article 6(1)(a) GDPR, together with Section 25(1) TDDDG, may be required for optional or non-essential external map and terminal-equipment access.

Recipients and International Data Transfers: OpenStreetMap Foundation, United Kingdom. The United Kingdom benefits from an adequacy decision under Article 45 GDPR.

Retention Period: Map data is processed for display and, where permitted, local caching. Technical server logs maintained by OSMF are subject to its privacy provisions. Specific local cache retention periods must be established according to the app configuration.

MapLibre itself is a software library. External data transfers primarily arise when requests are made to the configured map tile provider.

C.2.3 Google Play Integrity

Purpose of Processing: Detecting modified application versions, preventing automated attacks, securing API functionality, and reducing fraudulent use.

Categories of Personal Data: Integrity tokens and verification results provided by Google Play Integrity, together with technical information necessary for server-side verification.

Legal Basis: Article 6(1)(f) GDPR, based on our legitimate interest in application security, fraud prevention, and service integrity. Strictly necessary terminal-equipment access is governed by Section 25(2)(2) TDDDG.

Recipients and International Data Transfers: Google Ireland Limited, Google LLC, and our backend security infrastructure. Transfers to Google LLC covered by its certification may rely on the EU-US Data Privacy Framework under Article 45 GDPR.

Retention Period: Integrity information is processed during the verification operation. The retention period for separately stored verification results must be established. Temporary rate-limit records are deleted according to the periods specified in Part A.5.2.

C.2.4 Google Play Billing – Purchases and Credits

Purpose of Processing: Processing purchases, managing subscriptions, verifying purchase entitlements, and managing acquired credits where applicable.

Categories of Personal Data: Google Play transaction and purchase identifiers, product identifiers, purchase timestamps, purchase status, subscription information, account association, and credit balances or usage information.

The information is processed in google_play_purchases and google_credits where necessary.

Legal Basis: Article 6(1)(b) GDPR for contract performance; Article 6(1)(c) GDPR for tax and accounting obligations.

Recipients and International Data Transfers: Google as the Google Play billing operator and our backend and billing infrastructure.

International transfers may involve Google LLC. Where covered by its certification, transfers may rely on the EU-US Data Privacy Framework.

Retention Period: Purchase and credit records are retained as necessary to manage contractual rights and entitlements. Accounting records subject to statutory retention obligations are generally retained for 10 years, in accordance with applicable law.

Subscriptions can be managed through Google Play's subscription management settings.

C.2.5 Google AdMob and Google UMP

Our Android application uses Google AdMob to display advertisements and the Google UMP SDK to obtain and manage required consent.

Purpose of Processing: Financing free application features, displaying advertisements, potentially personalizing advertising, measuring advertising performance, and managing consent.

Categories of Personal Data: Depending on consent, IP address, device information, app version, advertising identifier, technical advertising identifiers, advertising interactions, consent status, and additional information used for personalized advertising where applicable.

Legal Basis: Article 6(1)(a) GDPR and Section 25(1) TDDDG for advertising technologies requiring consent. Separate, strictly necessary security processing may rely on other legal bases where their requirements are fulfilled.

Recipients and International Data Transfers: Google Ireland Limited, Google LLC, and additional advertising partners identified in the UMP interface where applicable.

Transfers to Google LLC covered by its certification may rely on the EU-US Data Privacy Framework under Article 45 GDPR.

Retention Period: Retention depends on the advertising and consent technologies used. The actual retention periods and technical identifiers must be verified against the AdMob and UMP configuration before publication.

Premium users do not receive AdMob advertisements.

Consent can be changed or withdrawn through the available privacy settings.

Personalized advertising activities requiring consent are not activated without the necessary permission.

C.2.6 Firebase Cloud Messaging (FCM)

Purpose of Processing: Delivering push notifications to Android devices.

Categories of Personal Data: FCM registration token, platform, language, app version, associated account where applicable, dispatch information, and notification content.

Legal Basis: Article 6(1)(b) GDPR for requested service-related notifications; Article 6(1)(a) GDPR for voluntary or promotional notifications. Additional requirements under Section 25 TDDDG may apply.

Recipients and International Data Transfers: Google or Firebase and our backend infrastructure. Processing in the United States may occur. Google LLC is certified under the EU-US Data Privacy Framework.

Retention Period: Registered push tokens are retained until deregistration, account deletion, or technical cleanup. The retention periods for notification delivery logs and inactive tokens remain to be established.

Part A.15 also applies.

C.2.7 Firebase Crashlytics – Android Error Diagnostics

We use Firebase Crashlytics by Google to identify technical application crashes.

Crashlytics is enabled only in Release builds.

Purpose of Processing: Detecting crashes, diagnosing technical errors, investigating application stability, and correcting software defects.

Categories of Personal Data:

• Device model
• Android operating system version
• Application version or build
• Error and crash timestamps
• Stack traces
• Technical diagnostic and session information
• Installation or diagnostic identifiers generated by the SDK where applicable

Legal Basis: Article 6(1)(f) GDPR may apply to data-minimized processing limited to necessary technical error diagnostics. Where the SDK stores or accesses information on terminal equipment for purposes that are not strictly necessary, consent under Article 6(1)(a) GDPR, together with Section 25(1) TDDDG, is required.

Recipients and International Data Transfers: Google Ireland Limited or Google LLC in connection with Firebase Crashlytics.

Processing in the United States may occur. Transfers covered by Google LLC's certification may rely on the EU-US Data Privacy Framework under Article 45 GDPR.

Retention Period: Google states that Crashlytics crash stack traces and associated identifiers are retained for 90 days before their deletion process begins. The retention periods actually applicable to our Firebase project, including any separate copies stored in our own systems, must be verified.

Enabling Crashlytics only in Release builds means this integration is not active in internal development builds of the application.

However, limiting deployment to Release builds does not remove the need to assess the SDK's data processing practices under applicable privacy law.

C.2.8 ExoPlayer – Public Webcam Streams from Pamporovo

Our Android application may display publicly available live webcam streams from the Pamporovo region using the ExoPlayer media player.

Purpose of Processing: Playing publicly accessible live video streams showing local conditions.

Categories of Personal Data: Requested stream URL, technical network and connection information, IP address, playback timestamp, and device or player information where applicable.

Legal Basis: Article 6(1)(b) GDPR for providing the video stream expressly requested by the user. Where playback requires a connection to an external streaming provider, the relevant transmission is necessary to deliver the selected stream.

Recipients and International Data Transfers: The operator or hosting provider of the respective webcam stream, where the device accesses the stream directly.

The specific stream operators and server locations must be identified.

Where the stream is delivered exclusively through a backend proxy, international transfer arrangements depend on the actual proxy architecture.

Retention Period: Stream data is processed during playback and, where necessary, temporarily buffered by the media player.

Permanent recording of viewed webcam streams by our application is not intended under the described implementation.

Any technical access logs maintained by external streaming providers are subject to their respective privacy policies.

ExoPlayer is a media playback component. The use described here does not inherently involve independent transmission of usage information to Google by the library itself.

C.2.9 Android Account Deletion and App Data

Users can request deletion of their accounts through the available account deletion functionality or through the Legal Center.

Purpose of Processing: Terminating user accounts and fulfilling statutory data deletion obligations.

Categories of Personal Data: User identifier, associated profile information, messages, reviews, visit history, push tokens, linked identities, and relevant transaction information.

Legal Basis: Article 6(1)(c) GDPR, in conjunction with statutory deletion and accountability obligations, including Article 17 GDPR; additionally, Article 6(1)(b) GDPR for carrying out the account termination process.

Recipients and International Data Transfers: Our backend and deletion infrastructure and, where necessary, external identity or payment providers involved in disconnecting accounts or invalidating tokens.

Retention Period: Account-associated data is removed according to the deletion procedures described in Part A.20.

Exceptions apply to lawfully retained accounting records, necessary evidence concerning reported violations, and automatically rotating encrypted backups retained for a maximum of 56 days.

Uninstalling the Android application does not automatically delete an existing account stored on our servers.

C.3 Managing App Permissions and Privacy Preferences

You can manage the following settings at any time through the applicable operating system or application controls:

• Location access and location accuracy
• Push notification permissions
• Consent for personalized advertising
• iOS App Tracking Transparency, where applicable
• Optional location and diagnostic features
• Linked authentication providers
• Account deletion and privacy requests

Refusing a permission may make the associated feature unavailable or limit its functionality.

Core functions that do not require the relevant permission generally remain available.

The general rights and contact options in Part A.21 apply to both mobile applications.