# PART A – General Privacy Information and Shared Services **TANO TRADING LTD OOD** **Scope:** Website, Web App, iOS App, Android App, and Shared Backend Services **Last updated:** 18 October 2026 ## A.1 Data Controller pursuant to Article 4(7) GDPR The controller responsible for processing your personal data is: **TANO TRADING LTD OOD (ТАНО ТРЕЙДИНГ ООД)** Company Registration Number (EIK / UIC): 204784209 ul. Hadzhi Dimitr 3 4700 Smolyan Bulgaria **Privacy Contact:** legal@tanotrading.com You may submit questions concerning the processing of your personal data and requests to exercise your data protection rights by contacting the email address above or using the **"Exercise your data rights"** form available in our Legal Center. The designation of this contact address does not imply that a Data Protection Officer has been appointed within the meaning of Articles 37–39 GDPR. ## A.2 Scope and Sources of Personal Data These general privacy provisions apply to all digital services operated by TANO TRADING insofar as they use our shared account, security, communication, payment, and data infrastructure. We process personal data obtained from the following sources: - Information you provide directly when registering, using our services, or contacting us. - Technical and usage information generated during your interaction with our services. - Information received from Apple or Google when you choose to use a third-party sign-in method. - Information provided by other users through place listings, reviews, messages, or content reports. - Publicly available location and business information, including information obtained from integrated catalog services such as Google Places. Where personal data has not been obtained directly from the individual concerned, the information obligations under **Article 14 GDPR** apply. We provide the legally required information within the periods specified in Article 14(3) GDPR unless a statutory exception applies. Providing optional personal data is generally voluntary. However, certain information, particularly an email address, username, and authentication credentials, is necessary to create and maintain a user account. Without this information, certain services or features may be unavailable. ## A.3 Technical Infrastructure, Hosting, and Cloudflare ### A.3.1 Backend and Server Infrastructure **Purpose of Processing:** Operating our digital services, storing user and application data, processing API requests, maintaining technical functionality, and preventing unauthorized access. **Categories of Personal Data:** IP addresses, request timestamps, technical connection data, API endpoints, session and authentication information, and usage or content data necessary for the requested service. **Legal Basis:** **Article 6(1)(b) GDPR** where processing is necessary to perform a contract or provide requested contractual features; additionally, **Article 6(1)(f) GDPR** based on our legitimate interest in maintaining secure, reliable, and functional services. **Recipients and International Data Transfers:** Our internally operated server infrastructure and, where applicable, technical hosting and infrastructure providers. The specific server locations and any additional hosting processors must be confirmed before publication. Connections routed through Cloudflare are additionally subject to Section A.3.2. **Retention Period:** Retention depends on the specific processing activity and the account, content, security, and billing retention periods described below. A specific deletion period for independent server access logs remains to be established. ### A.3.2 Cloudflare – DNS, CDN, and DDoS Protection We use services provided by **Cloudflare, Inc., USA**, or the relevant Cloudflare contracting entity. **Purpose of Processing:** Secure and efficient delivery of our online services, DNS resolution, DDoS mitigation, detection of malicious requests, and protection of our server infrastructure. **Categories of Personal Data:** IP addresses, request timestamps, requested hostnames and resources, HTTP request data, browser information, User-Agent strings, security indicators, and security identifiers generated by Cloudflare where applicable. **Legal Basis:** **Article 6(1)(f) GDPR**, based on our legitimate interest in maintaining the security, availability, and integrity of our services. Where access to information on a user's terminal equipment is strictly necessary for security functionality, **Section 25(2)(2) TDDDG** applies. **Recipients and International Data Transfers:** Cloudflare and its contractually engaged subprocessors. Processing in the United States may occur. Cloudflare states that it participates in the EU-US Data Privacy Framework (DPF). Transfers covered by the applicable adequacy decision may rely on **Article 45 GDPR**. Where applicable, Standard Contractual Clauses under **Article 46(2)(c) GDPR** may provide additional safeguards. **Retention Period:** Data retained on our infrastructure is subject to the applicable backend retention rules. Cloudflare's independent security and access logs are retained according to the applicable contractual and product-specific policies. The exact retention periods for our subscribed Cloudflare services must be verified and added. Further information: https://www.cloudflare.com/privacypolicy/ ## A.4 Registration and User Accounts ### A.4.1 Registration and Email Verification **Purpose of Processing:** Creating and managing user accounts, verifying email addresses, preventing fraudulent registrations, and securing account access. **Categories of Personal Data:** - Username - Email address - Password stored exclusively as a cryptographic hash - Email verification codes and expiration timestamps - Number of unsuccessful verification attempts - Registration and account status information Passwords are not stored in plaintext. **Legal Basis:** **Article 6(1)(b) GDPR** for account registration and provision; **Article 6(1)(f) GDPR** for preventing account compromise and unauthorized registrations. **Recipients and International Data Transfers:** Our authentication and database infrastructure and our self-hosted Mailcow email infrastructure. Our SMTP relay provider also processes information necessary to deliver verification emails. Its identity, hosting location, and international transfer arrangements must be specified. **Retention Period:** Account data is retained until the account is deleted, unless a statutory retention obligation applies. Verification codes expire according to their configured validity periods. The subsequent deletion period for expired verification-code records must be confirmed. ### A.4.2 Sign in with Apple and Google If you select a third-party sign-in option, authentication is performed through the respective identity provider. **Purpose of Processing:** Simplified and secure registration, authentication, and linking of existing user accounts. **Categories of Personal Data:** Identity provider, provider-specific user identifier (Subject ID), transmitted email address, name where provided, and the association with your TANO TRADING account. For Apple authentication, an encrypted refresh token may also be stored. **Legal Basis:** **Article 6(1)(b) GDPR**, as processing is necessary to provide the authentication method selected by you. **Recipients and International Data Transfers:** - Apple for Sign in with Apple - Google for Sign in with Google - Our internal authentication infrastructure Google may process data in the United States. Google LLC is certified under the EU-US Data Privacy Framework. Apple processes data relating to users in the European Economic Area through entities including Apple Distribution International Limited, Ireland, and describes safeguards including Standard Contractual Clauses for relevant international transfers. **Retention Period:** Identity links are retained until the authentication method is disconnected or the user account is deleted. Stored Apple refresh tokens are revoked and deleted when the connection is removed or the account is deleted, where technically possible. Independent processing by Apple and Google is governed by their respective privacy policies. ### A.4.3 Profile Information, Business Details, and Permissions **Purpose of Processing:** Account personalization, provision of business features, management of access rights, Premium subscriptions, testing groups, and community integrity. **Categories of Personal Data:** Display name, profile picture or company logo, telephone number, company name, company registration number (EIK), VAT identification number, Premium status, Premium expiration date, test channel, group membership, reputation points and associated notes, and account restrictions with recorded reasons. **Legal Basis:** **Article 6(1)(b) GDPR** for contractual account, business, and Premium services; **Article 6(1)(f) GDPR** for abuse prevention, permission management, community quality, and traceable moderation decisions. **Recipients and International Data Transfers:** Authorized internal systems, personnel, and administrators. Profile information designated as public may be visible to other users. Cloudflare-related infrastructure processing is described in Section A.3.2. **Retention Period:** Generally until account deletion. Restriction and moderation data is removed when no longer necessary for legitimate enforcement purposes, unless a documented legal obligation or legal defense requirement justifies continued retention. The specific review period for historical restriction and reputation notes remains to be established. ## A.5 Authentication, Sessions, and Account Security ### A.5.1 Sessions and Password Recovery **Purpose of Processing:** Maintaining secure login sessions, detecting unauthorized access, and restoring account access. **Categories of Personal Data:** Hashed session tokens, associated account identifiers, technical session data, expiration timestamps, and hashed password-reset tokens. **Legal Basis:** **Article 6(1)(b) GDPR** and **Article 6(1)(f) GDPR**. Strictly necessary storage or access to authentication information on terminal equipment is governed by **Section 25(2)(2) TDDDG**. **Recipients and International Data Transfers:** Our authentication infrastructure and, where applicable, Cloudflare as described in Section A.3.2. **Retention Period:** - Regular Web and App sessions: **30-day validity** - Administrator sessions: **12-hour validity** - Automatic deletion of server-side session records: **7 days after expiration** - Password-reset tokens: until successful use or expiration; the exact token validity and subsequent deletion periods must be specified. ### A.5.2 Rate Limiting, Automated Attack Prevention, and Abuse Protection **Purpose of Processing:** Preventing brute-force attacks, spam, automated misuse, unauthorized access, and infrastructure overload. **Categories of Personal Data:** Pseudonymized hash values derived from account, device, or network characteristics, including IP address and User-Agent where applicable, unsuccessful attempt counters, and temporary restriction timestamps. A hash value is not automatically anonymous merely because the original identifier cannot be readily reconstructed. **Legal Basis:** **Article 6(1)(f) GDPR**, based on our legitimate interest in securing our infrastructure and protecting users. Where terminal-equipment access is strictly necessary, **Section 25(2)(2) TDDDG** applies. **Recipients and International Data Transfers:** Our security infrastructure and, where involved, Cloudflare in accordance with Section A.3.2. **Retention Period:** Rate-limit records are deleted after a few minutes or, at the latest, after **48 hours**. Failed administrator login counters are retained for **1 hour**. Platform-specific device integrity verification using Apple App Attest and Google Play Integrity is addressed in Part C. ## A.6 Published Places and User-Generated Content ### A.6.1 Places, Points of Interest, Images, and Routes **Purpose of Processing:** Operating a community-based place directory, displaying attractions and establishments, providing navigation, and maintaining accurate place information. **Categories of Personal Data:** Place name, address, description, photographs, geographic coordinates, contact person's name, telephone number, email address, author or account association, and timestamps. **Legal Basis:** **Article 6(1)(b) GDPR** for publishing and managing content submitted by users as part of the requested service. Where personal data of third parties or publicly available business contact details are processed, **Article 6(1)(f) GDPR** may apply, subject to the rights and interests of affected individuals. **Recipients and International Data Transfers:** Other users and website visitors where content is publicly displayed, as well as our backend and technical infrastructure. Public information may also be accessed from outside the European Union; such accessibility is distinct from a targeted transfer to a specific third-country recipient. **Retention Period:** Place information is retained for as long as the listing is required for the directory. Upon account deletion, personal account associations and personal contact information are removed or anonymized. A specific review period for outdated public listings remains to be established. You should submit personal information relating to other individuals only where you are legally entitled to do so. ### A.6.2 Ratings and Reviews **Purpose of Processing:** Enabling public reviews and improving the quality and usefulness of place information. **Categories of Personal Data:** Star rating, review text, associated place, internal user identifier, timestamp, and limited public name information. Publicly displayed names are restricted to the first name component, with a maximum length of 30 characters. Email addresses are never displayed as part of a review. Displaying a shortened name does not guarantee anonymity. **Legal Basis:** **Article 6(1)(b) GDPR** for providing the review functionality; **Article 6(1)(f) GDPR** for maintaining the integrity of the review system and preventing misuse. **Recipients and International Data Transfers:** Public review information is accessible to other visitors. Internal account associations are restricted to authorized systems and administrators. Infrastructure processing is governed by Section A.3. **Retention Period:** Until deletion of the review or the associated user account, subject to legally necessary evidence preservation under Section A.9. ## A.7 Visit History **Purpose of Processing:** Managing place-visit functionality and displaying previously visited locations. **Categories of Personal Data:** User account ID, place ID, and visit timestamp stored in `place_visits`. **Legal Basis:** **Article 6(1)(b) GDPR**, where processing is necessary for the requested account-based history feature. **Recipients and International Data Transfers:** Our backend and database infrastructure. Publication to other users is not intended. Infrastructure transfers are addressed in Section A.3. **Retention Period:** Until the individual visit record or user account is deleted. Associated visit records are deleted upon account deletion. ## A.8 Direct Messages and Communication Features **Purpose of Processing:** Enabling direct communication between users and providing reporting and blocking functionality. **Categories of Personal Data:** Sender and recipient identifiers, message content, timestamps, technical delivery information, and relevant blocking or reporting information. Messages are stored in encrypted form on our servers. This does not necessarily mean that end-to-end encryption is implemented. **Legal Basis:** **Article 6(1)(b) GDPR** for message functionality and **Article 6(1)(f) GDPR** for enforcing community rules and preventing misuse. **Recipients and International Data Transfers:** Intended message recipients and our backend infrastructure. Authorized administrators may access data only where justified by legal or security-related requirements. Infrastructure transfers are governed by Section A.3. **Retention Period:** Generally until deletion of the relevant account or message through the available deletion functions. Legally necessary evidence preservation may justify exceptions. Messages associated with a deleted account are removed in accordance with the implemented deletion procedures. ## A.9 Content Reports, Moderation, and the Digital Services Act **Purpose of Processing:** Handling reports of potentially unlawful content, reviewing user-generated material, documenting moderation decisions, ensuring accountability, and preserving evidence where necessary for establishing, exercising, or defending legal claims. **Categories of Personal Data:** - Reporting person's email address and, where applicable, account association - Reported content and related user or place information - Report timestamp and justification - Preserved content snapshot (`content_reports.snapshot`) - Review notes, decisions, reasoning, and notices - Where applicable, information regarding the affected individual and available remedies **Legal Basis:** **Article 6(1)(c) GDPR**, where specific obligations under applicable law, including Regulation (EU) 2022/2065 (Digital Services Act), apply; additionally, **Article 6(1)(f) GDPR** for investigating potential violations and defending legal claims. Where special categories of personal data are exceptionally involved, **Article 9(2)(f) GDPR** may also apply insofar as processing is necessary for legal claims. **Recipients and International Data Transfers:** Authorized staff and administrators, legal advisers, courts, law enforcement authorities, and regulatory bodies where legally required or justified. Technical infrastructure is described in Section A.3. **Retention Period:** According to the described technical implementation, content reports and evidence snapshots are currently stored without automatic expiration. However, indefinite retention of every report cannot be justified solely by a general interest in evidence preservation. A documented, case-specific retention and review policy must therefore be established before publication. Relevant criteria include necessity, pending proceedings, applicable limitation periods, and statutory documentation obligations. Deleting the original user account does not automatically require deletion of an evidence record that must lawfully be retained. ## A.10 Place Ownership Verification (Place Claim) **Purpose of Processing:** Verifying that a user is authorized to manage a business or place listing and preventing unauthorized ownership claims. **Categories of Personal Data:** Video recordings of entrances or premises, uploaded supporting documents, verification codes, account information, place details, and verification status. Uploaded material may contain identifiable individuals or other personal information visible in images, videos, or documents. **Legal Basis:** **Article 6(1)(b) GDPR** for processing the requested ownership verification; **Article 6(1)(f) GDPR** for preventing impersonation and unauthorized control over listings. **Recipients and International Data Transfers:** Authorized administrators and our file storage and backend infrastructure. Files are maintained in our upload storage. Applicable infrastructure transfers are addressed in Section A.3. **Retention Period:** Verification files are physically removed from active upload storage no later than account deletion. An earlier regular deletion period following verification should be defined; the exact period remains outstanding. Encrypted backup copies expire automatically within **56 days**. ## A.11 Feedback and Product Improvement **Purpose of Processing:** Receiving bug reports, improving usability, and evaluating feature suggestions. **Categories of Personal Data:** Feedback text, category, star rating, screen or affected feature, operating system, application build, application version, language, device type, and optional email address. Where users are logged in, feedback may be associated with their accounts. IP addresses are not stored as part of the feedback record. **Legal Basis:** **Article 6(1)(f) GDPR** for improving technical functionality; **Article 6(1)(a) GDPR** for a voluntarily supplied email address where consent is used for optional follow-up communication. **Recipients and International Data Transfers:** Our internal product development and support systems and the infrastructure described in Section A.3. **Retention Period:** Until the feedback has been processed and any reasonably necessary follow-up period has ended. A specific deletion period for closed feedback records remains to be established. Data that is no longer required is deleted or irreversibly anonymized. ## A.12 Ski Slope Tracking by Authorized Users **Purpose of Processing:** Recording, verifying, and updating geographic routes and ski slope information. **Categories of Personal Data:** Recorded coordinates, timestamps where available, recording user's account association, and related route information. This feature is accessible only to authorized recorders and administrators. **Legal Basis:** **Article 6(1)(b) GDPR**, where recording is part of the requested functionality; additionally, **Article 6(1)(f) GDPR** for maintaining subsequently anonymized route information. **Recipients and International Data Transfers:** Our geographic backend services and authorized administrators. Published, sanitized route information may be made available to other users. **Retention Period:** Identifiable raw records are retained only as long as necessary for verifying and processing the recorded route. A specific raw-data retention period remains to be established. Upon account deletion, published routes are disconnected from the originating account and personal information is anonymized, provided the remaining information cannot reasonably identify the original user. ## A.13 Newsletter, Waiting List, and Beta Applications ### A.13.1 Newsletter **Purpose of Processing:** Sending voluntarily subscribed updates, product announcements, and marketing communications where applicable. **Categories of Personal Data:** Email address, subscription status, double opt-in confirmation, registration and confirmation timestamps, and necessary consent evidence. **Legal Basis:** **Article 6(1)(a) GDPR**, together with applicable electronic marketing requirements. Retention of necessary consent evidence is based on **Article 6(1)(c) GDPR**, where a legal documentation obligation applies, or **Article 6(1)(f) GDPR** for defending legal claims. **Recipients and International Data Transfers:** Our self-hosted Mailcow infrastructure and SMTP relay provider. The provider's identity and any applicable international transfers must be specified. **Retention Period:** Until unsubscribe or withdrawal of consent. Following withdrawal, the email address is removed from the active mailing list. Necessary consent evidence is retained only for the legally justified documentation or defense period; the precise period remains to be established. ### A.13.2 Website Waiting List **Purpose of Processing:** Managing expressions of interest and notifying users when announced products or services become available. **Categories of Personal Data:** Email address, waiting-list status, and double opt-in confirmation records. **Legal Basis:** **Article 6(1)(a) GDPR**. **Recipients and International Data Transfers:** Mailcow, the SMTP relay provider, and our internal management systems as described in Section A.13.1. **Retention Period:** Until withdrawal of consent or fulfillment of the specified waiting-list purpose. Entries are deleted after the waiting-list purpose ends, except where consent evidence must lawfully be retained. ### A.13.3 Beta Applications and Invitation Codes **Purpose of Processing:** Reviewing beta applications, selecting and managing test access, and protecting invitation codes against unauthorized or repeated use. **Categories of Personal Data:** Name, email address, optional application note, assigned test group or channel, and hashed invitation codes. **Legal Basis:** **Article 6(1)(b) GDPR** for processing requested participation or taking pre-contractual steps; **Article 6(1)(f) GDPR** for maintaining the integrity of invitation systems. **Recipients and International Data Transfers:** Our internal beta management and authentication infrastructure and, where applicable, the email providers described in Section A.13.1. **Retention Period:** Until completion of the application process or beta participation, unless the user continues to maintain an account. Specific deletion periods for rejected or unanswered applications and unused invitation-code hashes remain to be established. ## A.14 Usage Statistics and Analytics ### A.14.1 Internal Web and App Analytics We operate an internal analytics system (`analytics_hits`) that does not require analytics cookies. **Purpose of Processing:** Measuring usage frequency, analyzing pages and features, and improving our services. **Categories of Personal Data:** - Calendar day and hour - Requested path - Referrer - Language - Device type - Country - Daily rotating pseudonymous visitor identifier The visitor identifier is derived from the IP address and User-Agent using a salt that rotates every day at **00:00 UTC**. This identifier is not automatically anonymous simply because it does not directly contain the user's name or other obvious identifiers. We respect Do Not Track (DNT) and Global Privacy Control (GPC) signals in accordance with our technical implementation. **Legal Basis:** **Article 6(1)(f) GDPR** based on our legitimate interest in privacy-conscious audience measurement and technical improvement. Where collection or calculation involves access to terminal-equipment information requiring consent, such access is performed only in accordance with **Section 25(1) TDDDG**. Analytics based exclusively on ordinary network communication data must be assessed according to their actual technical implementation. **Recipients and International Data Transfers:** Our internal analytics systems. We do not intend to disclose these analytics records to external advertising platforms. Infrastructure-related processing under Section A.3 remains possible. **Retention Period:** **395 days (13 months)**, followed by automatic deletion of the personal or pseudonymous analytics records. ### A.14.2 Self-Hosted Matomo **Purpose of Processing:** Analyzing usage patterns and improving the usability and performance of our digital services. **Categories of Personal Data:** Technical HTTP request information, including IP address and User-Agent, and page or usage information processed according to the Matomo configuration. Matomo is self-hosted and configured without analytics cookies or persistent Matomo visitor identifiers (`_id`). Technical request data may nevertheless be processed for server-side aggregation. **Legal Basis:** **Article 6(1)(f) GDPR**, provided the implementation remains privacy-conscious, does not use terminal-equipment access requiring consent, and is supported by an appropriate balancing of interests. Otherwise, **Article 6(1)(a) GDPR** together with **Section 25(1) TDDDG** applies. **Recipients and International Data Transfers:** Our self-hosted Matomo instance. We do not use Matomo Cloud as an external analytics service. Infrastructure processing under Section A.3 remains possible. **Retention Period:** A specific retention and automatic deletion period for the self-hosted Matomo database must be established. Genuinely anonymous aggregate statistics may be retained beyond the raw-data retention period. ## A.15 Push Notifications **Purpose of Processing:** Delivering account-related notifications, service messages, and voluntarily enabled information or announcements. **Categories of Personal Data:** Push token, operating system, language, app version, account ID, registration and update timestamps, and notification log information such as title, message body, recipient group, and dispatch timestamp. **Legal Basis:** **Article 6(1)(b) GDPR** for notifications directly connected with requested service functionality; **Article 6(1)(a) GDPR** for voluntary marketing or other consent-based notifications. Where terminal-equipment access requires consent, **Section 25(1) TDDDG** also applies. **Recipients and International Data Transfers:** - iOS: Apple Push Notification service (APNs) - Android: Firebase Cloud Messaging (FCM), operated by Google - Our backend notification management systems Google may process data in the United States, and Google LLC participates in the EU-US Data Privacy Framework. Apple may process personal data internationally using the safeguards described in its privacy documentation, including Standard Contractual Clauses where applicable. **Retention Period:** Push tokens are retained until the relevant device is deregistered, notification services are withdrawn, or the associated account is deleted. Specific deletion periods for inactive or undeliverable tokens and `push_log` records remain to be established. Notification permissions can be disabled in the device's operating system settings. Disabling a system permission does not necessarily cause immediate server-side deletion of the associated push token; this is handled through our deregistration or cleanup processes. ## A.16 Payments, Subscriptions, and Premium Services ### A.16.1 Subscription and Entitlement Management **Purpose of Processing:** Managing subscriptions, Premium status, subscription periods, access entitlements, purchases, passes, and acquired services. **Categories of Personal Data:** Account ID, product and subscription information, purchase and transaction identifiers, payment status, contract and validity information, Premium expiration date, and applicable invoice information. **Legal Basis:** **Article 6(1)(b) GDPR** for purchase and contract performance; **Article 6(1)(c) GDPR** for statutory accounting and tax obligations. **Recipients and International Data Transfers:** Our billing and backend infrastructure, applicable payment providers, Apple or Google for in-app purchases, and authorized tax advisers or authorities where necessary. **Retention Period:** Contract and entitlement information is processed for the duration of the contractual relationship and as necessary to complete the relevant transaction. Accounting records and tax-relevant documents are retained for **10 years**, where this period applies under the relevant legislation to the specific category of record. ### A.16.2 Web Payments through the Payment Center For paid web services, we use our Payment Center at: https://paymentcenter.tanotrading.com **Purpose of Processing:** Processing B2C subscriptions, passes, and other paid services. **Categories of Personal Data:** Customer and account association, purchased services, price, currency, payment and contract status, transaction numbers, invoice information, and tax-related details where applicable. **Legal Basis:** **Article 6(1)(b) GDPR** and **Article 6(1)(c) GDPR**. **Recipients and International Data Transfers:** Our Payment Center, associated technical infrastructure providers, and the payment processor actually integrated into the payment system. The payment processor, its role, and applicable international transfer arrangements must be named before publication. **Retention Period:** Contract and payment information is retained as necessary to fulfill the relevant transaction and contractual obligations. Tax and accounting records are generally retained for **10 years**, subject to the specific requirements of applicable law. ## A.17 Server-Side Google Places Integration **Purpose of Processing:** Providing, searching, and updating publicly available geographic and business information. **Categories of Personal Data:** Place names, search parameters, place identifiers, catalog information, and geographical search areas where applicable. Requests to Google Places are made through our server-side backend infrastructure. Under the described implementation, users' devices do not establish direct client-side connections to Google Places. **Legal Basis:** **Article 6(1)(f) GDPR**, based on our legitimate interest in maintaining complete and current place information. Where the request is directly necessary to deliver a function requested by the user, **Article 6(1)(b) GDPR** may additionally apply. **Recipients and International Data Transfers:** Google, including Google LLC, USA, or the Google entity responsible for the service. Transfers covered by Google LLC's EU-US Data Privacy Framework certification may rely on the adequacy decision under **Article 45 GDPR**. **Retention Period:** Requests and results are processed only for the relevant search, update, or permitted caching purpose. Specific retention periods must be determined from the actual technical implementation and applicable Google Places terms. ## A.18 Email Infrastructure and System Communications **Purpose of Processing:** Sending and receiving registration, security, support, reporting, termination, and other transaction-related emails. **Categories of Personal Data:** Sender and recipient addresses, subject lines, message content, dispatch timestamps, delivery status, and technically necessary email headers. **Legal Basis:** **Article 6(1)(b) GDPR** where communications are necessary for a contract or requested function; **Article 6(1)(c) GDPR** where legally required communications are involved; additionally, **Article 6(1)(f) GDPR** for secure and traceable communication. **Recipients and International Data Transfers:** Our self-hosted Mailcow infrastructure, the SMTP relay provider, and the email providers of the recipients. International processing may result from the location of the recipient's email provider or the SMTP relay. **Retention Period:** Until the communication purpose has been fulfilled and any applicable statutory retention obligations have expired. Specific deletion periods for mailbox contents and SMTP delivery logs must be established. ## A.19 Backups and Data Recovery **Purpose of Processing:** Restoring data and services following technical failures, security incidents, or data loss. **Categories of Personal Data:** Encrypted backup copies of the relevant datasets, potentially including personal data contained in production systems at the time of backup. **Legal Basis:** **Article 6(1)(f) GDPR** based on our legitimate interest in data security, resilience, and recoverability; additionally, **Article 6(1)(c) GDPR** in conjunction with applicable statutory security obligations, including **Article 32 GDPR**, where appropriate. **Recipients and International Data Transfers:** Local backup infrastructure and **Cloudflare R2** object storage. Backup data is encrypted using `rclone crypt`. International processing associated with Cloudflare is governed by the safeguards described in Section A.3.2. **Retention Period:** - **14 daily backup versions** - **8 weekly backup versions** - Automatic backup rotation and deletion no later than **56 days** Deleting personal data from our production systems does not immediately modify previously created backup copies. These copies expire within the stated maximum period. Where a backup is restored, deletions completed after its creation must be reapplied. ## A.20 Account Deletion Users may request deletion of their accounts through the available account deletion functionality or by submitting a privacy request. Our deletion procedures include removing: - User accounts and associated profile data - Active and stored sessions - Linked Apple and Google identities - Reviews and associated messages - Visit history - Push tokens - Verification and authentication codes - Personal verification documents from active upload storage Uploaded place and route information may be retained only where account associations and identifying personal information have been removed and the remaining content is genuinely anonymous. Account identifiers and personal contact details are deleted or neutralized during this process. Replacing a user identifier with the value `0` is not sufficient if the remaining data could still identify the original individual. **Exceptions to immediate deletion** may include: - Invoices and accounting records subject to statutory retention requirements - Content-report evidence lawfully required for defending legal claims - Encrypted rotating backups retained for a maximum of **56 days** Where necessary, retained records are restricted from use for unrelated purposes. ## A.21 Your Data Protection Rights Subject to the conditions established by applicable law, you have the following rights: 1. **Right of Access – Article 15 GDPR:** You may request information about the processing of your personal data and obtain a copy of the relevant data. 2. **Right to Rectification – Article 16 GDPR:** You may request correction of inaccurate information and completion of incomplete information. 3. **Right to Erasure – Article 17 GDPR:** You may request deletion of your personal data unless a statutory exception applies. 4. **Right to Restriction – Article 18 GDPR:** You may request restriction of processing under certain circumstances. 5. **Right to Data Portability – Article 20 GDPR:** You may receive personal data you have provided in a structured, commonly used, machine-readable format where the statutory requirements are satisfied. 6. **Right to Object – Article 21 GDPR:** You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without providing such grounds. 7. **Right to Withdraw Consent – Article 7(3) GDPR:** You may withdraw previously given consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Requests can be submitted to **legal@tanotrading.com** or through the **"Exercise your data rights"** form in our Legal Center. We generally respond within one month of receiving a request. This period may be extended under the conditions specified in Article 12(3) GDPR. Where reasonable doubts exist regarding the requester's identity, we may request additional information necessary to verify their identity. ### Right to Lodge a Complaint Under **Article 77 GDPR**, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, workplace, or the place of the alleged infringement. The supervisory authority responsible for our registered establishment in Bulgaria is: **Commission for Personal Data Protection (CPDP / КЗЛД)** 2 Prof. Tsvetan Lazarov Blvd. 1592 Sofia Bulgaria Email: kzld@cpdp.bg Website: https://www.cpdp.bg/ ## A.22 Automated Decision-Making and Profiling Our systems may perform automated security checks, rate limiting, device integrity verification, authorization checks, and statistical analysis. Based on the technical implementation described here, we do not intend to make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them within the meaning of **Article 22 GDPR**. Automated security and risk assessments may nevertheless lead to technical restrictions. Permanent or substantially adverse measures must remain reviewable in accordance with applicable legal requirements. Advertising-related profiling by third parties, where used, is permitted only where the relevant legal requirements and necessary consent conditions have been satisfied. ## A.23 International Data Transfers We transfer personal data outside the European Economic Area only where an appropriate legal basis exists under Chapter V GDPR. Relevant transfer mechanisms include: - **Article 45 GDPR:** Adequacy decisions, including the EU-US Data Privacy Framework for appropriately certified recipients. - **Article 46 GDPR:** Appropriate safeguards, particularly the European Commission's Standard Contractual Clauses. - Additional technical and organizational safeguards where necessary. A company's certification can only be relied upon for the specific legal entity and processing activities covered by that certification. You may request information about applicable safeguards and how to obtain a copy by contacting legal@tanotrading.com. ## A.24 Technical and Organizational Security Measures We implement technical and organizational measures appropriate to the risks associated with the processing of personal data. The described safeguards include: - Cryptographic password hashing - Hashed authentication and session tokens - Encrypted storage of selected authentication credentials - Restricted administrative access - Device integrity verification - Rate limiting and abuse detection - Encrypted backups - Separation of user roles and access permissions - Automated expiration and deletion mechanisms Absolute protection against security incidents cannot be guaranteed. ## A.25 Changes to This Privacy Policy We may update this Privacy Policy to reflect changes in legal requirements or actual data processing activities. Where changes are material, we will provide appropriate notice. The version published in our Legal Center at the relevant time is the applicable version. # PART B – Website and Web App Privacy Information **TANO TRADING LTD OOD** **Scope:** Website, browser-based applications, and web services **Last updated:** 18 October 2026 This section supplements the general privacy provisions in **Part A**. Parts A and B together constitute the Privacy Policy for our Website and Web App. ## B.1 Website Access and Technical Connection Data When you access our Website, certain technical information is processed to deliver the requested content. **Purpose of Processing:** Providing the Website, establishing network connections, transmitting requested content, diagnosing technical errors, and securing our web servers. **Categories of Personal Data:** IP address, access date and time, requested URL or resource, HTTP method, HTTP status code, amount of data transferred, User-Agent, browser and operating system information, and Referrer where applicable. **Legal Basis:** **Article 6(1)(f) GDPR**, based on our legitimate interest in operating a secure and functional Website; additionally, **Article 6(1)(b) GDPR** for contractually required Web App functionality. **Recipients and International Data Transfers:** Our web servers and backend infrastructure, as well as Cloudflare acting as an upstream infrastructure and security provider. International transfers are governed by Part A.3. **Retention Period:** Data is processed for as long as technically necessary. Where independent server logs are stored, a specific automatic deletion period must be established. The separate pseudonymous usage statistics are subject to the **395-day** retention period described in Part A.14. ## B.2 Cookies, Local Storage Technologies, and Consent Management We distinguish between strictly necessary storage and access operations and optional technologies used for analytics, advertising, and additional features. ### B.2.1 Strictly Necessary Technologies **Purpose of Processing:** Maintaining authenticated sessions, storing essential security and session settings, and providing features explicitly requested by users. **Categories of Personal Data:** Session identifiers, authentication information, necessary security identifiers, and functional settings. **Legal Basis:** **Article 6(1)(b) GDPR** or **Article 6(1)(f) GDPR**; strictly necessary storage or access to information on terminal equipment is governed by **Section 25(2)(2) TDDDG**. **Recipients and International Data Transfers:** Our backend infrastructure and, where applicable, Cloudflare as described in Part A.3. **Retention Period:** Regular server-side sessions remain valid for 30 days and are deleted 7 days after expiration. Individual browser storage entries follow their technically configured lifetimes. A complete inventory of actual storage keys and their expiration periods must be included in the Consent Center. ### B.2.2 Consent Management **Purpose of Processing:** Obtaining, managing, technically enforcing, and documenting user privacy preferences. **Categories of Personal Data:** Granted or refused consents, selected purposes, consent timestamps, version of the consent interface, and any identifiers necessary to document consent. **Legal Basis:** **Article 6(1)(c) GDPR**, in connection with applicable accountability and documentation obligations; additionally, **Article 6(1)(f) GDPR** for legitimate evidentiary purposes. Strictly necessary storage of your privacy preferences on your device is governed by **Section 25(2)(2) TDDDG**. **Recipients and International Data Transfers:** Our own consent management system. Information is shared with external advertising providers only to the extent necessary for the advertising and consent functions actually activated. **Retention Period:** Your preferences are stored until they are changed or the configured consent validity period expires. Necessary consent evidence may be retained for a longer legally justified period. The exact retention periods must be established. Optional technologies are activated only where the required consent has been obtained. You may change or withdraw your consent at any time through the **Privacy Settings in our Legal Center or Consent Center**. Refusing optional consent does not prevent access to essential Website functionality. ## B.3 Internal Analytics and Matomo We use our own analytics solution and a self-hosted Matomo instance to understand how our Website is used. **Purpose of Processing:** Audience measurement, technical improvement, and statistical evaluation of our services. **Categories of Personal Data:** Visit day and hour, path, Referrer, language, device type, country, daily pseudonymous visitor identifier, and technical IP address and User-Agent data processed by Matomo. **Legal Basis:** **Article 6(1)(f) GDPR** where the implementation is legally permissible, privacy-conscious, and does not involve terminal-equipment access requiring consent. Otherwise, **Article 6(1)(a) GDPR**, together with **Section 25(1) TDDDG**, applies. **Recipients and International Data Transfers:** Our internal analytics systems and self-hosted Matomo installation; Cloudflare may process technical transmission data. **Retention Period:** Records in our own analytics system are deleted after **395 days**. The retention period for Matomo must be established. Our analytics setup does not rely on analytics cookies and respects technically detected DNT and GPC signals. Further information is provided in Part A.14. ## B.4 Google AdSense – Website Advertising We use Google AdSense to help finance free Website features. **Purpose of Processing:** Delivering advertisements, financing free services, potentially personalizing advertisements, managing advertising frequency, detecting invalid advertising interactions, and measuring advertising performance. **Categories of Personal Data:** Depending on the consent provided, Google may process IP addresses, browser and device information, viewed pages, advertising interactions, cookies, local identifiers, and advertising interest information. **Legal Basis:** **Article 6(1)(a) GDPR** and **Section 25(1) TDDDG** for advertising technologies requiring consent. Other legal bases relied upon by Google for its independently controlled processing are described in Google's applicable privacy information and the purposes presented in the consent interface. **Recipients and International Data Transfers:** Google Ireland Limited, Ireland, Google LLC, USA, and other advertising technology partners identified in the consent management system where applicable. Transfers to Google LLC covered by its certification may rely on the EU-US Data Privacy Framework under **Article 45 GDPR**. **Retention Period:** Retention by Google depends on the advertising technologies in use and the durations disclosed through the consent management system. These periods must be verified against the cookies and identifiers actually used. Users may withdraw locally recorded advertising consent at any time. ### Our Advertising Principles - Google AdSense is not integrated into legal information pages, including this Privacy Policy and other mandatory legal notices. - Logged-in Premium subscribers do not receive Google AdSense advertisements. - Google advertising scripts requiring consent are not activated before the necessary permission is granted. - Non-personalized advertisements may be delivered where the required consent for any cookies or identifiers used has been obtained. - Where consent-dependent advertising technologies are rejected, those technologies are not loaded. Any technically possible form of highly restricted advertising without consent requires a separate legal and technical assessment. Privacy preferences can be changed through the Consent Center. Further information: https://policies.google.com/privacy ## B.5 Optional Browser Fingerprinting We offer a separate optional consent setting called **"Count Google searches more accurately"**. Without this consent, we do not perform active Canvas, WebGL, or screen-based fingerprinting for the additional counting function described below. **Purpose of Processing:** Improving the statistical counting and differentiation of search events when this feature is enabled by the user. **Categories of Personal Data:** Browser and display characteristics, Canvas and WebGL properties, screen configuration, and resulting hash or recognition values. Without consent, the function is limited to permissible passive network characteristics. No active device fingerprint is calculated. **Legal Basis:** **Article 6(1)(a) GDPR** and **Section 25(1) TDDDG**. **Recipients and International Data Transfers:** Our own analytics and backend infrastructure. Under the described implementation, browser fingerprints are not directly transmitted to Google. The name of the function does not imply that fingerprint data is sent to Google. **Retention Period:** A specific period for deleting or regenerating fingerprint hashes remains to be established. After withdrawal, previously collected identifiers may not continue to be used for recognition without an independent legal basis. Consent may be withdrawn through the Consent Center at any time. ## B.6 Cloudflare Turnstile – Form Protection We use Cloudflare Turnstile on selected forms and security-sensitive interactions. **Purpose of Processing:** Distinguishing legitimate interactions from automated access and protecting forms against spam, account attacks, and abusive submissions. **Categories of Personal Data:** IP address, User-Agent, technical browser and interaction characteristics, information associated with the security verification, and necessary verification identifiers. **Legal Basis:** **Article 6(1)(f) GDPR**, based on our legitimate interest in protecting our forms and technical infrastructure. Where access to information on terminal equipment is strictly necessary for the expressly requested protected service, **Section 25(2)(2) TDDDG** may apply. Non-essential terminal-equipment access requires separate consent. **Recipients and International Data Transfers:** Cloudflare, Inc., or the relevant Cloudflare entity. Possible transfers to the United States are described in Part A.3.2. **Retention Period:** Security information is processed according to the applicable Cloudflare Turnstile configuration and product-specific retention rules. The specific retention period must be verified before publication. ## B.7 OpenStreetMap and Leaflet Maps We use Leaflet with map data or map tiles provided by the OpenStreetMap Foundation (OSMF). External map tiles are loaded only after the user actively authorizes the map connection through a preceding dialog. **Purpose of Processing:** Displaying interactive maps, geographic places, routes, and location-based information. **Categories of Personal Data:** IP address, technical request information, User-Agent, Referrer, requested map regions, and zoom levels. **Legal Basis:** **Article 6(1)(a) GDPR** for voluntary authorization of the external map connection; **Section 25(1) TDDDG** for terminal-equipment access requiring consent. **Recipients and International Data Transfers:** OpenStreetMap Foundation, United Kingdom. The European Commission has adopted an adequacy decision for the United Kingdom under **Article 45 GDPR**. **Retention Period:** We do not independently store the direct connection data processed by OSMF as a separate map usage history. The map provider's privacy and retention rules apply to its technical logs. Any local map cache or stored map authorization must be assigned a retention period based on the actual implementation. Further information: https://osmfoundation.org/wiki/Privacy_Policy ## B.8 Web Search, Routes, and Location Features **Purpose of Processing:** Searching for places, calculating routes, displaying destinations, and providing geographical information. **Categories of Personal Data:** Search terms, selected places, starting and destination coordinates or entered addresses, and technical information necessary for the respective request. **Legal Basis:** **Article 6(1)(b) GDPR** for the explicitly requested search or routing function. Additional requirements under **Section 25 TDDDG** must be considered where a voluntary device location function is accessed. **Recipients and International Data Transfers:** Our geographical backend services and, depending on the requested function, Photon and OSRM services accessed through our backend. The specific operators and server locations of the external Photon and OSRM instances must be identified. OSMF may additionally receive information if the user separately authorizes external map tiles. **Retention Period:** Routing and search responses are cached for up to **24 hours**. Cache keys are generated from hashed coordinates. Independent server access logs, where maintained, are subject to the retention rules still to be established under Section B.1. Where you explicitly save visits or other account-related information, the corresponding provisions in Part A also apply. ## B.9 Web Error Reporting through GlitchTip We use a self-hosted GlitchTip instance based on Sentry technology for our Web App. **Purpose of Processing:** Detecting, investigating, and correcting technical errors and application failures. **Categories of Personal Data:** Error type, stack trace, technical browser and operating system information, application version, timestamp, and relevant technical context information. Our configuration uses `sendDefaultPii = false`. Screenshots are not submitted to GlitchTip. URLs are transmitted without query parameters. **Legal Basis:** **Article 6(1)(f) GDPR**, based on our legitimate interest in identifying and correcting errors and maintaining a functional online service. This legal basis does not automatically cover additional terminal-equipment access requiring consent. **Recipients and International Data Transfers:** Our self-hosted GlitchTip instance and authorized developers or administrators. Infrastructure processing is governed by Part A.3. **Retention Period:** Error reports are retained for the time necessary to investigate the issue and for an appropriate technical verification period. The exact automatic deletion period for our GlitchTip instance remains to be established. ## B.10 Forms, User Accounts, and Web Payments Our Web App enables users to manage accounts, publish content, submit feedback, subscribe to newsletters or waiting lists, exercise privacy rights, and purchase paid services. **Purpose of Processing:** Providing the requested function and communicating with the user. **Categories of Personal Data:** Information submitted through the relevant form, associated account information, and necessary technical security data. **Legal Basis:** Depending on the functionality, **Article 6(1)(a), (b), (c), or (f) GDPR**, as specified for each relevant processing activity in Part A. **Recipients and International Data Transfers:** Our backend infrastructure, Mailcow, SMTP relay, Cloudflare, and, where applicable, external identity providers and payment service providers. Further details are provided in Part A. **Retention Period:** According to the specific functionality and retention periods described in Part A. Statutory accounting requirements apply to relevant invoice and transaction records. ## B.11 Locally Hosted Fonts and Scripts The fonts used by our Website and our regular first-party application scripts are hosted locally. No connection to Google Fonts or any other external font CDN is established to provide these resources. Technically necessary requests for locally hosted resources are processed according to Section B.1. Separately described third-party features, particularly advertising, maps, and bot protection, remain subject to their respective privacy provisions. # PART C – Mobile Application Privacy Information **TANO TRADING LTD OOD** **Scope:** iOS App and Android App **Last updated:** 18 October 2026 This section supplements the general privacy information contained in **Part A**. The following provisions distinguish between data processing activities common to both mobile platforms and technologies specific to each operating system. - **C.0:** Processing activities common to both mobile applications - **C.1:** iOS-specific processing activities - **C.2:** Android-specific processing activities ## C.0 Processing Activities Common to Both Mobile Applications ### C.0.1 Location Processing, Nearby Search, and Navigation Our mobile applications offer location-based features, including nearby search, route calculation, navigation, and geographic route recording for authorized users. **Purpose of Processing:** Displaying nearby places, calculating routes, providing active navigation, and delivering location-based information. **Categories of Personal Data:** - Current geographic coordinates - Precise or approximate location, depending on the permission granted - Entered or selected starting points and destinations - Destination coordinates - Selected transportation modes and routing preferences - Technical request and functionality information - Geographic coordinates recorded during authorized ski slope tracking Location processing depends on the system permissions granted and the specific functionality being actively used. **Legal Basis:** **Article 6(1)(b) GDPR**, where processing is necessary to provide a location-based feature requested by the user. For additional optional location processing, **Article 6(1)(a) GDPR** applies. Where access to location information on terminal equipment falls within the scope of Section 25 TDDDG, **Section 25(2)(2) TDDDG** applies if access is strictly necessary to provide the expressly requested feature. Otherwise, consent under **Section 25(1) TDDDG** is required. Granting an operating system permission does not automatically replace every legally required consent under data protection law. **Recipients and International Data Transfers:** Our backend infrastructure and the Photon and OSRM services used for geographic search and routing. Requests to `/geo/route`, `/geo/search`, and `/transit/plan` are processed through our backend infrastructure. The specific operators and server locations of external Photon and OSRM instances must be identified. Where operating system-specific map providers are used, information may additionally be transmitted to Apple or OpenStreetMap as described in Sections C.1 and C.2. **Retention Period:** Routing and geographic search responses are cached for **24 hours**. Cache keys are generated from hashed coordinates. Permanent storage of complete navigation histories is not intended for ordinary routing functions. Separately saved visit records and authorized ski slope recordings are governed by Parts A.7 and A.12. Location permissions may be changed or withdrawn at any time through the operating system settings. ### C.0.2 Regional Country Detection **Purpose of Processing:** Determining the relevant country or region, selecting country-specific application functionality, and managing regional service availability. **Categories of Personal Data:** Country code derived from location data, location information required for local country detection, and technical request information. On iOS, the country is determined through the iOS geocoder. For this function, our API receives only the country code through the `X-Region` header, rather than the precise geographic coordinates used for determining the country. **Legal Basis:** **Article 6(1)(b) GDPR** for providing region-specific application functionality; additionally, **Article 6(1)(f) GDPR** for maintaining appropriate and reliable regional service configuration. **Recipients and International Data Transfers:** Our backend infrastructure. Where the operating system's geocoding service communicates with Apple or Google services, the provider's applicable privacy information and international transfer mechanisms also apply. **Retention Period:** The country code is processed for the relevant regional request. Permanent storage of a precise location history for this feature is not intended. The retention period for any regional request logs remains to be established. ### C.0.3 Destination Analytics We operate a privacy-conscious destination analytics feature to improve our navigation and place services. **Purpose of Processing:** Analyzing destination preferences, destination categories, and transportation modes to improve geographic information and routing features. **Categories of Personal Data:** Destination, destination category or type, and selected transportation mode. The starting location and a user identifier are not stored as part of the destination analytics record. Address-related information is generalized to a spatial resolution of approximately **1 kilometer**. **Legal Basis:** **Article 6(1)(f) GDPR**, provided processing is necessary to produce privacy-conscious, non-identifying usage statistics and is not overridden by the rights or interests of the individuals concerned. **Recipients and International Data Transfers:** Our internal analytics infrastructure. Individualized destination statistics are not intended to be disclosed to advertising providers. **Retention Period:** Genuinely anonymized aggregate data that can no longer be linked to an individual may be retained without a personal-data retention limit. Where information remains personal data during collection or intermediate processing, a specific deletion period for those intermediate records must be established. Geographic generalization to a one-kilometer grid does not, by itself, guarantee that data is anonymous. ### C.0.4 Diagnostic Requests from Restricted Regions If the application is accessed from a region where certain functionality is unavailable, diagnostic information may be collected to investigate regional restrictions. **Purpose of Processing:** Investigating regional availability issues, detecting misuse, and diagnosing technical problems. **Categories of Personal Data:** Device identifier or device number, geographic location, diagnostic timestamp, and information relating to the regional restriction. **Legal Basis:** **Article 6(1)(f) GDPR** may apply only where transmitting the specific device and location information is necessary, proportionate, and supported by a documented legitimate security or diagnostic interest that is not overridden by the individual's rights. For additional transmission of precise location data beyond what is strictly necessary, **Article 6(1)(a) GDPR**, together with the applicable requirements under **Section 25 TDDDG**, must be considered. **Recipients and International Data Transfers:** Authorized administrators and our secured backend infrastructure only. Infrastructure-related processing is governed by Part A.3. **Retention Period:** Automatic deletion no later than **90 days** after collection. Automatic transmission of precise coordinates together with a persistent device identifier, without prior consent, requires a separate assessment of necessity and proportionality. Until that assessment has been completed, processing must be restricted to information necessary for the diagnostic purpose. ### C.0.5 Mobile Usage Analytics **Purpose of Processing:** Improving application functionality, measuring usage, and identifying general usage patterns. **Categories of Personal Data:** Day, hour, application feature path, language, device type, country, Referrer where applicable, and the daily rotating pseudonymous visitor identifier generated by our internal analytics system. **Legal Basis:** **Article 6(1)(f) GDPR** for legally permissible privacy-conscious analytics. Where information is accessed on the user's device in a manner requiring consent, **Article 6(1)(a) GDPR**, together with **Section 25(1) TDDDG**, applies. **Recipients and International Data Transfers:** Our internal analytics infrastructure and the technical infrastructure described in Part A where applicable. **Retention Period:** Internal pseudonymous analytics records are automatically deleted after **395 days**. Additional information is provided in Part A.14. ### C.0.6 Accounts, User Content, and Shared Backend Functionality Both mobile applications use our shared backend infrastructure for user accounts, profiles, places, reviews, direct messages, feedback, ownership verification, and selected Premium features. **Purpose of Processing:** Providing consistent functionality across devices and operating systems. **Categories of Personal Data:** The account, content, communication, history, and transaction information described in Part A, depending on the functionality used. **Legal Basis:** **Article 6(1)(b), (c), or (f) GDPR**, depending on the relevant function; **Article 6(1)(a) GDPR** where processing requires consent. **Recipients and International Data Transfers:** Our backend services, Cloudflare, and the authentication, payment, or communication providers identified in Part A where applicable. **Retention Period:** The specific retention periods described in Part A apply, particularly those concerning account deletion and backups. --- ## C.1 Additional Privacy Information for the iOS Application ### C.1.1 Location Permission and Background Navigation Our iOS application may request the **"While Using the App"** location permission. The `Location` and `Audio` background modes are configured to support active turn-by-turn navigation. **Purpose of Processing:** Nearby search, route guidance, active navigation, necessary background functionality, and audible navigation instructions where applicable. **Categories of Personal Data:** Current location, position and movement changes during active navigation, requested route, navigation status, and technical information required for navigation audio output. **Legal Basis:** **Article 6(1)(b) GDPR** for the navigation service requested by the user. Optional additional location processing is based on **Article 6(1)(a) GDPR**. Terminal-equipment access is subject to **Section 25 TDDDG** according to the necessity of the specific function. **Recipients and International Data Transfers:** Our routing backend infrastructure and, where applicable, Apple through iOS location and mapping services. Apple may process personal data internationally and describes safeguards including Standard Contractual Clauses. **Retention Period:** Location information is processed while the relevant location or navigation feature is active. Backend routing responses are cached for **24 hours**. Permanent storage of complete navigation histories outside separately activated recording features is not intended. Permissions can be changed at any time under **iOS Settings → Privacy & Security → Location Services**. The presence of a background mode does not mean that the application is intended to create permanent movement profiles independently of active navigation. ### C.1.2 Apple MapKit **Purpose of Processing:** Displaying maps, enabling geographic search, and supporting location-based navigation. **Categories of Personal Data:** Displayed map region, search queries, selected places, location where applicable, starting points, destinations, route requests, and technical device information. **Legal Basis:** **Article 6(1)(b) GDPR** for requested mapping and navigation services. **Article 6(1)(a) GDPR** may additionally apply to voluntary location features. **Recipients and International Data Transfers:** Apple, including Apple Distribution International Limited, Ireland, and affiliated Apple entities. Apple may process data in the United States; international transfers are governed by its relevant privacy policies and safeguards, including Standard Contractual Clauses where applicable. **Retention Period:** Processing through the iOS application occurs while the relevant map functionality is being used. Apple's independent retention practices are described in its Apple Maps privacy information and the terms applicable to its services. Further information: https://www.apple.com/legal/privacy/data/en/apple-maps/ ### C.1.3 Sign in with Apple and Google Sign-In **Purpose of Processing:** Offering alternative sign-in methods and securely linking external identities to user accounts. **Categories of Personal Data:** Identity provider, Subject ID, transmitted email address, name where available, and an encrypted Apple refresh token where applicable. **Legal Basis:** **Article 6(1)(b) GDPR**. **Recipients and International Data Transfers:** Apple or Google, depending on the authentication option selected. International processing is described in Part A.4.2. **Retention Period:** Until the sign-in method is disconnected or the user account is deleted. Apple refresh tokens are revoked and deleted upon disconnection or account deletion. ### C.1.4 Apple App Attest **Purpose of Processing:** Verifying the authenticity of our iOS application, detecting manipulated clients, and protecting security-sensitive API requests. **Categories of Personal Data:** Cryptographic attestations generated by Apple App Attest, attestation-related identifiers, technical verification results, and any necessary association with an app installation or session. **Legal Basis:** **Article 6(1)(f) GDPR**, based on our legitimate interest in preventing application manipulation and fraudulent access. Strictly necessary terminal-equipment access is governed by **Section 25(2)(2) TDDDG**. **Recipients and International Data Transfers:** Apple through the attestation service and our backend security infrastructure. International processing by Apple may occur. **Retention Period:** Attestation information is processed for the technical verification and security purpose. A specific retention period for stored server-side attestation identifiers must be established. Temporary rate-limit information is deleted within 48 hours in accordance with Part A.5.2. ### C.1.5 Apple StoreKit 2 – In-App Purchases **Purpose of Processing:** Processing, validating, associating, and managing purchases of paid features and subscriptions. **Categories of Personal Data:** Apple transaction identifier, product identifier, purchase and expiration timestamps, transaction status, `appAccountToken`, and refund or cancellation information where applicable. These records are processed in `apple_transactions` where necessary. **Legal Basis:** **Article 6(1)(b) GDPR** for purchase and contract performance; **Article 6(1)(c) GDPR** for legally required record retention. **Recipients and International Data Transfers:** Apple as the App Store and in-app purchase operator, and our backend and billing infrastructure. Apple's international processing is governed by its applicable privacy and international transfer provisions. **Retention Period:** Transaction information is retained for as long as necessary to manage and verify purchased services. Tax-relevant accounting documents are generally retained for **10 years**, in accordance with the applicable statutory requirements. App Store subscriptions can be managed through the subscription settings of your Apple Account. ### C.1.6 Google AdMob, Google UMP, and App Tracking Transparency Our iOS application may display advertising through Google AdMob. For managing data protection consent in the European Economic Area and the United Kingdom, we use the **Google User Messaging Platform SDK (UMP)**. Where tracking within the meaning of Apple's requirements is performed, we also request permission through **App Tracking Transparency (ATT)**. The application declares `NSPrivacyTracking = true`. **Purpose of Processing:** Financing free functionality, delivering advertisements, potentially personalizing ads, measuring advertising performance, detecting fraud, and managing associated consent decisions. **Categories of Personal Data:** Depending on consent and SDK configuration, IP address, device and application information, advertising identifier (IDFA), technical advertising identifiers, advertising interactions, consent status, and other information used for personalized advertising where applicable. **Legal Basis:** **Article 6(1)(a) GDPR** and **Section 25(1) TDDDG** for advertising and tracking activities requiring consent. Other legal bases may apply to separately identified, strictly necessary security processing, provided their requirements are satisfied. **Recipients and International Data Transfers:** Google Ireland Limited, Google LLC, and advertising partners identified in the UMP consent interface where applicable. Transfers to Google LLC in the United States that are covered by its certification may rely on the EU-US Data Privacy Framework under **Article 45 GDPR**. **Retention Period:** Retention of advertising identifiers and advertising data depends on the technologies used and the information provided in the UMP interface. The relevant SDK and consent retention periods must be confirmed before publication. The following principles apply: - Premium subscribers do not receive AdMob advertisements. - Advertising activities requiring consent are activated only in accordance with the applicable consent decisions. - ATT permission does not replace consent required under the GDPR. - Refusal of ATT permission is not circumvented through alternative tracking methods. - Personalized advertising activities requiring consent are not activated without the necessary permission. ATT settings may be changed under **iOS Settings → Privacy & Security → Tracking**. Other consent preferences may be changed using the application's available privacy settings. ### C.1.7 iOS App Privacy – Data Categories Based on the technical information provided, the following data categories are relevant to the privacy disclosures in the Apple App Store. **Data Categories Declared as Linked to the User's Identity:** - Email address - Name - User ID - Purchase history - Telephone number - User-uploaded media - Precise location **Data Categories Declared as Not Linked to the User's Identity:** - Approximate location - Search history - Diagnostic data The classification of data as linked to an individual's identity does not automatically mean that every listed category is transmitted to Google AdMob. The actual use of information for advertising or tracking purposes depends on the implementation and the consent provided. The purpose classifications disclosed in the App Store, particularly those concerning advertising and tracking, must accurately reflect the application's SDK configurations and actual data flows. ### C.1.8 iOS Error Reporting through GlitchTip **Purpose of Processing:** Detecting application crashes, investigating technical errors, and improving stability. **Categories of Personal Data:** Error type, stack trace, device and operating system information, app version, timestamp, and relevant technical diagnostic context. Our GlitchTip configuration uses `sendDefaultPii = false`. Screenshots are not transmitted. URLs are processed without query parameters. **Legal Basis:** **Article 6(1)(f) GDPR**, based on our legitimate interest in maintaining a secure and stable application. **Recipients and International Data Transfers:** Our self-hosted GlitchTip instance and authorized developers or administrators. Technical infrastructure processing is described in Part A.3. **Retention Period:** Error records are kept for the investigation period and an appropriate subsequent verification period. The exact GlitchTip deletion period remains to be established. ### C.1.9 Apple Push Notification Service (APNs) **Purpose of Processing:** Delivering enabled push notifications to iOS devices. **Categories of Personal Data:** APNs push token, app and device association, language, app version, and necessary notification content. **Legal Basis:** **Article 6(1)(b) GDPR** for requested service-related notifications; **Article 6(1)(a) GDPR** for voluntary or promotional notifications, subject to any additional requirements under Section 25 TDDDG. **Recipients and International Data Transfers:** Apple Push Notification service and our notification backend infrastructure. International processing by Apple is subject to its applicable privacy provisions. **Retention Period:** Push tokens are retained until deregistration, account deletion, or technical cleanup. A specific retention period for notification delivery logs remains to be established. Part A.15 also applies. --- ## C.2 Additional Privacy Information for the Android Application ### C.2.1 Android Location Permissions and Foreground Service Our Android application may request access to approximate and precise location. A **Foreground Service** may be used to provide ongoing navigation guidance. **Purpose of Processing:** Nearby search, active navigation, route guidance, and geographic recording for authorized users. **Categories of Personal Data:** Approximate or precise location depending on permissions, position changes during active navigation, navigation status, and recorded route coordinates where applicable. **Legal Basis:** **Article 6(1)(b) GDPR** for requested navigation functionality. Additional optional location processing is based on **Article 6(1)(a) GDPR**. Terminal-equipment access is subject to **Section 25(1) or Section 25(2)(2) TDDDG**, as applicable to the particular feature. **Recipients and International Data Transfers:** Our backend infrastructure and, where applicable, integrated routing and geographic service providers. Details are provided in Section C.0.1. **Retention Period:** Processing takes place during the relevant location or navigation functionality. Backend routing responses are cached for **24 hours**. Separately stored route recordings are subject to the feature-specific retention rules in Part A. Permissions may be changed through Android's application and location permission settings. The use of a Foreground Service supports continuous navigation but does not mean that the application is intended to store a movement history independently of active use. ### C.2.2 MapLibre and OpenStreetMap Maps Our Android application uses **MapLibre** to display interactive maps and obtains map tiles from the OpenStreetMap Foundation. **Purpose of Processing:** Displaying maps, supporting geographic orientation, and providing visual navigation and place information. **Categories of Personal Data:** IP address, technical request information, User-Agent, requested map regions, and zoom levels. **Legal Basis:** **Article 6(1)(b) GDPR** where map transmission is necessary for an expressly requested functionality. **Article 6(1)(a) GDPR**, together with **Section 25(1) TDDDG**, may be required for optional or non-essential external map and terminal-equipment access. **Recipients and International Data Transfers:** OpenStreetMap Foundation, United Kingdom. The United Kingdom benefits from an adequacy decision under **Article 45 GDPR**. **Retention Period:** Map data is processed for display and, where permitted, local caching. Technical server logs maintained by OSMF are subject to its privacy provisions. Specific local cache retention periods must be established according to the app configuration. MapLibre itself is a software library. External data transfers primarily arise when requests are made to the configured map tile provider. ### C.2.3 Google Play Integrity **Purpose of Processing:** Detecting modified application versions, preventing automated attacks, securing API functionality, and reducing fraudulent use. **Categories of Personal Data:** Integrity tokens and verification results provided by Google Play Integrity, together with technical information necessary for server-side verification. **Legal Basis:** **Article 6(1)(f) GDPR**, based on our legitimate interest in application security, fraud prevention, and service integrity. Strictly necessary terminal-equipment access is governed by **Section 25(2)(2) TDDDG**. **Recipients and International Data Transfers:** Google Ireland Limited, Google LLC, and our backend security infrastructure. Transfers to Google LLC covered by its certification may rely on the EU-US Data Privacy Framework under **Article 45 GDPR**. **Retention Period:** Integrity information is processed during the verification operation. The retention period for separately stored verification results must be established. Temporary rate-limit records are deleted according to the periods specified in Part A.5.2. ### C.2.4 Google Play Billing – Purchases and Credits **Purpose of Processing:** Processing purchases, managing subscriptions, verifying purchase entitlements, and managing acquired credits where applicable. **Categories of Personal Data:** Google Play transaction and purchase identifiers, product identifiers, purchase timestamps, purchase status, subscription information, account association, and credit balances or usage information. The information is processed in `google_play_purchases` and `google_credits` where necessary. **Legal Basis:** **Article 6(1)(b) GDPR** for contract performance; **Article 6(1)(c) GDPR** for tax and accounting obligations. **Recipients and International Data Transfers:** Google as the Google Play billing operator and our backend and billing infrastructure. International transfers may involve Google LLC. Where covered by its certification, transfers may rely on the EU-US Data Privacy Framework. **Retention Period:** Purchase and credit records are retained as necessary to manage contractual rights and entitlements. Accounting records subject to statutory retention obligations are generally retained for **10 years**, in accordance with applicable law. Subscriptions can be managed through Google Play's subscription management settings. ### C.2.5 Google AdMob and Google UMP Our Android application uses Google AdMob to display advertisements and the Google UMP SDK to obtain and manage required consent. **Purpose of Processing:** Financing free application features, displaying advertisements, potentially personalizing advertising, measuring advertising performance, and managing consent. **Categories of Personal Data:** Depending on consent, IP address, device information, app version, advertising identifier, technical advertising identifiers, advertising interactions, consent status, and additional information used for personalized advertising where applicable. **Legal Basis:** **Article 6(1)(a) GDPR** and **Section 25(1) TDDDG** for advertising technologies requiring consent. Separate, strictly necessary security processing may rely on other legal bases where their requirements are fulfilled. **Recipients and International Data Transfers:** Google Ireland Limited, Google LLC, and additional advertising partners identified in the UMP interface where applicable. Transfers to Google LLC covered by its certification may rely on the EU-US Data Privacy Framework under **Article 45 GDPR**. **Retention Period:** Retention depends on the advertising and consent technologies used. The actual retention periods and technical identifiers must be verified against the AdMob and UMP configuration before publication. Premium users do not receive AdMob advertisements. Consent can be changed or withdrawn through the available privacy settings. Personalized advertising activities requiring consent are not activated without the necessary permission. ### C.2.6 Firebase Cloud Messaging (FCM) **Purpose of Processing:** Delivering push notifications to Android devices. **Categories of Personal Data:** FCM registration token, platform, language, app version, associated account where applicable, dispatch information, and notification content. **Legal Basis:** **Article 6(1)(b) GDPR** for requested service-related notifications; **Article 6(1)(a) GDPR** for voluntary or promotional notifications. Additional requirements under Section 25 TDDDG may apply. **Recipients and International Data Transfers:** Google or Firebase and our backend infrastructure. Processing in the United States may occur. Google LLC is certified under the EU-US Data Privacy Framework. **Retention Period:** Registered push tokens are retained until deregistration, account deletion, or technical cleanup. The retention periods for notification delivery logs and inactive tokens remain to be established. Part A.15 also applies. ### C.2.7 Firebase Crashlytics – Android Error Diagnostics We use **Firebase Crashlytics** by Google to identify technical application crashes. Crashlytics is enabled only in Release builds. **Purpose of Processing:** Detecting crashes, diagnosing technical errors, investigating application stability, and correcting software defects. **Categories of Personal Data:** - Device model - Android operating system version - Application version or build - Error and crash timestamps - Stack traces - Technical diagnostic and session information - Installation or diagnostic identifiers generated by the SDK where applicable **Legal Basis:** **Article 6(1)(f) GDPR** may apply to data-minimized processing limited to necessary technical error diagnostics. Where the SDK stores or accesses information on terminal equipment for purposes that are not strictly necessary, consent under **Article 6(1)(a) GDPR**, together with **Section 25(1) TDDDG**, is required. **Recipients and International Data Transfers:** Google Ireland Limited or Google LLC in connection with Firebase Crashlytics. Processing in the United States may occur. Transfers covered by Google LLC's certification may rely on the EU-US Data Privacy Framework under **Article 45 GDPR**. **Retention Period:** Google states that Crashlytics crash stack traces and associated identifiers are retained for 90 days before their deletion process begins. The retention periods actually applicable to our Firebase project, including any separate copies stored in our own systems, must be verified. Enabling Crashlytics only in Release builds means this integration is not active in internal development builds of the application. However, limiting deployment to Release builds does not remove the need to assess the SDK's data processing practices under applicable privacy law. ### C.2.8 ExoPlayer – Public Webcam Streams from Pamporovo Our Android application may display publicly available live webcam streams from the Pamporovo region using the ExoPlayer media player. **Purpose of Processing:** Playing publicly accessible live video streams showing local conditions. **Categories of Personal Data:** Requested stream URL, technical network and connection information, IP address, playback timestamp, and device or player information where applicable. **Legal Basis:** **Article 6(1)(b) GDPR** for providing the video stream expressly requested by the user. Where playback requires a connection to an external streaming provider, the relevant transmission is necessary to deliver the selected stream. **Recipients and International Data Transfers:** The operator or hosting provider of the respective webcam stream, where the device accesses the stream directly. The specific stream operators and server locations must be identified. Where the stream is delivered exclusively through a backend proxy, international transfer arrangements depend on the actual proxy architecture. **Retention Period:** Stream data is processed during playback and, where necessary, temporarily buffered by the media player. Permanent recording of viewed webcam streams by our application is not intended under the described implementation. Any technical access logs maintained by external streaming providers are subject to their respective privacy policies. ExoPlayer is a media playback component. The use described here does not inherently involve independent transmission of usage information to Google by the library itself. ### C.2.9 Android Account Deletion and App Data Users can request deletion of their accounts through the available account deletion functionality or through the Legal Center. **Purpose of Processing:** Terminating user accounts and fulfilling statutory data deletion obligations. **Categories of Personal Data:** User identifier, associated profile information, messages, reviews, visit history, push tokens, linked identities, and relevant transaction information. **Legal Basis:** **Article 6(1)(c) GDPR**, in conjunction with statutory deletion and accountability obligations, including **Article 17 GDPR**; additionally, **Article 6(1)(b) GDPR** for carrying out the account termination process. **Recipients and International Data Transfers:** Our backend and deletion infrastructure and, where necessary, external identity or payment providers involved in disconnecting accounts or invalidating tokens. **Retention Period:** Account-associated data is removed according to the deletion procedures described in Part A.20. Exceptions apply to lawfully retained accounting records, necessary evidence concerning reported violations, and automatically rotating encrypted backups retained for a maximum of **56 days**. Uninstalling the Android application does not automatically delete an existing account stored on our servers. --- ## C.3 Managing App Permissions and Privacy Preferences You can manage the following settings at any time through the applicable operating system or application controls: - Location access and location accuracy - Push notification permissions - Consent for personalized advertising - iOS App Tracking Transparency, where applicable - Optional location and diagnostic features - Linked authentication providers - Account deletion and privacy requests Refusing a permission may make the associated feature unavailable or limit its functionality. Core functions that do not require the relevant permission generally remain available. The general rights and contact options in Part A.21 apply to both mobile applications.