Privacy Policy

1. Introduction

1.1 Welcome to Mygocu's Privacy Policy.

1.2 We consider the protection of your privacy to be extremely important. We are bound by and use your personal data in accordance with the Spanish Act 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (the "Spanish Data Act"), the General Data Protection Regulation 2016/679 of April 27th 2016 (the "GDPR") and the Spanish Act 34/2002, of July 11, on Information Society Services and Electronic Commerce (the "Spanish eCommerce Act").

2. Data Controller

3. What personal data do we collect and how?

3.1 Personal data shall mean any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to physical, physiological, genetic, mental, economic, cultural or social identity.

3.2 We currently collect and process the following personal data of our website and digital platform (the "Platform") users:

• personal identifiers and contact details (for example, name, email, password and phone number);

• payment details (for example, credit/debit card information and transaction data);

• cookies, provided that Platform users' consent is dully collected, when mandatory;

• data from social media user's profiles that interact with us such as pictures, videos, nickname, profile, posts, or other information made publicly available by users to us; and

• other personal data you may voluntarily disclose to us when you use our Platform at any time or is generated in the course of our communications.

3.3 Finally, please note that, by providing us with your data, you guarantee the truthfulness and/or accuracy of this data. Consequently, you will be liable for any false or inaccurate statements you make, as well as for any damages caused to Mygocu or third parties as a result.

4. Other information we collect about you and information we receive from third-party sources

4.1 We may also receive personal data indirectly from our partners or third parties outside Mygocu where you have agreed to receive information about our services and/or where this data sharing is necessary for providing you with our services.

5. What do we use your data for? Which are our legal grounds for that?

6. Who will your data be shared with?

6.1 We share this information with:

• Mygocu collaborators: We may share your data with our trusted collaborators (in accordance with data processing agreements in place with those entities) for operational purposes, and in cases where such data communication is controller to controller, we will rely on legitimate interest to facilitate business operations, and support collaborative efforts with these third parties, for example, travel agencies.

• Providers: We will grant access to your personal data to those providers who require such access to deliver their services to us, such as cloud hosting, accounting, IT services, cloud platforms, CRM providers, consultants or collaborators and legal advisors, and any other third party helping us in organizing and/or managing the Platform. Before sharing any of your personal data with our external providers when acting as our (sub)processors, we require them to sign a data processing agreement pursuant to Art. 28 GDPR, confirming that your data will be kept secure. This means that in such cases we determine the purpose for which and the manner in which your data is to be processed, and the data (sub)processor is only allowed to handle your data according to the instructions and security standards that we follow.

• Other: We will share your personal data with third parties if we are required to do so by law, by an administrative or judicial authority, or in the public interest or for public order, such as, for example, to comply with anti-money laundering and counter-terrorism regulations, tax or social security obligations.

6.2 Finally, in the event of a business restructuring, merger, split, or sale, we may transfer all of your personal information to the third party arising from such transaction based on legitimate interest in accordance with article 21 of Spanish Data Act.

7. How do we protect your personal data?

7.1 We take all reasonable and appropriate technical and organisational measures to protect the security of your personal data throughout the course of our business, taking into consideration the risks associated to the processing activities being carried out. Technical safeguards are for example restrictive access, encryption, antivirus software, regular testing and evaluation.

8. Do we carry out international transfers?

8.1 We do not carry out international transfers of data. We store all your personal data within the EU (in particular, in Ireland).

8.2 In the event that in the future we need to contract a service provider, for example an IT provider, whose servers are located outside the European Economic Area (EEA) and, therefore, an international transfer is needed, we will execute all necessary contractual agreements or other measures with any recipients of your information to ensure your personal data will be equally protected.

9. How long will we keep your personal data for?

9.1 We keep the information we collect only for as long as necessary for the purpose we collected it. We may also store your data for dealing with any complaints regarding our products and services. We will then dispose of your information by removing all files and back-ups from all personal computers, one drive and hard drive. Our retention periods are being determined as per the legal requirements.

9.2 Prior to deleting any personal data, our company will retain it dully blocked, in order to comply with the legal obligation envisaged under Article 32 of the Spanish DP Act.

10. How do we approach to children's privacy?

10.1 Our Platform is designed and intended for adults. We understand the importance of taking extra precautions to protect the privacy and safety of children.

10.2 If you learn that a child has, in violation of this Privacy Policy, registered for email newsletters, or otherwise provided their personal data, please report it to us infoⓐmygocu.com. If we become aware that an underage user has provided Personal Data without parental permission, we will delete all Personal Data provided by that user to the extent feasible and as soon as practicable.

11. What are your rights?

11.1 You are not required to pay any charge for exercising your rights (but a fee may be charged when requests are unfounded, excessive or repetitive). If you exercise any of the data protection rights detailed below, we have one month to respond to you, although we will do our best to provide you with a response in less than a month. In any case, pursuant to applicable data protection regulations, please note that such time period may be extended for extra 2-months period, if needed.

11.2 Under data protection law, you can exercise the following rights:

• Your right to withdraw consent - You can withdraw your consent at any given time by contacting us at infoⓐmygocu.com.

• Your right of access - You have the right to ask us for copies of your personal data.

• Your right to rectification - You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

• Your right to erasure - You have the right to ask us to erase your personal data in certain circumstances i.e., if your personal data are no longer necessary for the purpose they were collected for or if you withdraw your consent.

• Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal data in certain circumstances i.e., if you think that the information we process is inaccurate or unlawful.

• Your right to object to processing - You have the right to object to the processing of your personal data only if we process the relevant information on legitimate or public interest grounds.

• Your right to data portability - You have the right to ask that we transfer the personal data you directly gave us to another organisation, or to you, if we process the relevant information on consent or contract grounds.

• Your right to not be subjected to a decision based solely on automated processing - You have the right to ask not to be subjected to a decision based solely on automated processing which produces legal effects concerning you or significantly affects you in a similar way, if the legal requirements are not met.

11.3 Without prejudice to any other remedies, you also have the right to lodge a complaint with the competent supervisory authority at any time, in accordance with your place of residence. In the case of Spain, this is the Spanish Data Protection Agency (AEPD). You may enquire about the different supervisory authorities by contacting us at infoⓐmygocu.com In any case, before initiating any complaint, please contact us by e-mail in order to try to resolve any discrepancy or dispute amicably.

12. How to contact us

12.1 Please contact us at infoⓐmygocu.com if you wish to make a request or complaint or have any questions on how we use your personal data.

12.2 You can also contact us through the means set out in section 2 above.

13. How do we keep this Privacy Policy up to date?

13.1 We may update this Privacy Policy periodically and will revise the date at the bottom of this Privacy Policy to reflect the date when such update occurred. If we make any material changes in the way we collect, use, and/or share the personal data that you have provided, we will endeavour to provide you with notice before such changes take effect, such as by posting prominent notice on our Platform.

13.2 We encourage you to periodically review this page for the latest information on our privacy practices.