USER INFORMATION

Who is the controller of your personal data?

QUKO TECH, S.L. is the Controller of the USER's personal data and informs him/her that these data shall be processed in accordance with the provisions of Regulation (EU) 2016/679 of 27 April (GDPR) and the Organic Law 3/2018 of 5 December (LOPDGDD).

For what purpose do we process your personal data and why do we do it?

Depending on the form from which we have obtained the personal data, we will process it confidentially for the following purposes:

In the form Contact

• Respond to queries or any type of request made by the user through any of the contact methods available at the controller's website.
  (for the legitimate interest of the person in charge, art. 6.1.f GDPR)
• Conduct statistical analysis and market research.
  (for the legitimate interest of the person in charge, art. 6.1.f GDPR)

In the provision of the platform's main service

• Create and manage the USER's account, allow access to the platform and provide services for uploading, storing, organizing, displaying, analyzing and comparing sports, technical, performance and, where applicable, biometric data generated by the USER, their devices, their training or competition sessions, or by people and entities authorized within the platform.
  (for the performance of the requested service, art. 6.1.b GDPR, and based on the data subject's consent where applicable, art. 6.1.a GDPR)
• Manage athlete profiles, coaches, licenses, access permissions, session histories, reports, charts, derived metrics and analysis features necessary for the ordinary use of the platform.
  (for the performance of the requested service, art. 6.1.b GDPR, and for the controller's legitimate interest in maintaining service security and quality, art. 6.1.f GDPR)

In integrations with third-party APIs

• Import, store, organize, display and analyze the sports, activity, technical and, where applicable, health or biometric data that the USER expressly authorizes through third-party services connected to the platform, including session data, activity files, location, heart rate, breathing rate, sleep or equivalent indicators, always within the permissions granted by the USER.
  (based on the data subject's consent, art. 6.1.a GDPR, and for the provision of the requested service, art. 6.1.b GDPR)
• Allow the USER to manage connections with external services, revoke authorizations and request deletion of data imported from those APIs, without prejudice to any legal retention obligations that may apply.
  (based on the data subject's consent, art. 6.1.a GDPR, and on legal obligation where applicable, art. 6.1.c GDPR)

For how long will we keep your personal data?

Data shall be stored for no longer than is necessary to maintain the purpose of the processing or for as long as there are legal prescriptions dictating their custody, and when such purpose is no longer necessary the data shall be erased with appropriate security measures to ensure the anonymization of the data or their complete destruction.

To whom do we disclose your personal data?

No communication of personal data to third parties is foreseen except, where necessary for the development and execution of the purposes of the processing, to service providers acting on behalf of the CONTROLLER, limited to the data strictly necessary for those services and subject to the confidentiality and data processor contracts required by current privacy regulations. This exception does not apply to the sensitive biometric data or third-party API data described below.

Sensitive biometric data, such as heart rate, breathing rate or equivalent physiological indicators, shall never be shared with external third parties or with artificial intelligence agents. Data obtained from third parties through APIs or other integrations shall also never be shared with external third parties or artificial intelligence agents.

Other generic sports data, including aggregated or derived results from a training session, may only be sent to artificial intelligence agents when the USER has previously authorized the use of those services. This generic sports data shall not be shared with any other external third parties.

Payments. When the USER purchases a licence or subscription online, the transaction is concluded with Armitage Labs OÜ (trading as “Creem”), Rotermanni 14, 10111 Tallinn, Estonia, registry code 16977866, acting as authorised reseller and merchant of record. Armitage Labs OÜ processes, as an independent controller, the data needed to take the payment, calculate and remit the applicable taxes, issue the invoice and prevent fraud: name, email address, billing address and country, payment-method identifier and amount. The CONTROLLER never receives or stores full card or other payment-method details; it receives from Armitage Labs OÜ only the payment confirmation, the billing country and the identifiers needed to activate and renew the licence. Armitage Labs OÜ is established in the European Union, so this processing does not involve an international transfer of data to a third country. Its own privacy policy is available at creem.io/privacy.

What are your rights?

The rights of the USER are:

• Right to withdraw consent at any time.
• Right of access, rectification, portability and erasure of your data and the limitation or objection to their processing.
• The right to file a claim with the Spanish Supervisory Authority (www.aepd.es) if you consider that the processing does not comply with the current legislation.

Contact information for exercising rights:
QUKO TECH, S.L. — Rúa Canabés de Abaixo, 5 4ºC - 36940 Cangas, Pontevedra, Spain.
E-mail: contacto@quko.es

COMPULSORY OR OPTIONAL NATURE OF THE INFORMATION PROVIDED BY THE USER

The USERS, by marking the corresponding boxes and entering data in the fields, marked with an asterisk (*) in the contact form or download forms, accept expressly and in a free and unequivocal way that their data are necessary for the supplier to meet their request, voluntarily providing their data in the remaining fields. The USER ensures that the personal data provided to the CONTROLLER are true and is responsible for communicating any changes to them.

The CONTROLLER informs that all data requested through the website are mandatory, as they are necessary for the provision of an optimal service to the USER. In the event that not all of the data is provided, there is no guarantee that the information and services provided will be completely adapted to the User's needs.

SECURITY MEASURES

That in accordance with the provisions of the current regulations on the protection of personal data, the CONTROLLER is complying with all the provisions of the GDPR and LOPDGDD regulations for processing the personal data for which they are responsible, and is manifestly complying with the principles described in Article 5 of the GDPR, by which they are processed in a lawful, fair and transparent manner in relation to the data subject and appropriate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

The CONTROLLER guarantees that all appropriate technical and organisational policies have been implemented to apply the security measures established by GDPR and LOPDGDD in order to protect the rights and freedoms of the USERS, and has communicated the appropriate information for them to be able to exercise their rights and freedoms.

For more information about privacy safeguards, you can contact the CONTROLLER via QUKO TECH, S.L. — Rúa Canabés de Abaixo, 5 4ºC - 36940 Cangas, Pontevedra, Spain.
E-mail: contacto@quko.es