Data protection policy

1. Who are we?

This information on the protection of personal data applies to the processing carried out by
the Data Controller:

MACADAM TECHNOLOGIES SL
Registered office at Diagonal, 472, 6-4, 08006 Barcelona, Spain
TIN: B44845337

("We")

via the Apple or Android mobile app Macadam (hereinafter referred to as "Macadam" or "the App").

With your freely given, specific, informed and unambiguous consent of the relevant data
subject, We will process data on a lawful, loyal and transparent ground, and We commit to
comply with the legal obligations imposed by Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 (the “GDPR”), the Spanish Organic Law
3/2018, of 5 December 2018, for the Protection of Personal Data and the Guaranteeing of
Digital Rights (“LOPD-GDD”) and the European and Spanish developing regulation in force
(hereinafter, the “Data Protection Regulation”).

Our data protection officer can be contacted at the above address for the attention of
Benjamin Daudignac or at the e-mail address contact@macadam.app.

2. What data do we process?

As data controller, we collect and process the following data about you:

• Information you provide to us: the personal data you provide to us, for example when
  you fill in a form on the App or you register in Macadam, that is your login details
  (username, password), first and last name, email address, telephone number,
  country, date of birth, photo, relationship to the person you are sponsoring,
  challenges you take on, adverts you view (personal interests), promotional codes
  chosen and used. You may also provide us with certain data relating to your physical
  condition (weight, height).
  

• Information collected via your smartphone:
  • contact list with your express consent.

• Sensitive personal data:

  With your consent, we collect sensitive data from your phone or from external partners such as Google, Fitbit or Apple.

  List of the sensitive data collected by Macadam app, when consent is given:

  • Health: Number of steps, Energy burned and distance walked.

• Information provided by third party partners –these are third parties with whom we
  maintain a collaborative relationship (hereinafter, the “Partners”)–:
  
  • email address, last name, first name and profile picture of the Google account
    if you log in to Macadam via this account.
    
  • use of a promotional code on the Partner’s website.

• Information needed to personalise advertisements you watch on the App: your
  phone's advertising ID, clickstream on the App (including clicks), your date of birth,
  your country.
  

• Bank details (IBAN) and proof of identity if you wish to receive a transfer from us in
  connection with the use of Macadam. We collect and process this data exclusively
  for the purpose of carrying out the bank transfer and we will never use this data
  for any other purpose. In addition, once the transfer has been made, we archive
  your data and the proof of payment in a secure manner, i.e. only the persons
  expressly authorised by Macadam can access them, for specific purposes such as
  compliance with legal accounting obligations or the defence of our interests in
  the event of a dispute with the user concerned. This data is then deleted in
  accordance with applicable legal requirements (generally after 5 years).
  

• Our correspondence: if you contact us, we will usually keep a copy of that
  correspondence.
  

• Survey and research information: We may also ask you to complete surveys,
  research, questionnaires, from Macadam or third-party partners. In this case, we
  collect the data provided in the completed survey for our own purposes or for
  transmission to our third-party partners.
  

• Information we may collect about you as part of an audit of your use of the App:
  provisional ranking of Macadam users, suspicious behaviour, cheating, etc. To learn
  more about prohibited behavior when using Macadam, please see our Terms of
  Service.
  

• App and communications usage: details of your visits to the App and information
  collected through trackers and other tracking technologies, including, but not limited
  to, your IP address and domain name, browser version and operating system,
  browser language, access time, traffic data, location data, movements on the App,
  third party website you access or which you’re coming from and other
  communications data. We may also collect information about the pages you view on
  the App and other actions you take during your visit. In addition, we may also use
  these technologies to determine whether you have opened an e-mail or clicked on a
  link in an e-mail.
  

3. Why do we process this data?

As a rule, we only collect the data we really need, and only do so when the need arises.
Data which processing is justified for a specific purpose may only be re-used for other
purposes if this further use is itself legally justified.
We use this data for the following purposes.

Registering as a Macadam user and using the App

When you log in to the App for the first time, we collect your personal data to provide you
with a Macadam account. Then, when you use the App, we collect and process your data to
provide you with our services: to evaluate your actions (physical movement, viewing of
advertising content, sponsorship, Macadam challenges...) in order to convert them into
points and to award you rewards.
Please note that the provision of certain data (marked as such) is mandatory to create an
account and without this data we will not be able to provide access to the Macadam App or
services. For example, if you refuse to allow Macadam to access your physical activity data,
we will not be able to know how many steps you have taken in a day and convert them into
points.
Legal basis: performance of our contract with you; your consent where required by law; and
our legitimate interest (to facilitate the provision of our products and services).

Solve all your informative enquiries

In the event that you have contacted us through any of our channels, we will process your
personal data to respond to your request for information regarding our services, as well as to
provide you with technical assistance support if necessary.
Legal basis: your consent

Personalization of the advertising to be watched on the App in order to collect points

Among the actions available on Macadam to collect points and increase your prize pool, you
can choose to watch/view advertising content from our third-party partners.
Legal basis: your consent and our legitimate interest (to improve the experience of users of
the App).

Sharing your data with third-party partners for advertising purposes

If you authorise us to do so, we share your personal data with our third-party partners whose
advertising is available on the App. This allows them to contact you by email to offer you
their products and services. Please note that if you click on the advertisement, you will be
taken to the third-party partner's website and your personal data may be collected via that
site, outside of Macadam's control. Please refer to the partner's privacy policy for more
information on how they handle your data.
Legal basis: your consent.

Subscription to our newsletter/email advertising

If you have expressly consented or if you have already created a Macadam account, we may
use your e-mail address to send you news and advertising from Macadam. You can
unsubscribe at any time by clicking on the link in the e-mail.
Legal basis: your consent and/or our legitimate interest (to send you news and offers related
to our products and services).

Improving the App and our services

We collect your data to gather statistics about the use and effectiveness of the App using
various technologies and to personalise your experience while on the App, as well as to
tailor our interactions with you.
We may also anonymise your personal data in order to produce statistics on (i) the use of
the App, (ii) the advertising content viewed, (iii) our users and their physical activities, (iv) the
Macadam services. In this case, the only processing carried out on your personal data is
anonymisation and no identifying data is included in the results of the statistics. These
anonymous statistics may be communicated to our partners so that they can evaluate their
partnership with Macadam. Once anonymized, this data will no longer be considered
personal data.
Legal basis: your consent where required by law; our legitimate interest in improving our
services.

Detection of suspicious behaviour and cheating

We may use your personal data to verify and monitor your use of the App. For example, we
may cross-reference data to identify false data, false accounts, or the existence of multiple
accounts for the same user, as well as the sources of certain data to verify how points were
collected. To learn more about prohibited behavior when using Macadam, please see our
Terms of Service.
Legal basis: our legitimate interest in monitoring suspicious and prohibited behaviour on the
App in order to provide our services properly.

Reorganisation of our activity and/or structure

In the event that we: (i) are in negotiations to sell our business or a portion thereof to a third
party; (ii) are sold to a third party; or (iii) undergo a reorganization, we may need to transfer
some or all of your personal data to the relevant third party (or its advisors) as part of any
due diligence process for the purpose of reviewing any proposed sale or reorganization. We
may also need to transfer your personal data to the reorganised entity or third party after the
sale or reorganisation, for them to use for the same purposes as set out in this policy.
Legal basis: our legitimate interest in making changes to our business.

4. Sensitive personal data usage

If you authorized us, Macadam will get access to specifically requested sensitive personal data, listed below:

• Steps count

• Distance walked

• Energy burned

These sensitive data aren’t shared to third-party partners and subcontractors.
We do not transfer or disclose your information to third parties for purposes other than the core value proposition of Macadam.

5. With whom do we share this data?

We work with the following subcontractors who assist us in achieving the purposes
mentioned in section 2 above.

GOOGLE: for hosting and storing your data

MOENGAGE: to provide core communication service with our users

ZENDESK: to provide support services to our users

We also work with service providers who help us measure and improve the performance of
our services and the App, for example Mixpanel, Adjust.
The above will process the data in their capacity as data processors, in accordance with the
instructions given by us, the Data Controller, and with whom we have entered the
corresponding agreement of data processing.
We contractually require these service providers to maintain the confidentiality of your
personal data and not to use it for any purpose other than that necessary to perform our
contract with them.

We also share your personal data with :

• other third-party recipients such as our banks, our advisors, legal and regulatory
  authorities where required by law, judicial or administrative authorities in the event of
  a dispute between you and us.
  We hold your personal data within the European Economic Area (EEA). However, for the
  purposes set out in this policy, it is sometimes necessary for us to provide some of your data
  to processors and recipients outside the European Economic Area (EEA). Where we do so,
  we will ensure that such transfers provide an appropriate level of protection for personal
  data.
  Some countries outside the EEA have been approved by the European Commission as
  providing protections substantially equivalent to EEA data protection laws, and therefore no
  additional safeguards are required to export personal data to these jurisdictions.
  In countries that do not have such approvals (listed here:
  
  http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm),
  we use EU-approved "standard contractual clauses" to ensure that data protection
  safeguards equivalent to those required in the EEA are applied.
  Please contact us if you would like a copy of the safeguards we apply in relation to the
  export of your personal data.
  

6. What are your rights?

Macadam is committed to protect your privacy and the confidentiality of your personal
information. For such reason we will give you an adequate response when you request the
exercise your rights. You may exercise your rights by sending an email to our address
contact@macadam.app duly identifying yourself and clearly indicating the purpose of your
request.
Specifically, in accordance with the GDPR, you have the following rights:

• Right of access: you have the right to request access to the personal data we are
  processing and to obtain information about the processing we are doing;
  

• Right to rectification: if the personal information we hold about you is inaccurate,
  incomplete or obsolete, you are entitled to request its rectification.
  

• Right to erasure: you can ask us to delete or remove your personal data in some
  circumstances, such as when you consider that its processing is unnecessary or
  illegitimate;
  

• Right to restrict processing: you can ask us to limit the processing of your personal
  data in certain circumstances such as where you contest the accuracy of that
  personal information or object to us processing it.
  

• Right to data portability: you have the right, in certain circumstances, to obtain
  personal information you have provided us with, in a structured format, commonly
  used and machine-readable format, and to ask us to transfer this to another third
  party of your choice.
  

• Right to object: you can ask us to stop processing your personal information, on a
  legal basis, in relation to you or if it significantly affects you, unless the processing is
  necessary for reasons of public interest;
  

• Rights in relation to automated decision-making and profiling: you have the right to
  object to the automated processing of your data, including its processing for
  profiling purposes in the case you have previously authorized us to do so, when it
  produces a legal effect or significantly affects you;
  

• In the event that Macadam does not answer a query regarding your exercise of your
  rights, you have the right to file a complaint to the Spanish supervisory authority
  (“Agencia Española de Protección de Datos”) via the link
  www.aepd.es, by phone
  901 100 099 or by post at the address Agencia Española de Protección de Datos,
  C/Jorge Juan nº 6, 28001, Madrid, Spain.
  

• As a general rule, you can contact the supervisory authority at your usual place of
  residence, your place of work or at our company's headquarters. You will find a list
  of the contact details of the competent European authorities here: http: /
  /ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/i
  ndex_en.htm.
  

• You may have additional rights under the national law of your place of residence.
  If your personal data is processed on the basis of legitimate interests, you have the right, in
  accordance with Article 21 of the GDPR, to object to the processing of your personal data,
  insofar as there are reasons related to your particular situation or if the objection is directed
  against direct advertising. In the case of Macadam advertising, you can exercise your right
  by clicking on the link provided in the communications we send you, or by sending an email
  to contact@macadam.app.
  

7. How is the security of your data ensured?

Macadam implements appropriate technical and organisational security measures to protect
personal data against accidental or unlawful destruction, loss, alteration, diffusion or
unauthorised access, and to preserve the confidentiality, integrity and quality of the personal
data provided. We also ensure that our employees and data processors are suitably
qualified and trained to protect your personal information and ensure its confidentiality.
Macadam cannot guarantee the absolute security of personal data. In the event that
Macadam becomes aware of a security breach, i.e. a loss of availability, integrity or
confidentiality of data, either accidentally or unlawfully that constitutes a risk to your rights,
Macadam undertakes to notify the relevant data protection authority, in Spain the Data
Protection Agency (in Spanish: Agencia Española de Proteccion de Datos) and, if
necessary, to inform you.
You are responsible for maintaining the confidentiality of your Macadam username and
password. We recommend that you never share this password.

8. How long will your data be kept?

Our retention periods for personal data are based on business needs, legal requirements or
during the necessary time to comply with your request. We retain personal data for as long
as necessary for the processing purpose(s) for which the information was collected, and any
other related permitted purposes or until you unsubscribe or request not to receive our
informative and commercial communications about our services.
We can keep your personal data longer, even after you stop using our service, when
required to do so by law, under a Court order or in response to lawful demands of public
administrations and officials, in which case your personal data will be duly kept, protected
and blocked from of all our systems, to prevent their access and processing. Once the
possible actions prescribe, we will proceed to the removal of your personal data or, as the
case may be, to irreversible anonymization so that it cannot be related to anyone.

9. Amendment of this policy

This data protection policy is currently in force and was updated in March 2023.
We reserve the right to modify this Privacy Policy in accordance with the regulations in force
at any time. Any changes to this policy will be published via the App and will be binding upon
published. We encourage you to periodically visit this Data Protection Policy to acknowledge
about how we process and protect your personal data.
Any questions or queries regarding this Privacy Policy must be addressed to the following
address: MACADAM TECHNOLOGIES, S.L., Diagonal nº 472, 6-4 08006, Barcelona, Spain,
o via email to: contact@macadam.app.

10. Data Protection Officer

Macadam has appointed a Data Protection Officer, who will hold responsibility for the
supervision and the ensuring of the compliance with this Privacy Policy, in relation to any
processing of personal data of our data subjects.
Last update: March 2023.