Privacy Policy

Last Updated: 27 May 2025

This Privacy Policy informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data. It is compliant with the General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD).

We use your data to provide and improve the Service. By using the Service and explicitly consenting at sign-up, you agree to the collection and use of information in accordance with this policy.

1. DATA CONTROLLER

• The data controller(s) for your personal data are Anna Routledge and Santiago Cuenca, contactable at info@joinwavey.com.

• This section will be formally updated upon business registration.

2. INFORMATION COLLECTION AND USE

We collect several different types of information for various purposes to provide and improve our Service to you.

Types of Data Collected:

Personal Identifiable Information (PII):

• Email address

• First name and last name

• Date of birth (for age verification, minimum 18 years to use the service)

• Location (general area, e.g., city/region for event planning, as provided by you)

• Instagram handle (optional, for verification if provided by you)

• Profile picture (optional, if uploaded by you)

• Description/Bio (if provided by you)

Usage Data:

• Chat messages and content shared within the app (stored on Google Firestore)

• App interaction data (features used, time spent, crash logs)

Device Information:

• We may collect information about the device you use to access our Service, such as IP address, operating system version, device identifiers (for security and analytics).

3. PURPOSE OF DATA PROCESSING AND LEGAL BASIS (GDPR & LOPDGDD)

We use the collected data for the following purposes, with their corresponding legal bases:

• To provide and maintain our Service (e.g., account creation, chat functionality): Art. 6(1)(b) GDPR (performance of a contract).

• To verify user eligibility (age verification for 18+ community): Art. 6(1)(b) GDPR (performance of a contract).

• To facilitate event planning and communication: Art. 6(1)(b) GDPR (performance of a contract).

• To personalize your experience (e.g., showing relevant content): Art. 6(1)(a) GDPR (consent, if specific consent is sought for certain personalization).

• To notify you about changes to our Service or important updates: Art. 6(1)(b) GDPR (performance of a contract).

• To provide customer support: Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest to assist users).

• To gather analysis or valuable information to improve our Service: Art. 6(1)(f) GDPR (legitimate interest to enhance the app).

• To monitor the usage of our Service and ensure security: Art. 6(1)(f) GDPR (legitimate interest to protect our service and users).

• To detect, prevent and address technical issues or policy violations: Art. 6(1)(f) GDPR (legitimate interest).

• To comply with legal obligations (e.g., requests from authorities): Art. 6(1)(c) GDPR.

4. DATA STORAGE, SECURITY, AND RETENTION

• Your data is stored on Google Firestore, a service provided by Google. Google LLC is certified under the EU-U.S. Data Privacy Framework, which provides an adequate level of data protection for transfers of personal data from the EU to the U.S. We rely on Google's Standard Contractual Clauses (SCCs) or other appropriate transfer mechanisms for data transfers outside the EEA where necessary.

• We implement appropriate technical and organizational measures to protect the security of your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

• We will retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy, to provide the service (i.e., while your account is active), or as required to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. After this period, your personal data will be securely deleted or anonymized.

5. DATA SHARING AND DISCLOSURE

• We do not sell your personal data.

We may share your data with:

• Service Providers: Third-party companies that help us provide the Service (e.g., Google for Firestore, cloud storage providers). We ensure they are bound by confidentiality obligations.

• For Legal Reasons: If required by law, to respond to legal process, or to protect our rights, property, or safety.

We do not share your personal data with advertisers or other third parties for their marketing purposes.

6. YOUR DATA RIGHTS (GDPR & LOPDGDD)

Under GDPR and LOPDGDD, you have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): You can request a copy of your personal data we hold.

• Right to Rectification (Art. 16 GDPR): You can request correction of inaccurate data.

• Right to Erasure ("Right to be Forgotten", Art. 17 GDPR): You can request deletion of your data under certain circumstances.

• Right to Restriction of Processing (Art. 18 GDPR): You can request to limit how we use your data.

• Right to Data Portability (Art. 20 GDPR): You can request your data in a machine-readable format.

• Right to Object (Art. 21 GDPR): You can object to processing based on legitimate interests or for direct marketing.

• Right to Withdraw Consent (Art. 7(3) GDPR): If processing is based on consent, you may withdraw it at any time.

• Right to Lodge a Complaint: You have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos – AEPD) at www.aepd.es or your local data protection authority if you believe your data rights have been violated.

To exercise any of these rights, please contact us at info@joinwavey.com. We will respond to your request within one month (which may be extended by two further months if necessary, and we will inform you).

7. AGE RESTRICTION

Our Service is only available to individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected personal data from a child under 18 without parental consent, we will take steps to delete that information.

8. INTERNATIONAL DATA TRANSFERS

Your information, including personal data, may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. If you are located outside Spain or the EU and choose to provide information to us, please note that we transfer the data, including personal data, to Spain and process it there.

We ensure that adequate safeguards are in place for such transfers, as mentioned in Section 4 (e.g., reliance on Google's EU-U.S. Data Privacy Framework certification and SCCs).

9. CHANGES TO THIS PRIVACY POLICY

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

10. CONTACT US

If you have any questions about this Privacy Policy, or to exercise your data rights, please contact us at: info@joinwavey.com.

Data Controllers: Anna Routledge and Santiago Cuenca.