INFORMATION CLAUSE FOR CUSTOMERS

Personal data administrator 

The administrator of your personal data is:

SpotMeUp sp. z o.o.with its registered office in Warsaw, ul. Stefana Okrzei 1A lok. X, 03-715 Warsaw, entered into the National Court Register under the number 0001190579, NIP: 1133177347, REGON: 542534058 (hereinafter referred to as: "Operator", "Administrator" lub "my"

Administrator's contact details

Contact details of the Data Protection Officer

We have appointed a person responsible for the protection of personal data, i.e. the Data Protection Officer, whom you can contact by e-mail: [email protected] or in writing to SpotMeUp Sp. z o.o., ul. Stefana Okrzei 1A p. X, 03-715 Warsaw.

The scope of personal data processed

We collect your personal data when you create an account on our website and when you use our services, including contacting us.

1.   Creating an account

To create an account, you'll need your first name, last name, email address, and phone number. You can also provide a profile photo, date of birth, and address.

2.   Using the Application

When you use your account, we collect information about your activities on our website, such as your favorite service providers, searches, appointments you book, complete, or cancel at every stage of the process, as well as the content of comments and ratings you leave for service providers. Furthermore, you can share your location with us. You also have the option to select which services you are interested in – primarily for men, women, or everyone, regardless of gender.

When you contact us, we record the personal data you provide to us during contact and information relating to your case.

We also process information collected about you when you use the SpotMeUp service - this data includes your activity logs, IP address (which tells us your location), and certain metadata, such as connection time and the browser you are using. Detailed information in this regard can be found in the Cookies Policy available on our website.

We may also process other personal data that you voluntarily provide to us when using the Application.

3. Medical services

Due to the fact that some service providers cooperating with SpotMeUp offer medical visits, if you decide to book such a service,SpotMeUp will also process information about your health, including the name (type) of your booked appointment, the frequency of your use of medical services, and the status of your appointment (whether it was completed). SpotMeUp does not gain access to detailed information about your health (e.g., information from your medical records, including your diagnosis or recommendations).

4. Payments 

In your account SpotMeUp the payment methods you have selected are also visible, including the necessary information about your payment card that you have linked to your account SpotMeUp, as well as the history of payments made via SpotMeUp and used gift cards.

5. Family & Friends

If you decide to use the functionality SpotMeUp under the name "Family & Friends" and you add your loved ones to your network within this functionality, SpotMeUp will process information about your relationship with these people (friend, wife/husband, child, partner, other family member). In case you do not have an account in the SpotMeUp Application and you have been added by a user of the Application SpotMeUp to its network as part of the Application's functionality SpotMeUp “Family & Friends”, SpotMeUp may process the following set of information about you:

Your relationship to the SpotMeUp user who added you to their network (friend, wife/husband, child, partner, other family member), first name, last name, date of birth, phone number, email address. When you use appointments booked for you by the user SpotMeUp who added you to their "Family & Friends" network, SpotMeUp also obtains information about the type of services reserved for you and whether you used them. If you have an account with SpotMeUp, have been added by another user to their "Family & Friends" network and you accept this invitation, SpotMeUp will link your profile information with the information provided by the user who added you to their network. This user will see your name and profile photo, which are associated with your account inSpotMeUp. 

6. Login via external platforms

If you log in to SpotMeUp using external authentication services (e.g., Google, Meta Platforms (Facebook), Apple), SpotMeUp collects your personal data from these platforms, including your first name, last name, email address, account ID, and, in the case of Google and Facebook, your profile picture. You can refuse to share certain data when logging in. Logging in via Facebook results in joint control of your data between SpotMeUp and the platform owner, Facebook. Details on joint control are available here: https://www.facebook.com/legal/controller_addendum. Facebook, as a joint controller, is responsible for the implementation of your rights under the GDPR in connection with the processing of your profile on the platform and its transfer to SpotMeUp.

Purposes and legal basis of data processing 

In connection with your account on the SpotMeUp website, we process your personal data for the following purposes:

1. maintaining your account in the SpotMeUp Application,what does it include enabling you to use all its available functionalities, i.e., among others, searching for and booking appointments with service providers (entities cooperating with SpotMeUp - "Partners"), including providing them with your personal data to the extent necessary, leaving ratings and comments about the services you use; – such processing of your personal data is necessary for the performance of the contract as set out in the Application's regulations (Article 6, paragraph 1, letter b) of the GDPR);

2. enabling you to book medical services- if you request an appointment with a medical service provider through SpotMeUp, SpotMeUp receives your express consent to the processing of your medical data (Article 9, paragraph 2, point a) of the GDPR); this consent is necessary for SpotMeUp to, among other things, process information about the type of appointment you wish to book and transfer your data to the service provider of your choice to whom the booking relates, and the basis for the processing of your personal data not relating to health is the necessity to perform the contract as defined in the Application Terms and Conditions (Article 6, paragraph 1, point b) of the GDPR);

3. directing service and transactional communications to you, e.g. notifications about changes in the regulations of the SpotMeUp Application, confirmations of reservations made - the legal basis for the processing of your data in this respect is the necessity to perform the contract on the content of the regulations of the Application (Article 6 paragraph 1 letter b) of the GDPR) and the implementation of legal obligations incumbent on SpotMeUp (Article 6 paragraph 1 letter c) of the GDPR);

4. counteracting fraud, abuse, activities that may violate applicable regulations or good practices or negatively impact the security of the website or the credibility of SpotMeUp and Partners, activities that violate the SpotMeUp website regulations the basis for the processing of your personal data is the necessity to perform the contract in terms of ensuring compliance of the services with the regulations (Article 6 paragraph 1 letter b) of the GDPR), the fulfilment of legal obligations incumbent on SpotMeUp, including in connection with Article 6, Article 16, Article 20, Article 23 of the Digital Services Act, the so-called DSA, (Article 6 paragraph 1 letter c) of the GDPR), as well as the legitimate interest of SpotMeUp (Article 6 paragraph 1 letter f) of the GDPR) consisting in the need to support the safety of users

Application and fraud prevention;

5. marketing of SpotMeUp products or services (excluding direct marketing)– the processing of your personal data for this purpose will take place in pursuit of the legitimate interest of SpotMeUp (Article 6, paragraph 1, letter f) of the GDPR), which is the ability to market its own products and services;

6. direct marketing of SpotMeUp products or services via available electronic communication channels, including: e-mail, SMS, MMS, push notifications– such processing of your personal data is necessary to pursue the legitimate interest of SpotMeUp (Article 6 paragraph 1 letter f) of the GDPR), which is the ability to market its own products and services, consisting in direct communication with you for the purpose of advertising and promoting SpotMeUp services, in connection with your consent to receive marketing communications in this respect (in accordance with Article

398 of the Act of 12 July 2024, Electronic Communications Law);

7. direct marketing of products or services of entities cooperating with SpotMeUp– such processing of your personal data is necessary to pursue the legitimate interest of SpotMeUp (Article 6, paragraph 1, letter f) of the GDPR), which is the possibility of marketing the products and services of entities cooperating with SpotMeUp, consisting in direct communication with you for advertising purposes and promoting the services of entities cooperating with SpotMeUp, in connection with the marketing consent you have granted to receive communications in this regard (in accordance with Article 398 of the Act of 12 July 2024 - Electronic Communications Law);

8. personalize content and analyze preferred services(i.e. keeping reports – in order to adapt our products or services and their marketing to your preferences, as well as to the preferences of specific customer groups identified by us) – the processing of your personal data for this purpose will take place in pursuit of our legitimate interest (Article 6, paragraph 1, letter f) of the GDPR), which is to better adapt our content and offered services to your expectations;

9. research on preferences regarding the demand for SpotMeUp or Partner services(including in the form of telephone, text message or e-mail surveys, monitoring the activity of Application users) – which is necessary to pursue the legitimate interest of SpotMeUp (Article 6, paragraph 1, letter f) of the GDPR), which is the ability to establish a catalogue of products and services of interest to customers and the level of their satisfaction with SpotMeUp services or the services of Partners;

10. establishing, pursuing or defending against claims related to the concluded contract or the processing of your personal data, the processing of your personal data in this respect is necessary to pursue the legitimate interest of SpotMeUp (Article 6(1)(f) of the GDPR), which is the ability to establish, pursue or defend against potential claims;

11. filling burdensome that SpotMeUp  legal obligations arising from applicable legal provisions– the processing of your personal data in this case is necessary to comply with the legal requirements to which SpotMeUp is subject (Article 6 paragraph 1 letter c) of the GDPR);

12. creating reports, analyses, and statistics for SpotMeUp's internal needs(including reporting, service development planning, development work in the SpotMeUp system, creation of statistical models) – such processing of your personal data is necessary to pursue the legitimate interest of SpotMeUp (Article 6(1)(f) of the GDPR), which is the analysis and development of its business;

13. implementing new or developing solutions/functionalities of SpotMeUp systems/applications(development of application functionality, testing of introduced new solutions, analysis of the type of new functionalities necessary to introduce, creation of analytical tools/reports, etc.) – such processing of your personal data is necessary to pursue the legitimate interest of SpotMeUp (Article 6, paragraph 1, letter f) of the GDPR), which is the development and ensuring the security of the operation of SpotMeUp systems/applications;

14. to communicate with you when you contact us– such processing of your personal data is necessary for the performance of the contract between us (Article 6, paragraph 1, letter b) of the GDPR, when your case is related to the Account held in the Application, or for the legitimate interest of SpotMeUp (Article 6, paragraph 1, letter f of the GDPR), which is the ability to communicate with you.

5. creating reports, analyses, statistics for SpotMeUp's internal needs (including reporting, service development planning, development work in the SpotMeUp system, creating statistical models)– such processing of your personal data is necessary to pursue the legitimate interest of SpotMeUp (Article 6, paragraph 1, letter f) of the GDPR), which is the analysis and development of its business.

As a rule, you provide us with your personal data when you create your account on SpotMeUp, and then your personal data is collected by SpotMeUp when you use the SpotMeUp service.

If you were added by another SpotMeUp user to their "Family & Friends" network, your personal data was provided to SpotMeUp by that person. When you use authentication services provided by third parties (e.g., Facebook, Google), your personal data is provided to us by the entity through which you register or log in to the App.

Content Personalization

Please be advised that when we communicate with you or offer you services, we carefully select the content of the messages we send to ensure that you only receive recommendations and advertisements from our website that meet your preferences. For this purpose, we process your personal data, including: the date of your account registration, your booking history (including dates and service provider category (e.g., nail salon)), your frequency of using services through SpotMeUp, your use of SpotMeUp gift cards, the locations of the service providers you visit, and whether you are interested in services primarily for men or women. You have the right to object to our processing of your personal data for this purpose at any time.

We also assure you that SpotMeUp does not process your personal data in a fully automated manner that could lead to a decision being issued to you that would have legal effects or affect you in a similar way.

Categories of data recipients

Your personal data may be shared by SpotMeUp with third parties.

The recipients of your personal data may be:

1. Partners - when you express your wish to book a service with a given entity;

2. companies from the SpotMeUp capital group - when it is necessary to ensure the correctness of internal administrative and service processes, including those related to ensuring the security and development of the SpotMeUp website;

3. external service providers supplying SpotMeUp with technical and organizational solutions supporting SpotMeUp's operations, including IT service providers, payment service providers, machine learning technology tool providers, and automated response service providers

(chatbot);

4. service providers supporting SpotMeUp in our daily operations, including in the areas of marketing, communication and analytics, accounting, tax and debt collection companies, legal advisors, insurers, courier and postal companies, and providers of archiving and document destruction services.

If you add someone to your “Family & Friends” network, including sending them an invitation to join SpotMeUp, they are entitled to receive information about the source of their personal data obtained by SpotMeUp, i.e. your name and surname, which you have provided to us.

When you, as a person invited to join SpotMeUp via the “Family & Friends” feature, accept the invitation, the person who added you to their network receives information about your name and profile photo, as specified in your SpotMeUp account.

Due to the fact that we use the services of suppliers who support our operations based on technological solutions using artificial intelligence (AI), we may transfer your personal data to such entities. We ensure that we verify the entities we work with to ensure they provide an adequate level of personal data protection.

Transferring data outside

European

Area

Economic

We confirm that all entities to which we transfer your personal data provide at least the same protection of your personal data as set out in this privacy policy and as required by the guidelines of Apple Inc. and Google Ireland Limited.

Due to SpotMeUp's operations, as well as the technical tools and IT infrastructure used, your personal data may be transferred by SpotMeUp outside the European Economic Area, which comprises the European Union member states plus Norway, Iceland, and Liechtenstein. In such cases, SpotMeUp exercises due diligence to adequately secure your personal data, and the transfer is based on an agreement concluded between SpotMeUp and the entity receiving your data, using standard contractual clauses approved by the European Commission, or based on a European Commission decision establishing an adequacy level of data protection, or based on adopted binding corporate rules.

Please remember that if your data is transferred outside the EEA, you have the right to information on how to obtain copies of security measures or where they are made available.

Data storage period

SpotMeUp processes, including storing, your personal data for no longer than is necessary for the purposes for which the data is processed.

1. Performance of the contract with SpotMeUp (as defined in the Application regulations) - Article 6, paragraph 1, letter b) of the GDPR:Your personal data required to create an account in the SpotMeUp App and related to your activity in and using the SpotMeUp App, processed to enable you to use the App's functionalities, is processed by us until the termination or expiration of the agreement regarding the App's terms and conditions, and then for the limitation period for claims under the Civil Code. Additional data, such as your profile photo, is stored until you delete it or delete your Account.

2. Fulfillment of legal obligations - Article 6(1)(c) of the GDPR:data processed for the purpose of fulfilling legal obligations incumbent on SpotMeUp are processed for the period resulting from these legal provisions (e.g. in the case of tax law provisions, this period is 5 years counted from the end of the calendar year in which the tax deadline expired, and in the case of accounting law provisions - 5 years counted from the beginning of the year following the financial year in which the transaction was made).

3. Consent - Article 6(1)(a) GDPR or explicit consent - Article 9(2)(a) GDPR:If the basis for the processing of your personal data by SpotMeUp is your consent or express consent, the data processing period lasts until you withdraw your consent.

4. Legitimate interest - Article 6(1)(f) of the GDPR:Your personal data processed on the basis of SpotMeUp's legitimate interests are retained by us for the duration of those interests.

(e.g., correspondence) or until you object to the processing of your data for these purposes. In the event of overriding interests of SpotMeUp, the data may be stored for longer periods, of which we will inform you. Data processed for the purpose of pursuing or defending against claims is stored for the limitation period for claims or until the conclusion of mediation or court proceedings.

5. Marketing - art. 6 par. 1 lit. f) GDPR:in the case of marketing purposes, your personal data is processed by us until you withdraw your consent to receive marketing communications from SpotMeUp / SpotMeUp Partners or until you object to such processing.

Your rights

According to the GDPR, you are entitled to:

1. right of access to your data (i.e. receiving information from us, including information about how and for what purposes your personal data is processed by us) and receiving a copy thereof;

2. the right to rectification your personal data when the data processed by SpotMeUp is incorrect or incomplete;

3. the right to erasure data (which you will read more about in the next point of the table);

4. the right to processing restrictions data (in some cases, you can request that SpotMeUp temporarily ceases to use your personal data in full and limit itself to storing it, unless you allow it to be used for another purpose or such use is necessary due to applicable law, the establishment, exercise or defense of claims, or the protection of the rights of another person/entity. The circumstances for limiting processing include cases when: 1) you contest the accuracy of the data processed by SpotMeUp, 2) the data are no longer necessary for SpotMeUp's purposes, but you need them to defend or pursue your interests (e.g. in court), 3) you object to the processing of your personal data and SpotMeUp will verify the validity of your objection, 4) your data were processed unlawfully, but you do not want them to be deleted at this stage);

5. the right to data portability, which you are entitled to when your personal data is processed by us in an automated manner and based on your consent or for the purpose of performing the contract between you and SpotMeUp;

6. the right to lodge a complaint with the supervisory authority(President of the Personal Data Protection Office).

The right to withdraw consent

You can withdraw your consent to the processing of your personal data at any time – this only applies to the processing of data that SpotMeUp will process based on your consent. Withdrawing consent will not affect the lawfulness of data processing conducted prior to your withdrawal. If you use the SpotMeUp app, you can check which consents you have granted at any time and edit them by going to the "Profile" tab in your SpotMeUp app, then the "Privacy Settings" tab.

The right to object

The right to delete data

If you use the SpotMeUp app on iOS, you can delete your account by going to the "Profile" tab in your SpotMeUp app, then the "Your Data" tab and clicking the "Delete my account" button.

Information on the requirement or voluntary nature of providing data and consequence of their failure to provide

Providing your personal data required to create an account is voluntary, but necessary to conclude and execute the contract for the use of the SpotMeUp service. Without providing this personal data, you will not be able to use our services. Providing other data is optional, but may facilitate our communication with you and contribute to a more personalized use of our services.

You can check or edit the personal data you have provided to us at any time by going to the "Profile" tab in your SpotMeUp app and then to the "Your Data" tab.