Summary: This Policy explains how YouVisible processes personal data of users and visitors: what data we collect, for which purposes and legal bases, for how long we keep it, to whom it may be disclosed, and what rights you can exercise.

Controller and contact

Controller: YouVisible, sole trader (self-employed), owner of the YouVisible brand. Tax ID: [NIF] Registered address: Illescas-Toledo-España Legal contact email: legal@youvisible.com

General contact: you can write to us through our contact form available on the platform.

Privacy contact / DPO: contact our Data Protection Officer (DPO) through our contact form, which is the main communication channel.

Data processed

We process different categories of data depending on how you use the platform:

• Identification and contact: name, surname, email, phone (optional), country/language, role (athlete, club/scout, company, legal guardian).
• Account and authentication: credentials, tokens, verifications (email/SMS), access logs.
• Content and activity: videos, images, metadata (title, tags, sport/position), lists, favourites, comments, reports.
• Interactions and usage: views, clicks, searches, device information, approximate IP, technical events (errors, performance).
• Communications: in-app messages, support, push/email notifications, marketing preferences.
• Billing: subscribed plan, payment status, transaction identifiers, billing address. We never store full card numbers.
• Minors / guardianship: guardian data and evidence of consent/verification when required by law.
• Cookies and similar technologies: technical (necessary), preference, analytics and, where applicable, advertising cookies (always subject to consent).

Special categories: we do not deliberately request special categories of data unrelated to the features enabled by the user. Some sports metrics, particularly heart rate and similar data, may be considered data concerning health depending on their context and applicable law. When the user authorizes their import, we process them solely for the sports purposes described below and, where applicable law requires explicit consent, on the basis of that consent.

Sports data from connected devices and services

YouVisible allows users to voluntarily connect third-party sports services, applications and devices. Compatible services may include, depending on platform, availability and configuration, Android Health Connect, Apple Health / HealthKit, Polar and HUAWEI Health. YouVisible may add other equivalent sports providers; in each case, the user must initiate and expressly authorize the connection and the relevant permissions.

Data we may receive. Depending on the provider, activity and permissions granted, YouVisible may receive:

• Activity and workout records and their associated details.
• Sport type, date and time, duration and active time.
• Distance, calories, pace, speed, heart rate, cadence and steps.
• Altitude and elevation gain.
• Tracks, routes or GPS coordinates associated with the activity.
• Technical information about the source device or application.
• Other sports data associated with the activity when available and authorized.

Not every provider supplies all of this data. YouVisible receives only the data authorized by the user and made available by the provider. A GPS route or GPS coordinates are imported only when associated with a sports activity and the user has authorized the relevant permission. This activity-related location differs from real-time location that other YouVisible features may use; those features are governed by their own permissions and controls and are not enabled merely by connecting a provider.

Purposes. We use this data exclusively to import activities authorized by the user; build and retain their sports history; display metrics, statistics and progress; present maps, routes and tracks; organize sports information within their Profile; and allow them to view, manage and enrich their activities. Syncing alone does not make activities or their data public: visibility depends on the user’s settings and actions.

Activation, legal basis and synchronization. A connection is established only when the user initiates the integration and grants the permissions offered by the provider. For data that requires explicit consent under applicable law, processing is based on that consent. Imports may be initiated manually. If the user enables or authorizes automatic synchronization, YouVisible may periodically query or receive new activities or changes from the connected service.

Control, disconnection and retention. Users decide whether to connect a provider and which of the offered permissions to grant. They can disconnect the integration within YouVisible when that option is available, revoke permissions through the relevant platform or provider, and exercise the rights described in this Policy. Disconnecting or revoking access prevents new synchronization from that provider, but does not automatically delete activities already imported: those activities may be retained in accordance with the user’s settings and the account and content retention and deletion rules set out in this Policy.

External providers, data minimization and security. Each provider maintains its own terms and privacy policy, as well as its own internal retention rules, which YouVisible does not control. We request only the permissions needed for the features enabled by the user and do not use the connection to deliberately access categories of information unrelated to those features. Where a direct connection requires credentials or authorization tokens, they are used to maintain the authorized integration and protected through applicable technical and organizational measures. Technical logs and diagnostics must not include full tokens or authorization credentials.

Excluded uses. YouVisible does not use sports or health data received through these connections for medical diagnosis or treatment, insurance, employment screening or decisions, advertising based on health data, or the sale of sports or health data.

Details for compatible services.

• Android Health Connect: allows activities and associated sports data made available in Health Connect by other compatible sources to be imported with the read permissions granted by the user in Android. Permissions can be managed or revoked in Health Connect.
• Apple Health / HealthKit: allows available activities and sports categories authorized by the user to be imported on iPhone. YouVisible may periodically check for changes when automatic synchronization is enabled; it does not write data to Apple Health.
• Direct providers: Polar and HUAWEI Health may connect directly when the integration is available to the user. For HUAWEI Health, authorized read permissions allow YouVisible to receive sports activity records, details associated with the activity, and the route or location linked to it. The initial synchronization may cover authorized records from the preceding month; afterwards, the user may initiate manual synchronizations or authorize the periodic receipt of new activities or changes.

Purposes and legal bases

We use your data for the following purposes:

1. Service provision Registration, login, profile and role management, upload, transcoding and playback of content; messaging and operational notifications. Legal basis: performance of the contract (accepted Terms of Use).

2. Security and moderation Ensuring the integrity of the platform, preventing fraud/abuse, protecting minors, managing reports and legal notices, and enforcing the Community Guidelines. Legal bases: legitimate interest and legal obligation where applicable.

3. Support and quality Handling incidents, receiving feedback, fixing bugs and improving the service. Legal bases: performance of the contract and legitimate interest.

4. Non-essential analytics Product and usage metrics with aggregated or pseudonymised data to better understand how the platform is used. Legal basis: consent through the cookie/consent manager.

5. Marketing and commercial communications Sending email communications, push notifications or in-app messages according to your preferences; basic user segmentation. Legal bases: consent (opt-in per channel) or legitimate interest for existing customers, in line with applicable regulations.

6. Billing and accounting Managing payments, preventing payment fraud and complying with tax/accounting obligations. Legal bases: performance of the contract and legal obligation.

7. B2B / Marketplace relationships Managing vendor companies, KYC/KYB processes where required, and quality control of services offered by third parties. Legal bases: performance of the contract and legal obligation.

8. Legal defense Retention and use of data for the formulation, exercise or defense of judicial or administrative claims. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Recipients and processors

We may share your data with:

• Service providers (processors): hosting and CDN (e.g., AWS), video transcoding services, payment gateways, email and support platforms, verification services and analytics tools. We sign Data Processing Agreements (DPAs) and require appropriate safeguards. We maintain an updated list of subprocessors in the Privacy Center or supporting documentation.
• Marketplace companies: when you purchase a service from a vendor, we share only the data necessary to fulfil your order (name, contact details, booking information, etc.). These companies act as Controllers of their own processing.
• Public authorities: when there is a legal obligation or a valid request, we may disclose data to the relevant authorities.

International transfers

Some providers may be located outside the European Economic Area. In such cases:

• We verify that the country offers an adequate level of protection according to the European Commission, or
• We sign Standard Contractual Clauses (SCCs) or other mechanisms recognised by the GDPR, or
• We apply any other appropriate safeguards required by data protection law.

Detailed information about specific transfers is included in our processor contracts and subprocessor list.

Retention periods

We retain data only as long as necessary to fulfil the purposes described and comply with legal obligations:

• Account and content: while your account remains active. When you delete your account, we remove access and reasonably delete data, keeping only technical/backup copies and the information legally required.
• Billing data: Billing data: retained for at least 4 years under Spanish tax regulations and up to 6 years where the Spanish Commercial Code applies.
• Security and moderation logs: for the time required to investigate incidents, prevent abuse and defend against possible claims.
• Consents and preferences: for as long as necessary to demonstrate compliance or until you withdraw them.
• Cookies: according to the lifespan specified in the Cookie Policy, usually not longer than 24 months for preference cookies, unless local law states otherwise.

Once the contractual relationship has ended or erasure has been requested, data may remain blocked for the statutory limitation periods solely for the establishment, exercise or defence of legal claims, in accordance with Spanish data protection law.

Data subject rights

You may exercise the rights provided by the GDPR:

• Access
• Rectification
• Erasure
• Objection
• Restriction of processing
• Data portability
• Withdrawal of consent (when consent is the lawful basis)

To exercise your rights:

• Use the platform’s contact form (selecting the privacy/legal option), or
• Write to our contact form clearly stating your request.

If you are not satisfied with our response, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) or the supervisory authority in your country.

Minors

In Spain, the minimum age to provide valid consent for information society services is 14 years (Art. 7 Spanish Data Protection Act – LOPDGDD). Registration must always be completed by an adult. Where the user is under 14, legal guardian consent is mandatory.

• The platform applies specific protection measures for minors and requires the involvement of a legal guardian when required by law.
• We may request reasonable evidence of guardianship or consent to enable certain features (e.g., publishing public content or accessing certain contact channels).
• The guardian may review and manage the minor’s profile and exercise data protection rights on their behalf.

Company accounts, subscriptions and commercial content

When an account uses the Company role, we process the data needed to manage its business identity, subscription, payment status, limits per billing cycle, Marketplace services, posts, business messages and moderation. We do not store full card numbers; payments are handled by payment providers. Commercial-content signals and moderation actions are processed for security, contract performance, abuse prevention and service quality.

Cookies and similar technologies

We use cookies and similar technologies to:

• Ensure the technical operation and security of the service (strictly necessary cookies).
• Remember your preferences (language, interface settings, etc.).
• Perform usage analytics with aggregated or pseudonymised data.
• Where applicable, deliver advertising based on consent.

You can find more detailed information in the Cookie Policy, where you can manage your preferences at any time.

Automated decision-making

If we ever use automated decision-making processes that produce legal effects or significantly affect you (e.g., scoring systems or automated moderation), we will inform you about:

• The logic involved.
• The importance and expected consequences of the processing.
• The ways to request human intervention, express your point of view and challenge the decision.

Changes to this Privacy Policy

We may update this Policy to comply with new legal requirements or to incorporate improvements to the service.

When a change is relevant, we will communicate it in a visible way (for example, through notices on the platform or by email) and, where necessary, we will ask you to renew your consent.

---

Last review: 11 September 2026