Summary: This Policy explains how YouVisible processes personal data of users and visitors: what data we collect, for which purposes and legal bases, for how long we keep it, to whom it may be disclosed, and what rights you can exercise.

Controller and contact

Controller: YouVisible, sole trader (self-employed), owner of the YouVisible brand. Tax ID: [NIF] Registered address: Illescas-Toledo-España Legal contact email: legal@youvisible.com

General contact: you can write to us through our contact form available on the platform.

Privacy contact / DPO: contact our Data Protection Officer (DPO) through our contact form, which is the main communication channel.

Data processed

We process different categories of data depending on how you use the platform:

• Identification and contact: name, surname, email, phone (optional), country/language, role (athlete, club/scout, company, legal guardian).
• Account and authentication: credentials, tokens, verifications (email/SMS), access logs.
• Content and activity: videos, images, metadata (title, tags, sport/position), lists, favourites, comments, reports.
• Interactions and usage: views, clicks, searches, device information, approximate IP, technical events (errors, performance).
• Communications: in-app messages, support, push/email notifications, marketing preferences.
• Billing: subscribed plan, payment status, transaction identifiers, billing address. We never store full card numbers.
• Minors / guardianship: guardian data and evidence of consent/verification when required by law.
• Cookies and similar technologies: technical (necessary), preference, analytics and, where applicable, advertising cookies (always subject to consent).

Special categories: we avoid processing sensitive data (e.g., health data or ideology). If it becomes strictly necessary, processing will only take place with an appropriate lawful basis and explicit consent where required by law.

Sports data and Health Connect

On Android, YouVisible may connect to Health Connect if the user expressly authorizes it on the device. This connection allows the user to voluntarily import sports activities shared by compatible apps such as Samsung Health, Garmin Connect, Fitbit, Google Fit or other sports apps.

If you grant permission, YouVisible may read the following sports data, always within the authorized scope:

• Workouts or sports activities.
• Distance.
• Duration.
• Calories.
• Heart rate.
• Speed or pace.
• Elevation or elevation gain.
• Route tracks or route data when an activity includes them, they are available and the user authorizes their use.

We use this data to:

• Import activities into YouVisible.
• Build your sports history.
• Show metrics in History, Activities, Detail and Dashboard.
• Show maps, routes and charts when that data is available.
• Create sports statistics inside YouVisible.
• Enable shareable links only when the user decides to generate them.

YouVisible does not use Health Connect for medical diagnosis, medical treatment, sale of sports or health data, insurance, employment or other sensitive decisions. We also do not read medical data that is not necessary for the sports purpose of the platform.

You can grant or revoke permissions from Health Connect on Android. You can also manage your privacy, shared links, request account deletion or exercise data protection rights according to this Policy and the controls available in YouVisible. If the option is available in your account, you can also disconnect Health Connect from YouVisible. Technical diagnostics from the app must not include full tokens or authorization credentials.

Sports data and Apple Health

YouVisible can use Apple Health / HealthKit on iPhone to import sports activities if the user authorizes it. It may read workouts, distance, duration, calories, heart rate, speed or pace, elevation or elevation gain, and routes or tracks when available and authorized. YouVisible can check Apple Health changes periodically if the user enables automatic sync, and this option can be turned off at any time. YouVisible does not write data to Apple Health, does not provide medical diagnosis, and does not sell sports or health data.

Purposes and legal bases

We use your data for the following purposes:

1. Service provision Registration, login, profile and role management, upload, transcoding and playback of content; messaging and operational notifications. Legal basis: performance of the contract (accepted Terms of Use).

2. Security and moderation Ensuring the integrity of the platform, preventing fraud/abuse, protecting minors, managing reports and legal notices, and enforcing the Community Guidelines. Legal bases: legitimate interest and legal obligation where applicable.

3. Support and quality Handling incidents, receiving feedback, fixing bugs and improving the service. Legal bases: performance of the contract and legitimate interest.

4. Non-essential analytics Product and usage metrics with aggregated or pseudonymised data to better understand how the platform is used. Legal basis: consent through the cookie/consent manager.

5. Marketing and commercial communications Sending email communications, push notifications or in-app messages according to your preferences; basic user segmentation. Legal bases: consent (opt-in per channel) or legitimate interest for existing customers, in line with applicable regulations.

6. Billing and accounting Managing payments, preventing payment fraud and complying with tax/accounting obligations. Legal bases: performance of the contract and legal obligation.

7. B2B / Marketplace relationships Managing vendor companies, KYC/KYB processes where required, and quality control of services offered by third parties. Legal bases: performance of the contract and legal obligation.

8. Legal defense Retention and use of data for the formulation, exercise or defense of judicial or administrative claims. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Recipients and processors

We may share your data with:

• Service providers (processors): hosting and CDN (e.g., AWS), video transcoding services, payment gateways, email and support platforms, verification services and analytics tools. We sign Data Processing Agreements (DPAs) and require appropriate safeguards. We maintain an updated list of subprocessors in the Privacy Center or supporting documentation.
• Marketplace companies: when you purchase a service from a vendor, we share only the data necessary to fulfil your order (name, contact details, booking information, etc.). These companies act as Controllers of their own processing.
• Public authorities: when there is a legal obligation or a valid request, we may disclose data to the relevant authorities.

International transfers

Some providers may be located outside the European Economic Area. In such cases:

• We verify that the country offers an adequate level of protection according to the European Commission, or
• We sign Standard Contractual Clauses (SCCs) or other mechanisms recognised by the GDPR, or
• We apply any other appropriate safeguards required by data protection law.

Detailed information about specific transfers is included in our processor contracts and subprocessor list.

Retention periods

We retain data only as long as necessary to fulfil the purposes described and comply with legal obligations:

• Account and content: while your account remains active. When you delete your account, we remove access and reasonably delete data, keeping only technical/backup copies and the information legally required.
• Billing data: Billing data: retained for at least 4 years under Spanish tax regulations and up to 6 years where the Spanish Commercial Code applies.
• Security and moderation logs: for the time required to investigate incidents, prevent abuse and defend against possible claims.
• Consents and preferences: for as long as necessary to demonstrate compliance or until you withdraw them.
• Cookies: according to the lifespan specified in the Cookie Policy, usually not longer than 24 months for preference cookies, unless local law states otherwise.

Once the contractual relationship has ended or erasure has been requested, data may remain blocked for the statutory limitation periods solely for the establishment, exercise or defence of legal claims, in accordance with Spanish data protection law.

Data subject rights

You may exercise the rights provided by the GDPR:

• Access
• Rectification
• Erasure
• Objection
• Restriction of processing
• Data portability
• Withdrawal of consent (when consent is the lawful basis)

To exercise your rights:

• Use the platform’s contact form (selecting the privacy/legal option), or
• Write to our contact form clearly stating your request.

If you are not satisfied with our response, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) or the supervisory authority in your country.

Minors

In Spain, the minimum age to provide valid consent for information society services is 14 years (Art. 7 Spanish Data Protection Act – LOPDGDD). Registration must always be completed by an adult. Where the user is under 14, legal guardian consent is mandatory.

• The platform applies specific protection measures for minors and requires the involvement of a legal guardian when required by law.
• We may request reasonable evidence of guardianship or consent to enable certain features (e.g., publishing public content or accessing certain contact channels).
• The guardian may review and manage the minor’s profile and exercise data protection rights on their behalf.

Company accounts, subscriptions and commercial content

When an account uses the Company role, we process the data needed to manage its business identity, subscription, payment status, limits per billing cycle, Marketplace services, posts, business messages and moderation. We do not store full card numbers; payments are handled by payment providers. Commercial-content signals and moderation actions are processed for security, contract performance, abuse prevention and service quality.

Cookies and similar technologies

We use cookies and similar technologies to:

• Ensure the technical operation and security of the service (strictly necessary cookies).
• Remember your preferences (language, interface settings, etc.).
• Perform usage analytics with aggregated or pseudonymised data.
• Where applicable, deliver advertising based on consent.

You can find more detailed information in the Cookie Policy, where you can manage your preferences at any time.

Automated decision-making

If we ever use automated decision-making processes that produce legal effects or significantly affect you (e.g., scoring systems or automated moderation), we will inform you about:

• The logic involved.
• The importance and expected consequences of the processing.
• The ways to request human intervention, express your point of view and challenge the decision.

Changes to this Privacy Policy

We may update this Policy to comply with new legal requirements or to incorporate improvements to the service.

When a change is relevant, we will communicate it in a visible way (for example, through notices on the platform or by email) and, where necessary, we will ask you to renew your consent.

---

Last review: 02 July 2026