Part I – End Users

This Privacy Policy is intended to provide clear, complete, and transparent information regarding the processing of personal data carried out by PICK & PAY APP, S.L.U. in connection with the use of the GUAVA technological platform by end users who are natural persons (the "Users").

By accessing or using the Platform, Users acknowledge that they have read and understood this Privacy Policy. If the User does not agree with its contents, they should refrain from using the Platform.

1. Data Controller

The data controller is PICK & PAY APP, S.L.U., a company incorporated under Spanish law, with tax identification number (CIF) B10619526, registered office at Carrer de Calàbria 149, Entresuelo 1, 08015 – Barcelona (Spain), and contact email address: [email protected] (the "Data Controller").

The Data Controller determines the purposes and means of the processing of personal data of Users who access and use the GUAVA Platform.

At present, no Data Protection Officer (DPO) has been appointed. Should such appointment become mandatory or appropriate under applicable law, the relevant information will be duly communicated to the Users.

2. Scope of Application

This Privacy Policy applies exclusively to the processing of personal data of end users who are natural persons accessing and using the GUAVA Platform to browse content, place orders, make electronic payments, and interact with restaurants, bars, hotels, or other hospitality establishments available on the Platform (the "Establishments").

The processing of personal data relating to professional clients of the Platform is governed by Part II of this Privacy Policy.

3. Categories of Personal Data Processed

Depending on how the User interacts with the Platform and which functionalities are used, the Data Controller may process the following categories of personal data:

• Identification and contact data (such as name, surname, email address, telephone number);
• Account and authentication data (such as username, login credentials, and account settings);
• Transaction and order data (such as selected products or services, quantities, order history, timestamps, and related communications);
• Payment-related technical data (processed exclusively by external payment service providers; the Data Controller does not store full payment card details);
• Communications exchanged through the Platform, including messages or notes addressed to Establishments;
• Device and usage data (such as IP address, browser type, operating system, app usage data, and log files);
• Location data, where enabled by the User and necessary for the proper functioning of the services.

Health-Related Data

In addition, the Platform may allow Users to voluntarily provide information relating to dietary preferences, food intolerances, allergies, or similar characteristics, including information that may be considered data concerning health under applicable data protection laws. Such information may be provided, at the User's discretion, within the User profile, during the ordering process, or through notes addressed to the selected Establishment.

4. Purposes of Processing

Personal data are processed for the following purposes:

• Enabling access to and use of the Platform;
• Creating, managing, and maintaining User accounts;
• Facilitating orders, reservations, and electronic payments;
• Transmitting order-related information, including any notes or preferences provided by the User, to the selected Establishment;
• Providing customer support and handling User requests;
• Ensuring the security, integrity, and proper functioning of the Platform;
• Preventing fraud, misuse, or unauthorized access;
• Complying with applicable legal and regulatory obligations.

Where expressly authorized by the User, personal data may also be processed for marketing communications, service-related notifications, and soft profiling activities aimed at improving the User experience, such as personalizing content or suggesting features based on previous interactions.

Information relating to dietary preferences, intolerances, or allergies is processed exclusively for the purpose of enabling the correct handling of orders and communications with Establishments and, where applicable, improving the continuity of the service for the User.

5. Legal Basis for Processing

The processing of personal data is carried out in accordance with Article 6 of Regulation (EU) 2016/679 (GDPR), on the basis of one or more of the following legal grounds:

• The performance of a contract to which the User is a party or the implementation of pre-contractual measures requested by the User;
• The User's consent, where required;
• Compliance with legal obligations applicable to the Data Controller;
• The legitimate interests pursued by the Data Controller, provided that such interests do not override the fundamental rights and freedoms of the User.

Where information relating to dietary preferences, intolerances, or allergies constitutes data concerning health, such data are processed solely on the basis of the User's explicit consent, in accordance with Article 9(2)(a) GDPR, and exclusively for the purposes described in this Privacy Policy.

6. Data Recipients

Personal data may be disclosed, where necessary, to the following categories of recipients:

• Establishments selected by the User for the purpose of fulfilling orders or reservations;
• External payment service providers;
• Cloud infrastructure and hosting providers;
• Technical, IT, maintenance, and development service providers;
• Customer support and communication service providers;
• Analytics, security, and fraud prevention service providers;
• Public authorities and regulatory bodies, where disclosure is required by law.

All recipients process personal data subject to appropriate contractual safeguards and confidentiality obligations.

7. International Data Transfers

As a general rule, personal data are processed within the European Economic Area (EEA). Should international data transfers become necessary in the future, such transfers will be carried out in compliance with applicable data protection legislation and with appropriate safeguards in place.

8. Data Retention

Personal data will be retained for the time strictly necessary to fulfill the purposes for which they were collected and processed and, thereafter, for the periods required by applicable legal, accounting, or regulatory obligations.

Data relating to dietary preferences, intolerances, or allergies will not be retained longer than necessary for the management of the relevant orders, the continuity of the service, or the duration of the User account, unless a longer retention period is required by law.

9. Data Subject Rights

Users may exercise, at any time, their rights of access, rectification, erasure, objection, restriction of processing, and data portability by contacting the Data Controller via email at [email protected] or through any of the customer support channels made available on the Platform.

Users also have the right to lodge a complaint with the competent data protection authority.

10. Security Measures

The Data Controller has implemented appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. However, no system can guarantee absolute security.

11. Data of Minors

The Platform is not intended for use by individuals under the age of 18. The Data Controller does not knowingly process personal data of minors.

12. Cookies

The use of cookies and similar technologies is governed by a separate Cookie Policy available on the Platform.

Part II – Professional Clients

This section aims to provide clear, comprehensive and transparent information on the processing of personal data carried out by PICK & PAY APP, S.L.U. in connection with the marketing, provision and use of the GUAVA technological platform by professional clients operating in the hospitality sector.

13. Scope of Application (Clients)

This section applies to the processing of personal data relating to professional clients using the GUAVA platform, including restaurants, bars, hotels, hospitality groups, chains and other operators in the hospitality industry, as well as to natural persons acting on their behalf, such as legal representatives, employees, collaborators or authorised users.

14. Categories of Personal Data Processed (Clients)

Within the framework of the contractual relationship and use of the Platform, the Data Controller may process different categories of personal data depending on the services contracted and the functionalities used.

Such data may include identifying and contact details of natural persons linked to the client, professional data, contractual information, billing and financial data, payment-related information, usage data, access logs, roles and permissions, as well as operational information generated through the use of the Platform.

The Platform also allows clients to upload, generate, store and manage their own information and documentation, including commercial, accounting, operational or internal documents, supplier-related data, purchasing volumes, quantities, prices, expenses, invoices, reports and any other content the client decides to integrate into the system. The Data Controller does not determine the specific content or nature of such information and merely provides the technological infrastructure enabling its management.

15. Purposes of Processing (Clients)

Personal data are processed primarily for the purpose of enabling the correct execution, maintenance and development of the contractual relationship, including the provision of the technological services associated with GUAVA, user and account management, access control, customer support, incident handling and technical assistance.

Data may also be processed to:

• Ensure the security and integrity of the Platform, prevent misuse, fraud or unauthorised access;
• Perform internal audits and quality controls;
• Carry out technical analysis, generate backups and ensure service continuity;
• Send professional and commercial communications related to GUAVA, including information on service updates, new features, improvements or similar products;
• Perform statistical analysis, usage metrics and professional segmentation aimed at improving the service and optimising the client experience.

Such processing may involve non-intrusive profiling activities, without automated decision-making producing legal effects.

16. Legal Basis for Processing (Clients)

Personal data are processed where necessary for:

• The performance of a contract to which the data subject is party;
• Compliance with legal obligations applicable to the Data Controller;
• The purposes of the legitimate interests pursued by the Data Controller;
• And, where required, on the basis of the data subject's consent.

Processing is carried out in accordance with Article 6(1)(a), (b), (c) and (f) of Regulation (EU) 2016/679 (GDPR), together with applicable Spanish data protection legislation.

17. Data Recipients (Clients)

Personal data may be disclosed to third parties only where necessary for the proper provision of the services, compliance with legal obligations or the ordinary operation of the Data Controller's business.

Recipients may include technology and infrastructure providers, cloud hosting and data storage providers, technical support and maintenance providers, professional advisors, legal, accounting or auditing service providers, as well as payment service providers.

All such third parties process data under appropriate contractual safeguards and solely in accordance with the instructions of the Data Controller or as required by law.

18. International Data Transfers (Clients)

The Data Controller does not carry out international transfers of personal data outside the European Economic Area. Should such transfers become necessary in the future, they will be conducted in strict compliance with Articles 44 et seq. of the GDPR.

19. Data Retention (Clients)

Personal data will be retained for the duration of the contractual relationship and, thereafter, for the periods required by applicable law, taking into account the nature of the data and potential liabilities arising from their processing.

Once the relevant retention periods have expired, data will be securely deleted or anonymised.

20. Data Subject Rights (Clients)

Data subjects may exercise their rights of access, rectification, erasure, objection, restriction of processing and data portability at any time by contacting the Data Controller via the email address [email protected] or through any of the customer support channels made available by the Platform.

Data subjects also have the right to lodge a complaint with the Spanish Data Protection Authority if they consider that the processing of their personal data infringes applicable law.

21. Security Measures (Clients)

The Data Controller has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, aimed at protecting personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

However, the client acknowledges that no system is entirely secure and that data transmission over public networks entails inherent risks.

22. Client Responsibility

The client is solely responsible for the lawfulness of the personal data processed through the Platform, for having duly informed data subjects and for having obtained the necessary legal bases. The Data Controller acts exclusively as a technology provider and does not control the content or purposes of the data managed by the client within GUAVA.

23. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in legal, regulatory, or operational requirements. The version published on the Platform at any given time shall be the applicable version.

This Privacy Policy is governed by Regulation (EU) 2016/679, applicable Spanish data protection legislation and, where not regulated therein, Spanish law.