App Privacy Policy

PRIVACY POLICY FOR DATAPROCESSED BY MEANS OF THE EQUIVO APP

§1. GENERAL PROVISIONS

1.The use of the Equivo app (hereinafter: “App”) involves the processing of personal data. Pursuant to Article 12(1) and Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: “GDPR”), the Controller provides the information specified in those provisions concerning the processing of personal data of users of the App (hereinafter: “Users”).

2.The Privacy Policy constitutes an annex to and an integral part of the EQUIVO APP TERMS OF USE, which set out the rules and conditions for using the App.

3.The App does not use cookies. The App stores in the memory of the User's device only information that is necessary to provide the service requested by the User: an encrypted login session, App settings (e.g. language and appearance) and a copy of data enabling use without Internet access, which is deleted upon logging out. During registration and login, the Cloudflare Turnstile tool may use the storage of the browser embedded in the App solely for the purpose of distinguishing a human from an automated program. Pursuant to Article 399(3) of the Polish Act of 12 July 2024 - Electronic Communications Law, this does not require the User's consent.

4.Users may contact the Controller using the contact form available on the Website or by sending an e-mail message to kontakt@equivo.pl, and, in technical matters relating to the operation of the App, also to support@equivo.pl.

5.The App is intended for persons who have reached the age of 16. The Controller does not knowingly collect personal data of younger persons. If the Controller becomes aware that an Account has been created by a person under the age of 16, the Controller will delete that person's Account and data.

§2. DEFINITIONS

1.CONTROLLER or SERVICE PROVIDER - an entrepreneur operating under the business name “wAInot Natalia Piórkowska” with its registered office in Słubice, ul. Grzybowa 25 lok. 9, 69-100 Słubice, NIP: 5981585473, e-mail address: kontakt@equivo.pl.

2.USER - a person using the services provided by electronic means through the App.

3.APP - software in the form of a computer application by means of which the Service Provider provides services by electronic means, made available as a mobile application for devices running iOS and Android, available for download from App Marketplaces.

4.ACCOUNT - a set of permissions, data and other App resources assigned to an individual User.

5.TERMS OF USE - a separate document entitled EQUIVO APP TERMS OF USE, which sets out the rules and conditions for using the App.

6.SERVICES - services provided by electronic means by the Service Provider through the App, as described in the provisions of the Terms of Use.

7.PREMIUM SERVICES - digital services consisting in the paid provision of special App functionalities which are not available to Users of its free version, offered under the Premium and Max plans on the terms set out in the Terms and Conditions for the Paid Provision of Equivo App Premium Services.

8.WEBSITE - the website available at www.equivo.pl

9.APP MARKETPLACE - a website from which the App can be downloaded free of charge and Premium Services can be purchased. As at the date of entry into force of the Privacy Policy, these are App Store (Apple) and Google Play (Google).

10.SHARING - an App function enabling the User to make selected horse data available to another User (a co-owner or lessee) to the extent and with the permissions determined by the User, as well as to transfer a horse profile to another User.

11.PERSONAL DATA - any information relating to an identified or identifiable natural person, in particular a name and surname, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

12.PROCESSING OF PERSONAL DATA - means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

§3. PURPOSES OF THE PROCESSING OF PERSONAL DATA

The Controller processes personal data for the following purposes:

1.Registration and login to the App, which comprises personal data processing activities and processes performed for the following purposes:

1.1.Registration of Users in the App.

1.2.Logging in of Users.

1.3.Recovery of a login or password.

1.4.Deletion of an Account from the App.

2.Enabling the use of App functionalities, which comprises personal data processing activities and processes performed for the following purposes:

2.1.Processing of Users' profile data.

2.2.Storage of data, content and files entered into the App by Users.

2.3.Sharing of data, content and files between Users - exclusively with persons designated by the User as part of Sharing, as well as transfer of a horse profile to another User.

2.4.Making calculations and computations using personal data.

2.5.Determining the approximate location of the stable on the basis of the address provided by the User, in order to display weather forecasts and weather warnings.

2.6.Saving events in the App calendar and - at the User's request - opening them in Google Calendar.

2.7.Awarding points, titles and badges in the App.

2.8.Maintaining a list of contacts entered by the User (My team, emergency contacts, authorised persons, persons standing in for the User in caring for the horse).

2.9.Sending notifications and reminders (push notifications, local notifications and e-mail messages) about tasks, events and changes in the App, including e-mail messages with invitations sent at the User's request to persons designated by the User.

2.10.Generating a PDF file with a card for the person standing in for the User in caring for the horse.

3.Conclusion and performance of the agreement for access to Premium Services, which comprises personal data processing activities and processes performed for the following purposes:

3.1.Sale of Premium Services in App Marketplaces.

3.2.Granting a trial period, handling referral codes and handling Premium Services made available free of charge by the Service Provider (e.g. to Equivo ambassadors).

3.3.Provision of payment services - payments are handled exclusively by App Marketplaces; the Controller does not receive payment card details or bank account numbers.

3.4.Exercise of the right of withdrawal from the Premium Agreement.

4.Ensuring the proper functioning of the App, which comprises personal data processing activities and processes performed for the following purposes:

4.1.Recording of Users' activity in the App.

4.2.Collection of App crash and error reports.

4.3.Delivery of App updates.

5.Ensuring the security of the App, which comprises personal data processing activities and processes performed for the following purposes:

5.1.Changing personal data privacy settings.

5.2.Moderation of data, content and files in the App.

5.3.Protection of registration and login against abuse, including checking whether the password appears in known data breaches (without transmitting the password), and protection of forms against bots.

6.Marketing of goods and services, which comprises personal data processing activities and processes performed for the following purposes:

6.1.Marketing of the Service Provider's goods and services, including sending a newsletter to Users who have consented thereto, and displaying in the App messages from the Service Provider about the App and Premium Services, selected on the basis of the plan, the number of horses, the data storage space used and which App functions the User has used and when.

6.2.Marketing of goods and services of partners and third parties - displaying, in the free version of the App, advertisements of the Service Provider's partners, selected on the basis of the App plan and language and of the manner in which the App is used, without transferring personal data to partners.

6.3.Research and development work - statistical analyses carried out on pseudonymised data in order to improve App functions, including indicators and assessments relating to horses.

7.Performance of legal obligations and administrative tasks, which comprises personal data processing activities and processes performed for the following purposes:

7.1.Receiving notices of Unwanted Content, Prohibited Conduct or other infringements of the law or of the provisions of the Terms of Use.

8.Handling of notices and complaints, which comprises personal data processing activities and processes performed for the following purposes:

8.1.Correspondence by e-mail and via the contact form on the Website.

8.2.Handling of complaints under the agreement for the provision of services by electronic means through the App.

8.3.Receiving and handling requests concerning personal data.

8.4.Receiving and handling notices concerning infringements of copyright and of rights in intangible property.

§4. CATEGORIES AND TYPES OF PERSONAL DATA PROCESSED

1.The Controller processes the following categories of personal data:

1.1.registration and login data for the App, which include: name and surname and the user identifier in the App, the User's e-mail address, the password (stored only in encrypted form), the date and version of the accepted Terms of Use, the selected App language.

1.2.profile data: name and surname, language used, telephone number, contact e-mail address, correspondence address, name and address of the stable, date of birth (provided voluntarily), photographs which may show, in particular, the User's face, figure, sex and origin (profile picture, provided voluntarily), the rider's body weight (provided voluntarily, in order to estimate energy expenditure during training), currency and monthly budget for keeping the horse.

1.3.data contained in content made available by Users: photographs or videos containing depictions of the face, figure, sex and origin, information about the language used and voice recordings (voice notes), documents (e.g. scans of the horse passport, invoices, veterinary records), other information reflecting the physiological, genetic, mental, economic, cultural or social identity of App Users.

1.4.technical data: IP address, user name and identifier in the App, date and time of logging in to and logging out of the App; device token for push notifications, device model and operating system, App version, information about App crashes (without data identifying the User).

1.5.data on the User's activity in the App: on logging in to and logging out of the App; on making changes to individual Account settings; on the type and date of entry of data, content and files into the App; on the type of functionalities used by the User and the time of their use; on interactions with other App Users; on other activities performed using the App.

1.6.third-party data entered by the User: name and surname, telephone number, e-mail address, company, town and specialisation of specialists (e.g. veterinarians, farriers, trainers), of emergency contacts, of persons authorised to collect the horse or to make veterinary decisions and of persons standing in for the User in caring for the horse.

1.7.location data: the stable address provided by the User and the approximate geographical coordinates determined on its basis. The App does not collect the device's location.

1.8.calendar data: type and title of the event, persons (specialists) assigned to the event, description, notes and content of attachments, date, time and location of the event.

1.9.sales and payment data: name and surname, e-mail address, payment transaction identifier, information on current and past purchases of Premium Services, date and time of the commencement and end of the provision of Premium Services, type and prices of Premium Services, dates and amounts of payments made. Information on the trial period and the referral code used.

1.10.data from App Marketplaces: payment identifier (Order ID), purchase token (Purchase Token), name of the app package sold (Package Name), product identifier (Product ID), transaction price and currency, transaction status, country of the Account from which the purchase was made, date and time of the purchase or of the subscription renewal. Renewal status, expiry date and the Account identifier transmitted to the App Marketplace in order to assign the purchase to the Account.

1.11.certain financial data: financial estimates and calculations; lists, prices and dates of purchases; information on the characteristics of purchased products; data of sellers, service providers and counterparties; expense categories and summaries; other data which may reveal the economic identity of Users.

1.12.newsletter data: e-mail address, date and time of subscription, confirmation and unsubscription, content and version of the consent clause.

1.13.advertising and message data: information on which messages and advertisements the User has closed, and Premium Services panel events (impression, closing, click, purchase) with a User identifier, used to assess the effectiveness of messages. Partners' advertisement impression and click statistics are recorded without a User identifier and made available to partners solely as daily totals.

1.14.App usage data: total time of use, number of launches and number of visits to individual App screens on a given day, together with the type of operating system and the App version. These data are collected solely as daily totals with a random device identifier that changes every day, without a User identifier or IP address; they do not allow the User to be identified and are used solely to improve the App. They are stored for no longer than 400 days.

1.15.data relating to complaints and notices: name and surname or business name and e-mail address of the notifier, an indication of the electronic location of the information, such as exact URLs, and, where applicable, additional information enabling the identification of illegal content, name and surname or business name, address and e-mail address of the person responsible for the unwanted content or prohibited conduct.

1.16.copyright-related data: name and surname or business name and e-mail address of the notifying entity; name and surname or business name and e-mail address of the rightholder; name and surname or business name and e-mail address of the entity alleged to have infringed the rights, the type of rights held; identification of the infringing content.

2.The Controller processes specific categories of data depending on the purpose of processing:

2.1.Personal data processed for the purpose of enabling the use of App functionalities include the following categories: profile data, data contained in content made available by Users, technical data, data on the User's activity in the App, certain financial data, location data, calendar data, third-party data entered by the User.

2.2.Personal data processed for the purpose of concluding and performing the agreement for access to Premium Services include the following categories: profile data, sales and payment data, data from App Marketplaces.

2.3.Personal data processed for the purpose of ensuring the proper functioning of the App include the following categories: technical data, data on the User's activity in the App.

2.4.Personal data processed for the purpose of ensuring the security of the App include the following categories: profile data, technical data, registration and login data, data on the User's activity in the App, data contained in content made available by Users.

2.5.Personal data processed for the purpose of marketing goods and services include the following categories: registration and login data, newsletter data, advertising and message data, App usage data, data on the User's activity in the App (type and dates of use of App functions), information on the plan held, the number of horses and the data storage space used.

2.6.Personal data processed for the purpose of performing legal obligations and administrative tasks include the following categories: profile data, data on the User's activity in the App, data contained in content made available by Users.

2.7.Personal data processed for the purpose of handling notices and complaints include the following categories: login and registration data, data relating to complaints and notices, copyright-related data, other personal data - depending on the subject matter of the notice.

3.Subject to the User's additional consent, the App may access personal data and data of other types, collected and stored by the following components and software installed on the device from which the User accesses the App:

3.1.file manager - when uploading files to the App and when adding photos from the gallery;

3.2.camera - when photographing documents and the horse passport and taking photos of the horse.

3.3.microphone - when recording voice notes.

3.4.system notifications - in order to display reminders and notifications.

4.The App collects and processes data relating to equine animals which are not data relating to persons and do not constitute personal data, in particular:

4.1.identification data of equine animals, including the data specified in Commission Implementing Regulation (EU) 2021/963 of 10 June 2021 laying down rules for the application of Regulations (EU) 2016/429, (EU) 2016/1012 and (EU) 2019/6 of the European Parliament and of the Council with regard to the identification and registration of equine animals and establishing model identification documents for those animals, and in national legislation adopted on its basis.

4.2.husbandry data, including data on the behaviour, health condition, feeding and grooming of horses, as well as data on training sessions, competition starts, specialist visits and horse keeping costs.

5.The User consents to the processing of the data relating to equine animals referred to in §4(4) for the purpose and to the extent corresponding at least to the purposes of the processing of personal data referred to in §3 of this Privacy Policy.

6.Certain data concerning the health of equine animals may be protected by veterinary confidentiality. The User must hold the right to disclose such data before entering them into the App.

7.If the User enters personal data of other persons into the App (in particular of specialists, emergency contacts, authorised persons and persons standing in for the User), the Controller processes such data solely for the purpose of enabling the User to use those App functions. The source of such data is the User, who should have a basis for entering them and should inform those persons of the transfer of their data. Such persons may exercise the rights set out in §10 in relation to the Controller.

8.Providing registration and login data is necessary to create an Account and use the App. Providing other data is voluntary; however, without them it may not be possible to use certain App functionalities.

§5. LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

1.Personal data processed for the purposes listed below are processed on the basis of the consent of the data subject (Article 6(1)(a) GDPR):

1.1.Marketing of goods and services - with regard to the newsletter.

2.Personal data processed for the purposes listed below are processed as necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR):

2.1.Registration and login to the App.

2.2.Enabling the use of App functionalities.

2.3.Conclusion and performance of the agreement for access to Premium Services.

2.4.Ensuring the proper functioning of the App.

2.5.Handling of notices and complaints.

3.Personal data processed for the purposes listed below are processed because this is necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c) GDPR):

3.1.Performance of legal obligations and administrative tasks.

4.Personal data processed for the purposes listed below are processed for the purposes of the legitimate interests pursued by the Controller (Article 6(1)(f) GDPR):

4.1.Ensuring the security of the App - the legitimate interest is to ensure the secure operation of the App in compliance with the law and the provisions of the Terms of Use.

4.2.Marketing of the Service Provider's own services in the App (messages about Premium Services) and displaying partners' advertisements in the free version of the App - the legitimate interest is to inform about the Service Provider's offer and to finance the free version of the App.

4.3.Processing of third-party data entered by the User - the legitimate interest of the Controller and of the User is to enable the User to contact specialists and persons caring for the horse.

4.4.Research and development work - the legitimate interest is to improve App functions on the basis of pseudonymised data.

4.5.Establishment, exercise or defence of claims and storage of a record of the execution of an Account deletion request - the legitimate interest is the ability to demonstrate the proper performance of the agreement and of the User's requests.

§6. CONSENT TO DATA PROCESSING

1.During registration, the User accepts the Terms of Use and confirms having read the Privacy Policy. Irrespective of this, the User may voluntarily give consent:

1.1.to receive the Equivo newsletter with news and offers - by ticking the checkbox in the “Equivo development” section in the App (or on the Website) and confirming the subscription via a link sent by e-mail.

1.2.to the App's access to the camera, photos, microphone and notifications - in the operating system dialogue windows, when the given function is used for the first time.

2.Giving consent to the processing of personal data for the purpose of marketing goods and services is voluntary. The User may register and use the App without giving marketing consent.

3.The User has the right to withdraw consent to the processing of personal data at any time without affecting the lawfulness of processing based on consent before its withdrawal. Consent to the newsletter may be withdrawn via the link in each message or by a message sent to kontakt@equivo.pl, and consents to access to the camera, photos, microphone and notifications - in the device settings.

§7. INFORMATION ON PROFILING

1.The Controller does not make decisions concerning Users based solely on automated processing, including profiling, which produce legal effects concerning them or similarly significantly affect them.

2.The App automatically calculates indicators, assessments and reminders relating to horses (e.g. condition, health risks, feed stocks, awarding of carrots and badges). They are purely informative, relate to horses and do not replace the advice of a veterinarian.

3.Partners' advertisements in the free version of the App and the Service Provider's messages are selected on the basis of the App plan and language, the number of horses and the data storage space used, as well as which App functions the User has used and when. They are not selected on the basis of data concerning horses' health, location or content entered by the User, and they do not produce legal effects concerning the User. The User may object to such selection (Article 21 GDPR) by writing to kontakt@equivo.pl.

§8. PERIOD OF PROCESSING OF PERSONAL DATA

1.Personal data are processed by the Controller for the following periods:

1.1.Personal data are processed for the duration of the provision of services by electronic means consisting in access to the App, and also thereafter until the expiry of the limitation period for claims, the length of which is determined in accordance with the applicable provisions of law:

1.1.1.in the case of consumers, the limitation period is six years, and in the case of claims for periodic performance and claims connected with the conduct of business activity - three years.

1.1.2.in the case of tax data, the limitation period is five years, counted from the end of the calendar year in which the tax payment deadline expired.

1.2.Personal data processed for the duration of the provision of services by electronic means consisting in access to the App, referred to in paragraph 1.1, comprise data processed by the Controller for the following purposes:

1.2.1.Registration and login to the App,

1.2.2.Enabling the use of App functionalities,

1.2.3.Ensuring the proper functioning of the App

1.2.4.Ensuring the security of the App

1.3.Personal data processed for the duration of the provision of Premium Services and, after their provision has ceased, until the claims become time-barred (usually for three years) are data processed for the purpose of concluding and performing the agreement for access to Premium Services. Purchase data received from App Marketplaces are automatically deleted after 3 years.

1.4.Personal data processed until consent is withdrawn or an objection to processing is raised comprise data processed for the purpose of marketing goods and services. Data confirming consent to the newsletter are stored for 3 years from unsubscription in order to demonstrate that messages were sent with consent.

1.5.Personal data processed for the period necessary to handle a notice or complaint, but no longer than 3 years from the completion of its handling, are data processed for the following purposes:

1.5.1.Handling of notices and complaints.

1.5.2.Performance of legal obligations and administrative tasks.

2.The Controller will delete personal data and other data without undue delay after the Account has been deleted from the App (the Account is deleted 30 days after the request for its deletion has been submitted; logging in during this period and selecting the “Keep account” option cancels the request), if:

2.1.the circumstances set out in Article 17(1) GDPR have occurred.

2.2.further processing of the data is not necessary for the purposes set out in Article 17(3) GDPR.

3.Deletion of the Account does not terminate the agreement for the provision of Premium Services and does not affect the processing of data on its basis. The Subscription must be cancelled in the settings of the App Marketplace in which it was purchased.

4.Where personal data have been made public in the App and the Controller is obliged to erase them, the Controller, taking account of available technology and the cost of implementation, takes reasonable steps, including technical measures, to inform controllers which are processing those personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

5.In accordance with Article 43o(1) of the Polish Consumer Rights Act of 30 May 2014, deletion of the Account from the App results in the deletion of content other than personal data, except for content which:

5.1.has no utility outside the context of the digital content or digital service which constituted the subject matter of the agreement;

5.2.relates exclusively to the consumer's activity when using the digital content or digital service which constituted the subject matter of the agreement;

5.3.has been aggregated by the trader with other data and cannot be disaggregated without disproportionate effort;

5.4.has been generated jointly by the consumer and other consumers who are still able to make use of it.

6.Database backups are stored for no longer than 7 days, and App crash reports for no longer than 90 days, after which they are deleted. Premium Services panel events are stored for no longer than 13 months. A record of the execution of an Account deletion request (e-mail address, dates of the request and of the deletion, and the reason given) is stored for 3 years.

§9. INFORMATION ON RECIPIENTS OF PERSONAL DATA

1.The Controller may transfer personal data to the following categories of recipients:

1.1.providers of servers, computer memory, disk space and virtual drives.

1.2.providers of certain types of software which the Service Provider uses to enable the functioning of the App, in particular providers of operating and database systems, developer tools, anti-virus and cryptographic software.

1.3.providers of software which the Service Provider uses in its business, in particular providers of computer memory, virtual drives, and software and platforms for collaboration and sharing of data, files and documents, CRM systems, electronic calendars and online office software suites.

1.4.providers of online platforms which host App Marketplaces.

1.5.providers of payment services and payment systems.

1.6.providers of accounting and tax services.

1.7.state authorities authorised under separate provisions of law for the purposes of proceedings conducted by them.

1.8.providers of e-mail services and e-mail delivery services.

1.9.providers of push notification, App update and crash reporting services.

1.10.providers of weather data, address search services and currency exchange rates.

1.11.other Users with whom the User has shared data as part of Sharing or to whom the User has transferred a horse profile - to the extent selected by the User.

2.Personal data may be transferred to recipients in one or more categories selected according to the content of the complaint.

3.Personal data may be transferred to countries outside the European Economic Area, in particular to the United States of America. By Implementing Decision (EU) 2023/1795 of 10 July 2023 (OJ L 231, 20.9.2023, p. 118–229), the European Commission found that an adequate level of protection is ensured for personal data transferred to the USA. This applies to organisations participating in the EU-U.S. Data Privacy Framework. If a provider does not participate in this framework, the transfer of data is based on standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). The App database and uploaded files are stored on servers in the European Union (Frankfurt am Main, Germany).

4.As at the date of entry into force of the Privacy Policy, the recipients of data include in particular: Supabase Inc. (database, login, file storage, server functions; servers in Frankfurt); Apple Inc. and Apple Distribution International Ltd. as well as Google LLC and Google Ireland Limited (App Marketplaces, payment processing, push notifications on iOS and Android); Resend (e-mail delivery); 650 Industries, Inc. - Expo (push notifications and App updates); Functional Software, Inc. - Sentry (crash reports, servers in the European Union); Cloudflare, Inc. (protection of registration and login against bots; data processing in the Turnstile tool - Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/); OpenStreetMap Foundation - Nominatim and Zippopotam.us (looking up coordinates on the basis of the stable address). Only the rounded coordinates of the stable and the names of the localities searched for by the User, without User data, are transmitted to the weather forecast provider (Open-Meteo), and only currency pairs to the exchange rate provider (Frankfurter). The check whether a password has been leaked is performed using the Have I Been Pwned service on the basis of the first 5 characters of the password hash, without transmitting the password or the e-mail address.

§10. RIGHTS OF DATA SUBJECTS

1.The data subject has the right to:

1.1.access his or her data (Article 15 GDPR) - the data subject has the right to obtain from the Controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and information about their processing.

1.2.rectification of data (Article 16 GDPR) - the data subject has the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed.

1.3.erasure of data (Article 17 GDPR) - the data subject has the right to obtain from the Controller the erasure of personal data concerning him or her without undue delay.

1.4.restriction of processing (Article 18 GDPR).

1.5.data portability (Article 20 GDPR) - the data subject has the right to receive the personal data concerning him or her, which he or she has provided to the Controller, in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller.

1.6.object to the processing of personal data concerning him or her, in particular data processed on the basis of the legitimate interests of the Controller (Article 21 GDPR).

1.7.not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her (Article 22 GDPR).

1.8.withdraw consent to the processing of personal data at any time (Article 7(3) GDPR);

1.9.lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO) or with the supervisory authority in the European Union Member State of their habitual residence, place of work or place of the alleged infringement (Article 77 GDPR).

2.The rights of data subjects are exercised at their request submitted to the Controller in writing - to the address of its registered office, via the contact form on the Website, or by e-mail to: kontakt@equivo.pl

3.The Controller provides the data subject with information on action taken on a request to exercise his or her rights relating to the processing of personal data without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity of the request or the number of requests. The Controller informs the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.

4.Actions taken by the Controller to give effect to the rights relating to the processing of personal data are free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the Controller may:

4.1.charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

4.2.refuse to act on the request.

5.The Account can be deleted directly in the App (Profile, Settings, Account, “Delete the account”) and, without installing the App, on the page https://equivo.pl/en/delete-account. The User can correct most data themselves in the App. Upon request, the Controller sends a copy of the data provided by the User in a structured, machine-readable format.

§11. SECURITY MEASURES

1.The Controller applies technical and organisational measures ensuring protection of the personal data processed that is appropriate to the risks and to the categories of data, including measures securing the data against access by unauthorised persons.

2.The Controller does not designate a Data Protection Officer.

3.The App contains functionalities aimed at protecting Users' personal data, in particular:

3.1.the ability to change personal data sharing settings by specifying the group of App Users to whom the data are displayed, or to keep them confidential from other App Users.

3.2.the ability to withdraw consent to the processing of personal data for marketing purposes.

3.3.the contact form on the Website and the e-mail address kontakt@equivo.pl, through which Users may report personal data security breaches and exercise their rights relating to the processing of their data.

3.4.the ability to delete the Account from the App.

3.5.encryption of connections to servers and storage of the login session in encrypted device storage.

3.6.separation of individual Users' data at database level (access rules for each row of data).

3.7.storage of documents (e.g. scans of passports, invoices, veterinary records) in private file storage and making them available exclusively via links with limited validity.

3.8.checking during registration whether the password appears in known data breaches.

§12. FINAL PROVISIONS

1.For important reasons, the Service Provider may amend the Privacy Policy by providing the User with its new text in the App and by e-mail no later than 30 days before the amendments enter into force. The User is bound by the amended Privacy Policy if, within that period, the User has not withdrawn consent to the processing of personal data or requested their deletion.

2.The current Privacy Policy is available on the Website, including in PDF format, which allows the User to download and reproduce it at any time.

3.The date of entry into force of this Privacy Policy is 25.10.2026.