PRIVACY POLICY

1. Identification of the Data Controller

This privacy policy governs the processing of personal data carried out through the KORUU application, published on Google Play under the developer name “Macguffin”, as well as, where applicable, through the website and other digital environments linked to the service.
The Data Controller is NOVELLIAMS LLC, with registered address at 3810 Law Street, apt 366, Houston, Texas, United States, and contact email address info@novelliams.com.
Should it be legally required and once formally appointed, the details of the representative in the European Union will be incorporated into this policy.

2. Scope of Application

This policy applies to the processing of personal data carried out in the context of accessing, registering, browsing, and using the KORUU application, including user account management, participation in sessions or events, uploading, storing, viewing, and, where applicable, downloading images, as well as any interaction with the platform.

3. Personal Data Processed

Depending on the use of the service, the following categories of personal data may be processed:
• Identifying data, such as name, alias, or user identifier.
• Contact data, such as email address.
• Technical and usage data, such as IP address, device identifiers, operating system, activity logs, and browsing data.
• Data relating to the use of the service, such as activity history, sessions, and preferences.
• Economic and transactional data, in the event of contracting paid functionalities. In such cases, the user will be redirected to external payment platforms, with NOVELLIAMS LLC generally not having access to the full payment instrument details. However, the Data Controller may process information associated with the transaction, such as payment status, operation identifiers, amount, or related incidents, to the extent necessary for managing the service.
• User-generated content, in particular images uploaded to the platform, as well as information associated with such images, including metadata where applicable.
To the extent that images may contain identified or identifiable individuals, the processing may involve personal data of third parties.

4. Purposes of Processing

Personal data will be processed for the following purposes:
• To allow access to and use of the application, including the creation and management of accounts.
• To manage the operation of the service, including the organization of sessions, the uploading, storage, viewing, and downloading of images by authorized users.
• To facilitate interaction between users within the platform.
• To manage payments and functionalities associated with premium services.
• To respond to requests, inquiries, or incidents.
• To ensure the security of the service, prevent misuse, and detect potential fraud.
• To implement control measures, review, content removal, limitation of functionalities, and preservation of evidence when there are indications of non-compliance, abusive use, or unlawfulness.
• To comply with legal obligations.
• To send informational or commercial communications where there is a legal basis for doing so, in all cases providing mechanisms for objection or opt-out where required.

5. Legal Basis for Processing

The processing of data is based on the performance of the contract for the provision of the service requested by the user.
Likewise, it may be based on the user’s consent in cases where it is required, on the Data Controller’s legitimate interest in ensuring the security, integrity, and proper functioning of the service, preventing fraud, and defending its legal interests, and on compliance with legal obligations.

6. Processing of Images and User Responsibility

The application allows users to upload images that may contain personal data, including the image of third parties.
The user guarantees that they have the necessary rights to the content they upload and, where applicable, that they have the legal basis or necessary consent from the individuals appearing in them, especially when dealing with third-party data or data of minors.
NOVELLIAMS LLC acts as a provider of technological intermediary services, merely providing the infrastructure for the storage and availability of content within the application environment.
Without prejudice to the foregoing, the Data Controller may adopt measures for review, removal, blocking, account suspension, or preventive preservation of evidence when there are reasonable indications of unlawfulness, violation of rights, breach of the service terms, or risk to third parties or minors.
Access to content by other users occurs within the framework of the service’s own functionality, in accordance with the Terms of Use, and this policy does not, by itself, govern the legal relationships between users.

7. Recipients of Data

Data may be communicated to service providers necessary for the operation of the platform, including technological services for hosting, storage, analytics, support, and payment processing.
Likewise, they may be communicated to public authorities when necessary to comply with legal obligations or by virtue of binding requirements.
Images and content may be accessible by other authorized users within each session or event, according to the service’s own functionality.
No data transfers will be made to third parties for their own purposes other than those described.

8. International Data Transfers

Given that the Data Controller is located in the United States and that certain providers may be located outside the European Economic Area, personal data may be subject to international transfers.
Such transfers will be carried out in accordance with the mechanisms provided for in applicable regulations, including adequacy decisions, adherence to applicable privacy frameworks, or the execution of standard contractual clauses approved by the European Commission, without prejudice to the data subject’s right to request additional information on the applicable safeguards in each case.

9. Data Retention

Personal data will be retained for as long as necessary for the provision of the service and the fulfillment of the purposes described.
Data associated with the account will be retained as long as the account remains active.
Economic data will be retained for the periods required by applicable regulations.
Images will be retained for the time necessary for the operation of the service and the availability period defined in each session, without prejudice to their deletion or download by users.
When necessary for incident management, prevention of unlawful use, protection of rights, legal defense, or compliance with authority requirements, records, evidence, or backup copies may be retained on a restricted basis for the time strictly necessary for such purposes.
Subsequently, data may be kept blocked for the periods necessary to address potential legal liabilities.

10. User Rights

The user may exercise the rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent.
To do so, they may contact info@novelliams.com, providing proof of their identity.
The Data Controller will respond within a maximum period of one month.
Furthermore, the user may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) through its electronic office.
For specific issues related to data of minors, the Spanish Data Protection Agency has the channel canaljoven@aepd.es.

11. Data of Minors

The service allows the participation of minor users within the framework of sessions or events organized on the platform.
The use of the service by minors must be carried out in accordance with applicable regulations and, where required, with the authorization, assistance, or supervision of those holding parental authority or guardianship.
When the processing of personal data is based on the user’s consent, such consent shall only be valid if the minor is at least fourteen (14) years old, without prejudice to those cases where the intervention of their legal representatives is required.
Users participating in the platform, including minors, must be identified according to the technical mechanisms enabled in the service, for the purpose of ensuring the traceability of actions performed and the security of the environment.
Regarding content that includes data of minors, the user uploading it guarantees that they have the necessary legal coverage, authorizations, and consent, and that they have acted with the required diligence considering the special protection of minors.
NOVELLIAMS LLC does not perform a general prior review of content uploaded by users, without prejudice to the powers of review, removal, blocking, limitation of functionalities, and preventive preservation of evidence when there are reasonable indications of unlawfulness, violation of rights, or risk to the rights, privacy, or safety of minors.
In such cases, the Data Controller may adopt immediate measures and, where appropriate, report the facts to the competent authorities.

12. Security

Appropriate technical and organizational measures have been adopted to ensure the security of personal data, considering the nature of the data and the risks associated with the processing.

13. Relationship with Other Legal Texts

This policy is complemented by the Terms of Use and the Cookie Policy of KORUU.

14. Modifications

This policy may be updated in response to regulatory changes or changes in the operation of the service. When modifications are significant, reasonable efforts will be made to communicate them.