PRIVACY POLICY

Last updated: 9 July 2026

Privacy Policy | MySpot

Privacy Policy for the Myspot mobile application — what data we collect, why we process it, and how you can exercise your GDPR rights.

GENERAL INFORMATION

  1. Version 2.0 · Effective date: 9 July 2026 · A document of „May Spot App" OOD
  2. This Policy applies to end users of the Myspot mobile application (iOS and Android).

1. CONTROLLER AND CONTACT

  1. The controller of personal data is „May Spot App" OOD, UIC 207339717, with registered seat and address of management at 5A Lale Str., fl. 4 ("Provider", "Myspot", "we").
  2. We have appointed a Data Protection Officer (DPO), whom you can contact on any matter relating to the processing of your personal data and the exercise of your rights at: [email protected].

2. WHAT DATA WE COLLECT

  1. Registration and profile data: name/username, email address, and — where you register via Apple or Google — an identifier and data shared by the respective sign-in provider.
  2. Reservation data: selected venues and spots, dates, reservation status, issued Tickets, reservation history, and Credits.
  3. Payment data: processed by Stripe. Myspot receives limited information (for example, the payment result, card type/last digits, transaction identifier) but does not store the full card details.
  4. Technical and usage data: device/installation identifiers, device type and operating system, application version, events from your use of the Application (e.g. screen views, searches, reservations and payments made), diagnostic data.
  5. Correspondence: messages you send us (e.g. support enquiries).
  6. The Application does not use location services and does not collect geolocation data.

3. PURPOSES AND LEGAL BASES FOR PROCESSING

We process your personal data only where we have a legal basis to do so and in accordance with the GDPR, for the following purposes:

  1. To provide the service — creating and managing an account, processing reservations and payments, issuing Tickets, granting and using Credits, and customer support. This processing is necessary for the performance of the contract with you.
  2. To comply with our legal obligations — including accounting and tax requirements and the fiscal documents issued for Online Reservations.
  3. Based on our legitimate interests — for security and the prevention of abuse, for the maintenance and technical functioning of the Application, for analysis and measurement of usage in order to improve the service (for example, which support languages to add and what the adoption rate of new versions is), as well as for measuring the effectiveness of marketing. Where we process data on this basis, you have the right to object (see Section 8).
  4. We do not carry out email marketing and do not send advertising notifications (push).

4. SHARING AND RECIPIENTS OF DATA

  1. We share data with service providers and partners who process it for the stated purposes:
    1. Stripe — payment processing;
    2. Amazon Web Services (AWS) — hosting and storage;
    3. Google (Firebase) — technical infrastructure and analytics/measurement (see Section 5);
    4. Meta — advertising measurement and attribution (see Section 5).
  2. Merchants. We do not share your personal data (e.g. name, email, or other contact details) with Merchants. The relevant Merchant is provided only with the information necessary to fulfil the reservation — for example, that a particular Spot has an online reservation — without data that identifies you (see Section 9).
  3. Legal requirements and protection of rights: we may disclose data where required by law or by a competent authority, as well as to establish, exercise, or defend legal claims.
  4. Business transfers: in the event of a merger, acquisition, or transfer of assets, data may be transferred to the acquiring entity.
  5. Place of processing. We aim for your data to be processed within the European Economic Area (EEA). Some of our service providers (those listed in Sections 4.1 and 5) may process part of the data outside the EEA. Where this happens, it takes place only under appropriate safeguards in accordance with the GDPR — for example, a European Commission adequacy decision or Standard Contractual Clauses.

5. ANALYTICS, MEASUREMENT, AND ADVERTISING

  1. The Application uses Firebase Analytics (Google) and Meta App Events (Meta) to understand how the Application is used and to measure the effectiveness of marketing.
  2. These tools process usage events and identifiers, including data on reservations and payments made (for example, value, currency, and transaction identifier), as well as a user identifier that we associate with the events.
  3. We use this data for analytics purposes and advertising measurement/attribution. We do not use this data for retargeting or for building advertising audiences.
  4. Google and Meta act as independent controllers for their own purposes with respect to the data processed through their tools. For more information, see the privacy policies of Google and of Meta.
  5. Control and opt-out. You can limit these activities through your device settings (e.g. advertising/tracking settings and resetting the advertising identifier), as well as through the controls offered by Google and Meta.

6. CAMERA ACCESS

  1. The Application requests access to the camera solely to scan QR codes (spot plates and Tickets). We do not capture or store images or video for any other purpose.

7. RETENTION PERIODS

  1. We retain personal data only for as long as necessary for the purposes for which it was collected:
    1. account data — while the account is active;
    2. reservation and payment data — for the period required by accounting and tax legislation;
    3. technical/analytics data — for a limited period according to the settings of the respective tools;
    4. support correspondence — for a reasonable period for servicing and the protection of rights.
  2. After the applicable period expires, data is deleted or anonymised.

8. YOUR RIGHTS

  1. Under the GDPR you have the right to: access; rectification; erasure ("the right to be forgotten"); restriction of processing; objection to processing based on legitimate interest; portability of data; as well as the right to withdraw your consent at any time where processing is based on consent (without affecting the lawfulness of processing before the withdrawal).
  2. Rights are exercised at [email protected]. We will respond within the time limits set by the GDPR.
  3. You have the right to lodge a complaint with the supervisory authority — the Commission for Personal Data Protection (CPDP), Sofia — or with the supervisory authority of your habitual residence.

9. RELATIONSHIP WITH MERCHANTS

  1. With respect to the data processed through the Application, Myspot is the controller. We do not provide your personal data to Merchants through the Application (see Section 4.2).
  2. If you provide data directly to a Merchant (for example, during on-site service), the Merchant is a separate controller for that data and is independently responsible for compliance with applicable data protection legislation.

10. SECURITY

  1. We apply appropriate technical and organisational measures to protect data, including encrypted storage, storage of credentials/tokens in a secure device store (Keychain), as well as mechanisms for protection against abuse and verification of application integrity (e.g. Firebase App Check).
  2. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

11. ACCOUNT DELETION

  1. You can delete your account directly in the Application (via the profile screen) or by requesting deletion at [email protected].
  2. Upon deletion, we remove or anonymise your data, except where we are required to retain it by law (for example, accounting and tax obligations).

12. CHILDREN

  1. The content of the Application is suitable for all ages. However, creating an account and making reservations and payments requires the User to be at least 18 years old (or to use the Application with the consent and under the supervision of a parent or guardian). The Application is not directed at children, and we do not knowingly collect children's personal data. If you believe that a child has provided us with personal data, contact us at [email protected] and we will delete it.

13. CHANGES TO THE POLICY

  1. We may update this Policy. For material changes, we will notify you through the Application or by email. The current version is always available in the Application.

14. CONTACT

  1. „May Spot App" OOD, UIC 207339717 · [email protected].