PRIVACY POLICY (INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA)

Pursuant to Art. 13 of Regulation (EU) 2016/679 ("GDPR")

Last updated: November 2026

This Policy describes how the personal data of users who download, access and use the mobile application "hoozy" (available for iOS and Android operating systems) and the related connected web services (hereinafter, collectively, the "Platform") are collected, used and protected.

1. Data Controller

The Controller of personal data is Tomer Zvi Mieli, as a sole proprietor, with registered office at Via Pietro Venturi 55, 00149 Rome (RM), Italy, Tax Code MLITRZ96C30Z226B, VAT No. 17421931001 (hereinafter, the "Controller"). To exercise their data protection rights, users may contact the Controller at the dedicated email address: privacy@hoozy.it. For general or routine communications, the address supporto@hoozy.it is also available.

2. Categories of Personal Data Processed

In connection with the use of the Platform, the Controller processes the following categories of data:

• Registration and user profile data: first name, last name or pseudonym/username, email address, profile picture and cover image, any links to social media profiles voluntarily entered by the user, as well as the technical authentication identifiers provided when signing in through third-party services (e.g. Google Sign-In or Apple ID). The user's email address remains private and is not made visible to other members of the Platform.
• Geolocation data (active use only): geographic coordinates (GPS/network) detected by the device solely while the Platform is open and in active use (foreground), in order to centre the interactive map and show nearby restaurants, places and experiences ("Near me"). The Platform does not perform any continuous background location tracking while the screen is off or when the app is closed. Users may disable geolocation at any time from the device or Platform settings; in that case, some location-based features may be limited.
• User-Generated Content (UGC) and interactions: places suggested through the dedicated form, custom lists ("Hoozylist"), saved places, reviews, photos, links to external content, preferences ("likes"), connections ("follow/follower") and recent activity shown in the feed.
• Data and files uploaded to the "Wallet" section: digital documents, tickets, boarding passes, booking confirmations and files uploaded by the user to their personal "Wallet" space. These files are stored on the Platform's servers in strictly private and encrypted form, are accessible only to the account holder and are not shared with other members or third parties. Documents and files uploaded to the Wallet section are kept for the entire life of the account and permanently deleted if the account is deleted, within the timeframes set out in section 6.
• Search parameters and temporary filters: criteria selected by the user to filter places on the map (e.g. city, categories such as "Eat", "See", "Do", or dietary options such as "Kosher" or "Ethnic Restaurant"). These selections operate solely in real time during the individual search session and are not saved or permanently associated with the user's profile, thereby excluding any processing of special categories of data relating to religious or philosophical beliefs or dietary habits within the meaning of Art. 9 GDPR. Filter choices are not used to build profiles of the user's stable personal preferences or for targeted marketing purposes.
• Technical, diagnostic and notification data: device model, operating system version, IP addresses, access logs, anonymous tokens for sending push notifications, and statistical/diagnostic data managed through the app stores' native tools (Apple App Store / Google Play).

3. Purposes and Legal Bases of Processing

Personal data are processed for the following purposes and on the corresponding legal bases provided for by Art. 6 GDPR:

• Provision of the Platform services and account management: enabling registration, authentication, browsing of the geolocated map during active use, creation of lists, social interaction between users and creators, the award of virtual reputation points ("Hoozy Points") and private storage in the Wallet section.
• Legal basis: performance of a contract to which the data subject is party, or of pre-contractual measures (Art. 6(1)(b) GDPR).
• Security, technical maintenance and abuse prevention: ensuring the stability of the IT infrastructure, preventing fraud, spam or breaches of the Terms of Use, and moderating any unlawful content reported by users.
• Legal basis: the Controller's legitimate interest in the security and integrity of the service (Art. 6(1)(f) GDPR).
• Compliance with legal obligations: complying with statutory or tax provisions or with binding orders of judicial or public security authorities.
• Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Optional informational or promotional communications: sending updates about new Platform features or dedicated newsletters (only where the user has given specific consent).
• Legal basis: the data subject's freely given and revocable consent (Art. 6(1)(a) GDPR).

4. Processing Methods, Cloud Infrastructure and Data Transfers

Processing is carried out using IT and electronic tools, with appropriate technical and organisational security measures in place (encryption of communications, access control, segregation of environments). The Platform's database and files are hosted on the Supabase cloud infrastructure (built on Amazon Web Services (AWS) architecture), with servers located within the European Economic Area (EEA). For the Platform's authentication and distribution services, Google and Apple process data as independent controllers, under their respective privacy policies, while the cloud infrastructure providers (Supabase/AWS) act as Data Processors. Where certain integrated technical services involve a transfer of data to third countries (e.g. the United States), the transfer takes place solely in accordance with Art. 44 et seq. GDPR, on the basis of European Commission Adequacy Decisions (e.g. the EU-U.S. Data Privacy Framework) or through the execution of Standard Contractual Clauses (SCCs).

5. Recipients of Data

Personal data are not disseminated indiscriminately or sold to third parties. They may be disclosed only to:

• Technical and cloud service providers (e.g. the Supabase/AWS hosting/database provider, IT development and maintenance providers), duly appointed as Data Processors pursuant to Art. 28 GDPR. An up-to-date list of Data Processors may be requested from the Controller using the contact details given in section 1.
• Authentication and digital distribution service providers (Apple and Google), which act as independent controllers.
• Other users of the Platform, limited to the information the user chooses to make public on their profile (name/username, profile picture, public lists, shared content).
• Merchants / Restaurants: the Platform does not transmit users' personal data to the listed restaurants; for booking requests, the user is simply redirected to the external channels managed directly by the individual venue.

6. Data Retention Period

• Account data, lists and Wallet documents: kept for as long as the account is active and permanently deleted within 30 days of the user's account deletion request, made through the Platform settings or by email.
• Public content (reviews, suggestions and public lists): if the account is deleted, content with no identifying references is irreversibly anonymised (unlinked from the user's profile) or deleted at the specific request of the data subject.
• Data processed for optional informational or promotional purposes (newsletter): kept until the data subject withdraws consent.
• Geolocation data and search filters: processed solely in volatile memory during the active session and not kept in historical archives.
• Technical security logs: kept for a maximum of 12 months for IT security purposes.

7. Rights of the Data Subject

As a data subject, the user may at any time exercise the rights provided for by Arts. 15–22 GDPR, and in particular may:

• request access to their personal data and obtain a copy;
• request the rectification of inaccurate data or the completion of incomplete data;
• obtain the immediate erasure of their data and account (right to be forgotten);
• request restriction of processing or object to processing based on legitimate interest;
• receive their data in a structured, machine-readable format (portability);
• withdraw any consent given at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it).

Requests may be sent at any time to the email address privacy@hoozy.it.

8. Updates and Changes to this Policy

This Policy may be amended or updated. In the event of material changes, users will be informed through a notice on the Platform or through the Controller's official channels.