1. Identification of the Responsible Party

This Privacy Policy describes how Hoop Solutions S.L. (hereinafter,“TRIBE”) through its mobile application (“the TRIBBU Platform”), as well as the rights you have and how to exercise them.

At TRIBBU, we are committed to protecting and respecting your privacy. Our activities are carried out in compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), as well as Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”), hereinafter, the “Data Protection Regulations”.

The entity responsible for processing users' personal data in relation to the services provided through the TRIBBU mobile application is:

• Titular: Hoop Solutions S.L.
• Registered office: Calle Bravo Murillo, 231, 2ºDcha, 28020, Madrid
• C.I.F.: B88304126
• Public Registry: Madrid Commercial Registry, Volume 38422, Folio: 92, Registration Sheet No. 683510
• DPO Email:dataprotection@tribbuapp.com 

‍

2. Our approach to privacy

2.1. This Privacy Policy sets out how we collect, store, process, transfer, share and use personal data that identifies you or is associated with you ("personal information") in the use of our TRIBBU mobile application (hereinafter, "the Platform").

‍

2.2. This Privacy Policy applies exclusively to the use of the Mobile Platform, i.e., the application operated by TRIBBU. Please ensure that you have read and understood this Privacy Policy before accessing or using the app.

‍

3. Background information about our types of accounts

At TRIBBU there is only one type of user account. Through this account, the user can use the Platform both to offer a ride as a driver and to book a ride as a passenger, depending on their needs at any given time.

This account is personal, unique, and non-transferable. TRIBBU is not responsible for the misuse or negligent use of the account by the owner, nor for its use by unauthorized third parties.

‍

4. Who is responsible for the use of your personal information?

TRIBBU as Data Controller

TRIBBU acts as the Data Controller of users' personal data when:

a) Manage the creation and registration of user accounts in the TRIBBU app

b) It handles the information necessary for the creation and management of journeys, whether as a driver or as a passenger.

c) Manages payments, incentives, discounts and other services associated with the Platform.

d) It monitors the use of the app for the purposes of service improvement, security, fraud control or regulatory compliance.

e) To obtain Energy Saving Certificates in accordance with the legal requirements established in the Legal Framework of the CAE, in the case that the user uses the App in Spain.

d) If the App is used within the environment of an entity that contracts us for the provision and use of its staff, we may process data related to the characteristics of the trip (excluding those related to geolocation), provided that your organization requests it and complies with the requirements established in the GDPR.

‍

5. The personal information we collect from you when you use our Platform and how we use it.

We collect various types of personal information when you use our mobile app. Below, we explain what data we process, when, and for what purpose.

5.1 Registration and account creation

When you register on the mobile application, we ask for basic information to create your account and allow you to access the platform.

• This includesnecessary informationWithout which we could not provide the service: your first and last name, and telephone number (verified by SMS code)
• Voluntary information:such as your email address, whether you belong to a company, and uploading a profile picture. Additionally, you can complete other optional fields such as your country of birth, date of birth, nationality, and identification document (national ID card, foreign resident's ID card, or passport).

This information is used to correctly identify you, provide you with the service, personalize your experience, and facilitate the allocation of benefits linked to your organization, if applicable. The legal basis for this processing is the performance of a contract (provision of the service) and, in the case of optional/voluntary data, your consent.

5.2 Use of the platform as a driver or passenger

As a registered user, you can use the app to post and book trips, whether you're a passenger or a driver. To do this, we process the data you enter when creating or requesting a trip, such as the origin and destination, date and time of the trip, available seats, price, and your preferences or messages exchanged with other users. You can also save favorite addresses or add information about your vehicle, such as the license plate number.

This information is essential for the proper management and coordination of shared journeys, and is processed on the basis of the execution of the contract between you and TRIBBU, for the data strictly necessary for the provision of the service, and on the basis of consent, in the case of the data that you provide voluntarily.

5.3 Participation in the BBono Energy (CAE) program

Within the framework of Energy Saving Certificates (EACs), we process some of the personal data from your profile (name, surname, email address, telephone number, identification documents, vehicle registration number registered in the App and linked to the Energy Bonus (EAC)) and details of your trips (duration, distance, arrival/destination cities, proof of payment, and information about the users with whom you shared the trip). This data is necessary for obtaining Energy Saving Certificates in accordance with the legal requirements established in the EAC legal framework. This data is processed by our partner Delcae, a legally mandated delegate, as Data Processors, in order to verify your eligibility and submit an application to the Ministry for Ecological Transition and the Demographic Challenge. For trips eligible for the Energy Savings Certificates (BBono Energético) incentive taken between January 26, 2023, and July 19, 2024, this processing is based on our legitimate interest in benefiting ourselves and you from the Energy Savings Certificates. You have the option to object to this when we contact you to transfer your energy savings entitlements.

You have the right to rectify or delete your data (before the CAE request), as well as to access information concerning you and/or, for legitimate reasons, to object to this processing by contacting us.

All documents submitted with the application for CAE are kept for at least three years after the validation of the CAE to allow verification by public authorities.

Energy Saving Certificates are governed by Royal Decree 36/2023, of January 24, 2023, which establishes a system of Energy Saving Certificates in Spain and which is partially developed by Order TED/815/2023, of July 18, 2023, Order TED/845/2023, of July 18, 2023, which approves the catalog of standardized energy efficiency measures, and the TRA030 and TRA040 Fact Sheets in their simplified version validated by the Ministry for Ecological Transition and the Demographic Challenge (referred to independently or collectively as "Legal framework of the CAE").

5.3.1. Your location data.To prevent and detect fraud against the CAE system, TRIBBU and/or its users, it is necessary to collect real-time location data. This is a legal requirement of the Ministry for Ecological Transition and the Demographic Challenge (MITECO) for obtaining CAEs.

Once a trip is booked and confirmed, we track the driver's and passengers' locations throughout the journey, linking this data to their respective accounts. This allows us to verify that the trip proceeds as planned.

The collection of precise location data begins when the user manually activates tracking through the following actions:

(i) In the case of Drivers: by pressing the button "Have you started the journey?".

(ii) In the case of Passengers: by pressing the button "Has the driver picked you up?".

The tracking process ends when the user manually stops the trip with the following actions:

(i) In the case of Drivers: by pressing the button "Have you finished the journey?".

(ii) In the case of Passengers: by pressing the button "Has your driver left you?".

Additionally, if the trip is not manually completed, location collection will automatically stop once twice the estimated trip duration time has elapsed.

To activate the Energy Bonus and benefit from the Energy Savings Accounts (CAEs), you must grant permission for the collection of your exact location. Without this permission, the bonus cannot be activated, and consequently, you will not be eligible for the CAEs.

If you have any questions about this process, you can contact us throughdataprotection@tribbuapp.com. 

‍

5.4 Payment and withdrawal management

When you participate in paid rides, we collect information necessary to process payments or transfers. This includes your bank details (such as card number or IBAN), as well as your name, surname, full address, city, country, and postal code. In cases where you request a balance withdrawal, you will need to complete a Know Your Customer (KYC) verification process through our payment provider, Stripe.

This data is processed to comply with our legal obligations regarding the prevention of money laundering and to execute the agreed transactions. The legal basis is therefore compliance with a legal obligation and the performance of a contract.

5.5 Validation of journeys by photo (photo verification) and incident threshold.

To prevent and detect fraud against the CAEs system described in point 5.3, as well as for TRIBBU users in general, it is necessary that we can detect anomalous behaviors in the App, ranging from unregulated uses to attempts at fraud or abuse of the system, such as the use of multiple accounts or devices, the simulation of locations, etc.

‍

Therefore, we can request a photograph showing all members of the trip, so that the number of faces can be detected, allowing us to verify that they are real people and not attempts at impersonation.

‍

When a trip requires photo verification, the steps will be as follows:

(i) Indicator. The journey card will display a visual marker that clearly indicates that it is mandatory to take a group photograph to validate the journey.

(ii) Taking the photograph. The participation of all members of the trip will be requested, although only one of them may take the photograph on behalf of the others, taking into account the best position and visibility conditions.

(iii) Verification. The system will analyze the image in real time and detect the number of faces present in the photograph, validating that they are real people.

No biometric analysis is performed to uniquely identify a person; we only confirm that the number of people appearing in the route information matches the number of faces identified in the image.

(iv) Account blocking. If the user exceeds the threshold set in the incident accumulation system provided for in the terms and conditions, it will not be possible to register again or access using their data (email, telephone and ID), offering the possibility of contacting support if they consider that it is an error.

‍

This data is processed to comply with our legal obligations in accordance with the anti-fraud criteria required by the CAEs System and to prevent fraud in the general use of the TRIBBU App. The legal basis for this processing is therefore compliance with a legal obligation and TRIBBU's legitimate interest in fraud prevention.

‍

If you have any questions about this process, you can contact us throughdataprotection@tribbuapp.com.

‍

5.6 Identity Verification (KYC)

To comply with current regulations regarding the registration of travelers on shared mobility platforms with incentives (Resolution of the General Directorate of Planning and Energy Coordination, BOE-A-2024-23732) and to be able to participate in the incentive program linked to Energy Saving Certificates and register trips that may generate incentives, it is necessary that we verify your identity before you can access the program and register trips associated with it on TRIBBU.

‍

This verification was performed through Incode Technologies, Inc.,(101 Mission Street, Suite 900, San Francisco, CA 94105, USA), a specialized provider of identity verification processes, which acts as an independent data controller in the identity verification (KYC) process, with its own purposes and legal basis, and will be subject to its privacy policy, available at https://incode.com/privacy-policy/.

‍

If you wish to exercise your rights of access, rectification, erasure or objection in relation to the data processed by Incode, you can contactdataprotection@incode.com

‍

TRIBBU does not access images of your identity document or images captured during the selfie process, nor does it perform any processing associated with such verification. TRIBBU only receives the data necessary as a result of the verification, its involvement being limited to verifying that the user exists and has entered a real, valid, and current document.TRIBBU is responsible only for the data it receives as a result of the verification, which it processes on the basis of compliance with a legal obligation and TRIBBU's legitimate interest (Art. 6.1.c and 6.1.f of the General Data Protection Regulation).  

‍

When you need to complete identity verification, the steps will be as follows:

‍

(i) Verification request. You will receive a notification in the App indicating that you must complete the identity verification process to access the incentive program linked to Energy Saving Certificates. If this process is requested by the TRIBBU App, it will be mandatory to participate in the program, and you will not be able to register trips until it is completed.

‍

(ii) Document capture. You will be asked to photograph the front and back of your valid ID card or Foreigner's Identity Number (NIE). This capture is done directly by Incode Technologies through its system, without TRIBBU having access to the document images at any time.

‍

(iii) Biometric verification. You will then be asked to complete aselfie To verify that the person presenting the document is its legitimate holder, Incode Technologies compares the facial image with the photograph on the document using biometric technology. TRIBBU does not access your biometric data or the captured images at any time.

‍

(iv) Verification result. Once the process is complete, TRIBBU receives only the textual verification result: your full name, document number, and whether the verification was successful. This data is associated with your account to comply with the legal obligation to identify travelers and with internal security, verification, and fraud prevention procedures.

‍

In case you have any issues during the verification process, TRIBBU staff will always be available through the usual channels to review and address your request.

‍

6. How long do we keep your personal information?

‍

At TRIBBU, we retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, as well as to comply with any legal or contractual obligations arising from your use of our application. While your account remains active and you continue using the platform, we will retain your data to ensure the proper provision of the service. If you stop using the app without closing your account, your data may be retained for a maximum of five years from your last activity.

If you choose to close your account voluntarily, your personal data will be deleted within sixty days. However, if your profile has received negative reports or ratings from other users, we may retain your information for an additional period to address any potential liabilities arising from the provision of the service, depending on the type of incident, and to ensure the security and proper use of the community.

Certain data may be retained for different periods due to legal requirements. For example, information related to payments or financial transactions must be kept for the time stipulated by current accounting and tax legislation (Art. 66 LGT). Likewise, certain content generated within the platform, such as published routes or exchanged messages, may be stored in anonymized form for statistical purposes or to improve the service, without the possibility of personally identifying the user.

Finally, in situations where an account has been suspended or blocked for fraudulent use or serious breaches of the platform's rules, TRIBBU may retain the relevant information for the period necessary to determine the administrative or legal liabilities arising from the breach or fraudulent use by the user.

‍

7. Recipients of personal information.

‍

In some cases, only when necessary, TRIBBU will provide user data to third parties. However, the data will never be sold. External service providers (e.g., hosting providers) with whom TRIBBU works may use the data to provide the corresponding services, but they will not use this information for their own purposes or share it with third parties.

‍

TRIBBU strives to ensure the security of personal data when it is sent outside the company and ensures that third-party service providers respect confidentiality and have appropriate measures in place to protect personal data, through the corresponding data processing agreement. These third parties are obligated to ensure that the information is processed in accordance with data privacy regulations.

In some cases, the law may require that personal data be disclosed to public bodies or other parties; only what is strictly necessary for compliance with such legal obligations will be disclosed.

They have been appointed as sub-processors by TRIBBU in accordance with Article 28 of the Regulation:

1. Google Cloud: For the provision of infrastructure services such as servers, databases, and storage, necessary for the technical operation of our solutions. The information is stored on their servers located at europa-west4-a, Ems Harbor (Netherlands), Europe.
2. Stripe:Payment gateway provider for processing transactions within the platform. We use their services located in Ireland (Dublin) and Germany (Frankfurt).
3. Segment (Twilio):Responsible for sending basic personal data and app usage events to third-party platforms for analysis and functionality. Located in Ireland (Dublin).
4. Intercom:User support platform that manages basic personal data to provide personalized assistance. Located in Dublin, Ireland (eu-west-1).
5. Customer.io:Platform for sending push notifications and emails.
6. Cometchat:Internal chat platform of the application.
7. Amplitude: Platform for analyzing user interaction data with the application (pages viewed, actions taken, etc.). It does not include sensitive personal data and all information is anonymized.
8. Clarity:A tool for monitoring user sessions, interface interaction, and navigation patterns for analytical purposes. This information is stored on servers located in the United States.

‍

7.1. Application of third-party promotions and benefitsyou in your community

Some companies or institutions collaborate with TRIBBU to offer exclusive benefits to their members. In order to provide these benefits (for example, reserved parking spaces), we may share identifying data (such as your name and surname) or contact information (telephone number or email address) with third parties (with whom we have signed the corresponding confidentiality and data processing limitation agreements), along with the records that lead to the application of the promotion (for example, number of trips). This processing is based on the performance of the contract (requested benefit) and is necessary to be part of a community that offers these benefits and promotions.

You can continue using the App without receiving these promotions, but it will have to be outside the community environment.

‍

8. International data transfers

At TRIBBU we ensure that all processing of personal data takes place within the European Economic Area (EEA) and we avoid, as far as possible, any international transfer of data.

The data we collect through the app is primarily stored and processed on the servers of Google Cloud Platform, our technology infrastructure provider, whose data centers are located in the European Union. Although data is not systematically transferred outside the EEA, Google, as a global provider, may be subject to legal obligations in third countries (such as the United States), which implies the possibility of international access.

To ensure an adequate level of protection in these cases, TRIBBU and Google have signed the Standard Contractual Clauses approved by the European Commission, and additional technical and organizational measures are applied that limit access to and exposure of information.

In the exceptional event that it becomes necessary to transfer your data to a country outside the EEA that does not have an adequacy decision from the European Commission, we will ensure that we apply the safeguards required by Chapter V of the GDPR, including contractual guarantees, impact assessments and appropriate monitoring mechanisms.

You can request more information about the measures applicable to international transfers by writing to us atdataprotection@tribbuapp.com.

‍

9. Exercising your personal rights

In accordance with the GDPR, you have certain rights when it comes to our processing of your personal data:

‍

Right to be informed:You have the right to receive clear, transparent and easily understandable information about how we use your personal data and your rights.

Right of access:You have the right to access your personal data.

Right of rectification:You have the right to have your personal data rectified if it is inaccurate or incomplete.

Right to erasure:This right allows you to request the erasure or deletion of your personal data when there is no compelling reason for us to continue using it. This is not an absolute right to erasure, and exceptions apply.

Right to restrict treatment:You have the right to "block" or suppress the further use of your personal data. When processing is restricted, we can continue to store your personal data, but we cannot continue to use it.

Right to data portability:You have the right to obtain and reuse your personal data for your own purposes across different services.

Right to object to treatment: You have the right to object to certain types of treatment.

Right to file a complaint:You have the right to lodge a complaint with your national data protection authority regarding how we treat or process your personal data.

Right to withdraw consent:If you have given your consent for anything we do with your personal data, you have the right to withdraw it at any time.

Right not to be subject to an automated decision:You have the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects (or effects of similar significance) concerning you.

‍

You can direct your communications and exercise your rights by sending a written communication to the following email addressdataprotection@tribbuapp.comIn some cases, the request may be denied if the deletion of data necessary for compliance with legal obligations is requested.

‍

10. Processing of personal data of minors.

Our services are not directed at minors. However, if any of our services are directed at children under fourteen years of age, in accordance with Article 8 of the GDPR and Article 7 of Spanish Organic Law 3/2018, of December 5 (LOPDGDD), TRIBBU will require the valid, freely given, unambiguous, specific, and informed consent of their legal guardians for the processing of the children's personal data. In this case, the appropriate legal procedures will be established to confirm the identity of the person giving consent.

‍

In the case of those over fourteen years of age, the data may be processed with the user's consent, except in those cases where the Law requires the assistance of the holders of parental authority or guardianship.

‍

At TRIBBU we reserve the right to block the account if we suspect that fraudulent data has been used to activate the user.

‍

11. Security measures applied to the processing of your data

At TRIBBU we implement state-of-the-art security standards to prevent unauthorized access, maintain data accuracy and ensure the correct use of information.

‍

Our organization is ISO 27001 certified, which guarantees that we apply international best practices in information security management.

‍

We also apply security measures to ensure the confidentiality, availability and resilience of personal data processing systems.

‍

We apply these same security standards when working with business and technology partners. We only select and contract with third-party processors and suppliers who have implemented appropriate security measures and provide sufficient safeguards, including technical and organizational measures, to ensure the proper protection of the data we entrust to them.

12. Changes to the privacy policy

This privacy policy may change. We recommend that you review it periodically.

‍

13. Data Protection Generalitat Valenciana

This clause regulates the processing of personal data of those users who decide to join and participate in the communities “Valencia Comparte Coche” and “Valencia Comparte Coche - Campus de Burjassot UV” promoted by the Generalitat Valenciana.

‍

By accessing these communities, your data will be transferred to the Valencian Government as the Data Controller.

‍

The specifications for this mode of using the App are:

‍

(i) In accordance with the provisions of the eighth additional provision of Organic Law 3/2018, of December 5, on the protection of personal data and guarantee of digital rights, and in Article 4 of Law 40/2015, of October 1, on the legal regime of the public sector, the managing body may verify the data stated in your adherence to this car sharing community.

(ii) In accordance with European and Spanish regulations on the protection of personal data, the data you have provided will be processed by this department, as the controller and in the exercise of the powers attributed to it, for the purpose of facilitating the management of the car sharing service, in accordance with the provisions of the Register of processing activities (RAT) of this department.

‍

(iii) You may exercise your rights of access, rectification, erasure, and portability of your personal data, as well as the right to restrict or object to its processing, by submitting a written request to the registry of this department. You may also, where appropriate, file a complaint with the data protection supervisory authority, particularly if you have not received a response or if the response received was unsatisfactory in the exercise of your rights.

(iv) More information on data processing: https://mediambient.gva.es/es/proteccio-de-dades

‍

Notification that will be sent to users if they actively disassociate themselves from the Valencia Share Car community.

‍

Title:Update on Your Data Responsibility

Body: 

‍

Hello,

‍

You have requested to be removed from the "Valencia Share Car" community. To continue enjoying TRIBBU with your current profile, you need to adjust your privacy settings.

‍

By withdrawing from the collaboration framework with the public administration, the Valencian Regional Government will cease to be the Data Controller of your personal data. To continue, we require your explicit consent for TRIBBU to assume this responsibility directly and solely, in accordance with our general Privacy Policy.

‍

Do you accept that TRIBBU will become the new Data Controller of your personal data in order to continue using the platform?

‍

[ ] Yes, I accept the change of responsibility and wish to continue.

‍

[ ] I do not accept (this will result in the closure of your session on TRIBBU).

‍

Legal notice:This change does not affect the rights you have already exercised or the legality of the processing carried out previously by the Valencian Government.

‍