Privacy Policy

We hereby inform you about the Privacy Policy that shall apply in those cases in which users, through browsing the website https://www.chutapp.com/ (hereinafter, the "Website") and the mobile application "ChutApp" (hereinafter, the "Application"), collectively, the "Platforms", provide their personal data.

This Privacy Policy provides information about the processing of personal data provided by the parent, mother or legal guardian of the user when acting on their behalf, or, where applicable, of data that the minor may provide directly, provided that this is done with the guarantees established by the applicable regulations and in accordance with the provisions of this Privacy Policy (hereinafter, the "Data Subject"), including those data collected as a result of browsing the Platforms.

• Owner: SEVEN FOOTBALL, S.L. (hereinafter, "ChutApp" or the "Controller"); • Registered office: C/ Velázquez 30, 4º Izq., 28001 Madrid, Spain; • N.I.F.: B-22927289; • Public Registry: Registered in the Commercial Registry of Madrid at Volume [*], Folio [*], Section [*], Sheet [*], entry [*]; • E-mail: info@Chutapp.com; • Telephone: +34 [*].

In accordance with the provisions of the General Data Protection Regulation (EU) 679/2016 ("GDPR") and Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD"), by accepting this Privacy Policy, the Data Subject gives their informed, express, free and unequivocal consent to process the personal data collected through the Platforms, whether through forms enabled for that purpose or through information collected by cookies, in accordance with the provisions of this Privacy Policy.

Likewise, the User consents to the processing of this data by ChutApp in order to provide its services, applying the organizational and security measures required by the applicable regulations on the protection of personal data.

All personal data requested through the forms on the Platforms are, as a general rule, mandatory (unless otherwise specified in the required field), and it is not possible to provide the service without the corresponding data processing by ChutApp. This notwithstanding, browsing the Platforms is free of charge.

The Data Subject guarantees that the personal data provided to ChutApp is true and accurate, and therefore ChutApp shall not be held liable for any incident arising from the inaccuracy or falseness of the information provided by the Data Subject, beyond the possibility that Data Subjects have to exercise their right of rectification.

In the event that the Data Subject provides ChutApp with data of third parties, as controller or processor of the processing, the Data Subject shall be responsible for complying with all applicable data protection regulations. Furthermore, the Data Subject guarantees that they have obtained all legally necessary consents, authorizations and/or approvals before including personal data of third parties on the Website and/or the Application.

The personal data of the Data Subject, or of third parties provided by the Data Subject, shall be processed confidentially and incorporated into the corresponding processing activity of ChutApp.

The processing activities carried out by ChutApp are as follows:

ACTIVITY: CONTACT FROM THE DATA SUBJECT VIA E-MAIL Origin: From the Data Subject themselves through the sending of emails to the email address indicated on the Platforms. Legal basis: General Data Protection Regulation, in particular: Art. 6.1.b): Performance of a contract and/or application of pre-contractual measures at the request of the Data Subject. Purposes of processing: To attend to and respond to the queries submitted by the Data Subject. Group: Natural or legal persons. Category of data: Email address; any other personal data that the Data Subject voluntarily provides through their query. Recipients: No transfer to third parties is foreseen, except by legal obligation. International transfer: No international transfer of data is foreseen. Retention periods: Data shall be retained for the period strictly necessary to fulfil the purpose for which it was collected, unless the Controller must retain it due to legal obligation or to defend against the eventuality of a claim.

ACTIVITY: CONTACT FROM THE DATA SUBJECT VIA SOCIAL MEDIA Origin: From the Data Subject themselves through communication with ChutApp via ChutApp's profile on a social network (e.g., Instagram). Legal basis: General Data Protection Regulation, in particular: Art. 6.1 b): Performance of a contract and/or application of pre-contractual measures at the request of the Data Subject. Purposes of processing: To attend to and respond to the queries submitted by the Data Subject. Group: Natural or legal persons. Category of data: Username on the social network in question; any other personal data that the Data Subject voluntarily provides through their query. Recipients: No transfer to third parties is foreseen, except by legal obligation. International transfer: No international transfer of data is foreseen. Retention periods: Data shall be retained for the period strictly necessary to fulfil the purpose for which it was collected, unless the Controller must retain it due to legal obligation or to defend against the eventuality of a claim.

ACTIVITY: REGISTRATION OF THE DATA SUBJECT AS A USER Origin: From the Data Subject themselves through the form provided in the Application. Legal basis: General Data Protection Regulation, in particular: Art. 6.1 b): Application of pre-contractual measures at the request of the Data Subject. Purposes of processing: To process the Data Subject's request to register for the first time as a ChutApp user or to log in. Group: Natural or legal persons. Category of data: Email address; name; date of birth; username (alias); profile picture (optional). Recipients: No transfer to third parties is foreseen, except by legal obligation. International transfer: No international transfer of data is foreseen. Retention periods: The Data Subject's personal data shall be retained for the period strictly necessary to fulfil the purpose for which it was collected, unless the Controller must retain it due to legal obligation or to defend against possible claims. When the Data Subject registers on the Application, a user relationship is established with it. Therefore, data may be retained for up to five (5) years from the time the user's relationship with the Platform ceases, unless the Data Subject exercises their right of erasure.

In the event of exercising the right of erasure, the data shall be immediately blocked, so that it will no longer be processed, and shall only be retained until the end of the five (5) year period due to legal obligation or for the defense of possible claims.

ACTIVITY: SUBMISSION OF AUDIOVISUAL CONTENT BY THE DATA SUBJECT (OPTIONAL) Origin: From the Data Subject themselves. Legal basis: General Data Protection Regulation, in particular: Art. 6.1 a) GDPR: consent of the Data Subject or of their parent, mother or legal guardian depending on the user's age. Purposes of processing: To enable the Data Subject's participation in Platform functionalities, including uploading videos, social interaction and visibility within the Application. Group: Natural persons (minors and guardians acting on their behalf). Category of data: Videos in which the minor may be identified (image and voice) - optional; profile picture (optional); username or alias; any other personal information voluntarily provided by the Data Subject. Recipients: No transfer to third parties is foreseen, except by legal obligation. International transfer: No international transfer of data is foreseen. Retention periods: The Data Subject's personal data shall be retained for the period strictly necessary to fulfil the purpose for which it was collected, except by legal obligation or for defense against possible claims. While the account remains active, videos and photos may be used within the Platform. Following a request for erasure or account closure, data shall be immediately blocked and only retained until the end of the maximum period of five (5) years for legal obligations or defense of claims.

ACTIVITY: AUTHORIZATION AND ASSIGNMENT OF IMAGE RIGHTS OF MINORS Origin: From the Data Subject themselves or from their parent, mother or legal guardian in the case of minors. Legal basis: General Data Protection Regulation, in particular: Art. 6.1 a) GDPR: consent of the Data Subject or of their parent, mother or legal guardian depending on the user's age. Purposes of processing: To manage the authorization and assignment of image rights granted by the parent, mother or legal guardian of the minor to allow the publication, dissemination and display of audiovisual content in which the minor appears within the functionalities of the Platform, including its viewing by other Users and its possible use for purposes related to the promotion of grassroots sport and the activity of the Application. Group: Natural persons (minors appearing in audiovisual content and their parents, mothers or legal guardians who grant the corresponding authorization). Category of data: Image and voice of the minor in audiovisual content; username or alias associated with the content; identifying data of the parent, mother or legal guardian who grants the authorization (name and signature); any other personal information voluntarily provided during the authorization process. Recipients: No transfer to third parties is foreseen, except by legal obligation. International transfer: No international transfer of data is foreseen. Retention periods: Personal data shall be retained for as long as the authorization granted remains in force and while the audiovisual content remains published on the Platform. In the event of withdrawal of consent, request for erasure or account closure, the content shall be removed or blocked as appropriate, being retained only for the period necessary for compliance with legal obligations or defense against possible claims, with a maximum period of five (5) years.

ChutApp's Platforms are specially designed for use by minors in a safe digital environment and with full guarantees, and therefore the personal data processed may correspond to minors, in the following ranges:

• Minors under thirteen (13) years of age. In these cases, the minor may not create an account on their own. The creation of the account and the provision of consent for the processing of the minor's personal data must be carried out directly by their parent, mother or legal guardian.

• Minors between thirteen (13) and sixteen (16) years of age. The minor may initiate the registration process; however, the use of the application and the processing of their personal data shall be subject to the verification and linking of the account of their parent, mother or legal guardian through the system provided by ChutApp. Until such verification is completed, the account shall remain blocked.

The parent, mother or legal guardian who creates the account or verifies the minor's account guarantees that they hold the corresponding parental authority or legal guardianship, as well as that the data provided is true, accurate, complete and up to date, being responsible for any damages that may arise from the breach of such obligation, without prejudice to the right of rectification that corresponds to the data subject.

In the event that personal data of third parties is provided, the parent, mother or legal guardian guarantees having previously informed said third parties of the content of this Privacy Policy and having obtained, where applicable, the necessary authorization for the communication of their data to the Controller.

ChutApp adopts the necessary technical and organizational measures to guarantee a level of security appropriate to the risk; however, it cannot guarantee the absolute invulnerability of the systems and, consequently, does not assume liability for damages that may arise from unauthorized access by third parties, provided that such access is not attributable to ChutApp.

In accordance with the provisions of the GDPR and Law 34/2002, on Information Society Services, all personal data obtained through cookies during the use of the Website shall be processed in accordance with the provisions of the Cookies Policy.

In accordance with the provisions of the GDPR, Data Subjects are informed that they may exercise their rights of access, rectification, erasure, objection, data portability and restriction of processing directly before the Controller.

To exercise such rights, Data Subjects may send a message for this purpose, indicating their identifying data, to the following email address: info@chutapp.com.

In the event that any Data Subject considers that the exercise of their rights has not been duly addressed by ChutApp, they may also exercise their rights by filing a complaint with the Spanish Data Protection Agency.

The Data Subject ACKNOWLEDGES AND ACCEPTS HAVING READ AND UNDERSTOOD this Privacy Policy, the content of which constitutes the entire agreement between the Data Subject and ChutApp with respect to the use and processing of their personal information. The Data Subject expressly agrees to be bound by the terms of this Privacy Policy, in its entirety and scope, without exception to any of its provisions.

The express acceptance of this Privacy Policy shall be required when the Data Subject registers through any of the Platforms by completing the corresponding registration form.