Bubibo SuperApp

Privacy Notice

Last updated: June, 27, 2024

Introduction

This Privacy Notice outlines how we collect, process, utilize, and safeguard your personal data (as defined in the Regulation (EU) 2016/679 (General Data Protection Regulation) – hereinafter, the “GDPR”) or personal information (as defined in the California Consumer Privacy Act – hereinafter, the “CCPA”) when you use our Bubibo SuperApp available at https://www.bubibo.com/, Apple App Store and Google Play (hereinafter, the “App”). It also serves to inform you about the legal rights you have concerning your personal data or personal information. For the purposes of this Privacy Notice, the concepts of “personal data” and “personal information” are interchangeable.

Please review this Privacy Notice carefully to learn about our data privacy approach and the measures we have implemented to protect your information.

If you have any further questions or require clarification on any aspect of this Privacy Notice, please do not hesitate to reach out to us through the designated channels. We are committed to addressing your concerns and ensuring you understand our data processing activities comprehensively. 

Please read this Privacy Notice to learn how we treat your personal data. By using or accessing our App in any manner, you acknowledge that you have read, understood and accepted our data processing practices and policies outlined in this Privacy Notice.

If you have any objections or concerns regarding our handling of your personal information as described herein, you should discontinue using our App.

Table of contents

Introduction    

1. We and our details    

2. Sources of data    

3. Age restriction    

4. Types of data and purposes of processing    

5. Principles of personal data protection    

6. Third-party disclosures of your data    

7. Cross-border transfer of personal data    

8. Banking and subscriptions information    

9. Data security    

10. Data retention    

11. EEA-specific provisions    

11.1. Lawful bases    

11.2. EEA residents’ rights    

12. US-specific provisions    

12.1. United States residents’ rights    

12.2. Opt-out options    

12.3. Do not sell my personal information    

13. Canada-specific provisions    

Rights of the Canadian residents    

14. United Mexican States-specific provisions    

Rights of the United Mexican States residents    

15. Changes to the Privacy Notice    

16. Cookie Policy    

1. We and our details

Limited Liability Company “BUBIBO” is the controller and responsible for your data (“we”, “us”, or “our”).

2. Sources of data

Depending on your actions, we receive your data when you use and interact with the App. We collect your personal data from the following sources:

Registration form. When you create an account or register to use our App, we collect the personal information you provide through the registration form. This includes details such as your name, email address, and phone number.

Pet profile creation form. If you choose to create a profile for your pet within our App, we will collect the personal data you submit through the pet profile creation form. This includes information about your pet, such as its name, breed, and age.

Automatic collection. When you use our App, we automatically collect certain types of personal data. This can include technical information about your device, such as the device type, operating system, IP address, and unique identifiers, as well as usage data, such as the features you access, the content you interact with, and the time and duration of your App sessions.

Third parties. We may also receive data from third parties. It depends on your settings and the features you use. When a user purchases a subscription through our application, we receive transaction data, subscription IDs, subscription terms, and App statistics from the Apple App Store and Google Play platforms.

The data processing policies of the Apple App Store and Google Play further govern the collection, processing, and transmission of data related to purchases made through their respective platforms.

If you register your account with other services such as Facebook, Apple or Google, you provide us with information including your username, ID, email address and profile photo from your account on the mentioned platforms.

3. Age restriction

Our App does not knowingly process or collect personal data from US/Canadian users under the age of 13 and EEA users under the age of 16 (or lower for certain EEA countries).

If you are a user under the specified age, please do not attempt to register with our App or send any personal data about yourself to us; if you are a legal representative of such a user, please contact us immediately. If we learn that we have collected personal data from such a user, we will delete that information as quickly as possible.

4. Types of data and purposes of processing

Personal data, also referred to as personal information, refers to any information that can be used to identify a specific individual. It does not include data that has been anonymized, where identifying details have been permanently removed.

We collect, use, store, and transfer various categories of personal data about you, either automatically or with your actions which we have grouped as follows:

Our commitment to safeguarding your privacy is unwavering. We refrain from gathering any personal information pertaining to your race, ethnicity, religious beliefs, philosophical views, sexual life, sexual orientation, political affiliations, trade union membership, or genetic and biometric data. 

We adhere to the principle of data minimization, ensuring that we collect only the essential types and quantities of personal information strictly necessary for the purposes outlined below.

Purposes of processing

We process your personal data for the following purposes:

To identify you as a user. We collect certain identification information to verify your identity and ensure secure access to your account within our App.

To operate and improve the App. We analyze Logs and Usage Data, and user interactions to enhance its functionality, performance, and overall user experience.

For marketing and analytical purposes. We use your data to deliver relevant marketing communications, conduct market research, and analyze user preferences and behavior to improve our products and services.

To save, maintain, and administer user and pet profiles. We collect and process personal information to create and manage your user profile, as well as profiles for pets associated with your account.

To customize your user experience. We analyze your preferences and usage patterns to tailor the App’s features, content, and recommendations.

To provide access to the App and track the subscription period. We process your data to grant you access to the App and its features and to monitor and manage your subscription.

Should we intend to process your personal data for any new purpose beyond those initially specified, we will seek your separate consent. Furthermore, we are committed to ensuring the reliability, accuracy, completeness, and timeliness of the personal data we process, taking all reasonable measures necessary to uphold these principles for the intended uses.

5. Principles of personal data protection

We strive to adhere to the key principles of personal data protection, including generally accepted international principles and principles established by the laws of the country or state where the user is located.

Some of the key principles that we are using are Legality, Consent, Transparency, Legal basis for processing, Purpose limitation, Data minimization, Proportionality, and Retention.

6. Third-party disclosures of your data

We share your personal data with our service providers, but this sharing is strictly limited to the cases and purposes outlined in this Privacy Notice.

We mandate that all third parties respect the security of your personal data and treat it in accordance with legal requirements. We do not permit our third-party service providers to use your personal data for their own purposes.

We will not process your personal data in a manner incompatible with the purposes for which it was initially collected or subsequently authorized by you, as detailed in the “Types of data and purposes of processing” section of this Privacy Notice. Furthermore, we will not collect any personal data that is not required for the stated purposes.

We may disclose potentially personally identifiable information (i.e. personal data) among our employees, contractors, and affiliated or other third-party organizations that: 

• need to know this information to process it on our behalf or to provide services available at the company; and 
• have agreed not to disclose it to others.

We share your data with the parties listed below for the purposes specified in the “Types of data and purposes of processing” section.

Other disclosures

In addition to the disclosures for the purposes identified before, we may disclose information about you for the following purposes:

• law enforcement, legal process and compliance: if we are required to do so by law, in connection with any legal proceedings or to establish, exercise or defend our legal rights, or in the good-faith belief that such action is necessary to comply with applicable laws, in response to a facially valid court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement or other governmental agencies. We also reserve the right to disclose personal data or other information that we believe, in good faith, is appropriate or necessary to: (i) take precautions against liability; (ii) protect ourselves or others from fraudulent, abusive, or unlawful uses or activity; (iii) investigate and defend ourselves against any third-party claims or allegations; (iv) protect the security or integrity of our services and any facilities or equipment used to make our services available; or (v) protect our property or other legal rights, enforce our contracts, or protect the rights, property, or safety of others;
• change of ownership or other business needs: (i) in case we sell, licence or otherwise assign our company, corporate rights, the App or its separate parts or features to third parties; (ii) as part of a transaction, financing, or for other business needs (e.g. if we need to disclose your personal data to the prospective lender or bank, investor or prospective investor, and/or their professional advisers as part of certain due diligence processes, as the case may be); (iii) we may also disclose and otherwise transfer your personal data to an acquirer, successor or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets and only if the recipient of the information commits to a privacy notice that has terms substantially consistent with this Privacy Notice.

Your personal data will be stored electronically and securely hosted on the servers of the Microsoft Azure data center. This data center ensures the preservation and protection of personal data.

If we have processed your data based on your consent and you wish to withdraw your consent, please use the contact information provided in the section below titled “Opt-out options”.

7. Cross-border transfer of personal data 

In order to provide high-quality services, we hire people, enter into agreements with independent contractors, suppliers, services providers, and affiliated or third-party organizations located within or outside the EU/EEA, the United States of America, Canada, and the United Mexican States. For those reasons, some of your personal data can be passed to the mentioned persons. For the processing of personal data that is subject to the GDPR, we will transfer your personal data to such persons outside the EU/EEA subject to appropriate safeguards that we conclude with them, such as data processing agreements (DPAs) or Standard Contractual Clauses (SCCs). 

8. Banking and subscriptions information

When you pay for a subscription to our App, you share your banking information with the Apple App Store or Google Play. This relationship is further regulated by privacy notices in the Apple App Store and Google Play. 

Please note! We do not collect or process your bank information when buying a subscription.

To facilitate the processing of in-app purchases, we utilize the services of a third-party provider, RevenueCat.

When users make in-app purchases or restore previous purchases by logging into their account, certain information is transmitted to RevenueCat, including the user’s unique device identifier, purchase timestamp, purchase product identifier, and price, and App Store or Google Play receipt for validation purposes.

This information enables RevenueCat to provide customized receipt validation, subscriber analytics, and cross-platform purchase restoration functionalities for application purchases. RevenueCat stores this information under industry-standard security procedures and in compliance with applicable data protection regulations. We will not share any revenue data related to in-app purchases with any other third party except when necessary to fulfill the purchases made by users.

9. Data security

We have implemented appropriate security measures to prevent your data from being accidentally lost, used, or accessed unauthorizedly, altered, or disclosed. In addition, we limit access to your data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your data based on our instructions and are subject to a duty of confidentiality.

Apple KeyChain Database. The Apple KeyChain Database is a secure storage system provided by Apple for sensitive data such as passwords, encryption keys, and other confidential information. It offers robust protection through secure encryption and access control mechanisms. We leverage the KeyChain Database to store and retrieve sensitive data securely on Apple devices.

IP Whitelist and Password Protection. We implement an IP whitelist, which is a list of approved IP addresses that are granted access to our systems and resources. This measure helps prevent unauthorized access from untrusted or malicious IP addresses. Additionally, we employ strong password protection mechanisms, which include enforcing complex password requirements, regular password rotation, and secure password storage and transmission practices. 

Bearer Token Protection. To safeguard user data during transmission and authentication, we utilize bearer tokens. Bearer tokens are cryptographic tokens that represent a user’s identity and access rights. These tokens are typically included in the Authorization header of HTTP requests, allowing secure and stateless authentication without sending sensitive credentials over the network. By employing bearer token protection, we can securely authenticate users and authorize access to their data without exposing sensitive information.

10. Data retention

We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including meeting any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider factors such as the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the data, whether we can achieve those purposes through alternative means, and the applicable legal requirements.

We store your data while you actively use our App and for one (1) year after you terminate your use of the App or delete your account.

In some cases, we may anonymize your data (rendering it no longer associated with you) for research or statistical purposes, in which case we may use this anonymized information indefinitely without further notice.

User data is utilized solely to ensure the proper functionality of the App.

11. EEA-specific provisions

11.1. Lawful bases

We rely on the following lawful bases to process your personal data:

Performance of a contract. We process certain personal data as necessary for provision of our services to you, customizing your user experience, providing access to new functionality of our services, negotiating, concluding, and fulfilling our other contractual obligations to you, primarily specified in our Terms of Use. If you do not provide us with the data necessary for the performance of a contract between you and us, we will not be able to provide our App and other services to you.

Legitimate interests. Some processing activities are carried out based on our legitimate business interests in developing and improving our services while appropriately considering your interests, rights, and reasonable expectations.

Legal obligations. We may process your personal data to comply with applicable laws and regulations, such as tax reporting requirements, Know Your Customer (KYC) and Anti-Money Laundering (AML) obligations, or when requested by law enforcement agencies, courts, supervisory authorities, or other authorized public bodies.

Consent. In certain cases, we may rely on your consent to process your personal data for specific additional purposes that are clearly communicated to you, such as to deliver our marketing communications.

Our processing activities are conducted in compliance with relevant data protection laws and regulations, ensuring the lawful and transparent handling of your personal information.

11.2. EEA residents’ rights

You may exercise GDPR rights regarding your personal data. In particular, you have:

The right to access your information. You have the right to know what personal data we process. As such you can obtain the disclosure of the personal data involved in the processing and you can obtain a copy of the information undergoing processing.

The right to verify your information and seek its rectification. If you find that we process inaccurate or out-of-date information, you can verify the accuracy of your information and/or ask for it to be updated or corrected.

The right to have your personal data deleted. If we are not under the obligation to keep your personal data for legal compliance and it is not needed in the scope of an active contract or claim, we will remove your information upon your request.

The right to restrict the processing of your information. When you contest the accuracy of your information, believe we process it unlawfully or want to object to the processing, you have the right to temporarily stop the processing of your information to check if the processing was consistent. In this case, we will stop processing your personal data (other than storing it) until we are able to provide you with evidence of its lawful processing.

The right to have your personal data transferred to another organisation. Where we process your personal data on the legal basis of consent you provided us or on the necessity to perform a contract, we can make, at your request, your personal data available to you or to an organisation of your choosing. 

The right to object against the processing of your information. If we process your information for our legitimate interests (e.g. for direct marketing emails or our marketing research purposes), you can object to it. Let us know what you object against and we will consider your request. If there are no compelling interests for us to refuse to perform your request, we will stop the processing for such purposes. If we believe our compelling interests outweigh your right to privacy, we will clarify this to you. 

You can formulate such requests or channel further questions on data protection by contacting us directly at inbox@bubibo.com.

If you believe that our use of personal information violates your rights, or if you are dissatisfied with a response you received to a request you formulated to us, you have the right to lodge a complaint with the competent data protection authority of your choice.

12. US-specific provisions

12.1. United States residents’ rights

As data subjects, you have certain special privacy rights. To exercise these rights, please contact us at inbox@bubibo.com. 

Important Notice: Depending on the applicable state and legislative requirements, we have a period ranging from 30 to 60 days to process your request. Additionally, we reserve the right to extend this timeline by up to 30 additional days if necessary.

You have the right to file a complaint with the Federal Trade Commission.

Your rights vary depending on the laws that apply to you but may include:

Certain states may not have specific privacy laws. Residents of such states are governed by applicable U.S. federal laws. If your state is not listed, please contact us for further assistance.

12.2. Opt-out options 

Depending on the applicable scenario, you can withdraw your consent or opt-out from sharing your personal information as outlined in this subsection. You can exercise this choice at any time by utilizing one of the following options:

• By contacting us at inbox@bubibo.com;
• By adjusting your device settings in iOS or Android;
• Stop using our App.

12.3. Do not sell my personal information

Under the CCPA, California residents have the right to opt-out of the “sale” of their personal information by companies governed by the CCPA.

At our company, we do not engage in the sale of your personal information to any third parties, nor do we use your data as part of our business model.

However, in support of the CCPA, we provide California residents with the option to record their preference that we do not sell their personal information in the future, should our practices change. If you would like to exercise this option, please contact us.

13. Canada-specific provisions

Rights of the Canadian residents

As a data subject, you have privacy rights prescribed by Canada’s federal and provincial privacy laws. Please note that the rights of the data subject may vary according to federal and provincial legislation. 

Right to be informed. Inform individuals about the information collected, used, and disclosed, as well as the purposes.

Right to access. Individuals have the right to obtain access to their personal information held by organizations, subject to certain exceptions.

Right to rectification. Gives individuals the right to demand organizations cease dissemination or de-index links to their personal information.

Right to erasure. You have the ability to remove information that you have posted in the App. Quebec’s law gives this right, but it is unsettled in other provinces.

Right to opt-out. Individuals can submit complaints, withdraw consent (with limitations), and file complaints with the Privacy Commissioner.

Right to data portability. Right to data portability. Individuals may request that their personal information be communicated or transferred to them.

Right not to be subject to automated decision-making. A prohibition against a business making decisions about a consumer based solely on an automated process without human input. Quebec’s law requires notice if decisions are made solely via automated processing.

Other rights. Such as rights linked to correction, consent withdrawal, and seeking redress for violations.

Right to lodge complaints with relevant data protection authorities. individuals have the right to submit complaints to federal, provincial, or territorial privacy authorities regarding the (mis)handling of their personal information by organizations.

If you want additional information, please contact us by filling out a request at inbox@bubibo.com. 

14. United Mexican States-specific provisions

Rights of the United Mexican States residents

All data subjects are entitled to exercise the rights of access, rectification, cancellation, and objection regarding their personal data, collectively known as ARCO rights. These rights are not mutually exclusive.

Right of access. Data subjects have the right to access their personal data held by the data controller, as well as information regarding the conditions and general details of the processing.

Right of rectification. Data subjects can request, at any time, that data controllers rectify their personal data if it is inaccurate or incomplete.

Right of cancellation. Data subjects have the right to request the cancellation (i.e. erasure) of their personal data. However, there are certain situations where data controllers may object to such erasure (e.g. if required by applicable law or in the public interest).

Right of objection. Data subjects can, at any time, object to the processing of their personal data for legitimate purposes.

Right to lodge complaints with relevant data protection authorities. You have the right to submit a claim before the National Institute for Transparency, Access to Information, and Personal Data Protection (INAI). 

If you want additional information, please contact us by filling out a request at inbox@bubibo.com.

15. Changes to the Privacy Notice

We reserve the right to modify this Privacy Notice from time to time. In the event of any material changes, we will endeavor to notify you through our App, email communication, or by presenting you with an updated version of this Privacy Notice for your acceptance. This may occur, for instance, if we introduce new data processing activities or collect additional personal data from you.

Your continued usage of the App after the effective date of an updated Privacy Notice will be considered as your acceptance of the modified Privacy Notice.

16. Cookie Policy

When you visit BuBiBo's online services, and if you give us your consent, your device receives one or more cookies which are sent from our online service to your browser.

What are cookies?

A cookie is a small datafile that is saved on your computer, tablet or mobile phone. A cookie is not a program that can contain harmful programs or viruses. We also use similar technologies, such as web beacons and pixels. When we refer to cookies in this Cookie Policy we also refer to such similar technologies. Cookies are divided into persistent cookies and session cookies. Persistent cookies remain on your device for a pre-defined period of time, after which they are erased, either automatically or when you delete cookies from your browser. Session cookies remain on your device only for the duration of your visit to our online services and are deleted when you close the browser. In our online services, cookies can be set either by the online service you visit (first party cookie) or by a third party, such as analytics provider (third-party cookie).

Why and how do we use cookies?

We use cookies to improve user experience and to track the usage of our online services as well as to build better services. With cookies we can, for example, remember the language settings you choose in our online services so that you don't have to choose them again every time you visit our online services. In other words, we can improve the content and functionality of our online services and fix any errors in these services. We also use cookies in our marketing to target specific audiences. This enables us to provide you with content and marketing that interests you the most. For example, if based on the information that we collect with cookies, we can infer that you are interested in a specific product of BuBiBo, we can provide you with content related to that specific product. Additionally, we measure the appeal of our services and sites. Data collected with cookies include the Cookie ID, IP address, the type of browser and device, and the browsing country, among other things. With your separate consent, we can connect the information we collect via cookies to other information we have collected from you, such as your name or email address. With this information, we can personalise our email marketing and newsletters based on your interests and behavior on our websites. A single individual may be identifiable also through other means, such as an IP address that can be connected to a specific individual. With cookies, we can also monitor, how you react to email marketing and newsletters we have sent to you, for example by tracking if you have opened emails we have sent to you and proceeded to our online services. You can read more about personal data processing practices of BuBiBo Ltd. from here.

How long are cookies saved?

The storage time of cookies saved on your device can vary. Session cookies are deleted after you close your browser, whereas thee time when persistent cookies are scheduled to expire is calculated from the last date you visited the homepage. When cookies expire, they are automatically deleted. You can view storage time of each cookie from “Privacy controls”.

How can I prevent the use of cookies or delete cookies?

Most browsers allow cookies by default. You can, however, block cookies and delete them via the settings of your browser or device. When ever you visit our online services for the first time or from a new browser or device, we ask for your consent to place cookies on your browser or device. We use only strictly necessary cookies without your consent to make our online services function properly. Preventing or deleting cookies may make our online service less user-friendly, and our online service will no longer remember things like your language settings. Deleting cookies from browser history will clear cookies but will not stop the use of cookies in the future. Alternatively, you can select “ingocnito” or “private browsing” when browsing through websites. You can delete cookies that you have previously accepted. If you are using a PC with a recent version of a browser, you can delete your cookies by using these shortcut keys: CTRL + SHIFT + Delete. If the shortcut keys do not work and/or you are using an Apple computer, you must find out what browser you are using and then click on the relevant link:

• Internet Explorer
• Microsoft Edge
• Mozilla Firefox
• Google Chrome
• Opera
• Safari
• Flash cookies
• Apple
• Android
• Windows 7

Remember: If you are using several different browsers, you must delete the cookies in all of them.

Third-party cookies and data collected

In addition to our own cookies in our online services, we use third-party cookies. Third-party cookies are owned by third parties, such as web analytics and marketing technology providers. We use Google Analytics cookies, among others, for targeted advertising and for collecting measurement and analytics data from our online services. We have applied IP anonymization in our configuration of Google Analytics. This means that Google Analytics anonymizes the last octet of the user IP address as soon as technically feasible at the earliest possible stage of the collection network. The full IP address is never written to disk. Third-party cookies are owned by third parties, such as web analytics, marketing technology and social media providers. Third party services may be able to identify the user with cookie data collected by such third parties and combine it with other data they have collected. Third-party services are subject to their own cookie and privacy policies, and, consequently, BuBiBo is not responsible for third-party collection and handling of data. These third parties may transfer data that is stored in cookies by their web analytics and marketing technology tools to countries outside the Ukraine. This means that your personal data may be processed or stored in a country that has less stringent data protection standards than those of the Ukraine. The personal data transferred outside the Ukraine is protected by the adequacy decision made by the Ukrainian authorotoes or by appropriate contractual arrangements. For more information, please contact BuBiBo. If you wish to block cookies set by Google Analytics, you can download a browser plug-in from here. You can also use other tools and plug-ins to block cookies and tracking. We allow social media plug-ins in our online service so that you can, for example, visit our social media pages, use the Share buttons or see embedded video content from our social media pages. These services are subject to the Terms of Service of the social media service provider. Here you can find the Terms of Service for services such as Google, Facebook, Twitter, and YouTube.

Questions regarding the Cookie Policy

If you have any questions about our Cookie Policy, or any concern about privacy at BuBiBo Ltd., please contact us by e-mail at inbox@bubibo.com. The cookie declaration itself is updated every month via Cookie Bot. BuBiBo reserves the right to make changes to its Cookie Policy should the Cookie Policy need to be updated owing to changes in legislation or other reasons. When we change the Cookie Policy in a material way, we will ask for a new cookie consent.

Cookie declaration is updated as it’s declared on Cookie Bot.