PRIVACY POLICY

Last updated: April 10, 2024

ROSAN International Consulting & Reearch, S.L ("ROSAN") is committed to ensuring that your personal data is protected and not used for purposes other than those indicated in this Privacy Policy. This section informs users and interested parties of all matters concerning the processing of their personal data, thus complying with the applicable data protection regulations in our country: General Data Protection Regulation (EU) 2016/679 of 27 April on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, "GDPR") and Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights (hereinafter, "LOPDGDD").

This Privacy Policy applies to data processing that ROSAN carries out through the website: www.adri.care (hereinafter, the "Website"), through our mobile application: ROSAN (hereinafter, the "App"), which is available for iOS and Android, and/or those treatments that are indicated. We recommend that you read it carefully before using the Website or the App or providing your data through them. You can consult us about any doubts at the following email address: [email protected].

TABLE OF CONTENTS

In this Policy you will find all the information relating to the processing of your personal data and the rights you can exercise to maintain control over them. In this regard, you will find information about:

1. Who is responsible for processing your data.
2. What requirements you must meet to provide us with your personal data.
3. What data processing we carry out through the Website and/or the App and what are their main characteristics, explaining:
   1. What data we collect and what are the means of collection.
   2. For what purposes we collect the data we request from you.
   3. What is the legal basis for its processing.
   4. How long we keep it.
4. To which recipients your data is communicated.
5. Existence of international transfers of your data.
6. What are your rights and how you can exercise them.
7. How we protect your personal information.
8. Modifications to this policy.

1. WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?

Your personal data will be processed by ROSAN 2023, S.L ("ROSAN"), with NIF B86151768 and whose contact details are as follows:

Address: C/Vicente Lleó 48 Bis, Valencia 46006
Telephone: +34 647 846 291
Contact email: [email protected]

1.1. Our Data Protection Officer

ROSAN provides you with the contact details of our Data Protection Officer, to whom you can address any query you may have regarding this Privacy Policy or the processing of your personal data.

Email: [email protected]

2. What Requirements Must You Meet to Provide Us With Your Personal Data?

2.1. Minimum age

To provide us with your personal data, according to the regulations you must be at least 14 years old, and/or where appropriate, have sufficient legal capacity to use the Website or the App. However, our services are aimed at adults, therefore, you must be 18 years old to use our App.

2.2. Veracity

When you provide us with your data to use our services, you guarantee that the data and information provided is real, truthful, up-to-date and also belongs to you and not to third parties.In addition, you must notify us of any changes to the data provided, being in any case responsible for the truthfulness and accuracy of the data supplied at any time.

2.3. Age and Veracity Control

ROSAN reserves the right to verify your age and identification information at any time, if necessary, even requiring an official accrediting document or equivalent procedure and, in case of detection of fraud that is verified or suspected that you are under the indicated age, to delete, temporarily deactivate and/or cancel your account.

3. What Data Processing Do We Carry Out Through The Website Or The App And What Are Their Main Characteristics?

Below, we explain how we process your personal information and provide you, in detail, with all the relevant information regarding your privacy:

3.1. When you contact us through our channels

What are the means of data collection?

• Contact form
• QualBot "Feedback" form
• Emails sent to [email protected] or other ROSAN email addresses.

What data do we collect?

• Identifying and contact information: We collect your identifying data (name and surname) and email address, as well as any additional information you voluntarily include in communications with us.
• We may request additional information if necessary to fulfill your request or inquiry.

What are the purposes of processing your personal data?

• Responding to your inquiries: The primary purpose of processing this data is to respond to your inquiries, address your concerns, and/or provide the requested information, as well as, if applicable, to follow up on your requests.
• Improving customer service: All information derived from inquiries, consultations, and the advice provided to interested parties, as well as how requests are resolved, is anonymized and processed in aggregate to help us understand how we provide customer service, enabling us to conduct training and improve the quality of service.
• Additionally, all anonymized information is used to analyze the most common questions through our contact channels, automate the most frequent inquiries, develop FAQs, or be retained for statistical purposes to develop commercial strategies.

What is the legal basis for processing your data? Is it mandatory to provide this data?

• Consent: The data provided for the aforementioned purposes will be processed based on your consent, granted when you voluntarily contact us through the means provided to request information or submit an inquiry.
• Legitimate interest: All information collected by our customer service department will be processed for statistical purposes, which will help us improve the quality of customer service.
• You may request more information on the balancing of our legitimate interests by contacting us at [email protected].
• Mandatory information will be indicated with an asterisk or in a similar manner. Without such information, we will not be able to respond to your inquiries or requests.

How long do we retain your information?

We will process all your personal information for as long as your requests are being handled and, if necessary, to follow up on them. Once this period ends, ROSAN will retain the information, blocked, for the time periods required by law to address any potential liabilities and to demonstrate compliance with our obligations. Afterward, ROSAN will only process the information in anonymized form, making it impossible to link statistical data to specific users.

To whom do we disclose your personal information?

No additional disclosures are made for this processing other than those specified, in general, in point 4.

Some channels through which you may contact us are managed by service providers who act as Data Processors. More information on how these service providers operate can be found in point 4 mentioned above.

3.2. When you sign up for our App waiting list form, discount, and/or receipt of news or commercial communications related to ROSAN:

What are the means of data collection?

• Waiting list form for the App.
• Form to receive a discount.
• Subscription box for news, newsletters, or commercial communications in the contact form.
• Data derived from the contractual relationship between the Parties.

What data do we collect?

• Identifying and contact data: To send commercial information and/or discounts via electronic means, we use the identifying data (name) and contact information you provide in the corresponding form.
• If you maintain a contractual relationship with us, we may use the email address we have on file as part of our contractual relationship.

What are the purposes of processing your personal data?

• Sending publications and commercial communications related to our products/services: Your data will be used to send you our newsletter, updates, and news related to ROSAN’s services, and other commercial communications regarding our products and services via electronic means.
• If you sign up for the discount form, we will also send you an email with the discount code to use in our App.

What is the legal basis for processing your data? Is it mandatory to provide this data?

• Consent: The above purposes are carried out based on your consent, requested when signing up through the specific form or ticking the corresponding box in other forms.
• Legitimate interest: We may send you commercial communications if you are an ROSAN customer, based on our legitimate interest, as there is a prior contractual relationship between us in accordance with e-commerce regulations (LSSI).
• You can unsubscribe from these commercial communications at any time through the mechanism indicated in each email or by notifying us of your intention to unsubscribe by emailing [email protected].

How long do we retain your information?

• If the sending of commercial communications is based on your consent, we will retain the information for as long as you remain subscribed to our distribution list for such information, and once you unsubscribe, it will be blocked for the legally required time periods to address any potential liabilities.
• If the commercial information is sent based on our contractual relationship, we will retain your personal information for the duration of that relationship. Once it ends, ROSAN will retain the information, blocked, for the legally required time periods to address any potential liabilities and demonstrate compliance with our obligations.

To whom do we disclose your personal information?

There are no specific disclosures of your personal data to fulfill the purpose indicated in this section. However, we may use the services of email marketing service providers, form management providers (e.g., Typeform), or other advertising and marketing service providers, who will have limited access to the data and will be bound by a confidentiality obligation (for more information on how our service providers operate, see point 4. Who do we disclose your personal information to? > Service Providers).

3.3. When you register and use our App

What are the means of data collection?

• App registration form.
• Subscription form

What data do we collect?

1. Basic registration data: To register for our App and use the services, you must first create an account. To do so, we will request the following personal data:
   • Email address
   • Password
2. Data collected during App usage:
   • Usage data: We automatically collect usage data from the App, including technical data and information related to yourusage patterns, such as frequency, time spent and features used. We do not keep any of the documents you upload for processing.
   • Subscription data: We collect information regarding the date of subscription and plan subscribed. All credit card information is handled securely by the Stripe API.

What are the purposes of processing your personal data?

1. Registration: Registering and managing your account so we can verify your age to use the App and grant access to our services.
2. Subscription management: Updating your QualBot credits and charging the appropriate amounts.
3. Sending you commercial communications via email: We may send you news or commercial communications as per section 3.2.
4. Preventing, detecting, and prosecuting illicit activities or activities contrary to service conditions or that endanger the security of information or the App: ROSAN may process data to monitor and prevent any abuse of our services, such as fraudulent activities, denial-of-service attacks, spamming, unauthorized access to users’ accounts, or any other practice that violates the General Terms and Conditions or endangers the integrity of the App or the security of information. ROSAN reserves the right to delete accounts that violate legal requirements or the Terms and Conditions.
5. Statistical purposes and other uses with anonymized data: We may anonymize all personal information collected from users using the App for statistical purposes, measuring usability, improving the design and functionalities of the App, or other related purposes.

What is the legal basis for processing your data? Is it mandatory to provide this data?

1. Performance of the contract between the Parties: The reason we process your information for the purposes outlined above is to fulfill the contract between us.
2. Consent: We rely on your consent for the sending of push notifications unrelated to movement alerts.
   • You may revoke your consent at any time by configuring your device settings, deleting your content, or contacting us via email at [email protected].
3. Legitimate interest: We process data related to the prevention of illicit activities and ensuring the security of the App based on our legitimate interest. We will process data to guarantee the App's security, authenticity, integrity, and confidentiality of data.
   • We also process anonymized data for statistical purposes based on legitimate interest.

If you would like more information on how we have weighed ROSAN’s legitimate interests in relation to the above purposes, you may request it by emailing [email protected].

How long do we retain your information?

• We will retain all your personal information for the duration of our contractual relationship, i.e., until you choose to delete your account through the App settings.
• Once the contractual relationship has ended or your account is canceled, ROSAN will retain all information, blocked, for the legally required time periods to investigate illicit or harmful activities, address potential liabilities, and demonstrate compliance with our obligations.
• Notwithstanding the above, we reserve the right to use your anonymized information in aggregate after your account is closed for statistical purposes and to improve our services. The use of this information will not allow for personal identification.

To whom do we disclose your personal information?

There are no specific disclosures of your personal data to fulfill the purpose indicated in this section. However, we may use service providers who will have limited access to the data and will be bound by a confidentiality obligation (for more information on how our service providers operate, see point 5. Who do we disclose your personal information to? > Service Providers).

3.4. Navigation through the Website (cookies)

On our Website, we use cookies or other tracking tools to collect information about how users interact with the site. For more information about how we process data through these tracking tools, please refer to our Cookie Policy.

3.5. Use of social plug-ins or add-ons

When you use our services, you can share information on social networks such as Facebook, LinkedIn, or X through an implemented social plug-in (such as a “Share” button). If you choose to share information through a social plug-in, the following data will be transferred to the respective social network:

• I. Date and time of visit
• II. The Internet address or URL of the temporary address you are visiting
• III. Your IP address
• IV. The browser you are using
• V. The operating system you are using
• VI. Where applicable, your username and password, and if you are a registered user of the social network, your name and surname
• VII. The information for which you used the specific plug-in

The use of the above information will be carried out to perform the action you indicated (sharing, "like," etc.), in accordance with the terms and conditions of the respective social network. Therefore, we encourage you to stay informed about the purpose and scope of the information collection carried out through social plug-ins. If you wish, you can block social plug-ins in your browser settings. Please note that we have no control over the information collected by the social network through the use of plug-ins.

3.6. ROSAN profiles on social networks

ROSAN maintains profiles on major social media platforms such as Facebook, Instagram, LinkedIn, or YouTube. When you become a follower of one of our pages on social media, the processing of your data will be governed by the terms of use, privacy policies, and access regulations of the respective social network, which you previously accepted as a user. In this sense, ROSAN will process your data for the purpose of properly managing its presence on the social network, informing you of activities, products, or services, as well as for any other purpose permitted by the social network's policies. Please be aware that we have no control over the information collected by the social network or how it is processed, so we recommend that you stay informed about the purpose and scope of information collected through these networks.

4. To Whom Do We Transfer Your Personal Information?

Generally, ROSAN does not disclose your data to third parties. However, in addition to the specific disclosures indicated in the sections where we explain the characteristics of different operations (Section 3), we inform you about the general disclosures that may occur, affecting all previous processing activities and their legal basis:

• i. Essential service providers: To execute the services we offer you, we may disclose your data to service providers (e.g., hosting or cloud storage companies). These entities have signed confidentiality agreements and will only process your data according to our instructions, without using it for their own purposes or beyond the service they provide to us.
• ii. Public Authorities: We may disclose your data and any other information in our possession to competent public authorities when there is a legal obligation to do so, such as when required for the prevention or prosecution of service abuses or fraudulent activities through our Website or app. In such cases, the personal data you provide will be retained and made available to administrative or judicial authorities.
• iii. In case of a corporate transaction: In the event of a merger, acquisition, sale of all or part of its assets, or any other corporate transaction involving a third party, we may share, disclose, or transfer user data to the successor entity (even during the pre-transaction phase).
• iv. Third parties after aggregation or anonymization: We may disclose or use aggregated or anonymized data (i.e., data not linked to an identified or identifiable individual) for any purpose.
• v. Third parties with the user's consent or other legal basis: If we intend to share data with third parties outside the scope of this Privacy Policy, we will request your consent or inform you of the disclosure and its legal basis.

Please note that this Privacy Policy only applies to the collection, processing, and use of information (related to personal data) by us through your interaction with our Website or App. Access to third-party websites or applications, which you may reach via links from the Website or App, are governed by their own privacy policies over which we have no control. Therefore, we recommend that you review the privacy policies of those third parties before providing any personal information.

5. Are Your Personal Data Transferred to Third Countries Outside the European Economic Area?

Some of our service providers are located in countries outside the European Economic Area (EEA). The location of these companies outside the EEA implies an international transfer of your personal data, which may entail a lower level of protection than that provided by European regulations. However, ROSAN has implemented measures to ensure that such transfers do not result in a lower level of protection for your personal data.

In this regard, service providers located outside the EEA have valid mechanisms for conducting international transfers or have signed the relevant Standard Contractual Clauses approved by the European Commission ("SCCs"), an agreement under which the non-EU company guarantees that it applies European data protection standards, or they are companies certified under the new EU-US Data Privacy Framework (DPF).

Therefore, the use of these providers does not result in a lower level of protection for your personal data than the use of providers located within the EEA. You can review the content of the SCCs and the EU-US Data Privacy Framework adequacy decision at the following links:

• Standard Contractual Clauses for Controllers and Processors
• EU-US Data Privacy Framework Adequacy Decision

The following are the international transfers we conduct from ROSAN:

6. What Are the Rights You Can Exercise As An Interested Party?

You can exercise the rights that the law guarantees regarding the processing of your personal data by contacting our Data Protection Officer via email at [email protected]. Any rights request we receive will be resolved as soon as possible and, in any case, within the maximum period established by law from the time we receive it. In some cases, we may need to request a copy of your identification or another identifying document to verify your identity.

The rights available to you as a data subject include:

• i. Right to withdraw consent: You can withdraw your consent concerning all processing based on it at any time. However, withdrawing consent does not affect the legality of processing based on consent before its withdrawal.
• ii. Right of access: You have the right to know what data is being processed, if applicable, and, if so, to obtain a copy, as well as to obtain information related to:
  • The origin and recipients of the data;
  • The purposes for which the data is processed;
  • Whether there is an automated decision-making process, including profiling;
  • The retention period of the data; and
  • The rights provided by the regulations.
• iii. Right to rectification: You have the right to request the rectification or completion of your personal data when it is incomplete.
• iv. Right to erasure: You have the right to request the deletion of your personal data if it is no longer necessary for the purpose for which it was collected or if we are no longer authorized to process it.
• v. Right to data portability: You have the right to request the portability of your data if the processing of your data is based on your consent or the performance of a contract and was processed by automated means. Upon exercising this right, you will receive your personal data in a structured, commonly used, and machine-readable format. You may also request, where possible, that your data be transferred directly to another company.
• vi. Right to restrict the processing of your personal data: You have the right to restrict the processing of your data in the following cases:
  • When you have requested the rectification of your personal data during the period we verify its accuracy.
  • When you believe we are not authorized to process your data, in which case you may ask us to restrict its use instead of deleting it.
  • When you believe that it is no longer necessary for us to continue processing your data and want us to retain it for the purposes of exercising or defending legal claims.
  • When there is processing based on our legitimate interest, and you have exercised your right to object to it, you may ask us to restrict the use of your data while we verify the balancing of those interests relative to your own.
• vii. Right to object: You have the right to object at any time to the processing of your personal data based on our legitimate interest, including profiling.
  • Unsubscribing from commercial communications: Remember, you can object to receiving this type of communication at any time by emailing [email protected]. You may also opt out by following the instructions provided in the footer of each commercial email we send.
• viii. Right to file a complaint with a Supervisory Authority: If you believe we have violated your data protection rights, you may file a complaint with the relevant Supervisory Authority. In Spain, this is the Spanish Data Protection Agency (www.aepd.es).

7. HOW DO WE GUARANTEE THE CONFIDENTIALITY OF YOUR INFORMATION?

The security of your personal data is a priority for us. Accordingly, ROSAN has implemented all necessary security measures to ensure effective use and processing of personal data provided by users, safeguarding the privacy, confidentiality, and integrity of the data, and using the necessary technical means to prevent the alteration, loss, unauthorized access, or processing of your data, based on the state of technology at any given time. We comply with the recommended security standards to protect your data. However, it is impossible to guarantee total security due to the nature of the internet and the possibility of malicious actions by third parties beyond our control. We are committed to acting swiftly and diligently if data security is compromised and to notifying you if relevant.

8. MODIFICATIONS TO THIS POLICY

ROSAN may modify the content of the privacy policy at any time, especially when there are legislative, jurisprudential or interpretative changes by the Spanish Data Protection Agency that affect the data processing carried out by ROSAN through the Website or the App. Any new version of this Privacy Policy will come into force on the published effective date.

If the revised version includes a substantial change that affects the processing of your data, we will notify you at least 30 days in advance by publishing a notice on the Website, in the App or by communicating it to you via email. Notwithstanding the above, we recommend that you periodically review this Privacy Policy to be informed of how your personal data is processed and protected, as well as the rights that assist you. This Privacy Policy was last modified on July 8, 2024