Privacy Policy
Controller: Spareya s. r. o. · Effective from: 13 October 2026
This Privacy Policy explains what personal data we process about you, why, on what legal basis, with whom we share it, how long we keep it, and what rights you have. It applies to the Spareya Service — both the App and the Website (spareya.eu).
Users in the United Kingdom (UK). For users resident in the UK, this Policy applies under the UK GDPR and the Data Protection Act 2018; references to the "GDPR" and the "supervisory authority" are read, for such users, as the UK GDPR and the Information Commissioner's Office (ICO).
1. Controller and contact
The controller of personal data within the meaning of Regulation (EU) 2016/679 (the "GDPR") is:
- Spareya s. r. o., Lermontovova 911/3, 811 05 Bratislava-Staré Mesto, Slovakia
- Company ID (IČO): 57 718 768; registered in the Commercial Register of the Municipal Court Bratislava III, Section Sro, Insert No. 201128/B
- Managing director: Marek Jankech · Website: https://spareya.eu
- Contact for data protection matters: support@spareya.eu
Data Protection Officer (DPO): We have assessed the obligation to appoint a Data Protection Officer under Article 37 GDPR; given our current scale, this obligation does not arise. Should this change, we will appoint one and add their contact details.
Users in the UK: For data protection matters you may contact us directly at support@spareya.eu or the ICO (see clause 13). We will appoint a UK representative under Article 27 UK GDPR before the App is made available to users in the UK.
2. What data we process
Below is an overview of the categories of personal data we process, in each case with the purpose, the legal basis under Article 6 GDPR and the retention period. Account data (email, password, nickname, year of birth) is necessary to enter into and perform the contract for the Service — without it we cannot set up your Account. Data marked as optional is provided voluntarily.
2.1 Account data (App)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Creating and managing the Account, sign-in, transactional emails | Performance of a contract (Art. 6(1)(b)) | For the life of the Account; up to 30 days after the Account is deleted | |
| Password (hashed, Supabase Auth) | Securing access | Performance of a contract (Art. 6(1)(b)) | For the life of the Account |
| Nickname | Identification to other users | Performance of a contract (Art. 6(1)(b)) | For the life of the Account |
| Year of birth | Verifying the 18+ requirement | Performance of a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) | For the life of the Account |
| Gender (optional) | Preferences in matching; women-only or men-only Meetups | Performance of a contract (Art. 6(1)(b)) | For the life of the Account or until removed |
| History of gender changes (previous and new value, time) | Protecting women-only or men-only Meetups against abuse | Legitimate interest (Art. 6(1)(f)) | For the life of the Account |
| Language | Localising the Service | Performance of a contract (Art. 6(1)(b)) | For the life of the Account |
2.2 Profile data (App)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Sports and level | Matching and finding suitable Meetups | Performance of a contract (Art. 6(1)(b)) | For the life of the Account |
| Bio | Introducing yourself to others | Performance of a contract (Art. 6(1)(b)) | For the life of the Account |
| Nationality (optional) and the languages you speak | Introducing yourself to others, communicating at a Meetup | Performance of a contract (Art. 6(1)(b)) | For the life of the Account or until removed |
| Avatar (icon and colour) and badges (e.g. Founding member, ambassador, level) | Introducing yourself to others, recognising activity | Performance of a contract (Art. 6(1)(b)) | For the life of the Account |
| Availability (days and times when you can do sport) | Suggestions of partners and Meetups | Performance of a contract (Art. 6(1)(b)) | For the life of the Account or until removed |
| Home: the municipality (or postcode) you search for, its centre point, the district or area derived from it and an approximate zone (about 5 × 5 km) | Showing relevant Meetups, clubs and places nearby; counting towards the threshold of the district or area | Performance of a contract (Art. 6(1)(b)) | For the life of the Account |
| Reliability (rating) | Trust and safety of the community | Legitimate interest (Art. 6(1)(f)) | For the life of the Account |
2.3 Real-person and age verification (App)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Real-person verification result (yes/no + date) | Meetup safety: everyone you meet is a verified real person | Performance of a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) | For the life of the Account |
| Record of a verification attempt (type of check, status, times, Didit record number) | Running the verification, the attempt limit, checking that the record at Didit has been deleted | Legitimate interest (Art. 6(1)(f)) | For the life of the Account |
| Age check when there is a reason (status, reason, who decided) | Keeping the 18+ requirement | Performance of a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) | For the life of the Account |
We do NOT store the photo, the video or the estimated age. From verification we keep only the data in the table above. See clause 3.
Temporarily: We will switch on camera verification through Didit before the first district or area unlocks. Until then, no Meetups with people take place; the exception is training sessions for members of a verified Club only, where the Club knows its own members.
2.4 Activity data (App)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Meetups and events (attending, hosting, confirming that a Meetup took place, interest in an event) | Core function of the Service | Performance of a contract (Art. 6(1)(b)) | For the life of the Account; aggregated longer |
| "Looking for a partner" requests (sport, time window, approximate zone) | Partner suggestions and a replacement when a Meetup is cancelled | Performance of a contract (Art. 6(1)(b)) | Until the request expires; expired requests until deleted in the App or until the Account is deleted |
| Chat messages (within a Meetup, a Club or a conversation) | Communication between participants; safety and moderation | Performance of a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) | 90 days from sending; messages automatically flagged for review no more than 365 days, and messages tied to an open report until it is resolved |
| Ratings | Trust and quality of the community | Legitimate interest (Art. 6(1)(f)) | For the life of the Account |
| Reports and blocks | Safety, moderation, protection against abuse (DSA) | Legitimate interest (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) | For the duration of handling and then normally 12 months |
| Clubs: membership (role, status, date joined), attendance at club training sessions, a request to manage a Club including evidence (e.g. a link to a website or social network) | Running Clubs, verifying a Club | Performance of a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) | Until you leave the Club or delete your Account; after the Account is deleted, only an entry not linked to you remains in the Club's attendance record |
| Coach profile (description, sports, district or area of activity, sports venues, website link, documented qualifications) and coach reviews (stars, comment, the coach's reply) | The list of coaches and its trustworthiness | Performance of a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) | Until the coach profile is closed, the review is deleted or the Account is deleted |
| Suggestions of new sports venues (name, note, location of the suggested place) | Adding to the map of sports venues | Legitimate interest (Art. 6(1)(f)) | For the life of the Account; an unprocessed suggestion expires after 90 days |
| Problem reports (your text, our reply, technical context: version, language, platform, screen) | Support and bug fixing | Legitimate interest (Art. 6(1)(f)) | For the life of the Account |
| Invitations (your invite code, who invited whom) | Inviting friends, credits and the ambassador badge | Legitimate interest (Art. 6(1)(f)) | For the life of the Account; credits are not stored but calculated on an ongoing basis |
| Notifications in the App (type, content, time, whether read) | Keeping you informed about what is happening in the Service | Performance of a contract (Art. 6(1)(b)) | 180 days |
| Device token for delivering (push) notifications | Delivering notifications to your phone or browser | Performance of a contract (Art. 6(1)(b)) | Until notifications are turned off, the device is signed out or the Account is deleted |
| "Share with someone close" link for a specific Meetup | Safety: someone close to you knows where and when you are doing sport | Legitimate interest (Art. 6(1)(f)) | Valid until 6 hours after the Meetup starts or until it is cancelled |
2.4a Meetup photos (optional, App)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Photos from a completed Meetup (optional) | Sharing the experience; publication by Spareya only with consent | Consent (Art. 6(1)(a)) of all people shown — for publication by Spareya | Until consent is withdrawn or the Account is deleted |
Photos and consent. Photos are optional and available only after a Meetup has taken place. They are stored by Supabase Storage, and we remove location metadata (EXIF) before storage. For us to publish a photo (e.g. on Spareya's social media), all people shown must consent; any of them may withdraw consent at any time. Whether you share a photo yourself is your own decision, outside this processing. Photos are subject to the Community Rules and moderation (you can report them).
2.4b Emergency contact (optional, App)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Emergency contact — name + email or phone of a third party | Safety at Meetups; contacted only in an emergency/safety situation | Legitimate interest (Art. 6(1)(f)) — protection of life, health and safety | Until the contact is removed or the Account is deleted |
Emergency contact (third-party data). If you add an emergency contact, you confirm that you are entitled to provide us with that person's data. We will use it only in an emergency or safety situation, not for ordinary communication or marketing. The legal basis is our legitimate interest in protecting life and safety, not the consent of the person contacted. That person may request erasure of their data at any time at support@spareya.eu.
2.4c Profile photo (optional, App)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Profile photo (optional) | So other participants can recognise you at a Meetup | Performance of a contract (Art. 6(1)(b)) | Until the photo is removed or the Account is deleted |
| Check of the photo for inappropriate content (currently by a person, once switched on also automatically) | Community safety — protection against nudity and violence | Legitimate interest (Art. 6(1)(f)) | The result of the check, together with the photo; 30 days for a rejected photo |
Who sees your profile photo. Only confirmed participants of the same Meetup, and at most until two days after it starts. It is not shown on the map, in lists, in partner suggestions or on your public profile — your avatar is shown there. Before storing the photo, we remove its metadata, including location. Once automated checking is switched on, the photo is checked by Microsoft Azure AI Content Safety in the EU; the service does not store the photo or use it for training. Automated checking is currently switched off, and a person reviews every photo before it is shown. The photo must be of you and must show your face; other participants can report it and a moderator can hide it. We do not recognise your face or compare it with your identity document — this is not biometric processing.
2.4d "My sport" log (optional, App)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Entries of your own sports activity: date, sport, type (leisure, training, competition), duration, distance, time, score and result, placing, exercises (name, weight, repetitions), note, whether you did the sport alone, and any attendance taken over from a club training session | Your private overview of your own sport | Performance of a contract (Art. 6(1)(b)) | Until the entry is deleted or the Account is deleted |
Only you can see your log. We do not show your entries to anyone and do not use them for matching or advertising. The log works in every district or area, even before it is activated.
2.5 Website and Campaign data ("The Great Unlock" campaign) (Website)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Waitlist: email, district or area, time, verification status (double opt-in), invite code and who invited you | Participating in the campaign, unlocking districts and areas, confirming your email, sending your invite link, notifying you about the unlock | Consent (Art. 6(1)(a)) / pre-contractual steps (Art. 6(1)(b)) | Until the campaign starts/ends or consent is withdrawn |
| Club interest: club name, sport, city, email | Recruiting and activating clubs | Consent (Art. 6(1)(a)) / pre-contractual steps (Art. 6(1)(b)) | Until the interest is handled or consent is withdrawn |
| Wall of Fame: name or nickname, group, link to the post, country or city (optional), email, photo (optional) | Thanking people who spread Spareya; publication on the Website and Spareya's social media | Consent (Art. 6(1)(a)) | An unapproved application no more than 48 hours; a rejected one is deleted immediately; an approved one until consent is withdrawn |
2.6 Technical data
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| IP address (temporary; for Waitlist sign-ups and registration we store only a shortened form: IPv4 without the last number, IPv6 only the first half) | Rate-limiting, security, anti-bot (Cloudflare Turnstile) | Legitimate interest (Art. 6(1)(f)) | No more than 30 days |
| Device / browser (logs) | Diagnostics, security, operation | Legitimate interest (Art. 6(1)(f)) | No more than 90 days |
| Product analytics (Vercel Analytics — cookieless, anonymised) | Improving the Service | Legitimate interest (Art. 6(1)(f)) | Aggregated |
3. Real-person and age verification (Didit)
Spareya is a platform for in-person Meetups and is strictly 18+. Verification is carried out by the provider Didit (Didit Identity Spain, S.L., Barcelona, Spain) as our processor. We never ask for an identity document.
Temporarily: We will switch on camera verification through Didit before the first district or area unlocks. Until then, no Meetups with people take place; the exception is training sessions for members of a verified Club only, where the Club knows its own members.
- Real-person check. Before your first Meetup you verify once: you look into the front camera for a moment and turn your head. An automated liveness check uses a short video to confirm that a live person is in front of the camera, not a photo or a recording. Age is not estimated in this check. If you do not take part in Meetups, you never go through this check.
- 18+ requirement. You enter your year of birth when you register. We ask for an age estimate from your face only when there is a reason: an age of 18 to 20 in your Profile, a report that you may be under 18, or a request from a moderator. Until the age check is passed, new Meetups are not possible; all other functions keep working.
- The age estimate is an automated estimate from your face. We tell you this in the App before the camera turns on. The system does not decide against you on its own: if the estimate comes out low, a person from our team looks at the record at Didit, including the image of your face, and decides.
- What is processed and where. Both the liveness check and the age estimate work with an image of your face (a photo and a short video). Didit processes them on its servers, according to its documentation in the EU. The camera turns on only after you give your explicit consent in the App.
- What we store. The photo and the video are not transferred to our systems. Only the result (yes/no) and the date come back to us; we do not store the estimated age.
- How long. Once we receive the result, we ask Didit to delete the record (after a review by a person, immediately after the decision). In addition, the retention period at Didit will be set to a maximum of 1 month.
Our backup verification provider is Persona; it is not in use today. If we were to switch it on, we would update this Policy beforehand.
4. Location and the map
- The App does not ask for or store the location of your device (GPS). A person's precise location is not collected or stored anywhere in the system.
- As your home you search for a municipality (or postcode). We store its name and the centre point of the municipality (not your address), the district or area derived from it and an approximate zone (a geohash with a precision of about 5 × 5 km), which we use to suggest Meetups near you.
- Other users see only the district or area of your home.
- The map never shows people — only places and Meetups. (Clubs and sports venues, as public entities and places, may have a published exact address — this is not a user's location. Coaches appear on the map only with the district or area where they work, or the sports venue where they coach; we never publish their home address.)
Rendering the map, searching for places and the weather forecast for the place of a Meetup are handled by external providers (see clause 6.1a), to whom your IP address may be passed when loading. This approach is part of the Service's design (privacy by design, Article 25 GDPR).
5. Legal bases for processing (Article 6 GDPR)
- Performance of a contract (Art. 6(1)(b)): creating and managing the Account, providing the core functions of the Service (Profile, matching, Meetups, chat).
- Consent (Art. 6(1)(a)): optional data, the Waitlist and Campaign, marketing. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
- Legitimate interest (Art. 6(1)(f)): safety of the community and the Service, prevention of fraud and abuse, moderation, ratings and reliability, diagnostics. You may object to processing on this basis.
- Legal obligation (Art. 6(1)(c)): compliance with the 18+ requirement, obligations under the DSA, cooperation with authorities, accounting obligations (where they arise).
6. Who we share data with
6.1 Processors (sub-processors)
We use trusted providers who process data on our behalf under a data processing agreement (DPA) and only on our instructions:
| Processor | Purpose | Location / transfer |
|---|---|---|
| Supabase | Database, authentication, storage, realtime | EU (Frankfurt) |
| Vercel | Hosting the Website/App, cookieless analytics | US/EU (SCCs/DPF) |
| Didit (Didit Identity Spain, S.L.) | Real-person (liveness) check and, when there is a reason, age estimate from the face | EU (Spain) |
| Persona | Backup verification provider (not in use today) | US (SCCs/DPF) |
| Resend | Transactional emails | US (SCCs/DPF) |
| Microsoft (Azure AI Content Safety) | Automated check of profile photos for inappropriate content (once switched on; not in use today) | EU |
| Cloudflare | Turnstile anti-bot (form protection) | Global (SCCs) |
| Sentry | Error monitoring (IP, diagnostics) | EU |
| Google (Firebase Cloud Messaging) | Delivering notifications to the App on Android and iPhone (on iPhone onward through Apple) | US (SCCs/DPF) |
| Apple (APNs) | Delivering notifications to the App on iPhone | US (SCCs/DPF) |
| Your browser's push service (e.g. Google, Mozilla, Apple) | Delivering notifications to the App in the browser | depending on the browser, including the US |
| GitHub (Microsoft) | Encrypted database backups (no more than 30 days) | US (SCCs/DPF) |
| Websupport | Domain DNS and the support@spareya.eu mailbox | EU (Slovakia) |
6.1a External services loaded by your device
When you use the App or the Website, your device also connects to the following services; they receive in particular your IP address and the request (e.g. a map section, a search term, the coordinates of a Meetup's location). They do not hold any of your Account data.
| Service | Purpose | Location / transfer |
|---|---|---|
| OpenFreeMap | Map rendering | EU |
| Photon (komoot GmbH) | Searching for places and municipalities (geocoding) | EU (Germany) |
| Open-Meteo | Weather forecast for the place and time of a Meetup | Europe |
| Google Fonts (Google) | Loading the font in the App | US (SCCs/DPF) |
6.2 Other users
Some data is, by its nature, visible to other users so that the Service can work: from your Profile, your nickname, avatar and badges, sports and level, bio, age (calculated from your year of birth), nationality, languages, home district or area, reliability indicator and verification status; your profile photo as set out in clause 2.4c; at a Meetup, your attendance/hosting and chat messages within that Meetup; at a Club, your membership of it; for a coach, their profile and reviews. Without signing in, a visitor to the map can see the host's nickname and avatar for a Meetup, and the person you send a "Share with someone close" link to can see the sport, place and time of the Meetup and your nickname (until 6 hours after it starts). We do not show others your email, year of birth, your My sport log or precise location.
6.3 Public authorities
We will disclose data to authorities (courts, police, the supervisory authority) only where required by law or necessary to protect rights and safety and to comply with obligations (including under the DSA).
7. Transfers outside the EU
Some processors process data outside the EEA (particularly in the US). For such transfers we ensure appropriate safeguards under Chapter V GDPR — either an adequacy decision (the EU-US Data Privacy Framework, DPF, for certified recipients) or Standard Contractual Clauses (SCCs) supplemented by technical and organisational measures. Processors and services with possible transfers outside the EU: Vercel, Persona, Resend, Cloudflare, Google (Firebase Cloud Messaging, Google Fonts), Apple, browser push services and GitHub. You may request information about the safeguards applied at support@spareya.eu.
8. Retention
We keep data only for as long as necessary for the purposes set out above:
- Account and Profile: for the life of the Account; after the Account is deleted, erasure or anonymisation normally within 30 days.
- Activity (Meetups, ratings): for the life of the Account; thereafter aggregated/anonymised.
- Chat messages: 90 days from sending; messages automatically flagged for review no more than 365 days, and messages tied to an open report until it is resolved. You can delete the contents of your messages earlier, directly in the App (clause 9).
- My sport log: until the entry is deleted or the Account is deleted.
- Notifications in the App: 180 days.
- Meetup photos: until consent is withdrawn or the Account is deleted.
- Profile photo: until it is removed or the Account is deleted. A photo hidden by a moderator is kept for another 30 days in case of an objection and then deleted. A photo rejected by the automated check is deleted immediately; the record of the rejection (without the photo) is kept for 30 days.
- Emergency contact: until the contact is removed or the Account is deleted.
- Reports and blocks: for the duration of handling and then normally 12 months (longer only if proceedings are ongoing).
- Verification: the result and verification records for the life of the Account; the image of your face (photo and video) at Didit until deleted after the result, at most 1 month (once verification through Didit is switched on, clause 3).
- Technical data: IP address (shortened for the Waitlist and registration) no more than 30 days, logs no more than 90 days.
- Wall of Fame: an unapproved application no more than 48 hours, a rejected one is deleted immediately, an approved one until consent is withdrawn.
- Backups: we keep encrypted database backups for no more than 30 days; data deleted from the Service therefore disappears from the backups within 30 days at the latest.
- Waitlist / Campaign / Club interest: until the campaign starts/ends, the interest is handled or consent is withdrawn.
9. Your rights
As a data subject you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), to object (Art. 21), to withdraw consent (Art. 7(3)) and the specific right under Article 22 (automated decision-making — see clause 12).
In the App you can directly delete your Account, delete some of your data without deleting your Account, and export your data. Partial deletion (Profile → Account settings → Delete some of your data) covers the contents of your chat messages, your profile photo and Meetup photos together with the withdrawal of your consent to photos you appear in, the history of Meetups that were never confirmed, and optional Profile details (bio, gender, nationality). Message contents are removed and only a deletion note stays in the conversation so the other side keeps the context; messages automatically flagged for review and messages tied to an open report are retained as set out in clause 8, at most until the case is resolved (Art. 17(3)(e) GDPR), and confirmed Meetups stay because they are a shared record of both participants and the basis of the reliability indicator. For other requests, write to support@spareya.eu — we will handle them within one month (extendable by up to two further months in justified cases, of which we will inform you). Exercising your rights is normally free of charge. To verify the requester's identity, we may ask for additional information.
10. Minors
The Service is intended solely for persons over 18 years of age. Children and young people never have an Account; the 18+ requirement is verified (clause 3). Any involvement of young people in sport takes place solely through verified clubs and is directed at parents — children do not create an Account or provide their data in the App themselves. If we discover an Account held by a person under 18, we will close it and delete the data.
11. Data security
We take appropriate technical and organisational measures, in particular:
- Row-Level Security (RLS) on every table — access is enforced by the database, not only by application logic.
- Encryption in transit and at rest, and hashed passwords (Supabase Auth).
- Data minimisation (privacy by design) — we do not store precise location or biometrics.
- Anti-fraud and anti-bot measures (rate-limiting, Cloudflare Turnstile).
Given the nature of the processing (age verification, generalised location, content moderation, protection of children), we have assessed the impact on data protection and taken appropriate measures; we keep that assessment up to date. In the event of a personal data breach posing a risk to your rights, we will notify the supervisory authority within 72 hours (Art. 33) and, where the risk is high, notify you as well (Art. 34).
12. Automated processing and profiling
- (a) Matching (profiling). To suggest suitable Meetups and partners we compare Profile data (sports and level, generalised district or area, preferences). Each suggestion comes with clear reasons for the match, so you can see why we are showing it to you. Whether you attend a Meetup is decided by you, not the system.
- (b) Detection of attempts to exchange contact details. In chat we automatically assess whether messages contain attempts to circumvent safety rules. This serves to flag content for a human moderator — the flag itself has no automatic legal effect on you.
- (c) No solely automated decisions. Decisions with a significant effect (in particular restricting or closing an Account) are always made by a human. You have the right to human intervention, to express your view and to contest the decision (Articles 21 and 22 GDPR); you can exercise these at support@spareya.eu.
- (d) Checking profile photos. Currently, a person reviews every profile photo before it is shown. Once automated checking is switched on, the photo will first be checked by Microsoft Azure AI Content Safety. The service will reject a clearly inappropriate photo (nudity, violence); if the result is borderline or the service is unavailable, a person will review the photo. A rejection concerns only the photo, not the Account — you can upload another one or contact support@spareya.eu.
- (e) Real-person check and age estimate. (Applies once verification through Didit is switched on, clause 3.) The liveness check is automated; if it fails, you can try again. For the age estimate the system does not decide against you on its own — a low estimate is reviewed by a person from our team (clause 3).
13. Cookies and storage
On the Website and in the App we use necessary cookies and similar technologies (local storage) needed for the Service to function. Product analytics is designed to be cookieless and anonymised, so we do not use tracking cookies or a cookie banner on the Website. Should we introduce technologies requiring consent in the future, we will ask for it.
14. Complaint to a supervisory authority
If you believe our processing infringes the GDPR, you have the right to lodge a complaint with a supervisory authority.
Slovakia: Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Galvaniho 7/B, 821 04 Bratislava; email: statny.dozor@pdp.gov.sk; website: https://pdp.gov.sk. As an EU user, you may also contact the supervisory authority in your country of residence.
United Kingdom: Information Commissioner's Office (ICO), https://ico.org.uk.
We would appreciate it if you contacted us first at support@spareya.eu — we can resolve most matters directly and quickly.
15. Changes, effect and version
We may update this Policy from time to time (e.g. when functions, processors or legal requirements change). We will notify you of material changes in an appropriate way (in the App or by email). The current version is always available on the Website.
Effective from: 13 October 2026