Legal · Privacy
PRIVACY POLICY & PERSONAL DATA PROTECTION
1. DATA CONTROLLER & CONTACT INFORMATION
1.1. Identification of the Data Controller:
The Data Controller for the processing of personal data pursuant to Article 4(7) of the GDPR and Spanish organic law LOPDGDD (Ley Orgánica 3/2018) is:
- Data Controller: Emanuele Cresta, empresario individual / trabajador autónomo (sole proprietor under Spanish law), operating in his own name and under his own tax identity (Emanuele Cresta), with professional domicile in Santa Cruz de Tenerife (Canary Islands, Spain), NIF/NIE: Y8922606T, exclusive owner of the European Union trademark "SWOOPP" registered with the EUIPO (European Union Intellectual Property Office).
- Official Privacy Email:
privacy@swooppapp.com|legal@swooppapp.com.
1.2. Potential Corporate Evolution:
Data subjects are informed that the future incorporation of a Spanish limited liability company (Sociedad de Responsabilidad Limitada – S.L.) owned by the same proprietor is planned. Such company may assume the ownership of contractual relationships and data processing activities solely upon the formal completion of the necessary legal instruments and in accordance with applicable law. Data subjects will be informed of any modification of the Data Controller or identification details via an update to this Privacy Policy and, where required by applicable law, through additional appropriate communication channels, including on a durable medium for registered users.
2. PRIVACY LIAISON & DATA PROTECTION OFFICER (DPO)
SWOOPP has designated an internal privacy liaison for data protection matters, reachable at all times at: privacy@swooppapp.com.
This internal liaison oversees security practices and user interactions, but is not designated as a formal Data Protection Officer (DPO) under Articles 37–39 GDPR: based on preliminary assessments and the scale of processing at the effective date, the Controller considers that the legal criteria for mandatory DPO appointment under Articles 37–39 GDPR and Spanish law are not met. This assessment will be reviewed periodically, particularly if large-scale systematic monitoring or behavioral profiling is introduced.
3. DATA TAXONOMY: PERSONAL, PSEUDONYMIZED, AND ANONYMIZED
Pursuant to Article 12 GDPR transparency requirements and guidelines from the European Data Protection Board (EDPB) and the Spanish Data Protection Agency (AEPD), SWOOPP adopts a strict three-tier classification:
- Directly Identifiable Personal Data: Information directly identifying a natural person (e.g., email address, name, phone number voluntarily provided during account registration or support requests).
- Pseudonymized Data (Art. 4.5 GDPR): Data that cannot be attributed to a specific data subject without additional information kept separately and secured (e.g., unique app installation IDs, advertising identifiers IDFA/GAID, cryptographic IP hashes, in-app telemetry logs). Pseudonymized data remains personal data under the GDPR.
- Truly Anonymized Data: Data subjected to an anonymization process and re-identification risk assessment that renders the data subject reasonably unidentifiable, taking into account all means reasonably likely to be used and the risks of singling-out, linkability, and inference.
4. CATEGORIES OF PROCESSED DATA
SWOOPP processes the following categories of personal data:
- (a) Registration Data (Optional): Email address and authentication credentials stored via secure, salted password hashing functions. The Application is fully accessible for rate searches and map views without mandatory registration.
- (b) Geographic Location Data (Geolocation): Latitude and longitude coordinates from the device GPS module, strictly limited to the area needed for proximity searches, subject to mobile OS authorization.
- (c) In-App Search and Telemetry Data: Selected currency pairs (e.g., EUR/USD), indicative search amounts (without payment linkages), timestamps, viewed store profiles, and action clicks ("Call", "WhatsApp", "Directions").
- (d) Technical Network & Device Data: Connection IP address, device hardware model, OS version (iOS/Android), system language, screen resolution, technical session tokens (JWT), and diagnostic crash logs.
- (e) Commercial B2B Data (Merchant Partners): Corporate name of the bureau de change or ATM operator, NIF/VAT number or equivalent tax identifier, exchange license or authorization number, physical shop address, professional contact details, and published counter rates.
5. DATA NOT COLLECTED (PRIVACY BY DESIGN & MINIMIZATION)
In accordance with Privacy by Design and Data Minimization principles (Article 25 GDPR):
- SWOOPP never requests, processes, or stores full payment card numbers, bank credentials, CVV/CVC security codes, or transaction receipts from offline cash exchange or ATM withdrawals.
- SWOOPP does not collect or intend to collect special categories of data under Article 9 GDPR. Users are instructed not to submit health, political, religious, or biometric data in free-text fields or support tickets. Any incidental submissions will be deleted or excluded from regular processing.
6. PURPOSES, LEGAL BASES, AND RETENTION PERIODS
| Purpose of Processing | Data Categories | Legal Basis (Art. 6 GDPR) | Data Retention Period |
|---|---|---|---|
| 1. Proximity Search for Kiosks / ATMs | GPS coordinates, selected city, queried currencies | Performance of requested service (Art. 6.1.b) or Consent (Art. 6.1.a) where required; subject to mobile OS permission. | Volatile RAM processing; real-time GPS coordinates are never stored in persistent databases. |
| 2. Account Creation & Management | Email address, encrypted credentials | Performance of contract (Art. 6.1.b) | Deleted within 30 days of account closure, except where statutory retention applies. |
| 3. Infrastructure Security & DDoS Defense | IP address, API request logs, technical headers | Legitimate interest (Art. 6.1.f) in network security | Technical API logs: max 30 days. Security-specific logs: max 6 months, unless legal retention mandates longer. |
| 4. Customer Support & Service Notices | Push tokens, email, support ticket text | Performance of contract (Art. 6.1.b) | Push tokens: until disabled. Support tickets: up to 12 months after ticket closure. |
| 5. Marketing & Newsletters | Email address | Consent (Art. 6.1.a), subject to statutory soft-spam exceptions | Until consent withdrawal (Unsubscribe link in every email). |
| 6. Partner Lead Generation | Contact email, expressed preferences | Specific, separate consent (Art. 6.1.a) | Until consent withdrawal; prompt deletion from active transmission pipelines. |
| 7. Statistical Analytics & Optimization | Pseudonymized in-app events, API latency | Determined by instrument configuration (Section 8) | Monthly aggregations; individual analytical logs deleted or anonymized within 12 months. |
| 8. B2B Tax and Accounting Compliance | Corporate billing details, invoices | Legal obligation (Art. 6.1.c) under Spanish Commercial Code (Art. 30) | 6 years, or longer as mandated by tax and commercial regulations. |
7. SPECIFIC GEOLOCATION RULES (GPS)
7.1. Functional Minimization: GPS coordinates are solely used to determine nearby kiosks/ATMs and estimate walking/driving distance.
7.2. OS Permission vs. Legal Basis: Mobile OS location prompts represent a technical access gate. GDPR processing is grounded on contract execution (Art. 6.1.b) or consent (Art. 6.1.a). Users may revoke GPS permissions anytime and search manually.
7.3. No Background Tracking: SWOOPP never collects location data in the background when the app is closed.
7.4. Volatile In-Memory Processing: GPS coordinates are processed exclusively in server RAM and discarded after query response, with zero permanent storage in user profiles.
8. ANALYTICS, TELEMETRY, AND PERFORMANCE MONITORING
8.1. SWOOPP may process technical telemetry using pseudonymized IDs to evaluate latency and app stability.
8.2. Legal Framework (AEPD / EDPB):
- Web: Analytics cookies require prior consent via the cookie banner.
- Mobile App: IP addresses are truncated/masked. First-party privacy-preserving analytics based on legitimate interest (Art. 6.1.f) require documented pre-launch technical verification. If consent is required by applicable law, prior consent will be collected.
9. PROFILING AND AUTOMATED DECISIONS
SWOOPP does not engage in automated decision-making producing legal effects under Article 22 GDPR. Search result ranking is determined by declared objective criteria (distance, reported rate, profile completeness), without behavioral financial profiling.
10. MARKETING COMMUNICATIONS & SOFT SPAM
10.1. Promotional emails require prior opt-in consent (Art. 6.1.a GDPR).
10.2. Marketing consent is strictly optional and not tied to platform access.
10.3. Soft Spam: Under Article 21.2 of Spain's LSSI-CE, SWOOPP may send promotional emails regarding its own similar services to users with existing contractual or service relationships, provided a free opt-out mechanism is included in every message.
11. DATA SHARING WITH THIRD PARTIES & LEAD GENERATION
11.1. Relationship with Partner Merchants (Independent Controllers):
- When a user submits an inquiry to lock a rate or request contact (Lead Generation), SWOOPP transmits the contact details directly to the chosen merchant.
- Following transmission, the Merchant processes personal data as an independent Data Controller to the extent it autonomously determines the purposes and means of subsequent processing.
- SWOOPP is not responsible as Controller for processing autonomously carried out by the Merchant outside SWOOPP's instructions.
11.2. Third-Party External Links: Links to third-party tools (Google Maps, Apple Maps, WhatsApp) redirect users to external platforms governed by third-party policies.
12. ANONYMIZED STATISTICAL DATASETS
SWOOPP may compile aggregate macro-level statistical indicators on currency search flows. Data is only utilized for market analysis once a formal re-identification risk assessment confirms true anonymization.
13. COOKIES, SDKS, AND ADVERTISING IDENTIFIERS
Mobile apps do not use HTTP cookies, but may utilize local storage keys and SDKs. Access to Apple IDFA and Google GAID requires compliance with OS frameworks (ATT on iOS) and valid prior consent under Article 6.1.a GDPR and ePrivacy rules.
14. DATA RECIPIENTS (PROCESSORS EX ART. 28 GDPR)
Personal data may be shared with:
- Cloud Hosting & Database Providers (appointed Data Processors under formal DPAs, with primary EU/EEA infrastructure);
- Push Notification & Transactional Email Providers (Data Processors under Art. 28 GDPR);
- Professional Legal & Tax Advisors (bound by professional secrecy);
- Public Authorities and Law Enforcement where legally required.
15. INTERNATIONAL DATA TRANSFERS (EXTRA-EEA)
15.1. Primary servers are situated in the EU/EEA.
15.2. Extra-EEA transfers occur strictly pursuant to Chapter V GDPR:
- Adequacy Decisions (Art. 45 GDPR), including the EU-US Data Privacy Framework;
- Standard Contractual Clauses (SCCs, Art. 46 GDPR) backed by Transfer Impact Assessments (TIAs) and strong encryption;
- Specific Derogations (Art. 49 GDPR).
16. TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES (ART. 32 GDPR)
- Strong encryption in transit (HTTPS / TLS 1.3) and at rest (AES-256 for databases);
- One-way salted password hashing;
- Role-Based Access Control (RBAC), Multi-Factor Authentication (MFA), and Principle of Least Privilege (PoLP);
- Logical segregation between consumer and merchant databases, with daily automated encrypted backups.
17. DATA SUBJECT RIGHTS (ARTICLES 15–22 GDPR)
Users possess the rights of Access (Art. 15), Rectification (Art. 16), Erasure / Right to be Forgotten (Art. 17), Restriction (Art. 18), Data Portability (Art. 20), Objection (Art. 21), and Consent Withdrawal (Art. 7.3).
18. EXERCISE OF RIGHTS & RESPONSE TIMEFRAMES
18.1. Exercising rights is completely free of charge (Art. 12.5 GDPR).
18.2. Requests may be submitted in-app or via email to: privacy@swooppapp.com / legal@swooppapp.com.
18.3. Responses are provided within one (1) month, extendable by up to two (2) months for complex cases.
19. COMPLAINTS TO SUPERVISORY AUTHORITIES
Users have the right to lodge a complaint with their local EU Data Protection Authority (pursuant to Art. 77 GDPR), or with the Spanish Data Protection Agency:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6 – 28001 Madrid (Spain)
Website: https://www.aepd.es
20. AMENDMENTS TO THIS PRIVACY POLICY
SWOOPP reserves the right to modify this Privacy Policy. Material updates will be communicated via the Application or on a durable medium where required by applicable law.