Privacy Policy of the Website and the Application

Version 3 · Updated 19 August 2026

This Privacy Policy governs the processing of personal data carried out by RALLY RATING, S.L. (hereinafter, the "Data Controller") through the website rallyrating.app (hereinafter, the "Website") and the RALLY mobile application (hereinafter, the "Application" or the "App"), jointly referred to as the "Platform".

The Data Controller is committed to protecting users' personal data and guarantees that it is processed in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD") and other applicable legislation.

1.-WHO IS THE DATA CONTROLLER?

Data Controller: RALLY RATING, S.L.

Tax ID: B88743380

Registered office: Calle del Príncipe de Vergara 86, 1ª, 28006 Madrid

Contact email: support@rallyrating.app

Privacy email: hello@rallyrating.app

2.-WHAT PERSONAL DATA DO WE COLLECT?

The Data Controller collects personal data provided directly by the user during:

• registration
• access to the Website
• use of the Application
• use of sporting and statistical features

Certain technical data may also be collected automatically through the operation of the Website and the Application.

Types of data we process:

Identification and contact data: first and last name, email address and username. The profile image is generated automatically from the user's initials; no photographs are collected.

Profile and sporting data: date of birth, gender, province and city of residence, sport played (tennis or padel), match history, rivals and results, playing surface, ranking and rating history, sporting metrics and analysis of sporting performance.

The Platform does not use sporting data to infer information about users' health.

The Platform does not process special categories of data under Article 9 GDPR.

Moderation and safety data: reports submitted by the user or received in relation to the user, the reason and detail provided in the report, and blocks made between users, together with the date of each of these records.

Technical data: IP address, Device ID, Operating System, Browser type, date and time of access, technical logs, push notification token (collected only after the user grants the relevant permission) and information on use of the Website and/or Application. The Platform does not currently use third-party analytics, advertising or tracking tools.

User ID: The Data Controller assigns the user an internal unique identifier in order to manage their activity within the Platform and ensure that rankings and statistics function correctly.

The Platform is aimed exclusively at persons over 18 years of age. The Data Controller does not knowingly collect data from minors.

Should accounts belonging to minors be detected, the Data Controller may:

• suspend the account
• delete the associated data
• request documentation proving age

The Data Controller may also implement additional age verification mechanisms in line with future regulatory obligations.

Children’s Privacy (COPPA). The Platform is not directed at children under 13, and Rally does not knowingly collect personal information from children under 13 in compliance with the U.S. Children’s Online Privacy Protection Act (COPPA). If Rally becomes aware that it has collected personal information from a child under 13, it will promptly delete that data. Parents or guardians who believe that their child has provided personal information may contact hello@rallyrating.app.

3.-FOR WHAT PURPOSES DO WE USE YOUR DATA?

Personal data may be processed for the following purposes:

• To manage user registration and accounts.
• To enable access to and operation of the Website and/or the Application.
• To generate sporting rankings, ratings and statistics.
• To manage match results and sporting histories.
• To ensure the security of the Platform and prevent fraudulent activity.
• To manage reports and blocks between users, to moderate content and conduct contrary to the General Terms and Conditions of Use, and to take the appropriate measures in relation to offending accounts.
• To respond to queries, incidents or requests.
• To improve the operation and user experience.
• To comply with applicable legal obligations.
• To send communications relating to the service.
• Subject to applicable law and, where required, with the user’s prior consent, to share aggregated, de-identified, or anonymized data with third-party partners for analytical, research, or commercial purposes.

Additionally, and only where the user has given prior consent:

• To send commercial or promotional communications.
• To carry out statistical analysis and non-essential advanced analytics.

Profiling. Where the user consents, the Data Controller will build profiles from the data provided at registration and from the user's sporting activity on the Platform, in order to personalise the experience and to direct communications and recommendations suited to their sporting profile. This profiling is not based solely on automated means producing legal or similarly significant effects for the user within the meaning of Article 22 GDPR. The user may object to this processing or withdraw their consent at any time.

4.-WHAT IS THE LEGAL BASIS FOR PROCESSING YOUR DATA?

The legal bases legitimising the processing of data are:

Performance of the contractual relationship: Art. 6.1.b GDPR, to create and manage your account, provide the services offered, generate rankings and statistics, and enable use of the platform.

Compliance with legal obligations: Art. 6.1.c GDPR. For processing necessary under applicable legislation.

Legitimate interest: Art. 6.1.f GDPR. Fraud prevention, security of the Platform, detection of abuse, management of reports and blocks, moderation of content and conduct, and technical improvement of the service.

Consent: Art. 6.1.a GDPR. For sending commercial communications, or non-essential analytics technologies and optional features. The user may withdraw their consent at any time.

Withdrawal of consent. Users may withdraw their consent at any time through the in-app privacy settings or by emailing hello@rallyrating.app. Withdrawal of consent is as easy as giving it, in accordance with Article 7(3) GDPR. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

5.-WITH WHOM DO WE SHARE YOUR DATA?

The Data Controller may share data with providers that supply services necessary for the operation of the Platform, including:

• cloud hosting
• authentication
• technical support
• communications

All providers act as data processors and are subject to contractual obligations of confidentiality and security.

Data may be disclosed to the competent authorities where there is a legal obligation to do so.

In addition, certain information may be visible to other users where necessary for rankings and statistics to function, including:

• username
• nickname
• match results
• ranking
• rating
• sporting statistics

Reports between users are treated confidentially. The identity of the reporting user is not disclosed to the reported user.

Rally may share aggregated, de-identified, or anonymized data that does not reasonably identify any individual with third-party partners for commercial, analytical, or research purposes. Rally may also share personal data with third parties for commercial purposes where the user has provided explicit consent or where otherwise permitted by applicable law, including the CCPA/CPRA. Users will be informed of any material changes to data-sharing practices through updates to this Privacy Policy.

6.INTERNATIONAL DATA TRANSFERS

Some of the technology providers supplying services to the Data Controller (cloud hosting, authentication, technical support, communications and other services necessary for the operation of the Platform) may be located outside the European Economic Area (EEA) or process data from third countries. In such cases, the Data Controller may transfer personal data to those third countries.

These international transfers will be carried out only where one of the appropriate safeguards provided for in Chapter V of the GDPR applies, in particular:

Adequacy decisions: where the European Commission has declared that the third country, territory or sector guarantees an adequate level of protection (Article 45 GDPR).

Standard contractual clauses (SCCs): entering into with the provider the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional technical, organisational and contractual measures (Article 46.2 GDPR).

Other legally recognised mechanisms: any other appropriate safeguard permitted by applicable legislation, such as binding corporate rules or, failing that, the derogations for specific situations provided for in Article 49 GDPR.

Users may obtain further information about the safeguards applied to these transfers, and a copy of the mechanisms adopted, by writing to: hello@rallyrating.app.

7.HOW LONG DO WE KEEP YOUR DATA?

Personal data will be retained:

• for as long as the user keeps their account active
• for as long as it is necessary in order to provide the service
• for the periods required by law

When data is no longer necessary, it will be deleted or may be retained in blocked form in accordance with applicable legislation.

Reports and moderation records will be retained for as long as necessary to handle the incident, take the appropriate measures and demonstrate compliance with our obligations, and in any event for the periods required by law.

Statistical or anonymised data may be retained indefinitely where it does not allow the user to be identified.

8.WHAT RIGHTS DOES THE USER HAVE?

To the extent applicable, users may exercise the following rights before the Data Controller free of charge:

The right to request access to their personal data and therefore to know how we are processing their data and what that data is.

The right to request rectification of their data where it is inaccurate, incomplete or out of date.

The right to request erasure of their data (the right to be forgotten) where, among other cases, it is no longer necessary for the purposes for which it was collected, they withdraw their consent, or they object to the processing, without prejudice to the retention periods required by law.

The right to request restriction of processing in certain circumstances, meaning that we may temporarily restrict its processing or retain it beyond the necessary period.

The right to object to the processing of their data, among other cases where the processing is based on the Data Controller's legitimate interest.

The right to withdraw, at any time, consent given for those purposes based on it.

The right to request the portability of your data for processing based on the performance of a contract or on consent.

These rights may be exercised by sending written communication to the postal address at Calle del Príncipe de Vergara 86, 1ª, 28006 Madrid or by email to hello@rallyrating.app, telling us which right you wish to exercise.

Rally will respond to data subject rights requests without undue delay and in any event within one month of receipt. This period may be extended by up to two additional months where necessary, taking into account the complexity and number of the requests. Where the period is extended, Rally will inform the user of the extension and the reasons for the delay within the initial one-month period, in accordance with Article 12(3) GDPR.

Users may also delete their account at any time from within the Application, in the settings section.

Finally, we inform you that you have the right to lodge a complaint with the relevant data protection authority, which in Spain is the Spanish Data Protection Agency, www.aepd.es

9.SECURITY MEASURES

The Data Controller has adopted the technical and organisational measures necessary to safeguard the security, integrity, availability and confidentiality of your data. This includes internal review and verification processes covering the measures applied to guarantee the security of the processing.

10.DATA BREACH NOTIFICATION

In the event of a personal data breach likely to result in a risk to the rights and freedoms of individuals, Rally will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR. Where a breach is likely to result in a high risk to affected individuals, Rally will also notify those individuals without undue delay, in accordance with Article 34 GDPR. Rally will also comply with applicable U.S. state data breach notification laws.

11.CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)

This section applies to California residents.

Categories of personal information. Rally may collect the categories of personal information described in Section 2, including identification and contact data, profile and sporting data, moderation and safety data, technical data and User ID data.

Sale and sharing of personal information. Rally does not currently sell personal information as defined by the CCPA. Rally reserves the right to share or make available certain non-sensitive, aggregated, or de-identified data with third-party partners for commercial purposes in the future, subject to applicable law and with appropriate notice to users.

California residents may have the following rights, subject to applicable legal limitations:

• The right to know what personal information Rally collects, uses, discloses or sells, including the categories and purposes of such activities.
• The right to delete personal information collected from them, subject to applicable exceptions.
• The right to opt out of the sale or sharing of personal information.
• The right to non-discrimination for exercising these rights.

Users may exercise California privacy rights by emailing hello@rallyrating.app.

Do Not Track. The Platform does not currently respond to Do Not Track signals. Rally will update this Privacy Policy if it adopts a Do Not Track standard in the future.

12.AMENDMENTS TO THE PRIVACY POLICY

The Data Controller may amend the Privacy Policy to adapt it to changes that may occur in the Application, legislative changes or any other. The Data Controller may publish such amendments in the Application, so we recommend that you review this Privacy Policy periodically.

Updated 19 August 2026.