All U Can Pet Together – Application and Website Privacy Notice

All U Can Pet - Together Limited Liability Company (seat: 8000 Székesfehérvár, Pörös utca 4. C. ép.; court registry number: 07-09-036739; tax number: 32845123-2-07; “Company”, “we”, “our” or “us”).

The Company processes your personal data for the purposes below:

• 1. Account management and service communications: We process your registration and account data (name, email address, password, login data, profile information, device data) to establish your user account, authenticate you on subsequent visits, allow you to access the features of the Interface, provide customer support, and to send you operational notifications relating to the use of the Interface — including account-related notifications (password resets, security alerts), match alerts when a sighting may correspond to your lost pet, rescue alerts in your selected radius, calendar and reminder notifications you have configured for your pet, and information about developments and changes affecting shelters, non-profit organizations, the Website, and the Application that are essential to your use of the service. The processing is necessary for the performance of the Terms of Use, which constitute a contract between you and the Company (Article 6(1)(b) GDPR). Retained for the duration of the contractual relationship.
• 2. Managing guest user data: When you visit the Interface without logging in, we process limited technical data (IP address, device type, browser session identifiers, cookies) to display public-facing content correctly, ensure the security of the Interface, and enable basic site functionality. We rely on our legitimate interest (Article 6(1)(f) GDPR) in operating a secure, functional public-facing platform that allows visitors to learn about our services before deciding to register. Retained for 6 months from the date of the visit.
• 3. Age verification: We process information you provide regarding your date of birth or age confirmation to verify that you are at least 18 years old, as our services are not intended for minors. We rely on our legitimate interest (Article 6(1)(f) GDPR) in protecting minors from a service that involves communication with strangers, location sharing, and the coordination of in-person animal rescue activities, all of which carry risks that minors should not be exposed to without parental supervision. Retained for the duration of the contractual relationship.
• 4. Identity verification: The processing is based on your consent (Article 6(1)(a) GDPR), which you may withdraw at any time, in which case the verified badge will be removed from your profile. Retained until consent is withdrawn.
• 5. Pet registration and profile management: To enable you to report a lost pet or volunteer for animal rescues, we process the pet profile information you create (pet's name, photo, breed, distinguishing features, behaviour notes, vaccination and reminder data). The processing is necessary for the performance of the contract that allows you to use the pet-related features of the Interface (Article 6(1)(b) GDPR). Retained for the duration of the contractual relationship.
• 6. Reporting and documenting animal rescue cases: When you report your own or another person's lost animal, or when you flag a stray or injured animal, we process the location data of the sighting, your contact details, and the relevant pet profile data so that other users in the area can assist. We also retain records of completed rescues (rescue chat archive metadata, confirmation photographs, participant identifiers, timestamps) for the purpose of substantiating the integrity of rescue operations, addressing potential disputes, and producing aggregate statistics. We rely on our legitimate interest (Article 6(1)(f) GDPR) in facilitating the prompt recovery of lost animals through community-based location sharing, and in maintaining a verifiable record of rescue activity to ensure the Interface is not misused, to protect users involved in rescues from false accusations, and to demonstrate the impact of the platform. Retained for 30 days after the rescue has been marked as completed.
• 7. Rescue coordination: When multiple users respond to a stray or injured animal report in the same area, the system connects them in a shared chat room together with nearby NGOs to coordinate the rescue. We process the participants' user account data, location data, communication content within the chat, and rescue documentation (photos confirming the rescue). The processing is necessary for the performance of our service contract with you, which includes participation in coordinated rescue operations as a core platform feature (Article 6(1)(b) GDPR). The chat room is automatically deleted 30 days after the rescue is marked as complete.
• 8. Communication with business users: The Interface allows you to send and receive direct messages with registered business users (veterinarians, hotels, salons, restaurants, NGOs, etc.). We process the content of your messages, sender/recipient identifiers, and timestamps. We rely on our legitimate interest (Article 6(1)(f) GDPR) in offering a direct communication channel between users and animal-friendly service providers, which is a core utility of the Interface and which both parties reasonably expect when using the platform. Retained for a maximum of 5 years after the deletion of the business user account.
• 9. Content moderation and abuse management: We process user account data, communication data, the content of notices, technical data and metadata relating to the relevant content for the purposes of receiving and assessing notices concerning content uploaded or transmitted by users, removing or disabling access to illegal content, and handling breaches of the Terms of Use. The legal basis for processing is compliance with a legal obligation under Article 6(1)(c) GDPR in respect of the Company’s obligations as a hosting service provider under the DSA, and legitimate interest under Article 6(1)(f) GDPR in respect of other abuse management, security and legal claim handling purposes. Retained for the duration of the contractual relationship and thereafter until the legal limitation of legal claims.
• 10. Adoption database maintenance: We maintain a searchable adoption database in which shelters and individuals can list animals available for adoption, and where prospective adopters can browse and contact the listing party. We process pet profile data of the listed animals, organisation contact details, and chat communications between adopters and listers. We rely on our legitimate interest (Article 6(1)(f) GDPR) in providing an effective channel between animals in need of homes and prospective adopters, which advances both animal welfare and the broader public interest in reducing shelter populations. Adoption-related chat is deleted 30 days after the adoption is closed by the shelter or donor.
• 11. Shelters and nonprofit organizations registration: Shelters, animal-friendly organisations, and nonprofit organisations may register on the Interface to be listed as intake facilities, indicate available capacity, and receive rescue alerts in their area. We process the organisation's name, address, contact details, capacity information, and the contact details of its representative(s). We rely on our legitimate interest (Article 6(1)(f) GDPR) in connecting rescue activity with verified intake facilities, which materially improves the outcomes of stray animal cases by ensuring rescued animals can be placed quickly. Retained for a maximum of 5 years after the deletion of the business user account.
• 12. Business client management: We maintain a directory of registered businesses and nonprofit organisations on the Interface so that users can identify the nearest, most relevant facility for their needs. We process the business's listing data (name, address, opening hours, services offered) and aggregated user interaction data with the listing. We rely on our legitimate interest (Article 6(1)(f) GDPR) in offering a comprehensive directory that increases the value of the Interface for users and provides registered businesses with reach to relevant audiences. Retained for a maximum of 5 years after the deletion of the business user account.
• 13. Business directory, map view, and user reviews: Users can view registered businesses on a map and submit ratings and written reviews based on their experiences. We process your user account data, the location of the viewed area, the content of any review you submit, and aggregated data about your interactions with the directory. We rely on our legitimate interest (Article 6(1)(f) GDPR) in providing transparent, peer-sourced quality information about animal-related businesses, which assists users in making informed decisions and incentivizes businesses to maintain service quality. Retained for a maximum of 5 years after the deletion of the business user account.
• 14. News, social, and marketing communications: Where you have opted in, we send you newsletters, promotional content, news from partner shelters and businesses, event announcements, and marketing campaigns by email and/or push notification, based on your preferences. We process your user account data, contact details, and your consent record. The processing is based on your consent (Article 6(1)(a) GDPR), which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal — you can unsubscribe via the link in any marketing email or in your account settings. Retained until consent is withdrawn.
• 15. Subscriptions: If you subscribe to a paid package (e.g., business Premium), we process your account data, billing details, transaction records, and payment confirmations. The processing is necessary for the performance of the subscription contract between you and the Company (Article 6(1)(b) GDPR). Retained for the duration of the contractual relationship.
• 16. Accounting and tax compliance: We retain personal data contained in invoices, billing records, donation records, and supporting documentation as required by Hungarian Act C of 2000 on Accounting and Hungarian tax legislation. The processing is based on our legal obligation as set out in those acts (Article 6(1)(c) GDPR). Retained for at least 8 years.
• 17. Platform operation: To ensure the day-to-day operation, security, and continuous improvement of the Interface, we process technical data relating to the use of the platform, including system logs, error reports, performance metrics, and aggregated user account and organization data. The processing is based on our legitimate interest (Article 6(1)(f) GDPR) in operating a stable, secure, and continuously improving platform that meets users' reasonable expectations of a modern digital service. Retained in line with the cookie policy.

Nature of the provision of data and consequences of failure to provide data

The provision of certain personal data is necessary for using the Interface, creating a user account, managing pet profiles, using rescue-related functions, subscriptions, donations, and for complying with billing, accounting and tax obligations.

Where processing is based on the performance of a contract or on steps necessary prior to entering into a contract, the provision of the relevant data is a contractual requirement or a requirement necessary to enter into or perform the contract. Without such data, the Company cannot provide the relevant service or functionality.

Where processing is based on compliance with a legal obligation, the provision and processing of the relevant data is a statutory requirement. Without such data, the Company cannot comply with its legal obligations, including in particular billing, accounting, tax or notice-handling obligations relating to illegal content.

Where processing is based on consent, the provision of data is voluntary. If consent is refused or withdrawn, the relevant consent-based function or communication cannot be provided or continued, but this does not affect the use of other services.

Where processing is based on legitimate interest, the provision of data is generally not a separate statutory or contractual requirement; however, the processing of certain data may be necessary for the secure operation of the Interface, prevention of abuse, handling of legal claims or the basic functioning of the service. The data subject has the right to object to such processing.

For the purposes outlined above we process the data categories indicated below:

• A. Registration data: including your name, identification data (email address and password), Facebook/Google ID, registration confirmation code.
• B. User account data: including your username, user’s e-mail address, saved user activities, user group, group ID, volunteering-related data, temporary foster care status data, date and time accessing the Interface, logins, profile picture, user type (general/admin), use of language, newsletter subscription (if any), code for password change and its validity date, code for e-mail address change and its validity date.
• C. Pet-related data: Accessible through the user profile, including personal data of the user as well as data relating to the pet profile.
• D. Location data: including the last geographical location of the user, date of last geographical location.
• E. Animal rescue documentation: processing of data necessary for the organisation of animal rescues; including device data, location data, map data, and communication data.
• F. Organization data: name, legal form, logo, e-mail address and phone number of the Organization, and data contained in documents submitted for verification purposes.
• G. Event data: Service providers may publish events, and users may indicate their interest in such events.
• H. Device data: including, type of user device, the internet protocol (IP) address you use to visit our Interface and cookies, local storage and session storage data.
• I. Communication data: including details of your question, inquiry, comments or our communication with you.

To process your personal data, we may rely on the legal bases below:

• • The processing of your personal data is necessary for the performance of a contract with you under Article 6 (1) b) of the EU Regulation 679/2016 ("GDPR") (“Contract”).
• • Your consent provided to us under the Article 6 (1) a) of the GDPR (“Consent”).
• • We also process your personal data where we are subject to a legal obligation under Article 6(1)(c) of the GDPR, and under applicable tax and accounting legislation ("Legal Obligation").
• • The processing of your personal data is possible based on our legitimate interest under of the Article 6 (1) f) of the GDPR (“Legitimate Interest”).

The Company has a legitimate interest in facilitating the prompt identification and location of animals in need of rescue on the basis of location data and on-site information shared by users. Furthermore, it aims to improve the efficiency of the organisation of rescue operations by connecting users who volunteer for rescue activities through a shared chat function, thereby enhancing the effectiveness of assistance and increasing the likelihood of rescuing as many animals as possible.

The Company has a legitimate interest in providing its users with up-to-date information on animal-friendly facilities with available capacity, on users in the vicinity who are willing to participate in animal rescue, furthermore, in enhancing the value of its services by engaging additional animal-friendly facilities and volunteers.

For more information, please contact us at info@allucanpettogether.com

We may process your personal data for the purposes and legal bases indicated below:

We may process and store your personal data as long as necessary for the performance of our services and obligations and strictly for the time necessary to achieve the purposes for which the information was obtained. We will delete your personal data when it is no longer needed.

If we process your personal data based on your consent, we will process and store your personal data until your consent is withdrawn, but in case of marketing communication not longer than two years.

Any personal data relative to any complaint or legal claim will be stored until the statute of limitations under civil laws (i.e., 5 years).

We will retain your data during your contractual with us until the statute of limitations under civil laws (i.e., 5 years). Under Hungarian laws, at least eight years statutory data retention obligation applies to personal data in accounting documents, including contracts, communication and business correspondence. The tax authority shall keep a record of and retain the data obtained by it until the expiry of the right to tax enforcement.

Within the Company our staff with appropriate authorization may have access to your personal data on a “need-to-know” basis. We may engage third parties as data processors to provide services to us and courts, government bodies or other authorities may require us to disclose your data to them.

We may transfer personal data to third parties for the following reason:

• • With certain third parties: The Interface uses the services of Google Maps to visually display your location data via Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google may transfer your personal data to the USA. Google's privacy policy is available at https://policies.google.com/privacy?hl=en;

Service providers: we use externally provided IT-services and systems provided by third party vendors as a support to our internal processes:

• • Payment providers: we use the services of Stripe, Inc. (354 Oyster Point Boulevard, South San Francisco, CA 94080, USA) to facilitate payments on our site. Stripe, Inc acts as an independent data controller.
• • Social media service provider: In connection with the operation of the Company’s Facebook and/or Instagram pages, joint controllership may arise with Meta Platforms Ireland Limited in respect of Page Insights / page analytics data. Meta generates aggregated statistical data from visitors’ and users’ interactions with the Meta page and the content published on it, and makes such data available to the page administrator. The joint controllership covers the processing of Page Insights data; Meta acts as an independent controller for its further processing activities within its own services. Under the joint controllership arrangement, Meta Platforms Ireland Limited and the page administrator have entered into an arrangement allocating their respective obligations under the GDPR; Meta is primarily responsible for providing data subjects with information regarding the processing of Page Insights data and for enabling the exercise of data subject rights.
• • Government authorities and enforcement bodies: government authorities or enforcement bodies such as regulatory authorities, upon their request and only as required by the applicable law or to protect our rights or the safety of our customers, staff, and assets.

Personal data may be provided to parties that are located outside the European Economic Area ("EEA"). In such cases, we will ensure that the personal data is subject to measures (such as Standard Contractual Clauses for data transfers) that provide an equivalent level of protection as provided by data privacy laws in the EU (such as the EU General Data Protection Regulation; GDPR).

By way of entering into appropriate data transfer agreements based on Standard Contractual Clauses (Commission Implementing Decision 914/2021/EU) as referred to in Article 46(2)(c) GDPR or other adequate means, we have established that all other recipients located outside the EEA will provide an adequate level of data protection for the personal data and that appropriate technical and organizational security measures are in place to protect Personal Data against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing.

Please contact us via the e-mail address above if you would like to receive from us the copy of these measures that secure the adequacy of personal data transfers abroad.

You are entitled to exercise your rights below:

• (i) Right of access: You have a right to ask whether or not we have personal data about you and, if that is the case, request information on what personal data we have. We may request additional information from you for identification or for further copies requested by you, we may charge a reasonable fee based on administrative costs.
• (ii) Right to rectification: We are required to rectify inaccurate personal data, or to complete personal data that is incomplete, upon your request.
• (iii) Right to erasure (right to be forgotten): We are in some circumstances required to erase personal data on your request.
• (iv) Right to restriction of processing: We are in some circumstances required to restrict our use of personal data on request by the person concerned. In such cases, we may only use the data for certain limited purposes set out by the law.
• (v) Right to data portability: You may have the right to receive your personal data to which we have access, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another data controller.
• (vi) Right to object: You have the right to object to the processing of your personal data for any reason relating to your situation, and in this case, we may not be able to process your personal information. If you have the right to object and the exercise of this right is justified, your personal data in concern will not be further processed for the purposes of the objection.

You can contact the Hungarian National Data Protection and Freedom of Information Authority (Nemzeti Adatvédelmi és Információszabadság Hatóság – NAIH; seat: H-1055 Budapest, Falk Miksa str. 9-11.; website: www.naih.hu; phone: +36-1-391-1400; email: ugyfelszolgalat@naih.hu).