Privacy Policy — Lueira (instructor app)

This Privacy Policy describes how Maladeta Studio processes the personal data of people using the Lueira app for instructors (hereinafter, the "App"), in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Data controller

• Owner: Maladeta Studio, S.L.
• Trade name: Lueira
• Tax ID: B02697837
• Registered office: Plaça Naua, 1, Planta 2, Módulo 8, 25538 Casau (Lleida), Spain
• Contact email: rgpd@maladetastudio.com
• Website: https://lueira.com

The App is multi-tenant: each sports center or school (the "Center") subscribes to the service and its instructors use the App. Regarding the data of customers/students, the Center acts as data controller and Maladeta Studio as data processor. Regarding the instructor's own data as a user of the App, Maladeta Studio acts as controller with respect to the provision of the service.

2. Scope of application

This policy applies to instructors who use the App in connection with their relationship with a Center. Among other functions, the App enables the recording of working hours ("time tracking"), the management of classes and availability, communication with customers, and the creation of feedback on students.

3. Personal data we process

a) Instructor identification and contact data

Name, surname, email address, phone number, national ID/tax ID, postal address (and additional address details), postal code, city, country, languages, activities/specialties and profile photo.

b) Authentication data

Email address and a one-time access code (OTP) sent by email, as well as the session token (JWT), which is stored encrypted on the device.

c) Work activity data (time tracking)

Working-hours records (clock-in/clock-out), breaks and rest periods, monthly summaries, contract and availability data, as well as requests to amend such records.

d) Customer and student data accessible to the instructor

In performing their role, the instructor accesses data of customers and their family/students provided by the Center: name, surname, email, phone, language, level, comments, date of birth, and the feedback, badges and content the instructor generates about them. Since this data may relate to minors, see section 10.

e) Multimedia content

Photos and videos captured with the camera or selected from the device's gallery to attach to feedback or associated documentation.

f) Technical, device and diagnostic data

Push notification identifier (FCM token), device and operating system identifiers, and diagnostic and stability data (crash/error reports, performance metrics and session replay recordings with screenshots) generated by our diagnostic tools. Due to the configuration of such tools, these captures and recordings may include personal data displayed on screen.

4. Purposes of processing

• To provide and maintain the App service and its features.
• To manage working-hours records (time tracking) and associated employment information.
• To send push notifications related to the service.
• To enable communication with customers (e.g. through phone, SMS or WhatsApp links).
• To manage feedback and badges on students.
• To ensure security, prevent fraud, and diagnose and fix errors to improve the App.
• To manage feature activation (feature flags) and check the minimum required App version.

5. Legal basis for processing

• Performance of a contract or of the service/employment relationship linking the instructor with the Center and/or with Maladeta Studio (art. 6.1.b GDPR): provision of the App service.
• Compliance with a legal obligation (art. 6.1.c GDPR): time tracking meets the obligation set out in art. 34.9 of the Workers' Statute (as amended by Royal Decree-Law 8/2019).
• Legitimate interest (art. 6.1.f GDPR): App security, fraud prevention, and diagnosis/improvement of the service.
• Consent (art. 6.1.a GDPR): access to camera and photo gallery, sending push notifications and, where applicable, analytics and session recordings. Consent may be withdrawn at any time (see section 9), without affecting the lawfulness of prior processing.

6. Recipients and data processors

To provide the service, we rely on providers who act as data processors and who only process data in accordance with our instructions:

Data may also be disclosed to competent authorities where there is a legal obligation to do so.

7. International data transfers

Some of the providers listed above (for example, Sentry, and depending on the region, AWS or Mux) may process data outside the European Economic Area, including the United States. In such cases, these transfers are covered by the appropriate safeguards provided for in the GDPR, such as the European Commission's Standard Contractual Clauses or, where applicable, adequacy decisions (EU-U.S. Data Privacy Framework).

8. Retention period

We will retain personal data for as long as necessary to fulfil the purposes described and, thereafter, for the legally required periods. In particular, working-hours records must be retained for a minimum of four years under Spanish labor regulations.

Once the applicable periods have elapsed, the data will be deleted or anonymized.

9. Rights of data subjects

You may exercise the following rights: access, rectification, erasure, objection, restriction of processing and portability of your data, as well as withdrawing any consent given.

To exercise these rights, write to rgpd@maladetastudio.com, indicating the right you wish to exercise and, if necessary, attaching a document proving your identity.

You also have the right to file a complaint with the competent supervisory authority, the Spanish Data Protection Agency (AEPD), www.aepd.es, if you consider that the processing does not comply with applicable regulations.

10. Minors

The App may process data of students who are minors (including their date of birth), provided by the Center. The instructor accesses this data solely in connection with their role. The legal basis and, where applicable, obtaining the consent of parents or legal guardians is the responsibility of the Center as the controller of such data.

11. Security

We apply appropriate technical and organizational measures to protect personal data, including encryption in transit (HTTPS/TLS) of communications with our servers and encrypted on-device storage of session credentials (Keychain on iOS and encrypted storage on Android).

12. Device permissions

The App may request the following permissions, which you can grant or revoke in your device settings:

• Camera and photos: to capture or select images and videos attached to feedback and documentation.
• Notifications: to send push notifications related to the service.

13. Changes to this policy

We may update this Privacy Policy to reflect legal changes or changes in how the App works. We will publish the updated version at https://lueira.com/en/legal/app-privacy/ and indicate the date of the last update. We recommend reviewing it periodically.

14. Contact

For any query related to this Privacy Policy or the processing of your personal data, you may contact us at rgpd@maladetastudio.com.

15. Restrictions on the public API, MCP and similar functionality

This Privacy Policy governs the processing of personal data of App users and does not grant any right to use the Lueira platform beyond what is described herein. In particular, access to LUEIRA's public API, its MCP (Model Context Protocol) server, or any other functionality does not authorize replicating, cloning, recreating or developing products or services substantially similar to LUEIRA or to its functionality, whether past, present or future, as set out in section 12 of the Terms and Conditions.