Privacy Policy

1. Introduction

This Privacy Policy outlines the procedure for processing personal data through the Intuitivo platform, facilitating the purchase of products from the Autonomous Points Of Purchase (“A-POP”) situated in the stores of Intuitivo Tech LLC. Intuitivo will collect data on behalf and in the representation of Intuitivo Tech LLC, also known as the Data Controller. This Privacy Policy is subject to changes and updates. You must review the Privacy Policy to ensure that you are familiar with its contents. If Data Controller makes changes, Data Controller will notify you by changing the date at the top of this Privacy Policy. Data Controller may also provide you with additional notice.

2. Who is the Data Controller?

Intuitivo Tech LLC, EIN 86-2149065 and registered office at 888 Biscayne Blvd, Suite 505, Miami, FL, 33132 is the Data Controller for the personal data collected through the Intuitivo web application accessible via any of the following links https://app.prod.intuitivo.com/qr/ https://a-pop.prod.intuitivo.com/qr/ https://a-pop.intuitivo.com/qr/, hereinafter called the Web Application.

This Privacy Policy governs the collection and processing of personal data provided by the Users who access, browse, or use any features of the Data Controller’s Web Application or platform.

3. What kind of data do we process and how do we obtain it?

We process the following personal data obtained in various instances.

Information You Provide to Data Controller: When you sign up as a User in the Web Application or platform, you provide certain information directly to Data Controller. More specifically, the types of personal information you may provide to Data Controller include:

• Biometrical Information (e.g. fingerprint identification and facial recognition)
• Identifying Information (e.g. name/s, last name/s, date of birth, telephone, email, address)
• Transaction Information (e.g. purchase records and information about items you purchase)
• Limited financial information (e.g. payment information in connection with your purchases and details of your payments means)
• Any other information you chose to provide.

IMPORTANT: As part of the fingerprint identification, we will obtain information about the your device model as well as its brand, and the browser it is using to register. This will be associated with a unique ID for future purchases. This information will be used solely for transactional purposes and to prevent any type of fraud or unauthorized use in our system. Biometrical Information, means those personal data obtained from specific technical processing, relating to the physical, physiological or behavioral characteristics of a human person, which allow or confirm their unique identification. Biometric information that identifies a person will be considered sensitive data only when it can reveal additional data whose use could potentially be discriminatory for its owner (e.g. data that reveals ethnic origin or information regarding health). You know and expressly accept - without reservations - that, in order for you to be able to purchase a product through an A-POP and be granted with access to the Payment Platform, as applicable, we will request that you provide certain personal information that will include identifying information, which may contain Biometrical Information. Such Biometrical Information will be treated as established in this Policy and in the Personal Data Protection Law.

While you are not obliged to provide us with your personal information, please note that your refusal to do so or any inaccuracies or falsification of personal data may prevent you from purchasing the selected product.

This data is collected to identify you as a User of the Data Controller platform and facilitate your purchase.

Information Data Controller Collects Automatically: Data Controller automatically collects certain information about your interactions with the A-POPs, including:

• Product Selection: Once you are registered in the platform, and tap the open-door button, the cameras will start recording and the A-POP’s door will unlock. You can open the A-POP and the cameras within it will capture your movements to identify the chosen product(s).
• Transactional Information: When you make a purchase or return, Data Controller collects information about the transaction, such as product details, purchase price and the date and location of the transaction
• Preference Information: Data Controller collects information about your language and currency preferences
• Cookies: With your consent, we use cookies to collect data that allow us to obtain statistical information about the use of our website and enhance the service. Cookies are small data files used or stored in your device when you visit the Web Application. These files store and retrieve specific information that helps to improve your user experience. If you expressly accept the use of cookies, we will use analytical cookies to collect the following information:
  • Your identification as an Application User
  • Your User Registration
  • Your behaviour and interaction as a User with the Web Application.
  • The characteristics of your device.

Data Controller uses the information it collects in different ways through its Web Application, and for the following purposes:

• Verify your identity and identify you as an Application User.
• Provide, maintain, improve, and develop new products and services, including to debug and repair errors in Web Application and platform.
• Detect, prevent, and address fraud, violations of Data Controller terms or policies, and/or other harmful or unlawful activity against the rights of Data Controller and others.
• Manage and assure the integrity of the transactions.
• Send you technical notices, security alerts, support messages and other transactional or relationship messages.
• Communicate with you about products, services, and events offered by Data Controller and others and provide news and information that Data Controller thinks will interest you.
• Monitor and analyze trends, usage, and activities in connection with Data Controller products and services.
• Comply with Data Controller legal and financial obligations.
• Fulfil any action or purpose for which you consent or provide Data Controller direction.

4. What is the legal basis for processing data?

We process your personal data in compliance with applicable legal standards to fulfill the following purposes:

5. How long will we retain your data?

Your personal data will be retained for as long as your profile remains active on the Web Application, and you do not withdraw your consent for the data processing or exercise your right to deletion or your right to object. The data will be kept for a term of (5) five years if there is legal basis for doing so.

6. Who do we share your data with?

As a general practice, we do not share, sell, or offer your data to third parties. However, for the efficient delivery of services through the Web Application, external service providers may access your personal data in their role as Data Processors. They will have control over this information only to the extent that is strictly necessary for delivering the contracted services. These external providers act as our representatives.

Additionally, Data Controller shares personal information in the following circumstances or as otherwise described in this Privacy Policy:

• Data Controller shares personal information with suppliers that access personal information to perform work for Data Controller (including, but not limited to, Stripe, Heartland and Apriva as electronic payment service providers), such as companies and organizations that assist Data Controller with web hosting, payment gateways, provide technical infrastructure services, and host any experiences that may be associated with a transaction.
• Data Controller shares personal information with sellers, and service providers to enable transactions and to validate and complete purchases.
• Data Controller may disclose personal information if Data Controller believes that disclosure is in accordance with, or required by, any applicable law or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements.
• Data Controller may share personal information (including with sellers and service providers) if Data Controller believes that your actions are inconsistent with our user agreements or policies, if Data Controller believes that you have violated the law, or if Data Controller believes it is necessary to protect the rights, property, and safety of Data Controller, the users, the public, or others.
• Data Controller shares personal information with Data Controller lawyers and other professional advisors where necessary to obtain advice or otherwise protect and manage Data Controller business interests.
• Data Controller may share personal information in connection with, or during negotiations concerning, any merger, sale of Data Controller assets, financing round, or acquisition of all or a portion of Data Controller business by another company.
• Personal information is shared between and among Data Controller and current and future parent entities, affiliates, and subsidiaries and other companies under common control and ownership.
• Data Controller shares personal information with your consent or at your direction.
• Data Controller also shares aggregated or de-identified information that cannot reasonably be used to identify you.

Service providers have agreed with Data Controller to use personal data exclusively for the agreed purposes. We rigorously ensure that our providers and their subcontracted entities maintain the same high standards of protection, security, and confidentiality for personal data as we do.

7. International transfers

Data Controller is headquartered in the United States and has operations and suppliers in other countries. Therefore, Data Controller and those that perform work for Data Controller may transfer your personal information to, or store or access it in, jurisdictions that may not provide levels of data protection that are equivalent to those of your home jurisdiction. Where required by law, Data Controller provides adequate protection for the transfer of personal data in accordance with applicable law, such as by obtaining your consent, relying on the European Commission’s adequacy decisions, or executing Standard Contractual Clauses. Where relevant, you may request a copy of these Standard Contractual Clauses by contacting the Data Controller at [email protected]

8. What are your rights?

As the Data Subject, you have the following rights:

• a) Right of access: It refers to your right to obtain confirmation from us about whether or not your personal data is being processed, and, if so, to access all that information.
• b) Right to update/rectify: You can request the correction or amendment of inaccurate or outdated information that we hold about you.
• c) Right to Erasure or Right to be Forgotten: You may request the removal of your personal information under these circumstances: (i) Your personal data is no longer necessary for the purposes for which it was collected or processed; (ii) you withdraw your consent to the consented personal data processing provided there is no legal reason preventing deletion; (iii) in case of objection to the processing; (iv) if the personal data has been processed unlawfully; (v) if the deletion is required to fulfill a legal obligation; or (vi) if the personal data was obtained in connection with the offer of information society services to minors as set in the GDPR.
• d) Deactivate your account: you have the right to do so at any time. However, please note that Data Controller may retain certain information for legal reasons.

Depending on the applicable law, Data Controller may refuse a request for different reasons, including, for example, that the request may threaten public safety, the rights and freedoms of other users or third parties, etc.

9. How can you exercise your rights before the Data Controller?

To exercise any of the above rights, please send an email to Data Controller at [email protected] , specifying the right(s) you wish to exercise, the reason, and, if applicable, provide details of the relevant personal information.

If confirming identity becomes challenging, we may request supporting documentation to facilitate the verification process.

We will respond to your request within one month of its receipt. However, in specific situations, particularly when managing complex or numerous requests, we reserve the right to extend this timeframe by an additional two months. In either case, the extension and the reasons for the delay will be notified to you.

10. Contact Us

If you have any questions about this Privacy Policy, please contact Data Controller at [email protected]