Rufio App Privacy Policy

Last modified: 04/10/2026

This Privacy Policy describes how we will collect, use, share and otherwise process your personal data in connection with your use of:

• the Rufio mobile application (our "App"); and
• any of our services that are accessible through the App ("Services").

Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

Important information and who we are

Rufio App S.L. is the controller and is responsible for your personal data ("Rufio", "we", "us" or "our" in this Privacy Policy).

If you have any questions about this Privacy Policy, please contact us using the details set out below:

• Rufio App S.L.
• Name: Kendall Uggla
• CIF: B22703466
• Registered office: Madrid, Spain
• Email: woof@rufioapp.com

You also have the right to make a complaint at any time to the Information Commissioner's Office ("ICO"), the UK regulator for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance at woof@rufioapp.com or via our dedicated support page at https://rufioapp.com/support.

Changes to the Privacy Policy and your duty to inform us of changes

We keep our Privacy Policy under regular review.

This version was last updated on 04/10/2026. It may change and, if it does, those changes will be posted on this page and notified to you via email and/or a pop-up notification when you next start the App or log onto your account. The new policy may be displayed on-screen and you may be required to read and acknowledge the changes to continue your use of the App or the Services.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you. To update your details, please navigate to the 'My Profile' section in the App, or alternatively, you can contact us at woof@rufioapp.com providing details your required information changes.

Third party links and sites

Our App and Services may, from time to time, contain links to and from the websites of third parties. Please note that these websites (and any services accessible through them) are controlled by those third parties and are not covered by this Privacy Policy. You should review their own privacy policies to understand how they use your personal data before you submit any personal data to these websites or use these services.

The data we collect about you

We collect, use, store and transfer different kinds of personal data about you. To make it easier for you to use this Privacy Policy, we group these into the following categories. Each of these categories is described in more detail below under the heading: Description of categories of personal data.

• Identity Data.
• Contact Data.
• Profile Data.
• Pet-Related Data.
• Device Data.
• Usage Data.
• Location Data.
• Personalisation Data.
• Security Data.

We do not intentionally collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data).

We may collect data relating to criminal offences if necessary to secure and protect our App and users. Further details can be found under the heading: Criminal offence data and special category data.

Description of categories of personal data

• Identity Data: first name, last name, date of birth and Profile Data.
• Contact Data: first name, last name, country of residence, email address, your communication preferences and copies of the communications between you and us.
• Profile Data: your email address, username and encrypted password.
• Pet-Related Data: pet name, breed, age, sex, characteristics, routine plans (meals, medication reminders, walks, supplements), pet location (country and city), pet insurance information (if provided), mood logs, symptom logs, physical activity records and custom notes.
• Device Data: the type of device you use, your mobile operating system, IP address, and time zone setting.
• Usage Data: logs and detail of your use of our Apps and Services, being the dates and times on which you download, access and update the App and our Services, any error or debugging information, performance data and the resources that you access and the actions we and you take in relation to them.
• Location Data: your current location as disclosed by GPS technology WiFi connections, and your IP address for the time period where you have permitted us to collect it.
• Personalisation Data: Device Data, Content Data, Usage Data, Location Data, and the preferences we have inferred you have and use to personalise the App and Services, being the preferences noted in your device or browser settings or via the settings located in the sidebar section in the App.
• Security Data: information we collect about your use of the App, our Services and our Sites in order to ensure your and our other users' safety and security, being Usage Data.
• Content Data: information that you store or generate in the App, being photos, videos and associated metadata, check-ins, posts and messages.
• Direct Marketing Data: your direct marketing preferences, consents for receiving direct marketing from us and the history of the direct marketing communications we have sent to you.
• Feedback Data: your feedback and survey responses.
• Competition Data: information about the competitions you enter with us, being your competition history, the applicable terms and conditions, associated third parties and any additional privacy notices.

How is your personal data collected?

We collect your personal data in the following way:

• Registration. We collect your Identity Data and Contact Data when you register your account with us and it is necessary for you to access the App.
• Communications. When you communicate with us via email at woof@rufioapp.com or via one of our online forms at https://rufioapp.com/support, we collect your Contact Data. [If you contact us through the App using the chat function, we also collect Device to operate our chat function and respond to your messages.] If the communication relates to an error or problem you are having with the App or one of our Services, we will also collect Usage Data for diagnosis and improvement.
• Information you generate when using our App and Services. Each time you access and use our App and Services we collect Content, Device, Personalisation and Usage Data. We collect Content Data where you upload it to the App or interact with the content available on the App. We collect Device, Personalisation and Usage Data through internal logic when interact with the App.
• Information we collect through monitoring the use of our App and Services. Each time you access and use our App and Services we collect information about that access and use, being Device, Content, and Usage Data.
• Additional information we otherwise collect through our App and Services where we have your consent to do so. Where you provide your consent, we collect your Location Data on an ongoing basis while you have the App installed on your device.
• Information that you provide in the App. Where you voluntarily enter information about your pets in the App, we collect your Pet-Related Data.
• Children's Data. The App is rated ages 4+ in app stores. The App may be accessed by minors. Where required by applicable law, parental or guardian consent is required before personal data is processed. We do not knowingly collect personal data from children without appropriate legal basis. If a parent or guardian believes that a child has provided personal data without proper consent, they may contact us at: woof@rufioapp.com and we will take appropriate action, including deletion of the data where applicable.
• Direct Marketing. We collect and record Direct Marketing Data when we add you to our marketing database, you request to change your direct marketing preferences, or you interact with our direct marketing communications.
• Information we receive from third parties. We may receive personal data about you from the third parties set out below:
  • Device Data and Usage Data from cloud infrastructure and server providers, being Amazon Web Services, based in Sweden.

How we use your personal data

We will only use your personal data when we have a lawful basis to do so. Our lawful basis for each purpose for which we use your personal data is specified in the table below. Most commonly we will use your personal data in the following circumstances:

• Consent. Where you have freely consented before the processing in a specific, informed and unambiguous indication of what you want. You can withdraw your consent at any time (see Your legal rights below).
• Performance of a contract. Where we need to process your personal data to perform a contract with you or where you ask us to take steps before we enter into a contract with you. Where we rely on performance of a contract and you do not provide the necessary information, we will be unable to perform your contract.
• Legitimate interests. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
• Legal obligation. Where we need to use your personal data to comply with a legal or regulatory obligation. Where we rely on legal obligation and you do not provide the necessary information, we may be unable to fulfil a right you have or comply with our obligations to you, or we may need to take additional steps, such as informing law enforcement or a public authority or applying for a court order.

1.1. Delivery and improvement of our App and purchases

1.2. Account management and profiling

1.3. Direct marketing

1.4. Troubleshooting, improvement and security

1.5. Rights and obligations

1.6. Personalisation

1.7. Other communications

1.8. Personal data sharing

1.9. Business contacts

Criminal offence data and special category data

We do not intentionally collect criminal offence data about you. However, we may process data relating to criminal offences in monitoring the use of our App for security purposes, where we suspect you may have committed a crime, such as attempting to make a fraudulent purchase or claim or circumvent the security of the App or Services. In such circumstances we will provide that information to law enforcement and/or use it to establish, exercise or defend a legal claim. In those circumstances, according to the type of activity and purpose, we will rely on legitimate interests (protecting our business, employees and other users) and legal obligation (where required by legal, judicial or law enforcement to disclose or process that information). UK law authorises that processing under the Data Protection Act 2018 and although the appropriate authorisation will depend on a case-by-case basis, monitoring for criminal behaviour through the use of our App is in the Substantial public interest (preventing or detecting unlawful acts) and processing information related to suspected criminal activity for legal claims is permitted under the additional condition of legal claims.

Disclosures of your personal data

We may share your personal data with the following third parties:

• Your Appstore Provider and mobile network operator to allow you to install the App.
• Marketing and promotional partners and co-operatives acting as processors joint controllers with whom we share data to enhance our offerings and identify prospective customers.
• Third parties listed in the table above.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Policy.
• HM Revenue and Customs, regulators, law enforcement, public authorities or other third parties based in the UK where necessary to exercise our rights or comply with a legal obligation.

International transfers

We do not transfer your personal data outside the EEA.

Where we transfer your personal data between the UK and the EEA those transfers are made pursuant to the UK government's adequacy decision in favour of countries in the EEA and the European Commission's adequacy decision in favour of the UK.

Please contact Kendall Uggla using the contact details above if you want further information on the specific mechanism used by us when transferring your personal data outside of the UK.

Data security

All information you provide to us is stored on our secure servers located within in the EEA. All personal data transmitted via the App is encrypted using SSL / TLS protocols. Where we have given you (or where you have chosen) a password that enables you to access certain parts of our App or Services, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Once we have received your information, we will use strict procedures and security features to protect your personal data from loss, unauthorised use or access.

We have put in place procedures to detect and respond to personal data breaches and notify you and any applicable regulator when we are legally required to do so.

Data retention

In some circumstances you can ask us to delete your data, see the heading: Your legal rights below for further information.

Once we no longer have a legal right to hold your personal data, we will delete or, in some circumstances, we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

If you do not use the App or log into your user account for a period of 24 months, then we will treat the account as expired and will delete or anonymise your personal data, unless we are otherwise required to retain your personal data in accordance with applicable legal, regulatory, tax, accounting or other requirements.

Your legal rights

You have the following rights under data protection laws in relation to your personal data.

• Access. Request access to and/or a copy of the personal data we process about you (commonly known as a data subject access request). This enables you to check that we are lawfully processing it.

• Correction. Request correction of any incomplete or inaccurate data we hold about you. (We may need to verify the accuracy of the new data you provide to us.)

• Deletion. Request us to delete or remove personal data where there is no good reason for us continuing to process it. You also can ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we have processed your information unlawfully or where we need to erase your personal data to comply with law. (In some cases, we may need to continue to retain some of your personal data where required by law. If these apply, we will notify you at the time of our response.)

• Objection. Object to us processing your personal data where (a) we are relying on legitimate interests as the lawful basis and you feel the processing impacts on your fundamental rights and freedoms, or (b) the processing is for direct marketing purposes. In some cases, we may refuse your objection if we can demonstrate that we have compelling legitimate grounds to continue processing your information which override your rights and freedoms.

• Restriction. Request that we restrict or suspend our processing of your personal data:

  • if you want us to establish the data's accuracy;
  • where our use of the data is unlawful, but you do not want us to erase it;
  • where we no longer require it, but you need us to hold onto it to establish, exercise or defend legal claims; or
  • you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

• Data portability. Request we transfer certain of your personal data to you or your chosen third party in a structured, commonly used, machine-readable format. This right only applies to information processed by automated means that we process on the lawful bases of consent or performance of a contract.

• Withdraw consent. Withdraw your consent at any time where we are relying on consent to process your personal data. Please know that this does not affect the lawfulness of any processing carried out before you withdraw your consent, and after withdrawal, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

You can exercise any of these rights at any time by contacting us at woof@rufioapp.com.

You can also use the app's settings feature in your device's settings (iOS/Android) to manage your location preferences and to give or withdraw your consent to or disable our processing of your Location Data.