Legal

PRIVACY POLICY

How metzzo may collect, use, and protect personal information.

Last updated: September 17, 2026

This Privacy Policy explains how metzzo processes the personal data of people who access or use its website, applications and other digital services (collectively, the “Platform”). metzzo is a technological platform aimed at the Spanish market that facilitates the creation, search, organization of and participation in activities related exclusively to Kitesurf, Kitefoil, Wingfoil, Parawing and SUP Foil.

This Policy must be read together with metzzo's Terms and Conditions and Legal Notice. Data will be processed in accordance with Regulation (EU) 2016/679 (“GDPR”), Organic Law 3/2018 of December 5 (“LOPDGDD”) and other applicable law.

1. DATA CONTROLLER

Controller: Metzzo LLC, a Limited Liability Company (LLC), incorporated in Texas, United States of America, and registered with the Texas Secretary of State under State ID 0805309688.

Postal address: see the Legal Notice.

Contact for privacy and exercise of rights: support@metzzo.com.

metzzo's representative in the European Union (Article 27 GDPR): CLÀUDIA TERNS TORRENS. Spain. Contact email: support@metzzo.com.

metzzo will be the controller of processing for which it determines the purposes and means. Its incorporation or domicile in the United States does not limit Users' rights in Spain under applicable European and Spanish law.

The representative in the European Union provided for in Article 27 of the GDPR and the Data Protection Officer (DPO) provided for in Article 37 of the GDPR are separate roles with different obligations. Based on the characteristics and processing activities currently described for metzzo, no circumstances requiring the appointment of a DPO have been identified at present. This conclusion must be reviewed if the nature, scope, scale or purposes of processing change and, in particular, if metzzo's core activities come to involve regular and systematic monitoring of data subjects on a large scale, large-scale processing of special categories of data or any other circumstance requiring appointment under the GDPR or applicable Spanish law. metzzo may also appoint a DPO voluntarily.

2. PEOPLE TO WHOM THIS POLICY APPLIES

This Policy applies to Riders, Professional Users, website visitors and other people who contact or interact with metzzo. On the Platform, a Rider is a Consumer User who uses metzzo to search for, create, book or participate in activities. A Professional User uses the Platform professionally to offer or provide their own services.

Riders may have an account from the age of fourteen (14), subject to the specific measures for minors set out in this Policy. To register, undergo verification or act as a Professional User, a person must have reached sixteen (16) years of age and meet the applicable requirements.

3. DATA WE PROCESS AND WHETHER IT IS REQUIRED OR OPTIONAL

3.1. Registration, identification and profile

  • Name and identification details necessary to create the account: required when the Platform requests them as necessary.

  • Email address or information necessary for the chosen authentication method: required to create and protect the account.

  • Date of birth: required to verify age and apply the corresponding measures or features. It is not displayed publicly.

  • Profile photograph: optional, unless a particular feature states otherwise.

  • Sports practiced and declared level for each sport: necessary for features that depend on that information.

  • Privacy preferences and other account settings: configurable by the User within the available options.

3.2. Authentication

metzzo maintains its own session system. Sign-in may be initiated by email or through Google or Apple when the User chooses those methods. With third-party authentication, metzzo receives the data necessary to identify or link the account according to the provider's settings and permissions. metzzo does not receive the password for the Google or Apple account.

3.3. Activities, bookings and participation

  • Activities created or joined by the User; sport; activity type; date and time; location or meeting point; capacity; required level for each selected sport; participation status; and organizer or participant status.

  • Requests, confirmations, changes, cancellations and cancellation reason where applicable.

  • Additional notes entered by the organizer, for example about conditions, equipment, recommendations or the meeting point.

  • Price displayed for professional activities where applicable. metzzo does not process, receive, hold or manage payments between Riders and Professional Users.

3.4. Location and maps

When the User grants the application location permission, metzzo may process the location needed to show a relevant position on the map, find or display nearby activities, select a meeting point or facilitate activity organization. Permission may be revoked in the device settings.

The device's location is distinct from the location associated with an activity. A spot, meeting point or location chosen for an activity may be retained as part of that activity's data even when metzzo is not accessing the device's location at that time.

metzzo currently uses Apple Maps and OpenStreetMap for mapping features. These services may receive technical data and, depending on the feature used and permissions granted, information related to map or location requests. metzzo does not currently continuously track the User's sporting routes.

3.5. Professional User data

  • Professional profile data and declared sports or specialties.

  • Certifications, qualifications, licenses, accreditations or other documents submitted for professional verification.

  • Insurance documentation submitted for verification.

  • Information about professional activities, displayed prices, participation and ratings.

metzzo's verification is documentary. Documents are used to manage verified Professional status and check the documentation submitted; verification does not constitute a recommendation, a guarantee of competence or supervision of the professional activity.

3.6. Chat, support and communications

metzzo may process the content of activity chats and messages, questions, incidents, support requests, complaints or other communications sent through the available channels. Chat is enabled according to each activity's features and allows coordination between the people authorized to participate in it.

3.7. Reviews and reputation

metzzo may process reviews, ratings, responses, the activity to which they relate and the information necessary to determine whether a person may rate another User or organizer under the Platform's rules and applicable law.

3.8. Technical and security data

metzzo may process IP addresses, technical identifiers, device, operating system, browser, access logs, connection date and time, security events and other technical data necessary to provide, protect and maintain the Platform, prevent abuse and diagnose incidents.

3.9. Analytics and payment data

metzzo does not currently use Firebase Analytics, Amplitude or any other third-party product analytics tool. If a tool involving new processing of personal data is introduced, this Policy will be updated and consent obtained where legally necessary. metzzo also does not process bank card data or payments between Riders and Professional Users.

4. PURPOSES, LEGAL BASIS AND RETENTION

4.1. Account and authentication

Purpose: to create and administer the account, authenticate the User, maintain the profile, apply privacy settings and determine features according to age. Data: identification, email, date of birth, authentication data and settings. Legal basis: performance of the Terms and Conditions and, where applicable, consent. Retention: while the account is active and subsequently for the periods necessary to meet obligations or address liabilities.

4.2. Provision of metzzo's features

Purpose: to enable the creation, search, organization, booking of and participation in activities; manage requests and confirmations; display information necessary for participants; use maps and location; manage cancellations and facilitate interaction between Riders and Professionals. Data: profile, activities, participation, location where authorized and functional data. Legal basis: performance of the contract. Retention: during provision of the service and subsequently for the periods necessary to maintain the integrity of historical records and address liabilities.

4.3. Professional verification

Purpose: to review certifications, accreditations and insurance, manage verification status and protect features reserved for Professionals. Data: professional profile and documentation submitted. Legal basis: performance of the contract with the Professional and legitimate interest in protecting the integrity and safety of the Platform, without prejudice to applicable legal obligations. Retention: for as long as necessary to maintain or review verification and for additional periods strictly necessary to meet obligations or address claims.

4.4. Chat and operational communications

Purpose: to coordinate activities and send confirmations, notices, changes, cancellations and messages concerning access, security, support and incidents. Data: messages, User identifiers and activity data. Legal basis: performance of the contract and, for certain security communications, legitimate interest. Retention: for the time necessary to provide the feature and manage incidents, security or disputes.

4.5. Security, fraud and abuse prevention

Purpose: to detect unauthorized access, false profiles, impersonation, fraud, manipulation, breaches of the rules of use and security incidents; protect Users and respond to valid requests from authorities. Data: account, activity, communications where necessary and proportionate, and technical data. Legal basis: metzzo's legitimate interest in protecting the Platform and its Users, and compliance with legal obligations. Retention: for periods proportionate to the purpose and, where there is an incident, for the time necessary to investigate it and defend against claims.

4.6. Reviews, cancellations and trust

Purpose: to manage ratings, determine eligibility to review, allow responses where appropriate, apply cancellation rules and detect patterns of abusive use. Data: identity, participation, cancellations, reviews and responses. Legal basis: performance of the Terms and Conditions and legitimate interest in maintaining the community's reliability and safety. Retention: for the time necessary to maintain the feature and subsequently to address claims or liabilities.

4.7. Support, complaints and legal defense

Purpose: to answer questions, manage incidents and complaints, resolve disputes and establish, exercise or defend claims. Data: identification, contact and the content of the request, together with related data that are necessary. Legal basis: performance of the contract, compliance with legal obligations and legitimate interest in managing and defending rights. Retention: during handling of the matter and subsequently for the applicable liability periods.

4.8. Commercial communications

metzzo will send promotional communications only where there is a valid legal basis. Where consent is necessary, it will be requested separately and may be withdrawn at any time. Communications strictly necessary to use metzzo are not commercial communications.

4.9. Service improvement

metzzo may use aggregated or anonymized information to understand the Platform's general operation and improve it. Data that have been effectively anonymized cease to be personal data. Any future third-party analytics tool will be assessed and incorporated into this Policy before use where it involves processing personal data.

5. VISIBILITY AND DISCLOSURE OF DATA TO OTHER USERS

The information visible depends on privacy settings, participation in activities and the feature used. With a public profile, other Users may access the profile information that metzzo identifies as visible and, where appropriate, information associated with activities and reviews.

With a private profile, the User will not appear in searches and their full profile will not be displayed in activities under the conditions defined by metzzo. Their name may be displayed where necessary to identify them as a participant or organizer. A private setting does not make the account anonymous.

When a person creates, requests to join or participates in an activity, the data necessary to organize it may be shown to the organizer, participants and, where applicable, the Professional User. Chat content will be accessible to the people authorized for that chat.

The accounts of Users under eighteen (18), including underage Professional Users, will be subject to enhanced privacy and security measures under section 12.

6. RECIPIENTS AND PROVIDERS

metzzo does not sell its Users' personal data. It may allow access to data by providers needed to operate the Platform, acting as processors or, where appropriate given the nature of the service, as independent controllers.

  • Cloudflare: technological infrastructure, hosting, databases and file storage, including User images and professional documentation.

  • Mailgun: sending emails and supporting the email authentication flow.

  • Google: authentication when the User chooses to sign in with Google.

  • Apple: authentication with Apple, Apple Push Notification Service (APNs) for push notifications when used, and Apple Maps for certain mapping features.

  • OpenStreetMap and the technical providers involved in delivering its mapping data: maps currently used by metzzo.

  • Authorities, courts, law enforcement bodies or competent agencies where there is a legal obligation or valid request.

  • Professional advisers, auditors or security providers where their involvement is necessary and there is an appropriate legal basis.

metzzo will limit access or disclosure to the data necessary for the relevant purpose. Where a provider acts as a processor, metzzo will establish the required contractual safeguards. Where it acts as an independent controller, its own processing will also be governed by the privacy information provided by that provider.

7. INTERNATIONAL TRANSFERS

metzzo is an entity established in Texas, United States, and some providers belong to international groups. Consequently, certain data may be processed from countries outside the European Economic Area.

Where an international transfer is subject to the GDPR, metzzo will use a mechanism recognized by applicable law, such as a European Commission adequacy decision - including the EU-US Data Privacy Framework where applicable to the recipient - Standard Contractual Clauses or other valid safeguards, together with any appropriate supplementary measures.

The fact that metzzo is a US company does not in itself mean that all data are necessarily stored in the United States. The actual location and legal mechanism will depend on the real configuration of the infrastructure and each provider.

8. DATA RETENTION AND DELETION

metzzo will apply the storage limitation principle and retain data only for as long as necessary for the stated purposes and subsequently for the periods required or permitted to meet obligations and address liabilities.

When processing is no longer necessary, data will be deleted, anonymized or, where appropriate, blocked so that they remain available only to address legally enforceable liabilities.

The User may delete their account directly through the features enabled in the metzzo application. Account deletion will result in the erasure or anonymization of personal data that are no longer necessary, without prejudice to data that metzzo must retain in blocked or restricted form because of a legal obligation, for security reasons, to prevent fraud or abuse, or to establish, exercise or defend claims.

Account deletion is distinct from withdrawing a device permission or changing profile visibility. The User may also request erasure of their data through support@metzzo.com where applicable.

9. USERS' RIGHTS

Data subjects may, where applicable, exercise their rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent at any time for processing based on consent.

Requests may be sent to support@metzzo.com, indicating the right to be exercised and the information necessary to identify the account. metzzo may request reasonable additional information where necessary to verify identity, while seeking not to collect more data than necessary.

The User may manage certain options from their account and withdraw location or notification permissions in their device settings. Withdrawing permissions may prevent features that depend on them from functioning.

If a person considers that the processing of their data infringes the law, they may lodge a complaint with the Spanish Data Protection Agency (AEPD), without prejudice to any other remedy available to them.

10. AUTOMATED DECISIONS AND MODERATION

metzzo does not currently make decisions producing legal effects concerning the User, or similarly significantly affecting them, based solely on automated processing within the meaning of Article 22 of the GDPR.

metzzo also does not claim to currently use artificial intelligence systems to make moderation decisions about Users automatically. It may use ordinary technical tools for security, abuse prevention and service operation. If automated systems involving significant new processing are introduced in the future, metzzo will update this Policy and provide the information required by applicable law.

11. SECURITY

metzzo adopts technical and organizational measures appropriate to the risk to protect data against destruction, loss, alteration, unauthorized disclosure or access. Measures may include access controls, secure session management, communications encryption, infrastructure security measures, segregation of permissions and incident management procedures, in accordance with the architecture actually deployed.

No transmission or storage system can guarantee absolute security. metzzo will review and adapt its measures taking into account the nature of the data, the state of the art, implementation costs and risks to individuals' rights and freedoms.

12. MINORS

metzzo allows people who have reached fourteen (14) years of age to create Rider accounts. People under fourteen (14) may not create or use their own metzzo account.

Riders aged fourteen (14) to seventeen (17) may use the Platform with the restrictions and protective measures established for minors. In Spain, where processing is based on a minor's consent, those over fourteen years of age may generally give it themselves, except where a legal rule requires the assistance of those exercising parental responsibility or guardianship.

The ability to consent to certain data processing does not amount to recognition of unlimited capacity to enter into any contract or assume any obligation. Where an activity, service or transaction legally requires the involvement, assistance or authorization of parents, guardians or legal representatives, it must be obtained in accordance with applicable law.

Users who have reached sixteen (16) may register, undergo verification and act as Professional Users, provided they have sufficient legal capacity to carry out the relevant professional activity and meet the applicable legal, professional, sporting, insurance and any other requirements. Professional Users aged sixteen (16) and seventeen (17) will be subject to the same documentary verification process as adult Professional Users: they must provide the certifications, qualifications or accreditations and relevant insurance documentation required by metzzo, without additional documentary verification being established because of age. This is without prejudice to any authorizations, consents or assistance of legal representatives and other requirements or restrictions that may legally apply.

metzzo will use the date of birth to apply age-appropriate measures. The accounts of Users under eighteen (18), including those acting as Professional Users, will be subject to enhanced privacy, safety and protection settings and measures, particularly concerning profile visibility, exposure of information, communications and participation in features.

metzzo will not use minors' personal data to display profiling-based advertising where that practice is prohibited by applicable law.

The User must provide a truthful date of birth. Where there are reasonable grounds to doubt the declared age or where necessary to comply with a legal obligation, metzzo may apply reasonable and proportionate age-verification mechanisms, seeking to minimize the additional information requested.

If metzzo detects an account belonging to a person under fourteen, it may restrict the account while verifying the situation and, where appropriate, delete it and process the associated data in accordance with applicable law.

13. THIRD-PARTY SERVICES AND PROVIDER CHANGES

If the User chooses to sign in through Google or Apple, authentication is also subject to the chosen provider's terms and policies. metzzo receives only the information that is necessary and that the provider allows to be shared to authenticate or link the account.

Use of Apple Maps, OpenStreetMap and other third-party features may generate technical communications between the device and those services. The User can control certain permissions, particularly location, from their device.

If metzzo adds or replaces providers - for example, Google Maps, Firebase Analytics, Amplitude or another service - it will first assess the relevant processing and update this Policy where the change is significant. None of those future services is considered to be used by metzzo until it has actually been implemented.

14. CHANGES TO THE POLICY

metzzo may update this Policy to reflect legal, regulatory, technical, security or Platform-feature changes. The current version will be available on the Platform and will indicate its last update date.

Where a change significantly affects data processing or Users' rights, metzzo will communicate it by appropriate means and with the required advance notice. If new processing requires consent, it will be requested before that processing begins.

15. CONTACT

For questions about privacy, data protection or the exercise of rights, you may contact metzzo at support@metzzo.com.

Postal address: see the Legal Notice.