Privacy Policy

Last updated: 26/05/2026
Version: 1.0

This policy describes, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of 27 April 2016 (the "GDPR") and the French Act No. 78-17 of 6 January 1978 as amended (the "Data Protection Act"), how Gerlando Zicari collects and processes the personal data of HollyFriends application users.

1. Data Controller

• Controller: Gerlando Zicari
• Address: Contact details provided to the hosting provider in accordance with Article 6-III-2 of Act No. 2004-575.
• Email: legal@hollyfriends.com
• Data Protection Officer (DPO): Not appointed
• Dedicated GDPR contact: legal@hollyfriends.com

2. Data Collected and Purposes

2.1 Particularly Sensitive Data

The Application does not intentionally collect sensitive data within the meaning of Article 9 of the GDPR (racial or ethnic origin, political opinions, religious beliefs, health data, sexual life, biometric data, etc.). Users are advised not to publish such data in hubs, vibes or proposals.

2.2 Data Concerning Minors

For Users aged under 15 years, account creation requires the prior consent of a holder of parental authority (Art. 8 GDPR). This consent is collected by explicit declaration at registration. Gerlando Zicari may request proof of this consent at any time.

3. Data Recipients

Personal data is accessible to:

• Gerlando Zicari and authorised staff, strictly within the limits of their duties;
• Supabase, Inc. (hosting provider), a data processor within the meaning of Art. 28 GDPR, bound by a Data Processing Agreement (DPA). Data stored in region: eu-west-1 (Ireland);
• Expo / Apple Push Notification Service (APNs) / Google Firebase Cloud Messaging (FCM) for push notification delivery, where applicable;
• Other Users: for data voluntarily made public (username, avatar, active check-ins, messages in hubs).

No data is sold, transferred or rented to third parties for commercial purposes.

4. Transfers Outside the European Union

Depending on the Supabase storage region configured, certain technical processing operations (push notifications via APNs/FCM in the United States) may involve transfers outside the EU.

When this is the case, such transfers are made on the basis of:

• the European Commission's adequacy decision (in the case of the EU–US Data Privacy Framework for certified processors); or
• Standard Contractual Clauses adopted by the European Commission.

A copy of the safeguards can be obtained on request at legal@hollyfriends.com.

5. Retention Periods

Retention periods are specified in the table in Section 2. At the end of these periods:

• Data is deleted or anonymised;
• Some data may be retained in intermediate archiving to comply with legal obligations, with restricted access.

Account deletion results in the effective deletion of associated data within a maximum of 30 days, subject to statutory archiving periods.

6. Security

Gerlando Zicari implements appropriate technical and organisational measures to ensure the security, integrity and confidentiality of data:

• TLS encryption for all network exchanges;
• encryption at rest for Supabase databases;
• JWT token authentication with limited duration and rotation;
• data isolation via PostgreSQL Row Level Security (RLS);
• staff access controls;
• logging of sensitive operations.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, Gerlando Zicari will notify the French data protection authority (CNIL) within 72 hours and, where applicable, affected Users as soon as possible (Art. 33 and 34 GDPR).

7. Users' Rights

In accordance with Articles 15 to 22 of the GDPR, Users have the following rights over their data:

• Right of access (Art. 15): obtain confirmation that their data is being processed and receive a copy;
• Right to rectification (Art. 16): have inaccurate or incomplete data corrected;
• Right to erasure ("right to be forgotten", Art. 17): have their data deleted in the cases provided for by law;
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20): receive their data in a structured, commonly used and machine-readable format;
• Right to object (Art. 21): object to processing for reasons relating to their particular situation;
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing (Art. 7);
• Right to define post-mortem directives regarding the fate of their data after death.

7.1 Exercising Your Rights

These rights may be exercised:

• Directly in the Application: profile editing, account deletion, notification management, check-in deletion;
• By email at legal@hollyfriends.com, accompanied by proof of identity if required.

Gerlando Zicari undertakes to respond within a maximum of one month from receipt of the request (Art. 12 GDPR), extendable by two months in cases of complexity.

7.2 Complaint to a Supervisory Authority

Users have the right to lodge a complaint with the French National Commission for Information Technology and Civil Liberties (CNIL):

• Address: 3 place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07, France
• Phone: +33 1 53 73 22 22
• Website: https://www.cnil.fr/plaintes

Or with the supervisory authority of the Member State of their habitual residence.

8. Cookies and Trackers

The mobile Application does not use advertising cookies or third-party trackers. Only strictly necessary local storage elements are used (Supabase authentication tokens, user preferences), which are exempt from consent requirements.

See the Cookie Policy for details.

9. Automated Decisions

The automated processing agent for establishment proposals (Nominatim geocoding, website scraping) constitutes an automated decision within the meaning of Article 22 of the GDPR. This decision:

• has no legal effect or does not significantly affect the User (simple addition of an establishment to a catalogue);
• is strictly necessary for the conclusion or performance of the contract (provision of the enrichment service).

Users may at any time contest an automated decision by contacting legal@hollyfriends.com.

10. External Sources

When the Application enriches establishment listings from public sources (Nominatim/OpenStreetMap, Atout France register, official establishment websites), no User personal data is transmitted to these sources.

11. Policy Updates

This policy may be updated at any time. Substantial changes will be notified within the Application and will require new acceptance by the User.

The date of last update appears at the head of this document.

12. Contact

For any questions regarding the processing of your personal data: legal@hollyfriends.com