Your privacy is important to us

• User: any natural person who provides their personal data to Moradai and whose data is processed by Moradai, regardless of the purpose of such processing.
• Service: all services offered by Moradai, such as web services, the mobile app, the sale of physical products or any other.

This Privacy Policy applies to all services offered by Moradai, including but not limited to the public website, the web user dashboard or account and the mobile app. The data collected may differ in each case, depending on the different purposes of processing and legal bases involved. It is the user's responsibility to read and accept this Privacy Policy before providing any data to Moradai through any of the services, digital or otherwise, that it provides.

Moradai will process your personal data for the following purposes (depending on the products and services you request from us or any other action you take with Moradai):

Contact form submission: when you complete and submit any contact form on the website or app, or contact Moradai by any other means in which you provide your personal data, whether to make an enquiry, a proposal, a complaint or for any other reason, we collect the following personal data in order to handle your request in a personalised way and through means that ensure appropriate, efficient communication adapted to your needs:

• Identification data (name)
• Contact details (email address and mobile phone number)

If you provide us with your phone number (optional), you consent to us contacting you directly by phone call or WhatsApp instant messaging.

Newsletter or blog subscription: the purpose of subscribing to the blog/newsletter is to be the first to receive the best tips and solutions to protect your home and to stay informed about legal and security matters. When you ask Moradai directly to subscribe to the newsletter or periodic communications service, we collect the following personal data in order to send you those communications through appropriate means:

• Identification data (name)
• Contact details (email address)

Purchase of Moradai physical products: when you purchase physical products through any official means or channel, whether through one of the digital services or by requesting them directly from Moradai, we collect the following personal data in order to perform the contract, process the payment for the order, ship and deliver the order to the requested address, communicate updates or issues relating to the order and provide the user with personalised support:

• Identification data (first name, surname, national ID number)
• Shipping data (shipping address)
• Billing data (billing address)
• Contact details (email address, mobile phone number)
• Payment method
• Payment data (for security reasons, we never store your full card number and we work with external payment processors that guarantee a high level of security for that data)
• Statistical data (occasionally, we may request data for purely statistical purposes, such as the type of home, how you heard about us or the security systems you currently use in your home)

Registration and use of the Moradai App: when registering in the Moradai App, as well as in the web user area, the user provides their data so that we can give them access to the features of the service. We collect your personal data in order to offer you all the features of the contracted service, manage your secure access, provide you with support and technical assistance and communicate with you about any aspect of the service:

• Identification data (first name, surname, national ID number)
• Home data (address, type of home, owner details)
• Contact details (email address, mobile phone number)
• Password (we manage your passwords securely, using industry-standard encryption techniques)
• Photograph of your face
• Geolocation data (only during the initial account setup)
• Device data (IP address, Wi-Fi network SSID)

Use of Moradai physical products: if you purchase Moradai physical products for certifying residence, such as El Testigo, the provision of the service will include your explicit consent to the processing of biometric data (facial template), which will be processed locally and automatically by the device using the strictest security standards, as well as a photograph of your face to verify your identity. In this regard, Moradai will not have access to, process or share your biometric data, which will remain located and secure on your device at all times. Likewise, Moradai will not retain your biometric data after you cancel the service. If you choose to delete your account, your biometric data will be permanently deleted from the device's storage, and the service and previous data cannot be recovered should you sign up for the service again in the future.

You will find all information relating to biometric data in the Terms and Conditions of the product you have purchased.

The legal bases for processing are the following:

1. Performance of a contract. The following processing purposes are based on the performance of a contract:
   • Purchase of Moradai physical products
   • Registration and use of the App and other Moradai products and services
   • Sending communications that affect the service or that require decisions or actions by the user
2. Legitimate interest. The following processing purposes are based on legitimate interest:
   • Protecting the service and Moradai users in the event of improper or fraudulent use
   • Conducting surveys and studies or asking users for their opinions to improve the service
   • Sending communications that affect the service or that require decisions or actions by the user
3. Consent. The following processing purposes are based on the express consent given by the user:
   • Completing web forms
   • Newsletter or blog subscription
   • Sending commercial information
   • Processing payments or service subscriptions
   • Processing of biometric data (facial template).
4. Compliance with legal obligations. The following are based on compliance with our legal obligations:
   • The relevant checks required by law, such as those concerning age or identity
   • Retaining your personal data, once the contractual relationship has ended, for the period of time required by law

Your personal data may be shared with third parties in the following cases:

• Third-party service providers of Moradai, who will act on our behalf and under our instructions, and with whom we have signed the corresponding data access agreements (data processors). For example, to process electronic payments.
• Third parties to whom we must disclose your data for the proper provision of the service, insofar as this is necessary, and who will become controllers of your data independently of Moradai, provided that you give your express consent. In any case, such disclosure to third parties will be specified in the terms and conditions of the service, which the user must accept in order to contract it.
• Data may be disclosed to third parties where required by law and following a request from a competent Authority.

Your personal data will be kept for as long as you do not withdraw the consent you have given or for as long as the purpose for which it was collected remains. Once that purpose has been fulfilled, Moradai will keep the data blocked for the period during which liabilities may arise from its relationship with you, in accordance with the legally established limitation periods, and solely at the disposal of the Authorities to handle any claims.

We also inform you that Moradai has internal data retention criteria that apply to both customers and potential customers whose information it holds. If you would like more information about these criteria, you can contact the company's Data Protection Officer at dpo@moradai.io.

At any time, you may exercise, free of charge, your rights of access, rectification, objection, erasure, portability and restriction of processing, as well as withdraw the consents you have given and not be subject to a decision based solely on automated processing of the personal data processed by Moradai, by sending a request to the postal address C. Cifuentes, 5, Villaverde, 28021 Madrid, or by email to dpo@moradai.io. To properly prove your identity when exercising your rights, you may use the same means through which you provided your personal data, an electronically signed rights request form that reliably identifies the data subject or, failing that, a request accompanied by a photocopy of your national ID document.

We also inform you that it is your duty to update and amend your data, which you can do by following the procedure described above. Moradai will not be responsible for any consequences for users arising from their lack of diligence in updating that data, or where users provide false or inaccurate data to Moradai.

In any case, we remind you that you may contact the Spanish Data Protection Agency (www.aepd.es) at Calle de Jorge Juan, 6, 28001 Madrid, if you believe that Moradai has infringed or has not properly addressed the rights granted to you by the applicable data protection regulations.

In order to ensure that certain services are provided correctly, the Data Controller may use service providers that involve the international transfer of data, including: name, email address, mobile telephone number and social media content. Such international transfers will be governed by the GDPR, either through an Adequacy Decision by the European Commission or through standard contractual clauses incorporated into the Data Processing Agreement (DPA).

Moradai provides its services only to users who are of legal age, as expressly stated in the Terms and Conditions.

The customer is expressly prohibited from providing a sign-up link to the app as a co-resident. Any breach of this prohibition is the sole responsibility of the customer.

For any question relating to this Privacy Policy, you can contact us at the postal address C. Cifuentes, 5, Villaverde, 28021 Madrid or by email at dpo@moradai.io.