Introduction and Consent to the Privacy Policy

1.1. This privacy policy (hereinafter: the "Policy") regulates the manner in which Dean Tsatsis (hereinafter: the "Platform Operator" or the "Company") collects, uses, stores and processes the information received from users (hereinafter: the "User" or "you") in the context of accessing and using the Wooof application (hereinafter: the "Application").

1.2. The Policy applies to the use of the application in all its configurations and distribution platforms, including but not limited to: (a) the mobile applications distributed and available for download in the official app stores - App Store (of Apple) and Google Play (of Google). (b) any service, content, functionality or technological component accompanying the application or embedded in it.

Consent to the Privacy Policy

1.3. The mere entry into the application, browsing it, downloading it, installing it or using the services offered in it, constitutes the user's full, express and knowing consent to all the terms detailed in this Policy. The user confirms that they have read and understood the Policy and that they agree to the practices of information collection, processing, storage and transfer as described below.

1.4. It shall be clarified that no legal obligation applies to the user to provide the Company with any information. The provision of information is done at the user's free will and with their full consent for the purpose of receiving the services. To the extent the user does not agree to any of the terms of the Policy, they must immediately cease all use of the application and remove it from their device.

1.5. The user is aware that they are not obligated by law to provide the information detailed above, however the provision of information constitutes a necessary condition for using the application's services, in whole or in part. The non-provision of certain information (such as a delivery address or pet data) will prevent the ability to place orders or receive personally tailored recommendations, respectively.

Types of Information Collected and the Manner of Their Collection

The information collected and processed by the Company is divided into the following categories:

Information provided at the user's initiative:

2.1.1. Identification and contact details: full name, email address (received through direct registration or through third-party interfaces such as Google or Apple), phone number and physical address for the delivery of the products.

2.1.2. Pet data: detailed information about the pet in the user's possession, including the type of pet, its breed, age, weight, its image, as well as sensitive information regarding its health condition, such as allergies, sensitivities and chronic or specific medical conditions.

2.1.3. Activity data: order and purchase history, consumption preferences, balance of "treats" (credits) accrued and their actual redemption.

2.1.4. "Wanted" community content: information that the user chooses to publish in the Community Space, including locating or adoption notices, images, free descriptions and contact details intended for display to the community of users.

2.2. Technical information collected automatically: during the use of the application, technical information is collected about the user's end device, including the device type, operating system and its version, the installed application version, unique device identifiers, usage data, operational logs, and error data.

2.3. Payment data: it is clarified that the platform operator does not store in its systems the full credit card numbers of the users. The clearing process is carried out through a qualified external clearing provider, and the application stores only an encrypted "token" (Token) that allows identification of the transaction with the provider, as well as the last 4 digits of the credit card for identification purposes and the user's convenience only.

Information provided by the mere use of the application:

In addition to the information provided by the user actively, the platform operator collects and processes technical information collected automatically from the user's end device during browsing and use of the application (hereinafter: "technical information"). This collection is essential for the purpose of ensuring the proper functioning of the service, information security, adapting the user experience and improving system performance.

2.4. The technical information collected includes, among others: a unique device identifier (UUID/UDID), IP address, advertising identifiers (such as IDFA on iOS or AD-ID on Android) and unique installation identifiers, end device type, model, manufacturer, operating system type and its version, device language, time zone settings, and installed application version, click-stream data, duration of stay on various screens, frequency of use of the application, and bandwidth consumption data.

2.5. Geographic location data: subject to permission being given by the user through the operating system settings on the end device, the application may collect and process precise geographic location data (GPS-based) or approximate (based on Wi-Fi networks and cellular access points).

The user may cancel the access permission to the location data at any time through the device settings, however it is clarified that such cancellation may prevent the ability to use location-based functions in the application.

2.6. Operational logs and error reporting: the application's servers automatically record actions performed in the system, including entry and exit times, search queries, and server load data. In the event of the application crashing or a technical error, an automatic error report may be sent, including information about the state of the device at the time of the malfunction, the software version and the system details, for the purpose of locating malfunctions and improving system stability.

2.7. Tracking technologies and third-party components (Cookies & SDKs): the application makes use of "cookies" (Cookies), local identifiers and similar technologies for the purpose of identifying the user, saving their preferences (such as items in the shopping cart) and preventing the need to log in again on each entry. Also, the application embeds built-in software components of third-party providers (Software Development Kits SDKs) for the purpose of analytical analysis and optimization. These components may collect information about the user's activity and transfer it to the third-party providers (such as Google Analytics for Firebase, Meta SDK and the like). The information collected through the SDKs is used to analyze usage patterns, measure the effectiveness of advertising campaigns and adapt personal content to the user.

3. The platform operator will process the information for the following purposes (hereinafter: "the processing purposes"):
   1. Providing the services detailed in the Terms of Use, including the ongoing operation of the application and management of the user account.
   2. Operating the computerized recommendation mechanism for matching food products and equipment for pets based on the data entered.
   3. Managing logistical and commercial aspects, including processing orders, coordinating deliveries and managing the credit club ("treats").
   4. Operating and managing the "Wanted" community space to assist in locating pets and promoting adoption.
   5. Improving the user experience, statistical analysis of usage patterns and streamlining the technological interfaces.
   6. Referring the user to nearby services, distribution points or local promotions of the Supplier.
   7. Securing the systems, preventing fraud, defending against misuse of the application and complying with the requirements of the law.
   8. Streamlining the Supplier's delivery and logistics array.
   9. Complying with legal obligations applicable to the Company, including reporting requirements to authorities, bookkeeping and compliance with judicial orders.
   10. Providing service, support, and responding to user inquiries and requests.
   11. Sending system and operational messages (such as: order status updates, notifications, changes to terms, etc.).
   12. Sending advertising and direct marketing, in accordance with section 30A of the Communications Law (Telecommunications and Broadcasting), 5742-1982.
4. It shall be noted that the processing of information regarding the pet's health condition (such as allergies and diseases) is carried out on the basis of the user's express consent, given at the time of entering this data for the purpose of receiving tailored nutritional recommendations. The user may delete this data at any time through the profile settings, however it is clarified that this will detract from the system's ability to provide relevant recommendations.

Transfer of Information to Third Parties, Direct Marketing and Push Notifications

5. The platform operator does not sell, rent or trade in personal information about users to third parties, except as detailed above. Personal information will be transferred to third parties only for the purpose of fulfilling the processing purposes, and to the extent required for carrying out the services requested by the user.
6. Transfer of information to Hippopotam Ltd.: for the purpose of carrying out purchase transactions, supplying products and providing customer service, the platform operator will transfer the relevant information (including name, phone, delivery address, order details and pet data relevant to the purchase) to Hippopotam Ltd. (company no. 513311076) (hereinafter: the "Supplier"). The user confirms that the Supplier acts as an independent "database owner" with respect to the information transferred to it for the purpose of managing the sale, clearing, invoice issuance and delivery. The use of the information by the Supplier will be subject to the Supplier's privacy policy and the provisions of the law applicable to it.
7. App stores (App Store and Google Play): when distributing the application through these stores, technical information regarding the download of the application, its update and its performance is shared with the store operators (Apple and Google). The download of the application is subject to the privacy policy of the aforementioned providers, and the provisions of the law applicable to them.
8. Transfer of information to infrastructure and service providers (data processors): the platform operator uses external service providers for the purpose of operating the application, and these may be exposed to personal information within their role as "holders" as defined in the Protection of Privacy Law, 5741-1981:
   1. Supabase: cloud services, database storage and technological infrastructure. The personal information of users is stored on Supabase servers.
   2. Expo: a service that enables sending Push notifications to users' devices. For this purpose, a unique device identifier (Token) may be transferred to this provider.
   3. Tranzila: an external clearing provider that processes the payment data. As detailed in Chapter A, the full credit card information is transferred directly to the clearing provider and is not stored in the Operator's systems.
   4. Delivery providers: the user's details (name, address and phone) will be transferred to courier companies employed by the Supplier or the Operator for the purpose of carrying out the physical supply.
9. Transfer of information outside the borders of Israel: the user confirms that some of the service providers (such as Supabase and Expo) hold the information on servers located outside the borders of the State of Israel (including in the USA or the European Union).
10. Direct marketing and advertising messages: subject to obtaining the user's consent, the platform operator will be entitled to send the user advertising messages, updates, promotions and marketing offers by email, text messages (SMS) or messages. The user may withdraw their consent to receiving advertising at any time, by clicking on the "unsubscribe" link appearing in the body of the message or by contacting the Operator in writing through the means of contact detailed in this Policy.
11. Push notifications: the application makes use of Push notifications for operational updates (such as order status) as well as for marketing updates. The user can control the notification settings through the settings menu on their end device or through the application settings. It is clarified that canceling Push notifications may harm the user's ability to receive real-time updates about their orders.
12. Transfer of information by virtue of a legal obligation or corporate event: the platform operator will be entitled to transfer information to third parties also in the following cases: by virtue of a judicial order or a demand of a competent authority by law, within legal proceedings or a dispute between the user and the Operator or the Supplier, or in the event of a structural change in the platform operator (such as a merger, acquisition or sale of activity), provided that the absorbing entity accepts upon itself the provisions of this privacy policy towards the users.

Chapter C: Information Security, Retention Period, Rights of Data Subjects, and Policy Changes

14. The platform operator attaches importance to the protection of the collected information and takes reasonable and accepted security measures. To this end, technological and organizational protection measures are implemented in the application, including among others: 14.1. the use of standard encryption protocols for the transfer of information (such as TLS/SSL) and for its storage. 14.2. the use of SecureStore, Apple Keychain and Android Keystore components for the secure storage of encryption keys and access details (Tokens) on the user's device. 14.3. the implementation of a Row Level Security (RLS) mechanism in the Supabase infrastructure, ensuring that each user can access only the information belonging to them or the information they are authorized to view.
15. The user acknowledges and agrees that despite the security measures taken, it is not within the platform operator's ability to ensure absolute immunity of the information from unauthorized intrusion, technical malfunctions, cyber attacks or human errors. Without derogating from the above, the user bears sole responsibility for the security of their end device, including the installation of software updates and protection measures against viruses and malicious software, which may affect their privacy during the use of the application.
16. Information retention period: the personal information will be retained in the Operator's systems for the period required for the purpose of fulfilling the processing purposes detailed in this Policy, or for a longer period as required for the purpose of complying with legal obligations (such as retaining accounting documents for 7 years), protecting the Operator's legal rights or resolving disputes. Information published in the "Wanted" community space will be retained until its removal by the user or until the closure of the notice, subject to the Operator's right to keep an archival copy for operational or legal purposes. At the end of the required period, the Operator will act to delete the personal information or to perform anonymization, so that it will no longer be possible to identify the user from the remaining data.
17. Right of review: the user is entitled to review the information held about them in the Operator's database, by themselves or through their attorney authorized in writing.
18. Correction and deletion of information: to the extent the user found that the information about them is incorrect, incomplete, unclear or not up-to-date, they may contact the database owner with a request to correct the information or delete it.
19. Right to account deletion: the user may request at any time the deletion of their account in the application. It is clarified that the deletion of the account will lead to the deletion of the identified personal information, except for information that the Operator is obligated to retain by law or for legitimate interests as stated in this privacy policy.
20. For the purpose of exercising their rights, the user must send an inquiry to the Operator, at the email address: support@kikienjoy.com. The Operator will examine the inquiry and respond to it within the period prescribed by law. For the purpose of identifying the user and preventing the exposure of information to unauthorized parties, the Operator may require the user to provide additional identifying details or documents before providing a response to the inquiry.
21. Changes to the privacy policy: the platform operator may update or change the provisions of this privacy policy from time to time, at its sole discretion, among other things due to technological changes, version updates in the application or changes in the requirements of the law. In the event of a material change in the provisions of the Policy (such as a change in the processing purposes or the transfer of information to new third parties), the Operator will publish a notice in the application or send a notice to users by email. Continued use of the application after the publication of the updated Policy constitutes the user's consent to the changes. The most up-to-date Policy will be available at all times through the settings menu in the application.

Contact Details

22. For any question, clarification or complaint regarding this privacy policy or the manner of handling the personal information, you may contact the platform operator in the following ways: