Privacy Policy — One Big Jump

Version 1.0 · Last updated: 05.08.2026

1. Data controller

FIT JUMPS S.R.L., Miercurea Ciuc, Aleea Ciocirliei nr. 6, Sc. B, Ap. 17, 530164, Harghita County, Romania, tax ID (CUI) 23503540, Trade Register no. J2008000289193 (the "Operator") is the controller of the personal data processed through the One Big Jump app. Data protection contact: info@onebigjump.ro.

2. What data we process and why

• Account data — email, first name, last name, username, profile photo (optional), phone (optional). Purpose: creating and administering the account, sign-in. Legal basis: performance of the contract — GDPR Art. 6(1)(b).
• Sign-in — Firebase identifier (UID); for Google/Apple sign-in: the data supplied by those providers. Purpose: secure authentication. Legal basis: performance of the contract — Art. 6(1)(b).
• Dog data — name, breed, date of birth, microchip number, photo, Good Dog Card status. Purpose: the dog profile features and the Good Dog Card programme. Legal basis: performance of the contract — Art. 6(1)(b).
• Tickets and attendance — issued tickets, the QR code, the time of check-in at the event. Purpose: issuing tickets, access control. Legal basis: performance of the contract — Art. 6(1)(b).
• Payment data — amount, currency, order ID, transaction status. Card details are processed solely by EuPlătesc — they never reach us. Purpose: processing payments, accounting records. Legal basis: performance of the contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c).
• Referral — who invited you (username). Purpose: the referral programme and its rewards. Legal basis: performance of the contract — Art. 6(1)(b).
• Badges, points — badges earned, points balance and its history. Purpose: the loyalty programme. Legal basis: performance of the contract — Art. 6(1)(b).
• Push notifications — subscription to notification topics based on the language you choose; we do not store device tokens on our servers. Purpose: sending informational notifications. Legal basis: legitimate interest — Art. 6(1)(f); you can turn notifications off in your phone's settings.
• Technical data — app version, server technical logs (IP, time of request). Purpose: operating and securing the service, limiting abuse. Legal basis: legitimate interest — Art. 6(1)(f).

We do not process special categories of data and we do not make automated decisions with legal effect on you. The App does not use your data for third-party marketing.

3. Who has access to the data (processors / recipients)

• Google Firebase (Google Ireland Ltd.) — authentication and push notifications;
• Amazon Web Services — storage of uploaded files (photos), in a European Union region;
• EuPlătesc / EuroPayment Services s.r.l. — card payment processing;
• Romarg — hosting of the server and the database, within the European Union;
• public authorities, where the law requires it.

Transfers outside the EU: certain providers (Google, AWS) may transfer data outside the EU; these transfers rely on the Standard Contractual Clauses approved by the European Commission.

4. How long we keep the data

• account data: as long as the account is active, then deleted/anonymised within at most 90 days of the account being closed;
• accounting documents relating to payments: 10 years (legal obligation);
• technical logs: at most 12 months.

5. Your rights

Under the GDPR you have the right to: access, rectification, erasure, restriction, portability, objection (for processing based on legitimate interest), as well as the right to withdraw your consent (where applicable).

Requests go to info@onebigjump.ro; we reply within 30 days at the latest.

Account deletion: the account can be deleted directly from the App (Profile → Delete account) or by email. When the account is deleted, your personal data is erased or anonymised in line with the periods in section 4; accounting documents relating to payments are retained as required by law (10 years), and records of issued tickets may be retained without any association with you (anonymised).

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ANSPDCP) — dataprotection.ro.

6. Security

We use appropriate technical and organisational measures: encrypted communication (HTTPS), token-based authentication, role-based access control, hosting within the EU. No method offers absolute security, but incidents are handled in accordance with statutory notification obligations.

7. Children

The App is not intended for people under 16 and we do not knowingly collect data about them. If you become aware that a minor under 16 has provided us with data, contact us so we can delete it.

8. Changes

We will announce any significant change to this policy in the App before it takes effect.

9. Contact

FIT JUMPS S.R.L. · Miercurea Ciuc, Aleea Ciocirliei nr. 6, Sc. B, Ap. 17, 530164, jud. Harghita · info@onebigjump.ro