Privacy Policy

1. Identity of the Data Controller

For the purposes of applicable data protection legislation, the data controller is:

MERCACIO GROUP SL Trading as Revenue Operating Le Privé

NIF: B75917252 Registered Address: Avenida Chipiona, Calle Bobadilla, Número 24, 11408 Cádiz, Spain Website: https://www.leprive.net Privacy Contact: privacy@leprive.net Legal Contact: legal@leprive.net

MERCACIO GROUP SL determines the purposes and means of processing personal information collected through the Le Privé platform, except where another organization independently determines those purposes and means.

Where a participating Partner or independent service provider acts as a separate data controller, its own privacy policy and legal obligations apply to its independent processing activities.

Questions concerning this Policy or the processing of personal information may be directed to privacy@leprive.net.

2. Scope of This Privacy Policy

This Policy applies to personal information processed through Le Privé's websites, digital platforms, applications, membership systems, and associated business activities.

These include, where applicable:

2.1 Website Visitors

Individuals accessing Le Privé's public website, membership information, published content, and other online resources.

2.2 Membership Applicants

Individuals submitting applications for membership, private admission, or participation in restricted membership categories.

2.3 Registered Members

Individuals maintaining active, expired, cancelled, suspended, or pending Le Privé membership accounts.

2.4 Privé Card Holders

Individuals using digital membership credentials to access participating Partner benefits.

2.5 Talent and Affiliates

Individuals applying for, participating in, or otherwise engaging with Le Privé's talent and affiliate networks.

2.6 Business Partners

Individuals representing hotels, venues, brands, agencies, businesses, or other organizations engaging with Le Privé.

2.7 Customers and Commercial Contacts

Individuals requesting information about creative services, marketing campaigns, hospitality arrangements, partnerships, or other commercial opportunities.

2.8 Communications Recipients

Individuals who contact Le Privé, subscribe to permitted communications, submit inquiries, or communicate through approved channels.

This Policy does not replace the privacy notices of independent third-party businesses or service providers.

3. Categories of Personal Information We Collect

Depending on your relationship with Le Privé and the services you use, we may collect and process the following categories of personal information.

3.1 Identity Information

This may include:

• First and last name.
• Display name or profile name.
• Age or confirmation that you meet applicable age requirements.
• Nationality or country of citizenship.
• Country or city of residence.
• Identity verification information where reasonably necessary.
• Other identifying details voluntarily submitted in connection with membership or eligibility.

We may request additional identity verification where necessary to prevent fraud, establish eligibility, or comply with applicable legal obligations.

We do not require identity documentation where a less intrusive verification method is sufficient.

3.2 Contact Information

This may include:

• Email address.
• Telephone number.
• Country, city, or general location.
• Postal or billing address where necessary.
• Business contact details.
• Communication preferences.

3.3 Membership Information

We may process information associated with your membership, including:

• Membership account identifier.
• Membership Tier.
• Application and approval status.
• Membership activation date.
• Membership expiration date.
• Subscription and renewal status.
• Billing plan.
• Membership eligibility.
• Invitation or referral codes.
• Referral attribution where applicable.
• Digital Privé Card information.
• Membership points, where applicable.
• Benefit requests and redemption history.
• Relevant account settings and preferences.
• Membership cancellation or suspension records.

This information is used to administer memberships, verify eligibility, and provide the services associated with the relevant Membership Tier.

3.4 Payment and Transaction Information

When you purchase a membership or another paid service, we may process:

• Transaction identifiers.
• Purchase dates.
• Membership prices.
• Payment amounts.
• Transaction currency.
• Payment status.
• Billing history.
• Refund information.
• Subscription renewal records.
• Payment-provider references.
• Limited payment-method information made available by the payment processor.
• Relevant billing and tax information.

Payments may be processed by authorized third-party payment service providers.

Where payment information is collected directly by an external payment processor, that provider processes the information under its applicable privacy and security arrangements.

Le Privé does not require Members to provide complete payment card details through ordinary support communications.

The categories of payment information available to Le Privé depend on the payment provider and the integration used.

3.5 Talent and Creator Information

Individuals applying for or participating in the Le Privé talent network may provide:

• Name and professional identity.
• Photographs and portfolio materials.
• Videos and creative content.
• Social media usernames and profile links.
• Publicly available professional information.
• Languages.
• General location and availability.
• Professional experience.
• Areas of specialization.
• Relevant campaign preferences.
• Portfolio descriptions.
• Professional references.
• Other information voluntarily submitted for talent assessment.

Where individuals enter separate paid commercial arrangements, additional information reasonably necessary for contracting, invoicing, payment, or legal compliance may be collected.

Submission of a talent application does not automatically authorize unrestricted public or commercial use of the applicant's personal information or likeness.

3.6 Business and Partner Information

Where an individual represents a business, venue, brand, or other organization, we may collect:

• Contact name.
• Professional email address.
• Business telephone number.
• Organization name.
• Professional role.
• Business website.
• Business location.
• Partnership proposals.
• Proposed membership benefits.
• Booking arrangements.
• Relevant business correspondence.
• Commercial terms and inquiries.

Where a brand or agency requests creative services, we may also process campaign information, budgets, timelines, target markets, preferred talent, and related professional communications.

3.7 Travel and Hospitality Information

Where you request or use travel-related or hospitality services, we may process information necessary to facilitate the requested arrangement.

Depending on the service, this may include:

• Name and contact information.
• Destination preferences.
• Travel dates.
• Accommodation preferences.
• Reservation details.
• Booking references.
• Relevant membership eligibility.
• Information specifically required by an authorized travel or hospitality provider.

Additional identity or travel-document information may be requested only where reasonably necessary for a particular service or required by applicable law.

Independent travel providers may collect additional information directly under their own privacy policies.

3.8 Communications and Correspondence

We may maintain records of communications between you and Le Privé, including:

• Support inquiries.
• Email correspondence.
• Membership questions.
• Complaints.
• Refund requests.
• Partnership discussions.
• Talent applications.
• Feedback.
• Communications preferences.
• Other information voluntarily provided during correspondence.

These records may be used to respond to inquiries, administer services, resolve disputes, and establish or defend legal claims where necessary.

3.9 Technical and Usage Information

When you access our website or digital services, certain information may be collected automatically.

This may include:

• Internet Protocol address.
• Browser type and version.
• Device type.

• Operating system.
• Date and time of access.
• Pages or services requested.
• Session information.
• Authentication events.
• Technical error reports.
• Security-related activity.
• Device or browser identifiers where necessary.
• General geographic information inferred from technical data.
• Other diagnostic information required to operate and secure the platform.

Technical data is processed in accordance with the purposes, legal bases, and retention periods described in this Policy.

3.10 Marketing and Communication Preferences

Where applicable, we may process:

• Newsletter subscription status.
• Marketing consent records.
• Communication preferences.
• Consent withdrawal records.
• Relevant promotional interactions.
• Referral attribution.
• Suppression records maintained to respect opt-out requests.

Marketing-related tracking technologies will be used only where permitted by applicable law.

4. Information We Do Not Intentionally Request

Le Privé does not generally require special categories of personal information within the meaning of Article 9 GDPR for ordinary membership registration.

These categories include information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information processed for unique identification, health information, and information concerning sex life or sexual orientation.

Members should avoid submitting unnecessary sensitive information through ordinary application forms or support communications.

If sensitive personal information becomes necessary for a particular lawful purpose, we will establish an appropriate legal basis and satisfy any additional GDPR requirements before processing it.

Photographs and videos are not automatically treated as biometric data merely because they contain a person's image. Additional protections apply where biometric processing is used for unique identification.

5. Sources of Personal Information

We may obtain personal information through the following sources.

5.1 Directly From You

Information submitted when registering, applying for membership, making a purchase, contacting us, requesting benefits, or participating in our services.

5.2 Automatically Through Our Platform

Technical, security, authentication, and usage information generated when you access our websites and digital services.

5.3 Authorized Service Providers

Transaction confirmations, payment status, security notifications, or other information supplied by authorized providers where necessary to administer services.

5.4 Participating Partners

Information relating to membership verification, requested benefits, booking arrangements, or service-related issues, where such disclosure is lawful and relevant.

5.5 Referrals and Invitations

Information associated with invitation codes, referral programs, or introductions made through authorized channels.

5.6 Public Professional Sources

Where relevant to talent selection, professional partnerships, or legitimate business inquiries, we may review publicly available professional profiles, portfolios, social media references, business websites, or similar sources.

Public availability does not automatically authorize unrestricted collection or reuse of personal information.

Where personal data is obtained from someone other than the individual concerned, Le Privé will provide the information required by Article 14 GDPR within the applicable period, unless a lawful exception applies.

6. Purposes and Legal Bases for Processing

We process personal information only where an appropriate legal basis applies.

Depending on the activity, we may rely on:

Contractual Necessity — Article 6(1)(b) GDPR

Processing necessary to perform a contract with you or take requested steps before entering into a contract.

Legal Obligation — Article 6(1)(c) GDPR

Processing required to comply with applicable legal obligations.

Legitimate Interests — Article 6(1)(f) GDPR

Processing necessary for our legitimate business interests or those of another party, where those interests are not overridden by your fundamental rights and freedoms.

Consent — Article 6(1)(a) GDPR

Processing based on your freely given, specific, informed, and unambiguous consent.

The principal processing activities are described below.

• Membership registration: Create and administer accounts. Basis: Contractual necessity.
• Membership applications: Evaluate applications and eligibility. Basis: Requested pre-contractual steps or legitimate interests, depending on the application.
• Subscription management: Activate, renew, cancel and administer membership. Basis: Contractual necessity.
• Payment processing: Payments, refunds and billing. Basis: Contractual necessity and legal obligations.
• Accounting and taxation: Required financial records. Basis: Legal obligation.
• Privé Card and partner benefits: Verify eligibility and fulfill requested benefits. Basis: Contractual necessity.
• Membership points and request history: Maintain available membership features. Basis: Contractual necessity.
• Talent applications: Assess professional suitability. Basis: Requested pre-contractual steps or legitimate interests.
• Talent promotion: Publish approved profiles and authorized materials. Basis: Separate affirmative visibility choice and any required image-rights authorization; the relevant notice identifies the applicable basis.
• Partner and brand inquiries: Manage requested business relationships. Basis: Pre-contractual steps or legitimate interests.
• Customer support: Respond to inquiries. Basis: Contractual necessity or legitimate interests.
• Fraud prevention and security: Protect accounts, payments and systems. Basis: Legitimate interests or applicable legal obligations.
• Legal claims: Establish, exercise or defend legal rights. Basis: Legitimate interests or legal obligations.
• Service communications: Account, security and contractual notices. Basis: Contractual necessity or legal obligations.
• Marketing communications: Permitted promotional messages. Basis: Consent or the limited existing-customer exception where electronic marketing law permits.
• Optional tracking: Non-essential analytics or advertising, if introduced. Basis: Consent where required.
• Corporate transactions: Lawful restructuring or business transfers. Basis: Legitimate interests or another applicable basis.
• Regulatory cooperation: Lawful governmental requirements. Basis: Legal obligation.

Where we rely on legitimate interests, the relevant interests may include operating and protecting our services, preventing fraud, managing professional relationships, improving business processes, and defending legal claims.

We assess whether those interests are compatible with the rights and reasonable expectations of the individuals concerned.

Where consent is required, it will be requested separately and may be withdrawn as described in this Policy.

7. Membership Administration

We use membership information to operate and maintain the Le Privé membership platform.

This includes:

• Registering membership accounts.
• Verifying membership eligibility.
• Assigning membership categories.
• Activating and maintaining subscriptions.
• Managing recurring billing.
• Maintaining membership records.
• Issuing and verifying digital credentials.
• Providing access to available membership benefits.
• Processing membership changes.
• Recording benefit requests.
• Managing cancellation and expiration.
• Providing account assistance.

The processing of information necessary to provide purchased membership services is generally based on contractual necessity.

Additional processing required for fraud prevention, legal compliance, or security may rely on the relevant legal basis.

8. Privé Card and Partner Benefit Verification

Eligible Members may use their Privé Card or other approved credentials to access participating Partner benefits.

Where necessary to provide or verify a requested benefit, Le Privé may disclose limited personal information to the relevant Partner.

Depending on the arrangement, this may include:

• Member name.
• Membership status.
• Membership Tier.
• Membership identifier.
• Eligibility confirmation.
• Relevant booking or benefit request information.

We seek to limit disclosures to information reasonably necessary for the relevant purpose.

We do not automatically provide participating Partners with complete membership profiles, payment histories, application materials, or unrelated personal information.

Partners receiving personal information may act as independent data controllers where they independently determine how that information is used.

Where a Partner processes personal information solely on our behalf, appropriate contractual data-processing arrangements will apply.

9. Talent Applications and Professional Profiles

Le Privé operates a talent and creator network through which individuals may apply for consideration for professional opportunities.

Information submitted through talent applications may be used to:

• Review applications.
• Assess professional suitability.
• Verify submitted information.
• Manage talent profiles.
• Maintain an internal talent roster.
• Identify potential collaborations.
• Communicate about relevant opportunities.
• Coordinate approved campaigns.

Le Privé may review publicly available professional profiles and social media references supplied by applicants.

Being accepted into the talent network does not automatically authorize unrestricted public disclosure of personal information.

Public Talent Profiles

Where a talent profile is approved for public display, Le Privé will establish the necessary lawful basis and obtain any required authorization for the publication of photographs, names, biographies, or other identifiable materials.

Brand and Agency Shortlists

Where appropriate and lawfully authorized, selected professional profile information may be disclosed to prospective brands, agencies, or commercial clients for the purpose of evaluating potential collaborations.

Personal information unrelated to the proposed engagement will not be disclosed merely because an applicant joined the talent network.

Commercial Campaigns

Additional processing relating to compensation, campaign production, contractual obligations, intellectual property, or commercial use of a person's likeness will be governed by applicable law and any separately agreed arrangements.

Consent to the processing of personal information is distinct from any contractual authorization concerning the commercial use of photographs, videos, or other creative materials.

Public Talent profiles require approval and a separate affirmative visibility choice. Only the approved public fields and portfolio materials are displayed. Private contact details, fees, booking details and payout records are not public profile fields. You may request removal from public display; any lawful retention of underlying campaign or accounting records is considered separately.

10. Business Partners, Brands and Agencies

Le Privé may process the personal information of individuals representing prospective or existing Partners, brands, agencies, venues, and other businesses.

This information may be used to:

• Review partnership applications.
• Verify business contact information.
• Respond to commercial inquiries.
• Evaluate proposed member benefits.
• Negotiate partnership arrangements.
• Coordinate agreed services.
• Manage partner listings.
• Maintain business correspondence.
• Administer commercial relationships.

Where a business representative provides professional contact information, we may process that information to manage the relevant business relationship on an appropriate legal basis.

Information concerning a business does not always constitute personal data. However, information identifying an individual representative remains protected under applicable data protection legislation.

Public business listings may contain information provided or approved as part of the relevant partnership arrangement.

Personal information will not be published without an appropriate legal basis.

11. Membership Personalization and Service Improvement

Le Privé may use relevant membership information to organize and present services associated with a Member's eligibility, preferences, and Membership Tier.

This may include displaying available Partner benefits, maintaining membership history, and presenting information relevant to the Member's account.

Where applicable, we may use aggregated or anonymized information to understand membership activity, evaluate platform performance, improve services, and support legitimate business planning.

Where information remains capable of identifying an individual, it continues to be treated as personal data and is processed only on an appropriate legal basis.

We do not rely on a general interest in improving our business to justify unrestricted personal-data collection.

Where optional personalized advertising or tracking is introduced, we will provide the information and obtain the consent required by applicable law.

12. Customer Support and Communications

We may use personal information to communicate with you concerning:

• Membership applications.

• Account activation.
• Subscription status.
• Billing and payment issues.
• Membership cancellation.
• Security notifications.
• Available membership services.
• Requested Partner benefits.
• Customer support inquiries.
• Contractual or regulatory notices.

These communications may be necessary to perform our contractual obligations, comply with legal requirements, or protect legitimate operational interests.

Service-related communications are distinct from optional marketing communications.

Members may continue to receive essential contractual, security, or legally required notices even after unsubscribing from promotional communications.

We may retain relevant correspondence for customer support, dispute resolution, and legal compliance purposes.

13. Marketing and Promotional Communications

Le Privé may communicate information about membership offerings, available services, events, promotions, and related opportunities.

Marketing communications may include newsletters, invitations, promotional offers, or information about services relevant to Le Privé.

Such communications will be sent only where permitted by applicable law.

Depending on the circumstances, the legal basis may include:

13.1 Consent

Where consent is required, Le Privé will obtain an appropriate affirmative indication before sending marketing communications.

Consent may be withdrawn at any time.

13.2 Existing Customer Relationships

Where permitted under Article 21 of Spain's Law 34/2002, Le Privé may send electronic commercial communications concerning its own similar products or services to existing customers whose contact information was lawfully obtained in connection with a previous contractual relationship.

Applicable conditions must be satisfied, including provision of a simple and free opportunity to object.

13.3 Marketing Preferences

Recipients may opt out of promotional communications using the unsubscribe mechanism provided or by contacting:

privacy@leprive.net

Marketing opt-out requests will be honored without affecting membership access or essential service communications.

13.4 Independent Partner Marketing

Membership does not automatically authorize independent Partners to use a Member's contact information for unrelated promotional purposes.

Any disclosure for independent Partner marketing requires an appropriate legal basis and compliance with applicable electronic marketing requirements.

14. Cookies and Similar Technologies

Le Privé may use cookies, browser storage, session identifiers, and similar technologies to operate and secure its digital services.

Cookies are small data files that may be stored on a user's device when accessing a website.

Similar technologies may include local storage, session storage, authentication tokens, and other browser-based mechanisms.

14.1 Essential Technologies

Essential technologies may be used to support:

• Account authentication.
• Session management.
• Platform security.
• Fraud prevention.
• Service delivery.
• Storage of necessary technical preferences.
• Other functionality strictly necessary for a service requested by the user.

These technologies may be used without consent where an applicable legal exemption permits their use.

14.2 Functional Technologies

Certain technologies may remember user preferences or support requested website functionality.

Whether consent is required depends on the technology's purpose and the applicable legal requirements.

14.3 Analytics and Advertising Technologies

Le Privé's published Cookie Policy currently identifies no advertising or analytics cookies on the public website.

If non-essential analytics, advertising, or similar tracking technologies are introduced, Le Privé will update its disclosures and obtain consent where required before activating those technologies.

14.4 Third-Party Technologies

Independent third-party services, including payment platforms or external websites, may use their own cookies or related technologies.

Such technologies may be subject to the relevant provider's privacy and cookie policies.

Where Le Privé is legally responsible for obtaining consent before third-party technologies operate on its platform, the necessary consent mechanism will be implemented.

14.5 Cookie Preferences

Users may manage applicable cookie preferences through the controls made available on the website and through their browser settings.

Where consent is required, users must be able to reject non-essential cookies without being misled or subjected to unlawful barriers.

Further information is available in our:

Cookie Policy

15. Payment Processing and Financial Information

Le Privé may engage authorized third-party payment service providers to process membership fees and other payments.

Payment providers may independently collect and process payment card details, billing information, transaction information, and fraud-prevention data.

The precise allocation of data protection responsibilities depends on the provider and the relevant payment arrangement.

Le Privé may receive limited payment information necessary to:

• Confirm transactions.
• Activate paid memberships.
• Maintain subscription status.

• Process authorized recurring payments.
• Handle refunds.
• Investigate failed payments.
• Resolve payment disputes.
• Prevent fraudulent transactions.
• Maintain legally required accounting records.

Where a payment processor independently determines purposes of processing, its separate privacy policy applies.

Where a payment processor acts on Le Privé's behalf, appropriate contractual data-processing arrangements will be used.

Members should not transmit full payment card numbers, card security codes, or other unnecessary financial credentials through ordinary email or support communications.

Our membership checkout uses Stripe. Card details are entered on Stripe-hosted checkout; Le Privé receives payment and subscription references and statuses needed to administer membership. Stripe’s privacy information is available at https://stripe.com/privacy.

16. Sharing Personal Information

Le Privé may disclose personal information where necessary for a legitimate and lawful purpose.

Potential recipients include the following categories.

16.1 Technology and Infrastructure Providers

We may use authorized providers for website hosting, database infrastructure, cloud storage, authentication, media hosting, technical maintenance, and other operational services.

These providers may process personal information only to the extent necessary for their assigned functions and in accordance with their applicable legal responsibilities.

16.2 Payment Service Providers

Relevant transaction and payment information may be disclosed to payment processors and financial service providers necessary to complete authorized payments.

16.3 Communications Providers

We may use authorized service providers to deliver transactional emails, account notices, support communications, and lawful marketing messages.

16.4 Participating Partners

Limited information may be disclosed to participating Partners where necessary to verify membership eligibility, fulfill requested benefits, or facilitate agreed services.

16.5 Travel and Hospitality Providers

Where a Member requests travel or hospitality services, relevant information may be shared with the independent providers necessary to facilitate the requested arrangement.

16.6 Brands and Agencies

Where authorized and relevant to talent-related opportunities, selected professional profile information may be disclosed to brands, agencies, or prospective commercial clients.

16.7 Professional Advisers

Personal information may be disclosed to legal advisers, accountants, auditors, insurers, or other professional advisers where reasonably necessary and lawful.

16.8 Public Authorities

Information may be disclosed to courts, regulators, tax authorities, law enforcement agencies, or other competent authorities where required or permitted by applicable law.

16.9 Corporate Transactions

Personal information may be disclosed where reasonably necessary in connection with a legitimate corporate restructuring, merger, acquisition, or transfer of business operations, subject to appropriate legal safeguards.

16.10 Other Authorized Disclosures

Information may be disclosed to additional recipients where the disclosure is necessary for a lawful purpose and an appropriate legal basis exists, including where valid consent has been obtained.

Le Privé does not authorize processors acting on its behalf to use personal information for unrelated independent purposes.

Any disclosure of personal information must comply with applicable data protection legislation.

The platform integrates Neon for database services, Cloudflare R2 for media storage and Resend for email delivery where configured. Other configured mail or infrastructure services may be used for particular communications. Applicable provider arrangements, processing locations and transfer safeguards depend on the service actually used. You may request information about the relevant recipients and safeguards at privacy@leprive.net.

17. Data Processors and Service Providers

Le Privé may engage third-party organizations to process personal information on its behalf.

Where an organization acts as a data processor under the GDPR, we will establish the appropriate contractual arrangements required by Article 28.

These arrangements will address relevant obligations concerning:

• Documented processing instructions.
• Confidentiality.
• Information security.
• Subprocessor engagement.
• Assistance with data subject rights.

• Personal data breaches.
• Return or deletion of information.
• Demonstration of compliance.
• Other legally required safeguards.

Service providers may be replaced or added as operational requirements change.

Le Privé remains responsible for fulfilling its own obligations as a data controller.

18. International Transfers of Personal Information

Le Privé operates internationally and may engage service providers or business Partners located outside the European Economic Area (“EEA”).

Personal information may therefore be transferred to, accessed from, or processed in jurisdictions outside the EEA where necessary for the relevant service.

Such transfers will take place only where permitted by applicable data protection legislation.

Depending on the circumstances, the applicable transfer mechanism may include:

18.1 Adequacy Decisions

Transfers to countries, territories, or qualifying organizations covered by an applicable European Commission adequacy decision.

18.2 Standard Contractual Clauses

Transfers supported by the European Commission's approved Standard Contractual Clauses, together with any additional measures required in the circumstances.

18.3 Other Appropriate Safeguards

Transfers supported by binding corporate rules or another legally recognized transfer mechanism.

18.4 Specific Legal Derogations

In limited circumstances, transfers may occur under an applicable GDPR derogation, such as where a transfer is necessary to perform a specifically requested contract and the statutory requirements are satisfied.

Consent to this Privacy Policy does not independently constitute consent to unrestricted international transfers.

Where applicable, individuals may request information concerning relevant international transfer safeguards by contacting privacy@leprive.net.

19. Data Retention

Le Privé retains personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected or for another lawful retention purpose.

Retention periods depend on the nature of the information, the processing purpose, applicable legal requirements, and the need to establish or defend legal claims.

The following principles apply.

• Active membership information: For the duration of the membership relationship.
• Closed membership accounts: Only while necessary for closure administration, specific disputes, security investigations or legal claims.
• Subscription and transaction records: For the period required by applicable accounting, tax, commercial and financial legislation.
• Talent applications: During assessment and any justified subsequent selection, compliance or dispute period.
• Approved Talent profiles: During participation and any additional lawful period associated with agreed campaigns or legal obligations.
• Affiliate records: During participation and applicable contractual, accounting or legal retention periods.
• Partner and commercial records: During the relationship and any additional period justified by legal or contractual obligations.
• Support correspondence: Until the matter is resolved and applicable foreseeable disputes no longer justify retention.
• Security and technical logs: For their proportionate operational purpose, with longer retention only for specific investigations or legal compliance.
• Marketing consent records: While necessary to demonstrate consent, withdrawal and compliance.
• Marketing suppression records: As needed to continue respecting opt-outs.
• Cookie and preference records: According to their technical purpose and the Cookie Policy.

Spanish commercial legislation may require certain accounting books, business correspondence, and supporting records to be retained for six years, subject to applicable exceptions and other legal requirements.

Personal information will not be retained indefinitely merely because it may have future commercial value.

Where continued retention is no longer justified, information will be deleted, anonymized, or otherwise handled in accordance with applicable legal requirements.

Rejected applications are retained only while assessment, an explained talent-roster choice or a specific dispute or compliance requirement justifies retention. Closed-account operational data is retained only while closure administration, a specific security investigation or legal requirement justifies it; unrelated profile data is not retained solely because accounting records must be kept. Logs are retained only for their operational or investigation purpose. Campaign records are retained through delivery and settlement and any applicable contractual or statutory claims period. Reviews must separate records that require retention from data eligible for deletion or anonymization. This notice does not claim that automatic deletion schedules are already implemented.

20. Account Closure and Deletion

Members may request account closure or deletion of personal information by contacting:

privacy@leprive.net

Where a valid erasure request applies, Le Privé will delete personal information in accordance with applicable law.

Deletion may be restricted where continued processing or retention is necessary to:

• Comply with a legal obligation.
• Maintain legally required accounting or financial records.
• Establish, exercise, or defend legal claims.
• Address security incidents or fraud.
• Fulfill another lawful retention requirement.

Account closure does not automatically require immediate deletion of every associated record.

Where Spanish law requires personal information to be blocked following rectification or erasure, Le Privé will implement the applicable blocking and retention requirements.

Blocked information will not be used for unrelated ordinary business purposes.

Where information has been lawfully disclosed to an independent third party, that party may have separate retention obligations.

Le Privé will fulfill any applicable obligation to communicate rectification, erasure, or restriction requests to relevant recipients.

21. Accuracy of Personal Information

We take reasonable steps to maintain personal information that is accurate and relevant to its processing purpose.

Members are encouraged to update their information when necessary.

Where account functionality permits, Members may update certain personal details directly through their membership account.

Members may also request correction of inaccurate or incomplete information by contacting privacy@leprive.net.

Where appropriate, we may request information reasonably necessary to verify the requested correction.

22. Information Security

Le Privé implements technical and organizational measures appropriate to the nature of the personal information processed and the risks associated with the relevant processing activities.

Depending on the applicable systems and circumstances, measures may include:

• Access controls.
• Authentication mechanisms.
• Restricted administrative permissions.
• Secure communications.
• Protection of stored information.
• Security monitoring.
• Fraud-prevention controls.
• Backup and recovery measures.
• Appropriate service-provider oversight.
• Staff confidentiality requirements.
• Incident response procedures.

Security measures are reviewed and adapted as reasonably necessary in light of technological developments, operational requirements, and applicable legal obligations.

No method of electronic transmission or storage can guarantee absolute security.

However, this does not remove Le Privé's responsibility to implement appropriate safeguards under applicable data protection legislation.

23. Personal Data Breaches

Le Privé is responsible for identifying, assessing, responding to and documenting personal data breaches under applicable law. Publishing this policy does not itself establish that a particular technical incident-response system has been deployed.

Where a personal data breach occurs, we will assess the nature of the incident and any potential risks to affected individuals.

Where notification to a supervisory authority is legally required, Le Privé will comply with the applicable requirements and deadlines.

Under Article 33 GDPR, notification to the competent supervisory authority is generally required within 72 hours of becoming aware of a breach where the breach is likely to result in a risk to individuals' rights and freedoms.

Where a breach is likely to result in a high risk to affected individuals, Le Privé will communicate the breach to those individuals as required by Article 34 GDPR.

We may take appropriate measures to investigate incidents, secure affected systems, prevent recurrence, and cooperate with competent authorities.

24. Automated Processing and Profiling

Le Privé may use automated technical processes to operate its platform, administer memberships, verify transactions, and identify potential security threats.

Such processes may include automated membership status checks, payment status updates, and technical security alerts.

Where automated processing is used to support decisions, appropriate safeguards will be applied.

Le Privé will not rely on solely automated decision-making producing legal or similarly significant effects concerning an individual unless the processing is permitted by applicable law and the relevant GDPR requirements are satisfied.

Where such decision-making is implemented, affected individuals will receive the legally required information concerning its existence, relevant logic, significance, consequences, and applicable rights.

Where required, individuals will be able to request human intervention, express their views, and contest the decision.

25. Children's Privacy

Le Privé membership services are intended for adults aged 18 or older.

We do not knowingly offer ordinary membership registration to individuals who do not meet the applicable minimum age requirement.

Where we become aware that personal information has been collected from an ineligible minor without an appropriate legal basis, we will take reasonable steps to address the situation, including deletion where required.

Although Spanish data protection law establishes specific rules concerning consent by minors, those rules do not override Le Privé's minimum membership age.

Where content relating to a minor is submitted in connection with a separate lawful business activity, appropriate additional legal requirements and safeguards will apply.

26. Third-Party Websites and External Platforms

Our services may contain links to independent websites, social media platforms, booking systems, payment providers, or other third-party services.

These websites may collect and process personal information under their own privacy policies.

Le Privé does not determine the independent privacy practices of external organizations merely because links to their services appear on our platform.

Users are encouraged to review the privacy policies of third-party services before submitting personal information.

Where third-party content is embedded directly into Le Privé's platform, applicable privacy and cookie requirements will be observed.

27. Business Transfers and Corporate Restructuring

Where MERCACIO GROUP SL undergoes a legitimate merger, acquisition, restructuring, sale of assets, or other corporate transaction, personal information may be processed or transferred where lawfully necessary.

Such processing must have an appropriate legal basis and remain subject to applicable confidentiality, data protection, and security requirements.

Where required by law, affected individuals will receive appropriate information concerning changes to the identity of the data controller or the purposes of processing.

A corporate transaction does not automatically authorize unrestricted use of personal information for unrelated purposes.

28. Legal Disclosures and Regulatory Compliance

Le Privé may process or disclose personal information where reasonably necessary and lawful to:

• Comply with legal obligations.
• Respond to valid judicial orders.
• Cooperate with competent regulatory authorities.
• Meet accounting or tax requirements.
• Investigate suspected unlawful conduct.
• Establish, exercise, or defend legal claims.
• Protect the security and integrity of its services.

Disclosures will be assessed according to the applicable legal basis and the principles of necessity and proportionality.

Requests from public authorities will be evaluated in accordance with applicable law.

29. Your Data Protection Rights

Subject to applicable conditions and limitations, individuals have rights concerning their personal information under the GDPR.

29.1 Right of Access

You may request confirmation of whether Le Privé processes your personal information and obtain access to relevant information concerning that processing.

29.2 Right to Rectification

You may request correction of inaccurate personal information or completion of incomplete information.

29.3 Right to Erasure

You may request deletion of personal information where the relevant legal conditions are satisfied.

This right is subject to lawful exceptions, including certain statutory retention obligations.

29.4 Right to Restriction

You may request restriction of processing in circumstances recognized by applicable law.

29.5 Right to Data Portability

Where applicable, you may request personal information you have provided to us in a structured, commonly used, machine-readable format.

This right applies under the conditions established by Article 20 GDPR.

29.6 Right to Object

You may object to processing based on legitimate interests in circumstances recognized by applicable law.

Where the objection concerns processing for direct marketing, you have the right to object at any time.

29.7 Right to Withdraw Consent

Where processing relies on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

29.8 Rights Concerning Automated Decisions

Where applicable, you have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

29.9 Right to Lodge a Complaint

You may lodge a complaint with a competent data protection supervisory authority if you believe that your personal information has been processed unlawfully.

30. Exercising Your Privacy Rights

Requests concerning personal information may be submitted to:

privacy@leprive.net

To help us locate the relevant information, please provide sufficient details to identify the account or processing activity concerned.

Where we have reasonable doubts concerning the identity of the person submitting a request, we may request additional information necessary to confirm identity.

Identity verification measures will be proportionate and limited to what is reasonably necessary.

We will respond to valid requests within the period required by applicable law.

Under Article 12 GDPR, this is generally one month from receipt of the request.

Where necessary due to the complexity or number of requests, the response period may be extended by up to two additional months, provided the individual is informed of the extension and its reasons within the initial one-month period.

Requests will ordinarily be handled free of charge.

Fees may be charged, or action may be refused, only where permitted by applicable law, including in cases of manifestly unfounded or excessive requests.

Where a request cannot be fulfilled in whole or in part, we will provide an appropriate explanation and information concerning available remedies.

31. Marketing Opt-Out and Consent Management

Individuals may withdraw optional marketing consent or object to direct marketing at any time.

Where applicable, marketing preferences may be managed through:

• The unsubscribe mechanism included in promotional communications.
• Available account preference controls.
• A request sent to privacy@leprive.net.

Withdrawal of optional marketing consent will not ordinarily affect access to purchased membership services.

We may retain limited suppression information where necessary to ensure that an opt-out request continues to be respected.

Optional marketing consent is not a condition of purchasing or using ordinary Le Privé membership. Refusal or withdrawal does not remove purchased membership access.

32. Data Protection Supervisory Authority

Le Privé is established in Spain and is subject to the jurisdiction of the competent data protection authorities.

The Spanish data protection supervisory authority is:

Agencia Española de Protección de Datos (AEPD) Website: https://www.aepd.es

Individuals may contact the AEPD regarding concerns about the processing of personal information.

Where applicable, individuals may also lodge complaints with another competent supervisory authority under the GDPR.

We encourage individuals to contact privacy@leprive.net regarding privacy concerns so that we can investigate and address them.

Contacting Le Privé first is not a mandatory prerequisite to exercising the right to complain to a competent supervisory authority.

33. Changes to This Privacy Policy

Le Privé may update this Privacy Policy to reflect changes in:

• Applicable legislation.
• Regulatory guidance.
• Membership operations.
• Digital services.
• Business activities.
• Technology.
• Security requirements.
• Data processing practices.

Updated versions will be published on the Le Privé website.

The effective date or last updated date will be revised to reflect the applicable changes.

Where a material change requires additional notice, consent, or another legal measure, Le Privé will satisfy the relevant requirements before implementing the affected processing.

A revised Privacy Policy does not retroactively establish consent for processing that previously lacked a valid legal basis.

34. Relationship With Other Policies

This Privacy Policy should be read alongside the applicable Le Privé legal documents, including:

Membership Terms & Conditions

Cookie Policy

Additional privacy notices may apply to particular activities, including talent campaigns, commercial partnerships, travel arrangements, or other separately agreed services.

Where additional notices are required by law, they will be provided at an appropriate time.

Nothing in Le Privé's contractual terms overrides mandatory data protection rights.

35. Contact Information

For questions, concerns, requests, or complaints regarding this Privacy Policy or the processing of personal information, please contact:

MERCACIO GROUP SL Trading as Revenue Operating Le Privé

NIF: B75917252

Registered Address: Avenida Chipiona, Calle Bobadilla, Número 24 11408 Cádiz, Spain

Website: https://www.leprive.net

Privacy Contact: privacy@leprive.net

Legal Contact: legal@leprive.net

Privacy Policy: https://www.leprive.net/legal/privacy

Cookie Policy: https://www.leprive.net/legal/cookie-policy

Membership Terms: https://www.leprive.net/legal/membership-terms

36. App, community and editorial features

Where enabled, app features may process saved collections, editorial preferences, posts, comments, messages and reports. Saved collections are private by default. A post or comment is visible to the audience disclosed when submitting it; messages are shared with their intended recipients. Content and moderation records are used to deliver the requested feature and address abuse on an appropriate contractual or legitimate-interest basis. Additional notices identify recipients and retention criteria before collection. Prototype content and simulated actions do not establish live collection or service availability.

37. Bookings, invitations, guests and rewards

Where enabled, requests may include dates, venue or travel choices, invited guests, invitation responses, eligibility checks, points transactions and redemption records. Relevant details are shared only with recipients needed for the requested arrangement. Supply another person’s details only with appropriate authority and information; they retain their own privacy rights. A pending request is not a confirmed booking. Necessary request administration generally relies on contract or requested pre-contractual steps; accounting and proportionate fraud checks have their applicable separate bases.

38. Device permissions and sensitive preferences

Where offered, location and push-notification permissions are optional and controlled through the device. The feature will explain whether it uses approximate or precise location, its purpose, recipients and retention before collection; device permission is not blanket consent for unrelated processing. Marketing notifications require their applicable separate permission. Necessary service notices may still be delivered through other appropriate channels. Health, dietary or accessibility information that reveals special-category data is collected only where necessary with an Article 6 basis and an applicable Article 9 condition, including explicit consent where relied upon. No background location collection is established by this policy.

39. UGC campaigns and professional payments

Agreed creator campaigns may involve briefs, deliverables, revisions, usage permissions, brand shortlists, campaign communications, contracts, invoices and payout references. Requested collaboration administration relies on contract or pre-contractual steps; accounting relies on legal obligations. Publication and commercial image/content use require the appropriate separate permissions or agreements. Joining the Talent network does not authorize unrelated advertising or unrestricted sharing. Financial and private campaign records are not public portfolio fields.

40. Legal acceptance and privacy choices

Membership administration includes the accepted terms version, time, source and the express request to start membership services after verified payment. These records document the agreement and relevant legal obligations. Reading this privacy policy, accepting membership terms or requesting service activation is not consent to optional marketing, public profile visibility, unrestricted transfers or sensitive-data processing. A later policy version does not retroactively create consent.