Terms of service and privacy policy

Last updated: 13 May 2026. Version 1.0.

This single document combines the Terms of service (Block I) and the Privacy policy (Block II) of Grouptizer. Accepting one means accepting the other. The master language is Spanish. This English version published at /legal is a courtesy translation and is not legally binding; in case of any discrepancy, the Spanish version prevails.

Contents

Block I — Terms of service

1. Identification of the provider
2. Definitions
3. Purpose and nature of the service
4. Account registration and requirements
5. Services for Creators
6. Services for Buyers
7. Grouptizer plans and commissions to the Creator
8. Changes to prices and terms
9. Relationship between Creator and Buyer
10. Acceptable use and prohibited activities
11. Creator’s responsibilities
12. Buyer’s responsibilities
13. Refunds and disputes
14. Intellectual and industrial property
15. Service availability and limitation of liability
16. Suspension and termination
17. Changes to the service
18. Assignment
19. Governing law and jurisdiction
20. Out-of-court dispute resolution

Block II — Privacy policy

21. Data controller
22. Purposes, legal bases and categories of data
23. Retention periods
24. Data processors and third parties
25. Cookies and similar technologies
26. Rights of the data subject
27. Right to lodge a complaint
28. Security and technical measures
29. Minors
30. Changes to the policy

Final provisions

---

Block I — Terms of service

1. Identification of the provider

In accordance with article 10 of Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), the following information about the service provider is disclosed:

• Owner: Ángel Sagredo Sánchez, acting as a self-employed individual (Spanish autónomo).
• Tax ID (NIF): 02726249J.
• Registered address: Calle laponia, 5, Portal K, 3.º A, 28030 Madrid, Spain.
• General contact email: info@grouptizer.com.
• Legal contact email: legal@grouptizer.com.
• Privacy contact email: privacy@grouptizer.com.
• Trade name: Grouptizer.
• Main website: https://grouptizer.com.
• Product documentation: https://docs.grouptizer.com.
• Official Telegram bot: @grouptizer_bot.
• Data protection supervisory authority: Spanish Data Protection Agency (AEPD), https://www.aepd.es.

If a successor commercial company is incorporated, the provider’s details will be updated under the assignment clause in section 18.

2. Definitions

For the purposes of this document:

• Grouptizer, the Platform or the Service: the set of services accessible through the access points identified in section 1, supplied by the provider identified therein.
• User: any individual who accesses the Platform, whether as a Creator, a Buyer or a visitor.
• Creator: user who creates a Store on Grouptizer to sell access to one or more private Telegram channels or groups they own or legitimately manage.
• Buyer: user who purchases a subscription or one-off product in a Store to obtain access to the corresponding channel or group.
• Store: the Creator’s public page hosted at a URL of the form grouptizer.com/[slug].
• Product: any access option offered by the Creator (recurring subscription or one-off purchase).
• Creator Content: any material published by the Creator on the Store, on their Telegram channels or groups, or in any communication with their Buyers.
• Bot: the official @grouptizer_bot bot, which verifies whether a request to join a Telegram channel or group matches a valid purchase.
• Stripe: Stripe Payments Europe, Ltd. (Ireland) and its affiliates, the independent payments provider used by the Creator to charge Buyers.
• Telegram: Telegram FZ-LLC and its affiliates, the independent messaging provider on which the Bot operates.
• Stripe Connect Standard: the Stripe Connect tier under which the Creator enters into Stripe’s terms directly and keeps their own Stripe account connected to Grouptizer.
• Plan: the service tier subscribed by the Creator with Grouptizer (Free, Starter, Pro or Scale).

3. Purpose and nature of the service

Grouptizer is an information society service provider that offers technical infrastructure so that anyone can monetise access to private Telegram channels or groups. The Platform has three components:

1. A public Store at grouptizer.com/[slug] where Buyers purchase access.
2. A Creator dashboard to configure the Store, Products, prices and integrations with Stripe and Telegram.
3. A Buyer area to manage purchases, subscriptions and Telegram access.

Grouptizer acts solely as technical infrastructure provider. In particular:

• Grouptizer is not a party to the sale agreement entered into between the Creator and the Buyer. That contract is formed directly between them at the time of payment.
• Grouptizer is not a merchant, intermediary or agent of the Creator.
• Grouptizer does not process payments. Processing is carried out by Stripe through the Creator’s own Stripe Connect Standard account.
• Grouptizer never holds funds.
• Grouptizer does not control the Content published by the Creator on Telegram channels or groups and does not guarantee its legality, quality or accuracy.
• For the purposes of article 16 LSSI-CE, Grouptizer is a hosting service provider with respect to the content uploaded by the Creator to the Store and will act with due diligence to remove or block access to manifestly unlawful content once it has actual knowledge of it.

4. Account registration and requirements

To use the Platform as Creator or Buyer, an account is required. The User represents and warrants that:

• They are at least 18 years of age and have full legal capacity to enter into agreements under Spanish law.
• The information provided is truthful, accurate and current, and they will keep it up to date.
• They use a single personal account. Creating duplicate accounts, assigning the account to third parties or sharing credentials is prohibited.
• They will take reasonable steps to preserve the confidentiality of their password and will notify Grouptizer of any suspected unauthorised access.

Grouptizer may refuse a registration, suspend an account or request additional verification where there is reasonable evidence of non-compliance.

5. Services for Creators

Grouptizer offers the Creator the following services:

• Creation and configuration of one or more Stores, with customisation of logo, images, description, features, FAQ, social links and reviews.
• Connection to Stripe Connect Standard via OAuth authorisation. The Creator enters into Stripe Connected Account terms directly with Stripe. Grouptizer does not access Stripe credentials or Buyer card data.
• Connection to Telegram by inviting the Bot to the channel or group and granting the necessary administrator permissions to approve join requests and remove users whose subscriptions have lapsed.
• Management of Products, prices, subscriptions, customers, reviews, public questions, refunds (at the Creator’s discretion), disputes and payout data.
• Access to the Creator dashboard and to the public product documentation.

6. Services for Buyers

Grouptizer offers the Buyer the following services:

• Access to the Creator’s Store and purchase of Products via Stripe.
• After purchase, linking to Telegram via Telegram’s login method so the Bot can identify the Buyer and approve their join request.
• A personal area to manage subscriptions, view purchases, download receipts issued by Stripe on behalf of the Creator and request refunds from the Creator.
• A single Buyer account is valid across every Store the Buyer purchases from.

7. Grouptizer plans and commissions to the Creator

Grouptizer is remunerated under two separate items:

• A monthly or annual Plan fee paid by the Creator to Grouptizer.
• A variable commission on each sale made on the Store.

The Plans in force as of the last update are listed below. The Plan fee is invoiced in EUR to Creators established in countries of the eurozone, in GBP to Creators established in the United Kingdom, and in USD to Creators established in any other country. The applicable currency is determined at the time of the Creator’s first subscription and remains in force for all subsequent renewals.

	Free	Starter	Pro	Scale
Monthly fee (EUR)	€0	€29	€99	€299
Annual fee (EUR)	€0	€290	€990	€2,990
Monthly fee (USD)	$0	$29	$99	$299
Annual fee (USD)	$0	$290	$990	$2,990
Monthly fee (GBP)	£0	£25	£85	£249
Annual fee (GBP)	£0	£250	£850	£2,490
Sale commission	10%	3.5%	2%	1%

All amounts are stated exclusive of VAT. Grouptizer will apply VAT or equivalent taxes according to the Creator’s tax status and place of establishment.

The Plan invoice is issued by Grouptizer to the Creator at the time of charge. The variable commission is deducted directly from the amount transferred by Stripe to the Creator’s account; Grouptizer issues a periodic invoice to the Creator for the commissions accrued.

Plan subscriptions are renewed automatically. The Creator may cancel the Plan at any time from the dashboard; cancellation takes effect at the end of the current billing cycle, with no refund for the period already started, under article 103.m of the consolidated text of the General Law for the Defence of Consumers and Users (TRLGDCU), since this is a digital service whose performance starts with the Creator’s express consent and waiver of the right of withdrawal.

8. Changes to prices and terms

Grouptizer may change Plan prices, commissions, features included in each Plan and these Terms at any time.

Any change that affects the Creator economically or materially reduces the scope of the service will be notified with at least 30 days’ prior notice by email to the registered address. During that period the Creator may cancel the Plan without penalty and the new terms will not apply until the next billing period.

Changes that are strictly favourable to the User, typographical corrections, adjustments to regulatory changes and updates to the provider’s identifying information may take effect immediately.

9. Relationship between Creator and Buyer (Grouptizer is not a party)

The sale agreement for the Product is entered into directly and exclusively between the Creator and the Buyer. As a result:

• The seller towards the Buyer is the Creator. Where applicable, it is the Creator who invoices the Buyer in accordance with their own tax position.
• Stripe acts as the payment processor of the Creator. Receipts and collection are issued from the Creator’s Stripe account.
• Grouptizer is not liable for the quality, legality, delivery, suitability or accuracy of the Creator Content, nor for the Creator’s compliance with tax, commercial or consumer obligations vis-à-vis the Buyer.
• The Buyer’s complaints about the product or service purchased must be addressed to the Creator. Grouptizer may help facilitate contact but will not step into the Creator’s position.

10. Acceptable use and prohibited activities

The Creator is solely responsible for the Content published on the Store and on their Telegram channels or groups. It is strictly prohibited to use Grouptizer to offer, promote or sell Products related to the following activities:

10.1 Stripe-restricted activities

Because the payment infrastructure relies on Stripe, the Creator agrees not to breach Stripe’s Restricted Businesses list as in force from time to time (https://stripe.com/legal/restricted-businesses). In particular, but without limitation, the following are prohibited:

• Unlicensed financial services, unregulated currency exchange, high-yield investment programs.
• Pyramid schemes, multi-level marketing without a real product, get-rich-quick programs.
• Counterfeit goods or goods infringing third-party intellectual or industrial property.
• Controlled substances, chemical precursors, drug paraphernalia and synthetic cannabinoids.
• Firearms, ammunition, explosives and similar devices.
• Non-consensual sexual content, content involving minors, content promoting sexual violence or human trafficking.
• Gambling, lotteries and similar activities not duly licensed in the Buyer’s jurisdiction.
• Escort services or in-person sexual intermediation services.
• Medical devices, healthcare products or medication without the relevant authorisations.
• Any other activity included in Stripe’s policy at the time of the transaction.

The Creator is responsible for periodically reviewing Stripe’s policy and adapting the Store. If an activity is later added to Stripe’s list, the Creator must cease that activity on the Store with immediate effect. The Creator must also keep the legal policies and contact details required by Stripe published and current on the Store; their absence or being out of date may lead to the suspension or closure of the Creator’s Stripe Connect account.

10.2 Additional Grouptizer restrictions

In addition to Stripe’s restrictions, Grouptizer expressly prohibits:

• Adult, erotic or pornographic content of any kind, even where its exploitation is lawful in the Creator’s jurisdiction. Grouptizer does not provide the dedicated payment infrastructure required for adult content.
• Unauthorised resale or redistribution of courses, books, software, films, series, music, manuals, templates, leaked files or any content whose intellectual property does not belong to the Creator or whose licence does not allow redistribution.
• Shared, cracked or pirated software accounts or licences, including streaming platform accounts, unauthorised IPTV, key generators and DRM-stripped software.
• Services intended to circumvent third-party terms of use, including abusive automation bots, follower generators, account farms and similar.

10.3 General conduct

The User, whether Creator or Buyer, is also prohibited from:

• Impersonating any other person or entity.
• Systematic scraping, reverse engineering, decompilation or disassembly of the Bot or the Platform beyond what is legally permitted.
• Sending unsolicited commercial communications through the Platform or using data obtained from it.
• Circumventing the technical access controls (including sharing Telegram invitations with people who have not purchased).
• Making fraudulent charges, abusing disputes or refunds, or using payment instruments without the holder’s authorisation.
• Interfering with the availability or performance of the Service, including any denial-of-service attempt, intrusion or exploitation of vulnerabilities.

10.4 Consequences of non-compliance

When Grouptizer becomes aware, by any means, of a possible breach of this section, it may take, without prior notice and without prejudice to any legal action, one or more of the following measures:

• Precautionary suspension of the account and Store while the facts are investigated.
• Closure of the Store and removal of the content.
• Cancellation of the account of the Creator or Buyer.
• Revocation of the Buyer’s access to the Telegram channel or group, instructing the Bot to remove them.
• Retention of accrued commissions and pending transfers until the situation is regularised.
• Notice to Stripe and the competent authorities where a legal obligation exists or where the breach is criminally or administratively significant.

11. Creator’s responsibilities

In addition to the rest of this document, the Creator is responsible for:

• Complying with their own tax regulations and issuing the relevant invoices to Buyers under the regulations that apply to them.
• Complying with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD) regarding the processing of personal data of their Buyers and subscribers. The Creator acts as data controller for any data collected outside of Grouptizer’s standard flow.
• Moderating the Telegram channels and groups associated with the Store, addressing user notices and removing unlawful content.
• Publishing and keeping up to date their own privacy policy, terms and refund policy, as well as their legal identity and contact details, in accordance with the laws applicable to them and with Stripe’s requirements. This responsibility lies with the Creator whether they use the templates generated by Grouptizer or link their own.
• Handling disputes and chargebacks raised at Stripe directly, providing the necessary evidence.
• Keeping the Stripe Connect Standard account active and KYC-compliant. Inactivity or closure of the Stripe account prevents Grouptizer from providing the service.
• Keeping available the means necessary for Buyers to cancel the subscription, update their payment method and download invoices, including after the Creator has disconnected the payment providers integrated with the Platform, in accordance with applicable consumer protection law.
• Maintaining the Bot with the necessary permissions in the channels or groups. Revoking permissions prevents the Bot from revoking access; revocation remains the Creator’s responsibility.
• Indemnifying and holding Grouptizer harmless against any third-party claim arising from the Creator Content, from the Creator’s tax or consumer non-compliance, or from any breach of this document by the Creator.

Grouptizer may offer the Creator automatically generated legal text templates as a mere convenience. Such templates are provided “as is”, do not constitute legal advice and are not warranted to be sufficient, accurate or suitable for the Creator’s particular situation, sector or jurisdiction. The Creator is solely responsible for reviewing, adapting and verifying their legal compliance before publishing them, and bears sole responsibility for the consequences — including penalties, consumer claims or closure of their Stripe account — arising from the policies and details published on their Store.

12. Buyer’s responsibilities

The Buyer is responsible for:

• Paying the subscriptions and one-off purchases, and keeping their payment card or method up to date in Stripe.
• Not sharing the Telegram channel or group invitation with third parties. Access is personal and non-transferable.
• Managing the subscription and payment data through the Buyer portal or the Stripe portal.
• Raising any issue about the content or access purchased with the Creator first.

13. Refunds and disputes

Grouptizer does not issue refunds on sales made by the Creator. The refund policy is the Creator’s sole decision and must be displayed on the Store. The Buyer must address refund requests to the Creator, who will handle them according to the published policy.

The actual refund is issued through Stripe; the usual settlement period for the Buyer is 5 to 10 business days.

Refunding a purchase does not automatically revoke access to the Telegram channel or group, nor does it cancel a recurring subscription. The Creator may revoke access from the dashboard whenever they consider it appropriate.

Disputes or chargebacks initiated by the Buyer with their bank are handled entirely through Stripe between Stripe and the Creator. Grouptizer records the dispute outcome for informational purposes but is not a party.

With respect to the Plans subscribed by the Creator with Grouptizer, the Creator acknowledges and accepts that the service starts immediately upon subscription and therefore waives the right of withdrawal provided in article 102 TRLGDCU, under the exception of article 103.m TRLGDCU for digital services started with the consumer’s express consent.

14. Intellectual and industrial property

• Grouptizer is the trade name under which the provider operates. Although it is not currently registered as a trademark, it remains protected against confusion and unfair use under Spanish Law 3/1991 of 10 January on Unfair Competition. The Grouptizer logos, trade names and other distinctive elements are the exclusive property of the provider and may not be used without prior written authorisation.
• The software and text of the Platform are protected by Spanish Royal Legislative Decree 1/1996 (LPI) and applicable international rules. The User is granted a personal, non-transferable, revocable, limited licence to use the Service under this document. No other rights are granted.
• The Creator Content remains the property of the Creator. The Creator grants Grouptizer a worldwide, non-exclusive, royalty-free, revocable licence to host, display, index and reproduce that content strictly as needed to operate the Service (display it on the Store, generate previews, send notifications to the Buyer, etc.). The licence ends when the content is removed or the Store is closed.
• The Buyer obtains only a personal right of access to the Telegram channel or group purchased. The Buyer obtains no right of reproduction, communication to the public, transformation or distribution over the Creator Content. Recording or redistributing the Creator Content requires the express authorisation of the Creator and, where applicable, of any third-party rights holders.

15. Service availability and limitation of liability

The Service is provided “as is” and “as available”, with no express or implied warranty of uninterrupted operation, absence of errors or specific commercial outcomes. Grouptizer makes reasonable efforts to maintain availability but does not commit to a specific uptime level.

To the maximum extent permitted by applicable law, Grouptizer is not liable for:

• Indirect losses, loss of profit, loss of business opportunities, loss of goodwill or reputation.
• Losses arising from temporary unavailability of the Service, Stripe or Telegram.
• Losses arising from the actions of the Creator vis-à-vis the Buyer or vice versa.
• Losses arising from the loss or theft of credentials attributable to the User.

With respect to the Creator, Grouptizer’s maximum aggregate liability for any claim arising from the Service is limited to the amount actually paid by the Creator to Grouptizer for Plan and commissions during the twelve months preceding the event giving rise to the claim.

With respect to the Buyer in their capacity as consumer, no provision in this section excludes or limits Grouptizer’s liability for wilful misconduct, gross negligence, personal injury or any case in which consumer protection rules do not allow limitation, under article 86 TRLGDCU.

16. Suspension and termination

Grouptizer may suspend or terminate the User’s account, in whole or in part, in the following cases:

• Breach of any obligation under this document, in particular section 10.
• Reasonable suspicion of fraudulent or unlawful activity, or activity that may compromise the security of the Platform or third parties.
• Order from a competent administrative or judicial authority.
• Prolonged account inactivity, within the periods communicated.
• Unilateral decision by the provider with at least 30 days’ prior notice without cause, in which case the Creator will receive a refund of the unused portion of the Plan fee already paid.

The User may close their account at any time from the dashboard or in writing to the contact email, without prejudice to legal record-keeping obligations.

Termination of the account does not affect obligations accrued beforehand nor clauses that by their nature should remain in force (intellectual property, limitation of liability, governing law, jurisdiction).

17. Changes to the service

Grouptizer evolves continuously. The provider reserves the right to add, modify or retire features, take the Service offline for maintenance or introduce technical changes when needed. When a change materially reduces the scope of the Service, the notice regime in section 8 applies.

18. Assignment

The User may not assign the rights and obligations under this document without Grouptizer’s prior written consent.

Grouptizer may assign this document, in whole or in part, to a successor company of the provider, to a company within the same group or to a third party in the context of a corporate transaction (merger, spin-off, contribution of a line of business, asset sale). In such case, the User will be notified by email with at least 30 days’ prior notice. The User may cancel their account without penalty if they do not accept the assignment.

19. Governing law and jurisdiction

This document is governed by Spanish law.

• Disputes between Grouptizer and a Creator or any other User acting in the course of their business or professional activity (B2B) are submitted to the Courts of the provider’s domicile (Madrid), with express waiver of any other jurisdiction that might apply.
• Disputes with a User acting as consumer within the meaning of article 3 TRLGDCU are submitted to the Courts of the consumer’s domicile, under article 90.2 TRLGDCU.

20. Out-of-court dispute resolution

Under Regulation (EU) 524/2013, consumer Users domiciled in the European Union may submit complaints through the European online dispute resolution platform (ODR) at https://ec.europa.eu/consumers/odr. As of the last update, Grouptizer is not affiliated with any consumer arbitration scheme; any future affiliation will be communicated through an update to this section.

---

Block II — Privacy policy

21. Data controller

For the purposes of Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), the data controller for personal data collected through the Platform is the provider identified in section 1.

Given the current scale of the project, no Data Protection Officer (DPO) has been appointed, as the conditions of article 37 GDPR do not apply. Privacy-related communications can be sent to privacy@grouptizer.com.

22. Purposes, legal bases and categories of data

Data subject	Data processed	Purpose	Legal basis
Creator	Email, hashed password, trade name, Plan data, billed amounts, connection IP, images uploaded to the Store (logo, product images and other graphic assets), business legal identity published on the Store (tax identification number, registry details, address and support email)	Account opening and management, service provision, billing of Plan and commissions, public display of the Store, generation and publication of the Store’s legal policies and contact details	Performance of the contract (art. 6.1.b GDPR) and compliance with tax and accounting obligations (art. 6.1.c GDPR)
Creator	Telegram channel or group identifier and name, Stripe Connect account identifier	Technical integration with Telegram and Stripe	Performance of the contract (art. 6.1.b GDPR)
Buyer	Email, hashed password, Telegram identifier and username, purchase and subscription history, connection IP	Account opening and management, identification by the Bot, customer support	Performance of the contract (art. 6.1.b GDPR)
Buyer	Card data and other payment means	Not processed by Grouptizer. Collected and processed by Stripe as an independent controller	Not applicable to Grouptizer
Any User	Technical logs, device identifiers, security records	Platform security, fraud prevention, technical debugging	Legitimate interest of the controller (art. 6.1.f GDPR)
Any User	Contact details for transactional communications (sign-up, password recovery, receipt, subscription expiry)	Communications inherent to providing the Service	Performance of the contract (art. 6.1.b GDPR)
Any User	Data for commercial communications about Grouptizer	Marketing of Grouptizer’s own products and services	Express consent of the data subject, revocable at any time (art. 6.1.a GDPR)

Grouptizer does not take automated decisions with significant legal effects on Users. Grouptizer does not transfer or sell personal data to third parties for advertising purposes.

23. Retention periods

• Creator account data: while the account remains active. After closure, personal identifiers are anonymised, except for those fields that must be kept to comply with legal obligations.
• Accounting and tax data (invoices, receipts, collection records): 6 years from the last transaction, under article 30 of the Spanish Commercial Code, and 4 years for tax purposes, under article 66 of the General Tax Law.
• Buyer account data: while the account remains active. Upon request for erasure by the data subject, identifying data are anonymised immediately and, in any case, within 30 days, unless legal retention obligations apply.
• Technical and security logs: up to 12 months from generation, unless needed to investigate a specific incident.

Anonymisation consists in replacing personal identifiers (email, name, Telegram username, Stripe identifiers) with irreversibly dissociated values, preserving the referential integrity of transaction records but with no possibility of re-identification. Under recital 26 GDPR, anonymised data fall outside the scope of the Regulation.

24. Data processors and third parties

To deliver the Service, Grouptizer relies on the following providers acting as data processors or independent controllers, depending on the case:

Provider	Role	Data location	Transfer framework
Cloudflare, Inc.	(1) Content delivery network (CDN), managed DNS, DDoS protection and TLS termination for the grouptizer.com domain and its subdomains. Processes IP addresses, request headers and technical browser identifiers. May set strictly necessary security cookies (__cf_bm, cf_clearance). (2) Cloudflare R2: object storage for the images uploaded by the Creator to the Store (logo, product images and other graphic assets). (3) Cloudflare Turnstile: anti-fraud and anti-bot verification on registration and other sensitive forms. Processes IP, browser characteristics, device identifiers and interaction patterns to distinguish human from automated traffic	Global edge network; headquartered in the United States	EU Standard Contractual Clauses and Data Privacy Framework (DPF) certification
DigitalOcean, LLC	Hosting of the Platform and database	Frankfurt (Germany), European Economic Area	No international transfer
Stripe Payments Europe, Ltd	Payment processing. Independent controller for payment data	Ireland (European HQ); may process data in the United States	EU Standard Contractual Clauses and Data Privacy Framework (DPF) certification
Telegram FZ-LLC	Buyer OAuth authentication and Bot operation. Independent controller for data processed through its platform	United Arab Emirates and other group locations	Equivalent safeguards under article 46 GDPR. Use of Telegram is also governed by its own terms and privacy policy
Sinch Email (Mailgun)	Sending of automated transactional communications from no-reply@grouptizer.com	EU region (api.eu.mailgun.net), European Economic Area	No international transfer for primary storage; the parent provider may access under Standard Contractual Clauses and DPF certification
IONOS SE	Hosting of the grouptizer.com mailboxes (info@, legal@, privacy@) and routing of the provider’s inbound and outbound manual communications	Germany, European Economic Area	No international transfer

Grouptizer enters into a data processing agreement under article 28 GDPR with each processor. The list may be updated as the service evolves; updates will be reflected in this table.

In addition, data may be disclosed to competent public authorities when a legal obligation or an administrative or judicial order applies.

25. Cookies and similar technologies

The Platform uses only strictly necessary technical and session cookies to authenticate the User, keep the session active and preserve security. These cookies are exempt from prior consent under article 22.2 LSSI-CE and the AEPD Cookies Guide (2023).

Grouptizer does not use analytics, advertising or personalisation cookies, nor third-party pixels (Meta, TikTok, Google Ads). Should any be added in the future, prior consent will be requested through a compliant mechanism.

26. Rights of the data subject

The User may exercise the following rights set out in articles 15 to 22 GDPR and in the LOPDGDD:

• Access to their personal data.
• Rectification of inaccurate or incomplete data.
• Erasure (“right to be forgotten”). Where referential integrity of the Service or legal obligations prevent it, Grouptizer will deliver erasure through irreversible anonymisation.
• Restriction of processing.
• Portability of the data provided by the data subject.
• Objection to processing based on legitimate interest.
• Withdrawal of consent previously given, without retroactive effect.

These rights are free of charge and can be exercised by writing to privacy@grouptizer.com from the email address registered on the account, or in writing to the provider’s address. Grouptizer will respond within one month of receipt of the request, extendable by two further months in complex cases, under article 12.3 GDPR.

27. Right to lodge a complaint

If the User considers that the processing of their data does not comply with applicable law, they have the right to lodge a complaint with the Spanish Data Protection Agency (https://www.aepd.es), without prejudice to any other administrative or judicial remedy.

28. Security and technical measures

Grouptizer applies reasonable technical and organisational measures to ensure a level of security appropriate to the risk of processing, including:

• Encryption in transit through TLS for every connection with the Platform.
• Irreversible hashing of passwords with brute-force resistant algorithms.
• Access control based on the principle of least privilege.
• Backups with retention and encryption at rest.
• Records of processing activities for critical operations (article 30 GDPR).
• Breach notification procedures to the AEPD and, where applicable, to data subjects within the deadlines of article 33 GDPR (72 hours).

No technical measure guarantees absolute security. The User is co-responsible for the confidentiality of their credentials under section 4.

29. Minors

The Platform is not directed to anyone under 18. Grouptizer does not knowingly collect personal data from minors. If an account is found to belong to a minor, it will be suspended immediately and the data will be erased as soon as possible.

30. Changes to the policy

This policy may be updated to reflect regulatory, technical or service changes. Material changes will be notified to the User with at least 30 days’ prior notice by email to the registered address. Minor updates will be published with the last review date indicated at the top of the document.

---

Final provisions

Severability. If a competent authority declares any provision of this document null, illegal or unenforceable, the invalidity will affect only that clause and it will be deemed replaced by the most analogous statutory default. The remainder of the document will remain fully effective.

Forbearance. Grouptizer’s failure to enforce strict compliance with any provision does not amount to a waiver and does not prevent later enforcement.

Language. The master language of this document is Spanish. The English translation published at /legal is provided as a courtesy and is not binding. In case of any discrepancy, interpretive divergence or translation defect, the Spanish version prevails.

Version. Document version 1.0, in force as of 13 May 2026.