SPARR Privacy Policy

SPARR is a product of NextMove, a company registered in Amman, the Hashemite Kingdom of Jordan. NextMove operates the SPARR mobile applications for Android and iOS, the SPARR website at sparr.world, and the SPARR Hub dashboard used by partner gyms (together, the "Platform"). "SPARR" is a brand and trading name. The legal entity responsible for your personal data — the data controller — is NextMove. Where this policy says "we", "us" or "our", it means NextMove acting as the operator of SPARR. Data controller: NextMove Company website: nextmoveinternational.com Registered in: Amman, Hashemite Kingdom of Jordan Privacy contact: sparrworld@gmail.com If you are in a country that requires us to name a local representative and we have appointed one, their details will be published in this section.

This policy applies to everyone who uses SPARR: fighters and individual users of the mobile apps, visitors to sparr.world, and staff of partner gyms who use the Hub dashboard. It is written to meet the requirements of Jordan's Personal Data Protection Law No. (24) of 2023, the EU General Data Protection Regulation (GDPR) and the UK GDPR, the Google Play Developer Program Policies and Data Safety requirements, the Apple App Store Review Guidelines and App Privacy requirements, and the general data protection frameworks in force across the Gulf and the United States. Where a specific law gives you rights beyond what is described here, that law applies to you in addition to this policy. Separate documents govern other things: the User Terms of Service cover your use of the app and the assumption of risk that comes with martial arts training, and the Hub Partner Terms of Service cover what a gym may do with the data it can see. Both are at sparr.world/legal. We have tried to describe what the software actually does rather than what a template would allow us to do. If you find something in the app that this policy does not describe, tell us and we will correct the policy.

We collect what SPARR needs to work: your account details, the profile you build, your location while the app is open so the map can work, a record of the sessions you join and attend, and the photos and messages you choose to send. We use your location only while the app is in the foreground. We never track you in the background. Your profile is public to other SPARR users. That is the point of the app — other fighters need to see who you are before agreeing to train with you. We do not sell, rent or trade your personal data. We run no advertising on SPARR and we do not share your data with advertising networks or data brokers. We store your data with Google Firebase, which means it is held on servers outside Jordan. You can delete your account yourself, from inside the app or at sparr.world/legal/data-deletion. Age 16 and over only. Questions, requests, complaints: sparrworld@gmail.com.

Under the GDPR, the UK GDPR and Jordan's Personal Data Protection Law we must have a lawful basis for each thing we do with your data. Ours are as follows. To create and run your account, show your profile, deliver chat, run the map and record attendance — because it is necessary to perform the contract between you and us, being the Terms of Service you accepted. Without this data SPARR cannot function. To use your precise location for the map and nearby discovery — with your consent, given through the operating system permission prompt, which you may withdraw at any time in your device settings. To store and display your weight class — with your explicit consent, given by choosing to enter it, which you may withdraw by clearing the field. To send you push notifications — with your consent, given through the notification permission prompt. To keep the Platform safe: investigating reports, enforcing blocks, removing abusive content, suspending accounts, and preventing fraud and automated abuse — because we have a legitimate interest in a platform where people can arrange to meet strangers for a contact sport without being harmed, and you have a matching interest in being protected. We have weighed this against your privacy and consider it proportionate. To understand how SPARR is used and to fix faults — because we have a legitimate interest in a product that works. We keep this to aggregate product analytics and error diagnostics, and do not use it to build a profile of you. To send you service and security messages — because it is necessary to perform our contract with you and, for security notices, to comply with our legal obligations. To comply with law, respond to lawful requests, and establish or defend legal claims — because we have a legal obligation, or a legitimate interest in defending ourselves. We do not use your personal data for advertising, for marketing profiling, or for automated decisions producing legal effects concerning you.

SPARR is operated from Jordan, and our data is stored on Google Cloud infrastructure located outside Jordan, principally in the United States and the European Union. Some of our service providers are located in the United States, Ireland and the United Kingdom. This means your personal data is transferred across borders. Where the law requires a transfer mechanism, we rely on the following: For transfers out of the EEA and the UK — the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, which form part of our agreements with Google and our other providers, together with the technical measures described in section 14 For transfers out of Jordan — the conditions for cross-border transfer set out in Jordan's Personal Data Protection Law No. (24) of 2023, on the basis that the recipient applies an adequate level of protection under binding contractual terms You may request a copy of the relevant transfer safeguards by writing to sparrworld@gmail.com.

We keep personal data only as long as we need it. Account and profile data — for as long as your account exists Sessions, attendance records and your reliability record — for as long as your account exists Chat messages — for as long as your account exists, or until you or the other participants delete them Uploaded photographs and videos — until you delete them, or until your account is deleted Analytics and diagnostic data — retained by Google Analytics for Firebase for up to 14 months, and by Sentry for up to 90 days, in a form not linked to your profile Reports and moderation records — up to 24 months after the matter is closed, so that repeat behaviour can be recognised When you delete your account, we remove your personal data from our active systems within 30 days. Encrypted backups may retain it for up to a further 90 days before they are cycled out; during that period it is not accessible for ordinary use. We may keep a minimal record for longer where we are legally required to, or where it is necessary to defend a legal claim or to enforce a ban against someone removed for endangering other users.

You do not have to write to us to exercise most of your choices. Inside SPARR you can: Edit or clear any field on your profile at any time Turn off location visibility, so your city is not shown to others Revoke location, camera, photo and notification permissions in your device settings Delete individual photographs, messages and Memory Wall posts Block and report other users Hide individual sessions from your public profile Switch the entire app between English and Arabic Delete your account permanently — in Settings, or at sparr.world/legal/data-deletion, where you can sign in and submit a deletion request directly Account deletion is genuine and self-service. It is not a support ticket that we may or may not action.

Depending on where you live, you have some or all of the following rights over your personal data: Access — to be told whether we hold data about you, and to receive a copy Rectification — to have inaccurate data corrected and incomplete data completed Erasure — to have your data deleted Restriction — to have us stop using your data while a dispute about it is resolved Objection — to object to processing we carry out on the basis of legitimate interests Portability — to receive the data you gave us in a structured, machine-readable format, and to have it sent to another provider where technically feasible Withdrawal of consent — to withdraw any consent you gave, at any time, without affecting processing that already took place Complaint — to complain to your data protection authority To exercise any of these rights, write to sparrworld@gmail.com from the email address on your account, or use the deletion tool at sparr.world/legal/data-deletion. We will respond within 30 days. If your request is complex we may extend this by a further 30 days, and will tell you why. We do not charge for this. We may ask you to confirm your identity before we act, so that nobody else can use these rights to reach your data. If we refuse a request, we will tell you why and tell you how to challenge that refusal.

SPARR is for users aged 16 and over. This is a deliberate choice: the app arranges physical contact sport between people who may be strangers to one another, and that is not a service to offer to children. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we will delete the account and its data without delay. If you are a parent or guardian and you believe a child under 16 has created an account, write to sparrworld@gmail.com and we will act on it.

SPARR calculates your reliability record — sessions joined against sessions verified as attended — automatically, and displays it on your public profile. It is arithmetic on your own attendance history: not a prediction, not a score bought from a third party, and not a judgement about your character. We do not carry out profiling that produces legal effects concerning you or similarly significantly affects you. We do not use automated decision-making to suspend accounts: a person reviews reports before an account is suspended.

We protect your data with: Encryption in transit (TLS) for all communication between the apps, the website and our servers Encryption at rest for data stored in Google Cloud Server-side access rules in Cloud Firestore that enforce who may read and write each record, rather than relying on the app to behave Authentication handled by Google Firebase, so that we never store your password Restricted administrative access, limited to those who need it to operate the service Review of the access rules whenever the data model changes Two things you should know honestly. First, in-app chat is stored on our servers and is not end-to-end encrypted — do not send financial details, identity documents or anything else you would not want recovered. Second, no system is perfectly secure, and we cannot guarantee absolute security. Please help us: use a strong and unique password, do not share your account, and tell us at sparrworld@gmail.com if you believe someone else has accessed it.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, as required by the GDPR, and notify the Jordanian authority within the period its law requires. Where the breach is likely to result in a high risk to you, we will tell you directly and without undue delay, describing what happened, what data was involved, what we are doing about it, and what you should do. If you believe you have found a security vulnerability in SPARR, please report it to sparrworld@gmail.com rather than disclosing it publicly. We will not pursue researchers who report in good faith and give us a reasonable opportunity to fix the issue.

The Google Play Data Safety section and the Apple App Store privacy label for SPARR are derived from this policy and are intended to be consistent with it. If you find a discrepancy between a store label and this document, treat this document as the accurate one and tell us, so that we can correct the label. SPARR requests the following permissions, and each is used only for the purpose given: Location, while in use — the map, nearby sessions, and attendance verification Camera — taking a profile photo, adding photos to a Memory Wall, and scanning session QR codes Photos and media — attaching a photo or video that you select Notifications — session reminders, chat messages and safety notices Internet and network state — to reach our servers Denying any of these permissions disables the feature that needs it, and nothing else.

We may update this policy as SPARR changes, or as the law does. The date at the top of this page is the date of the current version. If a change is material — a new category of data, a new purpose, a new recipient, or a reduction of your rights — we will tell you before it takes effect, through an in-app notice or by email, and give you a fair chance to read it. Continuing to use SPARR after that notice means you accept the updated policy. If you do not accept it, you can delete your account. We will not apply a materially different use to data we already hold about you without asking you first.

Data controller: NextMove — operator of SPARR Address: Al Rayyan Commercial Complex, 3rd floor, opposite Radio & Television, Amman, Hashemite Kingdom of Jordan Company: nextmoveinternational.com Privacy and data requests: sparrworld@gmail.com Delete your account: sparr.world/legal/data-deletion We aim to answer every privacy request within 30 days. If you are not satisfied with our answer, you may complain to your national data protection authority. In Jordan that is the competent unit at the Ministry of Digital Economy and Entrepreneurship; in the EEA it is your national supervisory authority; in the United Kingdom it is the Information Commissioner's Office. You do not have to come to us first, but we would rather you did — most problems are faster to fix directly.