# Privacy Policy

Last updated: October 7, 2026

The protection of your personal data is important to us.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you use the **Voya** mobile application, our websites, and related services.

We process personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) where applicable.

## 1. Data Controller

The controller responsible for the processing of personal data in connection with the Services is:

**Sunporter eMobility GmbH**

Email: info@sunporter.de

Phone:+49 171 9135539

For questions concerning the processing of your personal data or to exercise your data protection rights, you may contact us using the contact details above.

## 2. Who Can Use Voya

Voya provides services to different types of users, including:

**Customers**, who can discover and purchase available deals or products and receive vouchers that can be used with participating merchants.

**Merchants**, who can create and manage their business account, provide information about their business, manage their offers, and redeem customer vouchers.

Merchant and customer accounts are separate account types and may therefore involve different categories of personal data.

## 3. Personal Data We Collect

Depending on how you use the Services, we may process the following categories of personal data.

### 3.1 Customer Account Data

When you create and use a customer account, we may process:

* First name and last name

* Email address

* Telephone number

* Country

### 3.2 Merchant Account and Business Information

If you register as a merchant, we may process:

* First name and last name, where applicable

* Email address

* Telephone number

* Country

* Business or trading name

* Business address

* Business contact information

* Merchant category

* Business description

* Business logo and cover images

* Legal business information required for verification or regulatory purposes

Depending on the applicable requirements, merchant verification may require information such as:

* Legal company name

* Legal form

* Company registration number

* Tax identification information

* VAT identification number

* Country of registration

* Registered business address

* Other information reasonably required to verify the business

The information required may vary depending on the merchant’s country, business type, and applicable legal or regulatory requirements.

### 3.3 Payment Information

Payments are processed through third-party payment service providers.

Depending on the type of transaction and the payment service used, payment service providers may process payment card information, payment method information, transaction information, and other information necessary to authorize and process payments.

For merchants, additional financial or payout information may be required by the applicable payment service provider to enable payments or payouts. This may include bank account or other financial information required for verification and payment services.

### 3.4 Location Information

With your permission, Voya may access your device’s location.

Location information is used to provide location-based functionality, such as:

* Showing deals or participating merchants near you

* Displaying nearby available offers

### 3.5  Camera Access

Voya may request access to your device camera.

Camera access is used for functionality such as scanning QR codes associated with vouchers.

For example, a merchant may use the camera to scan a customer’s voucher QR code to verify and redeem the voucher.

## 4. How We Use Personal Data

We use personal data to provide and operate Voya, manage customer and merchant accounts, process purchases and vouchers, enable voucher redemption, provide location-based features, process reviews and ratings, provide support, maintain security, prevent fraud and abuse, and comply with legal obligations.

## 5. Data Transfer to Third Parties

We may share personal data with third-party service providers where necessary to operate the Services, including payment service providers, email service providers, and hosting or cloud service providers.

We may also disclose personal data to competent authorities, courts, or other parties where required by law or necessary to protect our legal rights.

No personal data is shared for advertising, marketing, or tracking purposes.

## 6. Data Retention and Account Deletion

We retain personal data only for as long as necessary to provide the Services, fulfill the purposes described in this Privacy Policy, or comply with legal obligations.

You may request deletion of your Voya account through the account deletion option available in the app or through our external account deletion webpage.

After a deletion request, you will no longer be able to perform actions using the account in the app. Personal data, including account information, purchase history, voucher information, and related personal data, will be permanently deleted within three (3) months, unless certain information must be retained to comply with legal obligations, prevent fraud, resolve disputes, or establish, exercise, or defend legal claims.

## 7. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or unauthorized disclosure.

## 8. Your Rights

Depending on applicable law, you may have the right to:

* Access your personal data

* Correct inaccurate or incomplete personal data

* Request deletion of your personal data

* Request data portability

* Object to certain processing

* Withdraw consent where processing is based on consent

You also have the right to lodge a complaint with a competent data protection authority.

You may exercise these rights through the available options in the Services or by contacting us using the contact details provided above.

## 9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be reflected by updating the „Last updated“ date above.