TERMS AND CONDITIONS

9 September 2026

Effective Date: 12.09.2026

§1. General

1. These Terms and Conditions define the rules of using the "GIRL" Application, in

particular the types and scope of the Services provided, the terms and conditions of

concluding and terminating the agreement for the provision of Services by electronic

means and the complaint procedure.

2. The Service Provider and Operator of the Application is GIRL Spółka z ograniczoną

odpowiedzialnością with its registered office in Warsaw at Hoża 86/410, 00-682

Warsaw, entered into the register of entrepreneurs kept by the District Court for the m.st

of Warsaw in Warsaw, XII Commercial Division of the National Court Register under

KRS number 0001194379, share capital PLN 7500.00, NIP 7011278458, REGON

542783554.

3. Contact with the Service Provider is possible at the e-mail address: kontakt@girl-

app.com.

4. The application is intended only for natural persons who are over 18 years of age and

have full legal capacity.

5. The Terms and Conditions are made available to the User free of charge prior to

concluding the agreement for the provision of Services by electronic means, in a way

that allows them to be obtained, reproduced, recorded and stored.

6. The use of the Application requires reading the Terms and Conditions and the following

documents related to the Terms and Conditions:

1. Community Code,

2. Privacy Policy,

3. Cookies and Tracking Technology Policy.

7. Registering an account in the Application and using the Application means acceptance

of the Terms and Conditions and the related documents indicated above.

§2. Definitions

For the purposes of the Terms and Conditions, the following terms have the meaning given to

them below:

1. "Application" – a mobile application for Android and iOS, made available by the

Service Provider, used to use GIRL on a Mobile Device. The app is available for free

download and use. The app is not designed to work on tablets; running the Application

on a tablet may cause it to malfunction;

2. "Community Code" – a document defining the rules of conduct in the GIRL

community, including prohibited behaviors and the consequences of violating them;

3. "Account" – a set of resources and data created in the Application, enabling access to

the functionalities of the Application made available to the User in the Application after

the registration process, and in the scope of functionalities requiring identity

confirmation – after the verification process; enabling the identification of the User and

access to a separate part of the Application, including the management of personal data,

consents, settings and the use of the User's profile;

4. "Cookies and Tracking Technologies Policy" – an information document describing

the rules for the use of cookies and other tracking technologies (such as device

identifiers, local storage, SDK) in the Application, including the types of technologies

used, the purposes of their use, the data storage period and the method of giving and

withdrawing consent by the User, made available in the Application;

5. "Privacy Policy" – an information document describing the principles of processing

and protection of personal data of the Users of the Application, in particular the scope

of data, purposes, legal bases, storage period and rights of data subjects, required by the

provisions of the GDPR and made available in the Application;

6. 7. "Terms and Conditions" – these Terms and Conditions;

"GDPR" – Regulation (EU) 2016/679 of the European Parliament and of the Council

of 27 April 2016 on the protection of natural persons with regard to the processing of

personal data and on the free movement of such data, and repealing Directive 95/46/EC;

8. "Force Majeure" – an external event that the User and the Service Provider could not

have foreseen and prevented. It prevents the use of the Application in whole or in part,

permanently or for a certain period of time, which the User or the Service Provider could

not prevent with due diligence. It is not the result of errors or omissions of the User or

the Service Provider affected by its operation;

9. "User Content" – content of any kind (including photos, texts, comments and other

materials) added to the Application by the Users, and not by the Service Provider;

10. "Mobile Device" – an electronic device of the User, having the Application installed,

allowing for processing, receiving and sending data without the need to maintain a wired

connection to the Internet;

11. "Services" or "GIRL" – services provided electronically by the Service Provider to

Users via the Application, in particular the functionalities described in §3 of the Terms

and Conditions;

12. "Service Provider" – GIRL Spółka z ograniczoną odpowiedzialnością with its

registered office in Warsaw;

13. "User" – a natural person who is at least 18 years old, has full legal capacity and has

created an account in the Application;

14. "Event" / "Meeting" – a meeting organized through the Application by the User or the

Service Provider, taking place outside the Application (offline);

15. "Verified User" – a User whose identity has been confirmed through the verification

mechanisms provided for in the Application (in particular, offline verification using a

QR code).

16. "Payment Operator" – Stripe Payments Europe Ltd., based in Ireland, and entities

within the Stripe group, providing electronic payment processing services and

payment settlement infrastructure within the Application.

17. "Stripe Connected Account" – a sub-account within the Payment Operator's system,

established by the Event Organizer to receive ticket payouts, integrated with their

bank account.

18. "Connected User" – a User with whom another User has established a mutual

connection via a QR code, enabling in particular individual communication (1:1 chat).

§3. Types and scope of Services

1. The Service Provider provides the following Services to the Users via the Application:

1. maintaining the User Account and enabling the management of the User's

profile,

2. 3. 4. 5. allowing you to search, subscribe to themed clubs and view their content,

sharing the calendar of Events and allowing you to sign up for Events,

enabling Verified Users to organize Events,

providing communication tools within the Events, including status messages and

group chats for participants in the Event; Event-related chat is ephemeral and

available until 3 days after the end of the Event, after which it expires and its

content is deleted, except where further retention is required by law or is

necessary to handle a safety report, establish, pursue or defend against claims

6. 7. 8. Allow you to add photos and other content related to Events.

running a system of verification of Users (e.g. using QR codes),

enabling communication between Users via:

a) group chats intended for participants of a given Event,

b) individual 1:1 chats between Connected Users,

including sending text messages, photos, locations, and other content allowed

by the App. Individual 1:1 chats are not ephemeral.

9. operating a system of engagement points and community statuses.

2. The Application is solely an intermediary platform facilitating contact between Users.

The Service Provider is not a party to agreements concluded between Users in

connection with the organization of or participation in Events and is not liable for their

content or performance.

3. The Service Provider may display sponsored, promoted or partner content in the

Application, including sponsored Events, recommendations and informational or

marketing communications.

4. 4Sponsored, promoted or partner content will be marked in a manner enabling Users to

distinguish it from other content available in the Application.

1. 2. 3. §4. Technical Terms and Conditions of Use of the App

To use the Application, it is necessary to:

1. A mobile device with one of the current and currently supported operating

systems such as Android or iOS,

2. an active Internet connection,

3. the current version of the Application downloaded from the official store (App

Store / Google Play).

The User is obliged to provide the Mobile Device and Internet connection on their own.

The costs of data transmission are borne by the User in accordance with the agreement

with the telecommunications operator.

The User of the Application is responsible for the quality of the Mobile Device used to

access the Services in the Application, including technical problems or technical

limitations occurring on this Mobile Device (firewalls – blockades, antivirus programs

and others), which may hinder or prevent the User from accessing the Services in the

Application.

4. The User may only use the Application on one Mobile Device at a time.

§5. Registration and User Account

1. 2. The use of the Application requires the creation of an Account.

In order to register, the User provides at least:

1. Name or nickname

2. Email address

3. date of birth,

4. profile picture.

In the next step, the User confirms the e-mail address by clicking on the appropriate

button in the e-mail sent to the e-mail address provided during registration. It is also

possible to log in to the Application via social accounts and accounts used to log in to

the store specific to the User's Mobile Device.

3. Upon registration, the User confirms that they are at least 18 years old and have read

the Terms and Conditions, Privacy Policy, Cookies and Tracking Technology Policy,

and Community Code.

4. You acknowledge that the technology used to create and maintain your Account is only

a basic element of the security system designed to protect the contents of your Account

from third-party hacking and requires you to follow best practices for Account security.

The Service Provider stipulates that the use of GIRL may be associated with a standard

risk associated with the use of the Internet and recommends Users to take appropriate

steps to minimize this risk.

5. In the case of registering an Account in the Application, the agreement is concluded for

an indefinite period of time.

6. The User is obliged to provide true, up-to-date and non-misleading data and to update

it in the event of its change.

7. It is prohibited to create an Account using the data of other people or to use a fictitious

identity.

8. The User may at any time, without giving a reason, resign from using the Application

by deleting the Account using the appropriate function in the Application or by

contacting the Service Provider by e-mail. Deletion of the Account results in the

termination of the agreement for the provision of Services by electronic means, subject

to the data retention periods specified in the Privacy Policy.

9. Uninstalling the Application from the Mobile Device does not mean deleting the

Account.

1. 2. §6. Rules for participation in Events

Events may be organized by the Service Provider or by Verified Users.

Participation in the Events is at your own risk and responsibility. The User is obliged to

behave appropriately, in particular in terms of personal safety and compliance with the

applicable legal provisions.

3. Descriptions of Events may include information regarding their nature, location,

potential risks and rules of participation. You should review this information before

signing up for an Event.

4. Some Events may be subject to a fee. Information about the price, payment method and

possible additional fees is each time indicated in the description of the Event.

5. Payments for paid Events are processed via an external Payment Operator under the

terms and conditions specified in §6a of these Terms & Conditions. The Service

Provider does not store full payment instrument data of Users, including credit card

numbers.

§6a. Payments and Commissions

1. The Event Organizer may enable the option to purchase tickets for the Event through

the Application.

2. For ticket sales through the Application, the Service Provider provides technical

intermediation and payment process support. The Service Provider is not a party to the

ticket sales agreement concluded between the Organizer and the participant.

3. The ticket price is determined gross by the Event Organizer, who bears full

responsibility for its compliance with applicable laws, including proper tax settlements

(e.g., VAT).

4. For providing the ticket sales intermediation service, the Service Provider is entitled to

a commission of 5% of the gross value of each ticket sold (hereinafter: the “Service

Fee”). The Service Fee is collected through the Payment Operator’s system in

connection with the transaction and is deducted before the funds due to the Organizer

are transferred to the Organizer.

5. The Service Fee (5% commission) is non-refundable and constitutes the Service

Provider's remuneration for the successful processing of the transaction. In the event of

an Event cancellation, a change of its date, or a voluntary refund initiated by the

participant (in accordance with the Organizer's policy), the participant is entitled to a

100% refund of the ticket price, whereby the cost of refunding the Service Fee shall

be borne entirely by the Organizer.

6. Irrespective of the Service Fee due to the Service Provider, the Payment Operator may

charge its own fees related to the handling and processing of payment transactions, in

accordance with the Payment Operator’s rules and current pricing. The Payment

Operator’s fees are independent of the Service Fee charged by the Service Provider.

7. The rules for cancellation of participation, cancellation of the Event, and the conditions

for returning funds to participants are specified by the Organizer in the Event

description, subject to mandatory consumer protection laws.

8. The logistical initiation and approval of refunds to the participant are carried out by

the Organizer via their panel in the Application.

9. Funds due to the Organizer from ticket sales are released for payout to the Organizer

after 2 days following the completion of a properly conducted Event. The delay in

releasing the funds is intended to increase settlement security and to enable the

handling of cases involving cancellation or improper performance of the Event,

refunds, complaints and other reports related to the Event.

10. The actual date on which the funds are credited to the Organizer’s bank account may be

later and depends, in particular, on the procedures of the Payment Operator, the

Organizer’s bank and other entities involved in processing the payment.

11. The Service Provider shall not be held liable for delays or failure to process payouts and

payments resulting from malfunctions, technical maintenance, or actions of the Payment

Operator, financial institutions, or banks.

12. To accept ticket payments, the Organizer is required to complete the registration and

identity verification procedure (KYC/AML) and maintain a Stripe Connected

Account, in compliance with the Payment Operator's terms (Stripe Connected Account

Agreement). Failure to pass verification prevents the payout of funds.

13. The Payment Operator applies its own security and anti-fraud procedures. In case of

reasonable suspicion of law violation or risk of abuse, the Payment Operator may

refuse to process a transaction, freeze funds on the Organizer's account, or request

additional verification, for which the Service Provider bears no liability.

14. The use of the payment features by Users and Organizers constitutes simultaneous

acceptance of the regulations and policies of the Payment Operator (Stripe).

15. In a situation where the balance of the Organizer's Stripe Connected Account is

insufficient to cover the requested refunds for participants (e.g., due to previous fund

withdrawals to a bank account), the Organizer's account shall enter a negative

balance status (overdraft). The Organizer agrees to immediately cover the resulting

debt to the Payment Operator or the Service Provider, in particular by authorizing the

automatic debiting of their linked bank account (Direct Debit) by the Payment

Operator.

16. The Organizer bears full financial responsibility for Disputes and Chargebacks

initiated by participants. In the event of a lost dispute, the Organizer is obliged to

return the ticket amount and cover any additional fees, penalties imposed by the

Payment Operator (Stripe) or card networks (Visa/Mastercard).

§7. User Content, Photos and Image

1. 2. You may add User Content to the App.

User Content may be visible:

1. for other Users participating in a given Event,

2. in the Explore section or within the theme club – according to the functionality

of the Application.

3. Photos shared in the Explore section or group gallery are ephemeral and are available

for the period indicated in the App (7 days), after which they can be automatically

deleted or archived in accordance with the Privacy Policy.

4. The User declares that he/she has all rights to the User Content, including the

dissemination of the image of the persons immortalized therein, and that their posting

in the Application does not violate the rights of third parties or legal provisions.

5. Content sent via group chats related to Events and individual 1:1 chats constitutes User

Content within the meaning of these Terms and Conditions.

6. You may not post User Content:

1. violating the privacy, personal rights or intellectual property rights of others,

2. containing vulgar, offensive, inciting violence, hatred or discrimination,

3. of a pornographic or erotic nature with the participation or appearance of minors,

7. 8. 4. which may constitute paedophilic content or other content related to the sexual

exploitation of children,

5. violating the law, including those concerning the protection of minors and

combating unfair competition.

The User grants the Service Provider a non-exclusive, free-of-charge license to use the

User Content to the extent necessary for the proper functioning of the Application, in

particular for their recording, display to other Users, technical storage and processing

in the Service Provider's ICT systems. The license expires at the latest at the moment of

removal of the User Content from the Application, liquidation of the Application or

termination of the provision of services described in these Terms and Conditions,

subject to copies necessary for evidentiary or archiving purposes provided for by law.

The use of photos containing the User's image for promotional or marketing purposes

of the Application outside its premises (e.g. in social media or advertising materials of

the Service Provider) takes place only on the basis of a separate, voluntary and explicit

consent of the User, which the User may withdraw at any time. Events at which the

Service Provider will photograph Users for the above purposes will be marked in the

Application.

1. 2. 3. 1. §8. Your Rights and Obligations

The User is obliged to use the Application in a manner that does not violate these Terms

and Conditions, applicable regulations or the rights of third parties. In particular, it is

prohibited to provide illegal content to the Application.

In particular, it is prohibited to:

1. post content that is offensive, illegal, vulgar or misleading,

2. setting up fictitious Events or Events contrary to their declared purpose,

3. disrupting the course of the Events or violating the safety of other Users,

4. violating the privacy and personal rights of other Users,

5. use the Application for purposes contrary to its purpose, in particular to "hunt"

participants, including stalking, manipulation, psychological abuse or economic

exploitation,

6. conducting hidden commercial activity, including advertising of products,

services, training, MLM, without the prior consent of the Service Provider,

7. circumvent the rules of communication in the Application in a way aimed at

circumventing security mechanisms (e.g. publishing contact details in

descriptions of Events).

The User acknowledges that any actions resulting in or aimed at violating the terms of

use of the Application set forth in these Terms and Conditions constitute a violation of

the provisions of these Terms and Conditions

§9. Reporting of violations and moderation

The User may report content, Events or behaviour of other Users that they consider to

be contrary to the law, the Terms of Service or the Community Code, using the "Report"

function or other channels made available by the Service Provider (including by e-mail:

kontakt@girl-app.com).

2. The service provider shall process reports within a reasonable time, guided by the

principle of proportionality and taking into account the nature of the infringement.

3. As a result of considering the application, the Service Provider may, in particular:

1. remove or block access to the disputed content,

2. limit the scope of the User's Account functionality,

3. temporarily suspend the User's Account,

4. permanently block the User's Account.

The Service Provider informs the User about the result of the consideration of the

application by e-mail to the e-mail address assigned to the User Account.

4. In the event of a reasonable suspicion of committing a crime or a threat to the safety of

minors, the Service Provider shall immediately provide the competent law enforcement

authorities with the information necessary to clarify the case, to the extent permitted by

applicable law.

§10. Violations and suspicious activities

1. The Service Provider may block, suspend or delete the User's Account if there is a

reasonable suspicion that the User:

1. 2. 3. is under 18 years of age,

provided false data during registration or in the course of using the Application,

violates the law or the provisions of the Terms and Conditions, the Community

Code or other related documents,

4. 5. acts to the detriment of other Users or the Service Provider,

has been repeatedly reported by other Users as a person abusing the functions of

the Application, and the reports have been deemed justified,

6. has not been verified by at least one Verified User for a period of 1 year (if this

mechanism is used as a condition of continued use of the Application).

2. Your Account may be blocked without prior notice if your behavior potentially

threatens the safety of the community or materially violates the law.

3. The Service Provider may temporarily limit the User's access to selected functions of

the Application for the duration of the investigation.

§11. Liability

1. The Service Provider shall not be liable for the content posted by Users in the

Application or for their actions within or outside the Application, and for any resulting

consequences, including the course of the Events, and for damages resulting from

actions of the Users that are not in accordance with the applicable law or the provisions

of these Terms and Conditions.

2. The Service Provider does not guarantee the availability of specific Events or the

effectiveness of matching Users to thematic groups.

3. The Service Provider takes due care to ensure that the Application operates continuously

and without interruptions, but reserves the right to temporarily suspend the operation of

the Application in whole or in part for technical, safety or maintenance reasons in

accordance with the paragraph below.

4. The Service Provider reserves the right to perform maintenance, repair and related

activities related to the modification and development of the functionality of the

Application. If possible, the Service Provider will perform these works at night, i.e.

between 24:00 - 6:00 a.m. The Service Provider makes every effort to notify Users about

planned maintenance, repair activities and related to the modification and development

of the functionality of the Application.

5. The Service Provider shall not be liable for problems in the functioning of the

Application if they occurred because of the following events:

1. malfunctioning of the Internet;

2. disruptions in the operation of the power grid;

3. disadvantages of data transmission;

4. the action of Force Majeure;

5. decisions of public authorities;

6. delays resulting from failures of systems, power supply systems and

telecommunications links, which the Service Provider could not have foreseen

or prevented with due diligence.

6. Nothing in the Terms and Conditions excludes or limits the Service Provider's liability

to the extent that it is not permissible under mandatory provisions of law, in particular

consumer protection regulations.

1. 2. §12. Intellectual Property Rights

The content, marks, logos, graphic elements and software of the Application (including

the source or output code) are protected under copyright or other intellectual property

laws and are the property of the Service Provider or their respective licensors.

It is prohibited to download, copy, modify, further distribute, reprint, make available in

any form (including in electronic form), processing in whole or in part, or otherwise use

the Application or its elements, beyond the permitted use and ordinary use of the

Application, without the prior written consent of the Service Provider.

§13. Complaints

1. The User has the right to file complaints regarding the operation of the Application and

the Services provided.

2. A complaint may be submitted in any way that reveals its content, including, for

example, by electronic means to the Service Provider's e-mail address: kontakt@girl-

app.com or by letter to the Service Provider's address.

3. The complaint should contain at least: the name and surname (or nickname) of the User,

the e-mail address of the User Account and a description of the objections (allegations).

4. The Service Provider shall consider the complaint within 30 days from the date of its

receipt and shall respond to the User at the e-mail address assigned to the Account.

5. Disputes between the Service Provider and the User who is a consumer may be resolved

amicably, in particular by means of proceedings conducted by one of the entities entered

in the register of entities authorised to conduct proceedings on out-of-court settlement

of consumer disputes kept by the President of the Office of Competition and Consumer

6. 7. Protection (https://polubowne.uokik.gov.pl/rejestr,5,pl.html). The proceedings are

conducted by such an entity on the basis of the procedures in force in a given entity.

The Service Provider agrees to participate in the out-of-court settlement of consumer

disputes.

A case may be considered by an arbitration court only after the complaint procedure has

been completed and only if both parties to the dispute agree to it.

1. 2. §14. Right of withdrawal

The User has the right to withdraw from the agreement for the provision of Services

without giving a reason within 14 days from the date of conclusion of the agreement,

i.e. from the moment of registration (applies to the User who is a consumer who has

registered in the Application). In order to exercise the right of withdrawal, the User

should submit a statement of withdrawal from the agreement (template in Appendix No.

1 to these Terms and Conditions) by e-mail to the address kontakt@girl-app.com or in

writing to the Service Provider's address specified in the Terms and Conditions,

whereby in order to meet the deadline, it is sufficient to send the statement in question

before the expiry of the deadline indicated above

§15. Amendment of the Terms and Conditions

The Service Provider reserves the right to make changes and modifications to the Terms

and Conditions in the event of important reasons. Only the following are considered to

be important reasons:

1. the need to adapt the Terms and Conditions to the provision of Services in a

situation objectively justified by the need to change the technical conditions for

the provision of Services;

2. changes in generally applicable provisions of law, which entail the need to

change the functioning of the Application or change the content of the Terms

and Conditions;

3. material changes to the functionality of the Application or the manner in which

the Services are provided;

4. a final court decision or a decision of a public administration body ordering the

amendment of the Regulations in the part specified therein;

5. the necessity to amend the provision of the Regulations affected by the invalidity

referred to in §17 section 3 below.

The Service Provider shall inform Users of any change to the Terms and Conditions in

good time, i.e. at least 7 days before the planned date of entry into force of the new

version of the Terms and Conditions. Information regarding changes to the Terms and

Conditions and the date of their entry into force will be communicated to Users in a way

that allows them to familiarize themselves with these changes – electronically through

a message in the Application or by delivering an e-mail to the address provided during

Account registration. The User is obliged to read the information submitted.

3. Users will be bound by the provisions of the new Terms and Conditions, unless they

terminate them within 14 days from the date of notification of their change by e-mail or

in the form of a message in the Application.

§16. Termination of Services

The Service Provider shall terminate the provision of Services at the time of termination

of the contract for the provision of Services or termination of business activity by the

Service Provider in the scope of the provision of Services described in the Terms and

Conditions.

§17. Final provisions

1. Any comments, comments and questions related to the Application should be sent to

the following e-mail address: kontakt@girl-app.com.

2. The Terms and Conditions are governed by Polish law.

3. If any provision of the Terms and Conditions is declared invalid by a final court

decision, the remaining provisions of the Terms and Conditions shall remain in full

force and effect.

4. In matters not regulated by the Terms and Conditions, the provisions of Polish law

apply, in particular the Civil Code, the Act on Copyright and Related Rights, the Act on

the Provision of Services by Electronic Means, the provisions on the protection of

personal data and Regulation (EU) 2022/2065 of the European Parliament and of the

Council of 19 October 2022 on the Single Market for Digital Services and amending

Directive 2000/31/EC.

5. Any disputes between the Service Provider and the User will be resolved by the

competent common court, subject to the provisions on consumer protection.

Appendix no. 1 – Withdrawal from the Agreement template

Addressee: GIRL Spółka z ograniczoną odpowiedzialnością with its registered office in

Warsaw, Hoża 86/410, 00-682 Warsaw, entered into the Register of Entrepreneurs of the

National Court Register under KRS number 0001194379, NIP 7011278458, REGON

542783554

or by e-mail to: kontakt@girl-app.com

Example message content:

I hereby inform you of my withdrawal from the contract for the services of the GIRL App.

Date of conclusion of the agreement:

Name and surname of the consumer:

Consumer address:

Date of withdrawal:

User's e-mail address provided during registration:

Signature of the consumer or consumers (required only for correspondence sent by traditional

means, in paper form).

Effective Date: 12.09.2026

§1. Personal data administrator

1. The administrator of the personal data of the Users of the Application is GIRL Spółka

z ograniczoną odpowiedzialnością with its registered office in Warsaw at Hoża

86/410, 00-682 Warsaw, entered into the register of entrepreneurs kept by the District

Court for the m.st of Warsaw in Warsaw, XII Commercial Division of the National

Court Register under the number KRS 0001194379, NIP 7011278458, REGON

542783554 (hereinafter: "Administrator").

2. E-mail address of the Administrator to contact you in matters of personal data:

kontakt@girl-app.com.

3. Correspondence address of the Administrator in matters of personal data: GIRL Spółka

z ograniczoną odpowiedzialnością, Hoża 86/410, 00-682 Warsaw.

4. We have appointed a person responsible for the protection of personal data, i.e. a

personal data protection officer (DPO), who can be contacted:

1. by e-mail at: kontakt@girl-app.com;

2. in writing, to the address: GIRL Spółka z ograniczoną odpowiedzialnością, Hoża

86/410, 00-682 Warsaw.

§2. Purposes and bases for data processing

Your personal data may be processed for the following purposes:

Purpose of processing Legal basis

Creating and maintaining a User Account Article 6(1)(b) of the GDPR – performance

of the contract

Organization and participation in Events Article 6(1)(b) of the GDPR – performance

of the contract

Content Moderation, User Protection and

Abuse Prevention

Article 6(1)(f) of the GDPR – legitimate

interest of the Administrator

Handling requests and contacting the User Art. 6(1)(f) GDPR

Fulfilment of legal obligations (e.g. tax) Art. 6(1)(c) GDPR

Analysis of the use of the Application and

keeping internal statistics

Article 6(1)(f) of the GDPR – legitimate

interest (product and UX optimization)

Improving the usability, stability and

security of the Application

Article 6(1)(f) of the GDPR – legitimate

interest (ensuring the continuity and quality

of the Services)

Development and implementation of new

functionalities

Article 6(1)(f) of the GDPR – legitimate

interest (innovation and development of

GIRL Sp. z o.o.)

Sending the newsletter Art. 6(1)(a) GDPR – consent

Marketing and statistical purposes Art. 6(1)(a) GDPR – consent

Sharing location with participants of chats,

groups and Events at the User’s request

Article 6(1)(a) GDPR (consent) or Article

6(1)(b) GDPR (performance of a contract)

Enabling communication between Users,

including chats related to Events and

individual 1:1 chats

Article 6(1)(b) GDPR – performance of a

contract

Handling electronic payments, settlements,

fraud prevention, and ticket sales execution

Art. 6(1)(b) GDPR (performance of a

contract) and Art. 6(1)(f) GDPR (legitimate

interest of the Administrator consisting in

ensuring transaction security and

counteracting abuse)

§3. Scope of processed data

The following data may be processed in the application:

1. 2. 3. 4. 5. Identification and contact data: name (nickname), e-mail address, and Account ID.

Demographics: date of birth and age (verification of the requirement to be at least 18

years old).

Profile data: profile picture, interests, profile description (bio) and information about

Connected Users (list of verified friends in the Application)

Location data: location (e.g. city or approximate GPS coordinates) necessary to find

local groups and Events. The User may also voluntarily share their location within an

individual 1:1 chat or an Event chat. Location is shared exclusively at the User’s

initiative and is visible to the participants of the relevant chat or Event. The Application

does not continuously monitor the User’s location or track it in the background.

Data on the activity and functions of the Application: information on participation

in Events (registration, status of the organizer/participant) and browsing thematic

groups,

a. the time of the start and end of the use of individual screens of the application

(the so-called screen time, in the form of time stamps),

b. the number and type of the User's interaction with the elements of the

Application's interface, including button clicks and transitions between screens.

6. Technical and statistical data: technical data of the device (e.g. IP address, operating

system, device model, unique identifiers),

a. statistical data linked to the User's or Account's identifier, used to analyse how

the Application is used.

7. Communication data: data related to the newsletter (e-mail address, time of

subscription and withdrawal of consent) and content sent through the Application’s

communication features, including chats related to Events and individual 1:1 chats

between Connected Users, in particular text messages, photos, shared location and other

content permitted by the Application.

§4. Data recipients

Personal data may be transferred:

1. 2. 3. 4. technical service providers (e.g. hosting, Firebase, analysis of statistics),

entities authorized under the law (e.g. law enforcement authorities, courts),

marketing and newsletter service providers.

payment operators, in particular Stripe Payments Europe Ltd. and entities belonging to

the Stripe group, to the extent necessary to process payments, prevent fraud, verify

transactions, and fulfill obligations resulting from legal regulations.

5. data necessary to process payments, such as user ID, e-mail address, transaction

amount, order ID, and information required for transaction authorization and security,

may be transferred to the Payment Operator. The Administrator does not store full

credit card data or other full payment instrument data of Users.

Personal data may be transferred outside the European Economic Area (EEA), in particular to

the United States, in connection with the use of the services of providers such as Google

(Firebase, Analytics, AdMob). The transfer is based on standard contractual clauses approved

by the European Commission or other relevant protection mechanisms in accordance with the

GDPR. To the extent that data is collected by external tools (Firebase, Google Analytics,

AdMob), the terms and conditions of these providers apply.

§5. Data retention period

The data will be stored:

1. for the period of holding the Account in the Application or until an effective objection

to the processing is filed, but no longer than the period necessary to pursue, establish

claims, or defend against claims, i.e. 3 or 6 years,

2. 3. 4. for the period required by law (e.g. tax),

in the case of data processed on the basis of consent – to withdraw it.

Content published or sent by Users is stored for a period resulting from the nature of the

relevant functionality of the Application:

1. photos published in Event galleries (“Polaroids”) – for 7 days from the date of

publication;

2. messages, photos and other content sent in chats related to Events – until 3 days

after the end of the relevant Event, after which the chat and its content are

deleted;

3. messages, photos and other content sent in individual 1:1 chats between

Connected Users – for the period during which the Account is maintained in the

Application.

5. Location data shared within chats or Events is stored only for the duration of the relevant

chat or Event, after which it is automatically deleted, unless its further storage is

required by law or is necessary to handle safety-related reports.

§6. User rights

You have the right to:

1. access to your data,

2. rectification of data,

3. erasure of data ("right to be forgotten"),

4. delete the Account without the need to provide a reason,

5. restriction of processing,

6. data portability,

7. object to processing,

8. withdraw consent (at any time, without affecting compliance with previous processing),

9. file a complaint with the President of the Office for Personal Data Protection (2 Stawki

Street, 00-193 Warsaw, www.uodo.gov.pl).

In order to exercise your rights, please contact the Administrator: kontakt@girl-app.com.

§7. Photos from the Events and image

1. Within the Application, the User may add photos from Events which may

contain the User’s image or the image of other persons. An image is treated as

personal data within the meaning of the GDPR.

2. Publishing a photo in the Application means that it is visible to other participants

of the same Event. Such photos are available for 7 days from the date of

publication and are then automatically deleted.

3. Photos and other content sent via chats related to Events are stored until 3 days

after the end of the relevant Event, after which the chat and its content are

deleted. Individual 1:1 chats between Connected Users are not ephemeral, and

the content sent through them is stored in accordance with §5 of the Privacy

Policy.

4. The use of photos containing the User’s image for promotional or marketing

purposes of the Application outside the Application (e.g. in social media or

advertising materials) takes place exclusively on the basis of the User’s separate

and explicit consent (Article 6(1)(a) GDPR), which may be withdrawn at any

time by contacting the Administrator.

5. The User may withdraw consent to the use of a particular photo at any time by

contacting the Administrator.

§8. Data security

We have implemented appropriate technical and organizational measures to protect your data

from unauthorized access, disclosure, loss or destruction. Data is transmitted using encryption

(SSL/HTTPS) and is only accessible to authorized persons.

§9. Cookies and Tracking Technologies

The Application may use Cookies and similar technologies to:

1. 2. 3. maintaining sessions and ensuring the operation of the Application,

analyze the use of the Application,

personalization of content (if you agree).

Detailed information can be found in a separate Cookies and Tracking Technology Policy,

available in the Application. To the extent that data is collected by external tools (Firebase,

Google Analytics, AdMob), the terms and conditions of these providers apply.

§10. Newsletter

You have the option of subscribing to the newsletter of the GIRL App.

1. As part of the newsletter, you can receive information about events, news and

promotional materials.

2. The basis for the processing of data (e-mail address) is the User's voluntary consent

(Article 6(1)(a) of the GDPR).

3. You can withdraw your consent at any time by clicking on the unsubscribe link in the

footer of the message or by contacting the Administrator.

4. The withdrawal of consent does not affect the lawfulness of the processing before its

withdrawal.

§11. Changes to the Privacy Policy

We reserve the right to change this Policy. We will notify Users of any material changes via

the Application or by e-mail, in good time.

Cookies and Tracking Technology Policy

Effective Date:12.09.2026

§1. What are cookies and tracking technologies?

The GIRL App may use cookies and similar tracking technologies (e.g., mobile device

identifiers, local storage, SDKs) to ensure the proper functioning of the App, analyze how the

App is used, improve our Services, customize content and functionality, and conduct marketing

activities.

§2. What technologies can be used?

1. In the Application, we use in particular:

1. technical cookies and identifiers – necessary for the proper operation of the

Application, maintaining the session, ensuring security and remembering the User's

basic settings, including:

1. session cookies, which remain stored until you log out of the Application or

close it,

2. persistent cookies, which remain on the device for the time specified in their

parameters or until deleted by the User,

2. analytical tracking technologies (e.g. Firebase Analytics, Sentry) – used to analyze

the way the Application is used, detect errors and optimize the User's experience,

3. Marketing tracking technologies (e.g., Google AdMob) – To display tailored

promotional content.

4. technical tracking technologies and cookies provided by the Payment Operator

(Stripe) – necessary to ensure transaction security, authenticate payments, and detect

and prevent financial fraud (anti-fraud). The use of these technologies is a

mandatory condition for securely conducting payments within the Application.

§3. What are server logs and how are they used?

1. During the use of the Application, the so-called server logs may be automatically

collected. This data includes, in particular: the URL of the resources called, the date and

time of receipt of the query and the sending of the response, information about errors

that occurred during the execution of the query, the IP address of the device and

information about the operating system or model of the device used.

2. We use the data from the logs only for the purpose of administering the Application and

the server, ensuring the security and stability of the systems and keeping aggregate

statistics on the use of the Application.

3. Log data is not used to identify individual Users, unless it is necessary to prevent abuse,

clarify security incidents or pursue claims.

§4. Can you give or withdraw your consent?

1. 2. 3. In the case of technologies that are not necessary for the operation of the Application

(analytical and marketing), the User will be asked for consent when the Application is

first launched or in the appropriate privacy settings.

The use of these technologies is based on the User's consent within the meaning of

Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time in the privacy

settings of the Application, without affecting the lawfulness of the processing before its

withdrawal.

You can also restrict or block advertising identifiers in your device's system settings

(Android/iOS), which may affect the scope of personalization of advertising content.

§5. How long is the data stored?

The length of time you store your data depends on the specific technology and the purpose for

which it is used. Some data is stored only during the session, others may be stored for a longer

period of time – generally from 6 to 24 months in the case of statistical and marketing data,

unless you delete it first in the settings of your device or Application.

§6. Who has access to the data?

Data collected through cookies and tracking technologies may be available to:

1. 2. 3. 4. 5. the operator of the Application (GIRL Sp. z o.o.),

providers of analytical tools (e.g. Google, Firebase),

advertising operators, if consent is given for marketing purposes,

providers of technical services supporting the functioning of the Application.

Payment Operator (Stripe Payments Europe Ltd.) to the extent necessary for

the execution and security of financial transactions

All these entities are obliged to apply appropriate personal data protection measures in

accordance with the GDPR.

The Administrator may provide sponsors or business partners with anonymous and aggregated

statistical information regarding the use of the Application, in particular information concerning

the number of Users, User activity, the number of Event participants and the reach of content.

Such information does not constitute personal data and does not allow individual Users to be

identified.

§7. Changes to the Cookies Policy

We reserve the right to make changes to this Policy. We will inform Users of material changes

in the Application or by e-mail, in particular if the changes require re-obtaining consent to the

use of certain technologies.