Galfer Academy

Definitions

1. Brand Owner: Refers to the following entity, which has exclusive rights to the

content of GALFER ACADEMY brand:

INDUSTRIAS GALFER, S.A.,

Ctra. De Montmeló, 50,

Pol. Ind. Cal Gordi Can Català,

08403, Granollers, Barcelona, Spain

support.academy@galfer.es

Brand Owner acts as a Content Provider, who, pursuant to a separate agreement with

Evolve, uploads, submits, or otherwise provides course content, materials, or

information to the Platform, and who may also provide personal data of its own users

for the purposes of account creation, course enrollment, or analytics, and who may

access analytics or reports about those users via the Platform.

2. Website: Any web page or collection of web pages including all content,

functionalities, services, and software provided through them, managed or controlled

by EvolveApp Inc, and accessible over the internet, including but not limited to the

primary web address used by EvolveApp Inc, as well as any related subdomains,

microsites, or web pages. This term encompasses both desktop and mobile versions of

such web pages, as well as any related digital or electronic services offered by Evolve

INC. through these web pages.

3. Law: Refers to the applicable laws of the State of Delaware, USA, regarding data

protection and privacy. Additionally refers to General Data Protection Regulation

4. (GDPR) in relation to the users located on the territory of the European Union.

5. Mobile Application: Software (including all existing additions and improvements)

designed to operate on smartphones, tablets, watches, and other mobile devices,

developed for specific platforms (iOS, Android, Windows Phone, etc.).

6. Personal Data: A collection of personal data and/or non-personalized information

about the User, provided by the User themselves to the Platform owner and/or

automatically collected by the Platform owner and/or third parties.

7. Platform: A computer program represented in objective form as a collection of data

and commands which includes source code, databases, audiovisual works, other

legally protected intellectual property objects, and all documentation for its use. The

Platform is presented in the form of a Website and a Mobile Application.

8. Policy: This Privacy Policy of the Platform (with all existing amendments and

changes).

9. User: A legal or natural person who has accessed the Platform via the website or

Mobile Application.

10. User Agreement: The agreement concluded between the Platform owner and the

User regarding the terms, rules, and features of the User’s use of the Platform. The

User joins such an agreement and has no right to make and/or demand any changes or

additions. The User can review the terms of the User Agreement at the following link:

https://academy-app.galfer.eu/en/eula.

11. Platform Owner: Refers to the following entity, which owns exclusive rights to the

Platform:

EvolveApp Inc

8 The Green

Dover, Delaware (DE), 19901

Contact: support@evolveplatform.ai

12. Cookies: Small files sent by any mobile applications or websites, and placed on

smartphones, tablets, watches, and other mobile devices of the User, to improve the

operation of such applications or websites, and the quality of content hosted on them.

Scope of the Policy This Policy is used and applicable exclusively to Personal Data received

from the User in connection with their use of the Website and/or Mobile Application. The

provisions of this Policy are aimed at:

1. Defining the types and kinds of Personal Data received, directions and purposes of the

use (processing) of Personal Data, as well as the sources of obtaining such Personal

Data.

2. Defining the User’s rights regarding the protection of the confidentiality of their

Personal Data.

3. Identifying individuals responsible for the processing and storage of Personal Data, as

well as third parties to whom such data is disclosed (fully or partially). The rules of

this Policy do not apply in cases of processing by third parties of Personal Data

voluntarily provided by the User. By opening the Website and/or installing the Mobile

Application on a smartphone, tablet, watch, or other mobile device, the User agrees to

the terms of this Policy and consents to the Platform Owner collecting, processing,

retaining, and storing Personal Data under the terms and conditions provided by this

Policy. If the User does not agree with the terms of the Policy and/or if any terms of

the Policy are unclear to them, the User must immediately cease using the Platform.

User Rights for Data Protection Upon providing Personal Data, the User automatically

obtains the following rights:

1. To receive information about the processing of their data (the basis and purposes of

such processing, methods used, information about individuals who have access to the

data or to whom they may be disclosed based on the agreement or Law).

2. To receive information about the location and identification data of individuals

processing Personal Data.

3. To receive information about the terms of storage of Personal Data.

4. To receive information about the planned or actual cross-border transfer of Personal

Data.

5. To receive information about the location and identification data of individuals

storing Personal Data.

6. To contest the actions or inaction of the Brand Owner as well as the Platform Owner

at the authorized body for the protection of personal data rights or in court.

7. To receive compensation for damages and/or compensation for moral harm in court as

a result of violations of the User’s rights to the protection and security of their

Personal Data committed by the Brand Owner and/or the Platform Owner and/or third

parties.

8. To exercise other rights in the field of data protection provided by Law or the

provisions of this Policy.

List of Collected Personal Data

Non-personalized information about users

In connection with the use of the Platform, the Platform Owner may automatically collect and

process the following non-personalized information about the User:

1. Information about traffic, the possible number of clicks, logs, and other data.

2. Information about the device (identification number, mobile network), from which

access is performed, operating system, platform, browser type, and other browser

information, IP address.

Personalized Information About Users

3. Full surname, name.

4. User's gender.

5. Country of residence.

6. Photograph of the User.

7. User's email address.

8. All photos, video clips, audio files, and other types of media stored on the device from

which access to the Platform is performed.

9. Data contained in the User's personal account (profile), all internal correspondence of

the User (if any), as well as other activities of the personal account (profile) of the

User on the Platform.

10. Data about all publications made by the User on the Platform, including but not

limited to, comments, ratings, reviews, report publications, videos, and photos,

placing likes, ratings, and/or any other forms of activity available to the User on the

Platform, and/or created content.

11. Data and information obtained as a result of combining certain Personal Data of a

specific User, as well as data and information about the User obtained from third

parties (partners, marketers, researchers). The User is the only responsible party for

the completeness of the provided personal (personal) data and is obliged to change

them (update, verify, correct) on a regular basis. The Platform Owner assumes that all

personal (personal) data provided by the User are accurate, and that the User

maintains such information in a current state.

Purposes of Collection and Processing of Personal Data

Definition of processing purposes

The collection and processing of Personal Data are carried out for the following purposes:

1. To operate and maintain the learning management system (LMS), including User

account creation, enrollment in courses, access to course materials, tracking progress,

issuing certifications, and generating usage and performance reports.

2. To provide a personalized and adaptive learning experience, including analyzing User

behavior and preferences to recommend relevant content and optimize learning paths.

3. To improve the operation, security, and functionality of the Platform, including

troubleshooting, maintenance, and technical support.

4. To analyze and improve the quality and effectiveness of the Platform’s content,

services, and internal processes.

5. To communicate with Users regarding their accounts, learning activities, support

requests, and important notices.

6. To comply with applicable legal obligations, regulatory requirements, and contractual

commitments.

7. To conduct statistical and market research, provided that data is anonymized where

appropriate.

8. For any other purposes clearly communicated to the User and for which separate

consent has been obtained.

The processing of Personal Data is carried out based on the principles:

(1) legality of the purposes and methods of processing; and

(2) data security; and

(3) compliance of the purposes of processing Personal Data with the purposes previously

defined and declared during the collection of such Personal Data; and

(4) compliance of the volume and nature of the processed Personal Data with the declared

purposes of their processing.

Conditions for processing personal data

The processing of Personal Data is carried out in cases:

(1) obtaining consent from the User; or

(2) achieving the purposes of the Platform Owner provided by an international treaty or Law;

(3) provision by the User of their Personal Data to an unlimited number of persons; or

(4) fulfilling other obligations of the Platform Owner to the User, including, but not limited

to, providing certain content to the Use, account creation, enrollment in courses, access to

course materials, progress tracking, certification, and reporting; or

(5) saving the life or health of the User, when consent to the processing of his Personal Data

cannot be obtained in advance. In the case of anonymization of Personal Data, which does

not allow directly or indirectly identifying the User, subsequent use and disclosure of such

data to third parties are allowed and the rules of this Policy no longer apply to them. The

Platform Owner takes all possible measures to protect the confidentiality of the received

Personal Data, except in cases when the User has made such data publicly available. The

processing of Personal Data is carried out using automation means and without the use of

such means of automation.

Third Party Access to Personal Data

Use of analytical platforms

The Platform Owner uses the analytical platform Google Analytics to

(1) track the frequency of site visits by Users; and

(2) track the ways the User uses the Platform and/or its content; and

(3) identify the type and kind of content that is popular among Users; and

(4) determine the location of the User.

The User also gives their consent to the Platform Owner to use information obtained about

the User from Google Analytics. For these purposes, the Google Analytics platform may

collect data about the IP address, geolocation, user behavior, as well as their preferences and

interests regarding certain content. The Google Analytics platform accesses Personal Data to

provide the Platform Owner with insights on how effectively their platform operates, which

content is popular, how effectively ads are placed within it, and for purposes of developing

and/or improving the existing marketing strategy of the Platform Owner.

By registering on the Platform, the User agrees to the privacy policy of Google Analytics and

to the automatic installation of corresponding cookies on the User's device.

Disclosure of Personal Data to Third Parties:

The Platform Owner may disclose Personal Data to:

1. Its affiliates, branches, and representatives, both within the territory of the United

States of America and in other countries.

2. Successors of the Platform Owner who have arisen as a result of its liquidation,

reorganization, or bankruptcy and who have acquired exclusive rights to the Platform.

3. Brand Owner for the purposes of providing the User with certain content or access to

it and analyzing behavior of the Users to assess their. Brand Owner can also act as

Data Controller using the Platform as a Learning Management System (LMS).

The Platform Owner discloses Personal Data only if:

1. They are confident that third parties will comply with the terms of this Policy and take

the same measures to protect the confidentiality of Personal Data as the Platform

Owner does.

2. Consent for such disclosure has been expressed by the User through registration in the

application and joining this Policy.

Personal Data Provided by Brand Owner

1. In some cases, Brand Owner may upload or otherwise provide to the Platform

personal data of their own users (such as employees, partners, students, or other

learners) in order to enable those users to access courses, track progress, and receive

reports or certifications.

2. For the personal data of users provided to the Platform by Brand Owner, the Platform

Owner processes such data solely on behalf of the Brand Owner, acting as a data

processor, while the Brand Owner remains the data controller of that data.

3. Brand Owner is solely responsible for ensuring that they have a valid legal basis (such

as consent or other lawful ground) for the collection and provision of such personal

data to the Platform, in compliance with applicable data protection laws. Brand

Owner must also ensure that their users are informed about how their personal data

will be processed through the Platform and about their data subject rights.

Third-Party Advertising

The Platform's content may include advertising banners and/or links to the websites of Brand

Owner or third parties. The use of such websites by the User (by following a link or any other

means) may result in the collection, processing, and use of Personal Data, and the possible

automatic transfer of cookies to the User's device from which the transition to the third-party

site is made. The Platform Owner bears no responsibility for the methods, practices, and

order of processing Personal Data by third-party sites. Consequently, the Platform Owner is

also not responsible in case Personal Data is disclosed to an unlimited number of people in

connection with the use of such sites by the User.

The Platform Owner strongly recommends that each User thoroughly familiarize themselves

with the personal data protection policies of the sites they use.

Advertising in the Mobile Application

The Platform Owner places various advertising and marketing materials on the Platform,

taking into account the preferences of the User regarding certain content. Placement of

advertisements on the Platform involves the installation of certain cookies on the User's

device.

Procedure for Submitting Complaints and Requests to the Platform Owner: Request to

Stop Processing Personal Data

Each User has the right to express their objection to the Platform Owner against the

processing and/or storage of their Personal Data. Such an objection can be expressed as

follows:

● The request must be sent to the Platform Owner at the following address:

support@evolveplatform.ai

Request for Information about Personal Data: If the User has questions related to the

application or use of this Policy, the order and/or method of processing Personal Data, the

User may ask such a question as follows:

● The request must be sent to the Platform Owner at the following address:

support@evolveplatform.ai

Changes (updates, additions, corrections) or Deletion of Personal Data

The User has the right at any time to independently change or delete their Personal Data,

except when such change or deletion may lead to a violation of the rules of this Policy; or to a

violation of the Law; or the nature of such Personal Data is evidence in any judicial process

that arose between the Platform Owner and the User. For this, the User needs to delete their

personal account on the Platform.

The Platform Owner has the right at any time to delete the User's personal account (cabinet),

as well as all Personal Data about the User, if they violated the terms of this Policy and/or

User Agreement.

In case of deletion of Personal Data about the User, all publications made by the User

(comments, ratings, reviews, report publications, videos, and photos, placing likes, ratings)

and/or any other forms of activity available to the User on the Platform are also subject to

automatic deletion.

Periods and Order of Storage of Personal Data

Storage is carried out by third parties at the direction of the Platform Owner. The User

consents to the storage of their Personal Data by third parties at the direction of the Platform

Owner, provided that such third parties maintain the confidentiality of the received Personal

Data. The functions of storing information are entrusted to the following entity:

AMAZON.COM, INC. ("Custodian"), which maintains confidentiality of the stored data in

accordance with the applicable laws and agreements.

Procedure for Protecting Personal Data

Protecting the confidentiality of Personal Data is a paramount and important task for the

Platform Owner. The Platform Owner adheres to all required international standards, rules,

and recommendations for the protection of Personal Data.

The Platform Owner has implemented a number of technical and organizational methods

aimed at protecting Personal Data from disclosure or unauthorized access by third parties.

Final Provisions

Availability of the Policy Text for Review

The Platform Owner and/or Brand Owner are committed to regularly reviewing and updating

its data protection practices to ensure ongoing compliance with applicable laws and best

practices in the field of data privacy.

Users can review the terms of this Policy at the following link: https://academy-

app.galfer.eu/en/privacypolicy. This edition of the Policy is effective from August 15, 2025.

Amendment and Addition to the Policy

This Policy may be changed from time to time. The Platform Owner bears no responsibility

to the User for changing the terms of this Policy without permission and/or consent from the

User.

The User themselves must regularly check the provisions of this Policy for possible changes

or additions.

Applicable Legislation

This Policy is developed in accordance with the applicable data protection laws of the State

of Delaware, USA, as well as the General Data Protection Regulation (GDPR).

Risk of Disclosure

Regardless of the protective measures taken by the Platform Owner to protect the

confidentiality of received personal data, the User is hereby duly informed that any transfer

of Personal Data over the Internet cannot be guaranteed to be secure, and therefore the User

makes such a transfer at their own risk.