1. Introduction and Identity of the Data Controller

This Privacy Policy explains how HARMONY JOURNEY (“we”, “us”, “our”) collects, uses, stores and shares personal data when you use our platform at thesilverbuddy.com (the “Platform”) or when you contact us in connection with our services.

SilverBuddy is the data controller for personal data collected through the Platform, within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”).

Data Controller: HARMONY JOURNEY UNIPESSOAL LDA 

Email: hello@thesilverbuddy.com

Website: www.thesilverbuddy.com

This Privacy Policy applies to: (a) senior travellers and their family members who use the Platform to enquire about or book a companion service; (b) Companions who apply to join the SilverBuddy network; and (c) any other persons who interact with the Platform or contact us directly.

2. Personal Data We Collect

2.1 Data Provided by Clients and Travellers

When you submit an enquiry or confirm a booking through the Platform, we collect the following categories of personal data:

• Contact details of the Client: full name, email address, telephone number, country of residence.
• Personal details of the Traveller: full name, age, nationality, country of residence.
• Trip details: destination, travel dates, duration, type of support requested.
• Emergency contact details: name, relationship to Traveller, telephone number.
• Communication data: content of any messages, emails or enquiries submitted through the Platform or sent to us directly.
• Payment information: payment is processed by Stripe. SilverBuddy does not store card numbers or payment credentials. We receive confirmation of payment status and transaction reference from Stripe.

2.2 Data Provided by Companion Applicants

When a person applies to join the SilverBuddy network as a Companion, we collect:

• Full name, date of birth, nationality and contact details.
• Professional background, languages spoken, relevant experience and skills.
• Driving licence information.
• Availability and preferred working areas.
• Photograph submitted as part of the application.
• Any additional information voluntarily provided in the application form.

2.3 Data Collected Automatically

When you visit the Platform, we may collect certain technical data automatically through cookies and similar technologies, including:

• IP address and browser type.
• Pages visited and time spent on the Platform.
• Device type and operating system.
• Referral source.

For full details on our use of cookies, please refer to our Cookie Policy, available on the Platform.

3. Legal Basis for Processing

We process personal data only where we have a valid legal basis under Article 6 GDPR. The following table sets out the legal bases applicable to each category of processing.

3.2 Legitimate Interests

Where we rely on legitimate interests as a legal basis (Article 6(1)(f) GDPR), we have assessed that our interests are not overridden by the interests, rights or freedoms of the data subjects concerned. Our legitimate interests include: operating a safe and reliable platform, preventing fraud and misuse, and improving our services. You have the right to object to processing based on legitimate interests at any time — see Section 8.

4. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

• To process your enquiry and prepare a personalised Booking Proposal.
• To match the Traveller with the most suitable available Companion.
• To confirm and manage your Booking.
• To process payments through Stripe.
• To arrange and facilitate the video introduction call between the Traveller and the assigned Companion.
• To share relevant details with the assigned Companion for the purpose of delivering the Service.
• To send booking confirmation and service-related communications by email.
• To respond to complaints, queries or requests submitted by you.
• To comply with our legal and regulatory obligations.
• To improve the Platform and our services on the basis of aggregated and anonymised usage data.
• To send marketing communications.

5. Data Sharing and Recipients

5.1 Companions

We share the following data with the Companion assigned to your Booking: the Traveller’s name, age, nationality, destination, travel dates, emergency contact details, and any other information reasonably necessary for the Companion to deliver the Service safely and effectively. Companions are bound by confidentiality and data protection obligations under their independent service agreement with SilverBuddy.

5.2 Payment Processors

Payments are processed by Stripe Payments Europe Limited, which acts as an independent data controller for payment processing purposes. Stripe’s privacy policy is available at stripe.com/privacy. SilverBuddy does not receive or store your card details.

5.3 Email Service Providers

We use Brevo (formerly Sendinblue), a transactional email service, to send booking confirmation and service-related emails. Brevo processes your email address and name on our behalf as a data processor under a data processing agreement compliant with Article 28 GDPR.

5.4 IT Infrastructure and Hosting

Our Platform is hosted on Hostinger. Hostinger processes technical data on our behalf as a data processor. All hosting infrastructure is located within the European Economic Area or in countries subject to an adequacy decision by the European Commission.

5.5 Public Authorities

We may disclose personal data to competent public authorities, courts or regulatory bodies where required to do so by applicable law or by a binding legal order. We will notify you of any such disclosure where we are legally permitted to do so.

5.6 No Sale of Data

SilverBuddy does not sell, rent or trade personal data to third parties for commercial or marketing purposes under any circumstances.

6. International Data Transfers

SilverBuddy is established in Portugal and processes personal data within the European Economic Area. Where any data processor or service provider is located outside the EEA, we ensure that appropriate safeguards are in place in accordance with Chapter V GDPR, including:

• Adequacy decisions adopted by the European Commission under Article 45 GDPR.
• Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) GDPR.

In particular, Stripe may process data in the United States. Stripe participates in the EU-US Data Privacy Framework and has implemented Standard Contractual Clauses for transfers outside the EEA. For further details, please refer to Stripe’s privacy policy.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, and in accordance with applicable legal obligations. The following retention periods apply:

• Client and Traveller data (booking-related): 3 years from the date of completion of the Booking.
• Emergency contact data: deleted within 30 days of the end of the trip.
• Payment records: retained for the period required by applicable Portuguese tax and accounting law, which is currently a minimum of 10 years.
• Companion application data: 2 years from the date of application or the date of the last assignment, whichever is later.
• Marketing and service improvement data (with consent): until consent is withdrawn.
• Marketing communications to existing clients (soft opt-in): until you opt out.
• Technical and usage data: 12 months from collection.

At the end of the applicable retention period, personal data is securely deleted or anonymised. Where data is anonymised, it may be retained indefinitely for statistical and analytical purposes.

8. Your Rights as a Data Subject

Under the GDPR, you have the following rights in relation to your personal data. These rights apply to the extent permitted by applicable law and may be subject to certain exemptions.

8.1 Right of Access (Article 15 GDPR)

You have the right to obtain confirmation of whether we process personal data about you and, if so, to receive a copy of that data together with information about how it is processed.

8.2 Right to Rectification (Article 16 GDPR)

You have the right to request correction of inaccurate personal data and completion of incomplete personal data held about you.

8.3 Right to Erasure (Article 17 GDPR)

You have the right to request deletion of your personal data where: (a) the data is no longer necessary for the purposes for which it was collected; (b) you withdraw consent and there is no other legal basis for processing; (c) you object to processing and there are no overriding legitimate grounds; (d) the data has been unlawfully processed; or (e) erasure is required to comply with a legal obligation. This right does not apply where processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.

8.4 Right to Restriction of Processing (Article 18 GDPR)

You have the right to request that we restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data or where you have objected to processing pending verification of our legitimate grounds.

8.5 Right to Data Portability (Article 20 GDPR)

Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.

8.6 Right to Object (Article 21 GDPR)

You have the right to object at any time to processing of your personal data based on our legitimate interests (Article 6(1)(f) GDPR), including profiling based on those interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or for the establishment, exercise or defence of legal claims. You may also object at any time to processing for direct marketing purposes, without providing any justification.

8.7 Right to Withdraw Consent (Article 7(3) GDPR)

Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. Withdrawal of consent to the processing of health information may affect our ability to match the Traveller with the most appropriate Companion.

8.8 Rights in Relation to Automated Decision-Making (Article 22 GDPR)

SilverBuddy does not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on data subjects.

8.9 How to Exercise Your Rights

To exercise any of the above rights, please submit a written request to hello@thesilverbuddy.com. We will respond within one month of receipt of your request. This period may be extended by a further two months where requests are complex or numerous, in which case we will notify you within one month of the reason for the extension. We will not charge a fee for handling your request unless it is manifestly unfounded or excessive.

9. Cookies and Similar Technologies

The Platform uses cookies and similar tracking technologies to ensure proper functioning, analyse usage and, where you have given consent, to provide personalised content. The following categories of cookies are used:

• Strictly necessary cookies: required for the Platform to function. These cannot be disabled.
• Analytical cookies: used to understand how visitors interact with the Platform. These are only set with your consent.
• Marketing cookies: used to deliver relevant communications. These are only set with your explicit consent.

You may manage your cookie preferences at any time through the cookie consent banner on the Platform or through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform.

10. Data Security

SilverBuddy implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction or damage, in accordance with Article 32 GDPR. These measures include:

• Secure HTTPS connection on the Platform.
• Access controls limiting personal data access to authorised personnel only.
• Use of reputable third-party payment and email processors with established security standards.
• Regular review of data handling practices.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the CNPD without undue delay and, where required, notify affected data subjects in accordance with Articles 33 and 34 GDPR.

11. Data of Minors

The Platform and the Service are intended for adults. We do not knowingly collect personal data from persons under the age of 18. If you believe that a minor has provided us with personal data without appropriate parental consent, please contact us at hello@thesilverbuddy.com and we will delete such data promptly.

12. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority. In Portugal, the competent supervisory authority is:

Comissão Nacional de Proteção de Dados (CNPD)

Av. D. Carlos I, 134 — 1º, 1200-651 Lisboa

Website: www.cnpd.pt

Email: geral@cnpd.pt

You may also lodge a complaint with the supervisory authority of your country of residence if you are located in an EU Member State other than Portugal.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices or applicable law. The updated version will be published on the Platform with a revised version date. We encourage you to review this Privacy Policy periodically. Where changes are material, we will notify you by email or by a prominent notice on the Platform before the changes take effect.

14. Contact Us

For any questions, requests or concerns regarding this Privacy Policy or our data processing practices, please contact us at:

Email: hello@thesilverbuddy.com

Website: www.thesilverbuddy.com

Data Protection Authority: CNPD — www.cnpd.pt