PRIVACY POLICY — MAP 4 MAHJ APP

Last updated: June 2026

1. Controller / Data Protection Contact

TMMC GmbH Emil-Riedel-Straße 8 80538 Munich Germany

Phone: +49 160 93820254 Email: hello@map4mahj.com Website: www.map4mahj.com

Managing Directors: Mimi Kaumanns, Laura Pfirrmann Commercial Register: Amtsgericht München, HRB 310771

2. Scope

This Privacy Policy applies to the Map 4 Mahj mobile application (iOS and Android) and the associated web platform at www.map4mahj.com, operated by TMMC GmbH. It explains what personal data we collect, for what purposes, and what rights you have as a user.

3. Principles of Data Processing

We process personal data only to the extent necessary for providing the app or where there is a legal basis. We collect only the data we actually need (data minimisation, Art. 5 para. 1 lit. c GDPR).

4. Data We Collect and Why

4.1 Account Registration

Data: First name / display name, email address, password (encrypted), profile picture (optional), location (city / region), experience level, account type (Player, Company, Teacher, Club, Game Night Host) Purpose: Creating and managing your account, authentication, personalisation of the app experience Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance) Retention: Until account deletion; then 30 days before permanent erasure

4.2 Location Data

Data: GPS coordinates (precise location) or manually entered city / postal code Purpose: Showing nearby events, clubs, teachers, and players on the map Legal basis: Art. 6 para. 1 lit. a GDPR (consent) — you must explicitly grant location permission in the app Retention: GPS coordinates are not stored permanently; approximate location (city/region) is stored as part of your profile until changed or deleted Note: Location data is not shared with third parties and is not used for advertising.

4.3 Event Bookings and Payments

Data: Booking details, number of spots reserved, payment status, transaction reference Purpose: Processing reservations and payments for paid events Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance) Payment service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Payment data is processed exclusively by PayPal. PayPal privacy policy: https://www.paypal.com/privacy Retention: 10 years (statutory tax retention obligation, § 147 AO)

4.4 In-App Communication

Data: Email address, message content Purpose: Responding to enquiries, customer support, transactional messages (booking confirmations, event reminders, waitlist notifications) Legal basis: Art. 6 para. 1 lit. b / lit. f GDPR Retention: 3 years from last contact

4.5 Push Notifications

Data: Device push token Purpose: Notifications about new events, available waitlist spots, club activities, and messages Legal basis: Art. 6 para. 1 lit. a GDPR (consent via in-app permission prompt) Retention: Until you disable notifications or delete the app

4.6 Usage and Analytics Data

Data: Screen views, in-app actions, app version, device type, operating system, anonymised IP address Purpose: Improving app performance and user experience, bug tracking Legal basis: Art. 6 para. 1 lit. a GDPR (consent via in-app consent prompt) Retention: 13 months

4.7 Subscription Data

Data: Subscription tier (Free / Starter / Growth / Pro), billing cycle, subscription status Purpose: Managing access to features based on your subscription level Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance) Retention: Duration of subscription plus 10 years (tax records)

5. Recipients and Third-Party Providers

Provider Purpose Location Privacy Policy
PayPal (Europe) S.à r.l. Payment processing Luxembourg / USA https://www.paypal.com/privacy
Hosting provider Server infrastructure [TO BE COMPLETED] [TO BE COMPLETED]
Meilisearch In-app search functionality France https://www.meilisearch.com/privacy
Apple Inc. App distribution (App Store), push notifications USA https://www.apple.com/legal/privacy
Google LLC App distribution (Google Play), push notifications (FCM) USA https://policies.google.com/privacy

6. Transfer to Third Countries

Some service providers (PayPal, Apple, Google) are based in the USA. Data transfers are carried out on the basis of standard contractual clauses (Art. 46 para. 2 lit. c GDPR) or an adequacy decision by the EU Commission (EU–US Data Privacy Framework).

7. Your Rights

As a data subject under the GDPR, you have the following rights:

To exercise any of these rights, please contact us at: hello@map4mahj.com

You can also delete your account directly in the app under Settings → Account → Delete Account.

8. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent data protection supervisory authority:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18 91522 Ansbach Germany www.lda.bayern.de

9. Data Security

We implement appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorised persons. These measures include:

10. Minors

The Map 4 Mahj app is not directed at persons under 16 years of age. We do not knowingly collect personal data from minors under 16. If you believe a minor has registered, please contact us at hello@map4mahj.com and we will delete the account promptly.

11. In-App Consent Management

You can withdraw or adjust your consents (location, push notifications, analytics) at any time via:

12. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes in the legal situation or our services. When we make material changes, we will notify you via the app or by email. The current version is always available in the app under Settings → Privacy Policy and at www.map4mahj.com/privacy.

TMMC GmbH · Emil-Riedel-Straße 8 · 80538 Munich · Germany Email: hello@map4mahj.com · Phone: +49 160 93820254 Status: June 2026