Privacy Policy

Carpe Diem London ("we", "our", or "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your information when you use our platform (the "Service"), in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

We collect the following categories of personal data: Account and identity data • Name, email address, and profile picture (from direct registration or via Google/Apple OAuth) • Phone number (when provided for SMS verification) Usage data • Pages and features visited, search queries, pins and plans saved, offers claimed • Device type, browser, IP address, and approximate location • Interactions with embedded content and affiliate links (see Sections 5 and 8) Payment data • Billing details processed via our third-party payment provider (we do not store card numbers directly) User-generated content • Pin suggestions, feedback, and any other content you submit to the Service Communications • Messages you send to us via email or contact forms

We use your personal data to: • Create and manage your account • Deliver and personalise the Service (daily plans, pin recommendations, offers) • Process Premium membership payments • Send transactional communications (booking confirmations, account notifications) • Send marketing emails if you have opted in (you may opt out at any time) • Process and respond to your Pin suggestions using AI assistance • Analyse how users interact with the Service — including which pins, plans, and offers are viewed, saved, or clicked — in order to improve content quality, site performance, and the relevance of recommendations • Attribute sales or bookings made through affiliate links to the relevant partner, where applicable (see Section 5) • Comply with our legal obligations and enforce our Terms of Service

We process your personal data under the following lawful bases: • Contract — to fulfil our obligations to you as a user or Premium member • Legitimate interests — to improve the Service, understand usage patterns and engagement with content, prevent fraud, and ensure security. Where we rely on legitimate interests for analytics, we have assessed that this processing is proportionate and does not override your rights and interests, and it does not involve profiling that produces legal or similarly significant effects on you. • Consent — for marketing communications, non-essential cookies, and optional features (you may withdraw consent at any time) • Legal obligation — where required by applicable law

We share your data only where necessary, with the following categories of recipients: • Payment processors — to handle subscription billing securely • SMS providers (Twilio) — to send OTP verification messages • Email providers (SendGrid / Resend) — to send account and notification emails • Analytics and error monitoring tools — to understand usage patterns, measure performance, and improve reliability (e.g. Google Analytics) • Affiliate networks and partner platforms — where you interact with an affiliate link, limited data (such as a click or transaction identifier) may be shared with the relevant network or merchant to attribute the referral and calculate commission. This does not include your name, email, or payment details unless you separately provide these directly to that third party. • Partner businesses — limited data (e.g. redemption status) where required to fulfil an offer We do not sell your personal data to third parties. All third-party processors are contractually required to handle your data in accordance with UK GDPR.

Some content on the Service — including videos and images featured in pins — is embedded from, or sourced from, third-party platforms such as TikTok and YouTube. When embedded content is displayed or played, the relevant platform may collect data about your interaction with that content (such as viewing activity) in accordance with its own privacy policy and terms. We do not control this data collection and are not responsible for these third parties' privacy practices. We encourage you to review the privacy policies of TikTok, YouTube, and any other platform whose content appears on the Service.

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account: • Your profile and activity data will be deleted within 30 days • Anonymised or aggregated usage data may be retained for analytical purposes • Data required for legal or financial compliance (e.g. payment records) may be retained for up to 7 years in accordance with UK law

We use cookies and similar technologies to operate and improve the Service. These fall into the following categories: • Essential cookies — required for authentication and core functionality (e.g. session tokens stored as HTTP-only cookies). These cannot be switched off, as the Service will not function correctly without them. • Preference cookies — remember your settings and preferences (e.g. saved location, display preferences). • Analytics cookies — help us understand how users interact with the Service (e.g. via Google Analytics) so we can improve performance, content, and recommendations. • Affiliate tracking cookies — where you click an affiliate link, a cookie or similar identifier may be used by us or the relevant affiliate network to attribute a subsequent purchase or booking back to Carpe Diem London. Where required by law, non-essential cookies (including analytics and affiliate tracking cookies) are only set with your consent, which you can manage through your browser settings or any cookie controls provided on the Service. Disabling essential cookies may affect your ability to use the Service.

We take appropriate technical and organisational measures to protect your personal data, including: • HTTPS encryption for all data in transit • HTTP-only cookies for authentication tokens (not accessible to JavaScript) • Access controls limiting who can view personal data within our team • Regular security reviews of our infrastructure No method of transmission or storage is 100% secure. If you believe your account has been compromised, please contact us immediately.

You have the following rights regarding your personal data: • Right of access — request a copy of the data we hold about you • Right to rectification — request correction of inaccurate data • Right to erasure ("right to be forgotten") — request deletion of your data • Right to restriction — request that we limit processing of your data • Right to data portability — receive your data in a machine-readable format • Right to object — object to processing based on legitimate interests (including analytics) or for direct marketing • Rights related to automated decision-making — including profiling To exercise any of these rights, please contact us at hello.carpediemlondon@gmail.com. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

The Service is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact us.

Some of our third-party service providers may process data outside of the UK or European Economic Area. Where this occurs, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses) to protect your data in accordance with UK GDPR.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify you by email or by a prominent notice on the Service. Your continued use of the Service after changes take effect constitutes your acknowledgement of the updated policy.

If you have questions, concerns, or requests relating to your personal data or this Privacy Policy, please contact: Email: hello.carpediemlondon@gmail.com Carpe Diem London London, United Kingdom For complaints, you may also contact the Information Commissioner's Office (ICO): Website: ico.org.uk Phone: 0303 123 1113