Supplemental Terms — EU / EEA Jurisdiction Addendum

Last updated: 21 July 2026 · Effective: 21 July 2026

If you are located in a Member State of the European Union or the European Economic Area (EEA), these supplemental terms apply to you in addition to the Privacy Policy and Terms of Service. Atlayo operates primarily in Europe; this Addendum is designed to meet GDPR and national implementing requirements across all EU/EEA countries.

1. Territorial scope

This Addendum applies to users in:

• All 27 European Union Member States: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden.
• EEA countries outside the EU: Iceland, Liechtenstein, and Norway.

Users in the United Kingdom may have similar rights under UK GDPR; contact privacy@atlayo.com for UK-specific requests.

2. Data controller and EU establishment

Atlayo Overseas s.r.o. (company ID 29645433) is the primary data controller for the Atlayo Service in the EU/EEA.
Address: Příkop 843/4, Zábrdovice, 602 00 Brno, Czech Republic
Parent company: Atlayo spol. s r.o. (Atlayo group)
Lead supervisory authority (main establishment): Úřad pro ochranu osobních údajů (UOOU) — Czech Data Protection Authority.

3. GDPR rights (all EU/EEA users)

Under the General Data Protection Regulation (EU) 2016/679, you have the right to:

• Access — obtain confirmation and a copy of personal data we process.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion where no lawful retention ground exists.
• Restriction — limit processing in defined circumstances.
• Portability — receive data you provided in a structured, machine-readable format.
• Object — to processing based on legitimate interests or direct marketing.
• Withdraw consent — at any time for consent-based processing.
• Automated decisions — not be subject solely to automated decisions with legal or similar significant effect, except where permitted with safeguards.
• Complaint — lodge a complaint with your local supervisory authority (section 5).

Submit requests via Settings → Privacy in the app or privacy@atlayo.com. We respond within one month, extendable by two months for complex requests.

4. Legal bases and special categories

We process special categories of data (e.g. biometric voiceprints for optional voice lock) only with explicit consent or another Article 9 GDPR exception. Optional saved payment cards are tokenised; we do not process wallet balances or operate payment services under PSD2. Processing maps are in the Privacy Policy.

5. Supervisory authorities by country

You may contact your local authority if you believe we infringe data-protection law:

6. Country-specific supplemental notes

6.1 Czech Republic (main establishment)

Processing is registered with UOOU where required. Consumer disputes may be referred to the Czech Trade Inspection Authority or the EU ODR platform.

6.2 Germany

Non-essential cookies and similar technologies require consent under TTDSG alongside GDPR. Users may object to processing based on legitimate interests with heightened scrutiny for profiling.

6.3 France

Direct marketing by electronic means requires opt-in. Minors’ data receives heightened protection under CNIL guidance.

6.4 Italy

Users may request information on automated decision-making. Public-sector access requests follow national FOIA rules separately from GDPR access.

6.5 Spain

Digital rights (including right to digital disconnection where employment context applies) under LOPDGDD do not apply to consumer Atlayo accounts but inform our design principles.

6.6 Poland

Complaints may be filed with the President of UODO. Additional consumer protections apply under Polish Civil Code for B2C contracts.

6.7 All EU/EEA — saved payment cards

If you save a payment card, card data is tokenised by our infrastructure partner. Atlayo does not operate a wallet, stored balance, or peer-to-peer payments. Mini-apps use their own payment providers; Atlayo provides card autofill only with your explicit consent.

7. International transfers from the EU/EEA

When we transfer personal data outside the EU/EEA, we implement Standard Contractual Clauses, supplementary measures, and transfer impact assessments as required by Schrems II jurisprudence and EDPB guidance.

8. Minors in the EU/EEA

Digital consent age is 16 unless Member State law lowers it to not below 13. See the Children's Privacy Statement.

9. Language

We may provide translations of these documents (including Czech). If a translation conflicts with the English version, English prevails unless mandatory local law requires otherwise.

10. Consumer rights

EU consumers retain mandatory rights under national consumer-protection laws, including 14-day withdrawal for distance contracts where applicable to paid services purchased directly from Atlayo (not third-party mini-app merchants).

11. Contact

Atlayo Overseas s.r.o.
Company ID: 29645433
VAT ID: CZ29645433
File C 152275 at the Regional Court in Brno
Příkop 843/4, Zábrdovice, 602 00 Brno, Czech Republic

Parent company: Atlayo spol. s r.o. (Atlayo group)
EU/EEA privacy requests: privacy@atlayo.com
DPO: dpo@atlayo.com
Legal: legal@atlayo.com