Kiin VR App Privacy Notice

Effective date: 7 April 2023
Last updated: 18 December 2025

This Privacy Notice explains how personal data is processed when you use the Kiin VR App (the “App”). This notice applies only to the App and not to the Kiin or Virtual Bodyworks websites.

1. Who is responsible for your data?

The data controller is:

Virtual Bodyworks S.L.
Avenida Cabrera 36, 08302, Mataró Barcelona
Email: privacy@kiin.tech

Virtual Bodyworks S.L. operates the App under the Kiin brand.

We have not appointed a Data Protection Officer, as we are not legally required to do so. Privacy-related enquiries can be sent to the email address above.

2. How the App works (offline and online use)

The Kiin VR App can operate fully offline once installed.

• If you use the App offline, no usage data is transmitted to Kiin.

• If you use the App while connected to the internet, limited usage data may be transmitted to support the operation and improvement of the App.

The App does not require a continuous internet connection, and users may choose to use it entirely offline.

3. What personal data do we process?

When the App is used while online, we may process the following categories of personal data:

a) Account and access data

• Name

• Email address

• User or account identifier

• Organisation or deployment identifier (where applicable)

b) App usage data

• Which VR experiences are accessed

• Frequency of use

• Session duration

• Basic technical information necessary for app functionality (e.g. app version)

This usage data is linked to user accounts or organisational deployments.

4. What data do we not collect?

The Kiin VR App does not collect:

• Biometric data

• Eye-tracking data

• Facial images

• Voice recordings

• Continuous body-movement or positional tracking data

• Health data

• Special category personal data as defined under Article 9 GDPR

5. Why do we process this data?

We process personal data for the following purposes:

• To provide access to and operate the VR App

• To enable user authentication and account management

• To understand how the App and its experiences are used

• To improve the performance, reliability, and design of the App

• To support organisational reporting where applicable

• To meet legal and regulatory obligations

We do not use App data for advertising or marketing purposes.

6. What is the legal basis for processing?

Under the General Data Protection Regulation (GDPR), we rely on the following legal bases:

• Contractual necessity (Article 6(1)(b)): processing required to provide access to the App and deliver the services agreed with users or organisations.

• Legitimate interests (Article 6(1)(f)): processing limited usage data to operate, maintain, and improve the App.

Where legitimate interests are relied upon, we ensure that processing is proportionate and does not override users’ rights and freedoms.

7. Who receives your data?

Personal data may be accessed by:

• Authorised personnel at Virtual Bodyworks S.L.

• Trusted service providers acting as data processors (e.g. hosting or infrastructure providers), under appropriate contractual safeguards.

We do not sell personal data.

8. International data transfers

Where personal data is processed outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as standard contractual clauses approved under GDPR.

9. How long do we keep your data?

We retain personal data only for as long as necessary to fulfil the purposes described in this notice, including:

• the duration of the user account or organisational deployment

• any additional period required by law or contractual obligations

Data may be anonymised and retained in aggregate form for analytical purposes.

10. Your rights

Under GDPR, you have the right to:

• Access your personal data

• Correct inaccurate or incomplete data

• Request deletion of your data

• Restrict processing

• Object to processing based on legitimate interests

• Request data portability, where applicable

• Lodge a complaint with a supervisory authority

In Spain, the supervisory authority is the Agencia Española de Protección de Datos (AEPD).

To exercise your rights, contact us at privacy@virtualbodyworks.com.

11. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. Any material changes affecting how personal data is processed will be communicated through the App or other appropriate means.

12. Contact

If you have any questions or concerns about this Privacy Notice or the App’s privacy practices, please contact:

privacy@kiin.tech