Privacy Policy

This Privacy Policy explains how BLINKA LTD ("BLINKAP", "we", "us" or "our") collects, processes, stores and protects personal data when users access our website, mobile applications and related services.

BLINKAP is a digital platform designed to help individuals organise personal expenses, manage receipts and invoices, and share expenses with other users.

The data controller is:

BLINKA LTD

• Company registration number: 17183494

• Registered in England and Wales

• Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

• Website: https://www.blinkap.com

• General contact: info@blinkap.com

• Data protection contact: dpo@blinkap.com

BLINKA LTD is responsible for determining the purposes and means of processing personal data in connection with the Services.

BLINKAP processes personal data in accordance with applicable data protection legislation, including:

• Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR).

• The UK General Data Protection Regulation (UK GDPR).

• The UK Data Protection Act 2018.

• Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights, where applicable.

The applicable regulatory framework depends on the location of users and the circumstances of the processing activities.

BLINKAP collects and processes personal data necessary to provide its services.

3.1 Personal identification data

When users create an account, BLINKAP collects:

• First name.

• Last name.

• Email address.

Authentication information and technical account identifiers may also be processed as necessary to enable secure access to the application.

3.2 Expense and financial information

BLINKAP allows users to record and organise their expenses.

Depending on the functionality used, the following information may be processed:

• Expense amounts.

• Expense descriptions and categories.

• Dates of expenses.

• Currency information.

• Uploaded receipts and invoices.

• Expense allocations between group members.

• Shared balances and settlement information.

BLINKAP does not require users to provide bank account passwords or payment card credentials to use its current expense-management functionalities.

3.3 Invoice processing

Users may upload invoices and receipts to facilitate expense registration.

BLINKAP uses OCR and artificial intelligence technologies to identify and extract relevant information, particularly the monetary amount appearing on the uploaded document.

The current OCR functionality is not designed to identify or extract the payment method used for the transaction.

Uploaded documents may nevertheless contain additional information supplied by the user, which may be technically processed as part of document analysis.

3.4 Shared group information

When users create or participate in shared expense groups, BLINKAP processes information necessary to manage those groups, including:

• Group identifiers.

• Names of participants.

• Expense amounts and allocations.

• Shared balances.

• Group expense histories.

Relevant group information is made available to authorised participants to enable collaborative expense management.

3.5 Technical information

For authentication, security and application operation, BLINKAP and its technology providers may process technical information such as:

• IP addresses.

• Device and operating system information.

• Authentication identifiers.

• Application error reports.

• Security and diagnostic logs.

Such information is processed only where necessary for the operation, maintenance and security of the Services.

BLINKAP processes personal data for the following purposes:

Account registration and management

To create user accounts, authenticate users and provide access to the Services.

Legal basis: performance of a contract.

Expense management

To enable users to record, categorise and manage expenses.

Legal basis: performance of a contract.

Invoice and receipt processing

To extract relevant expense information from uploaded documents using OCR and artificial intelligence.

Legal basis: performance of a contract.

Shared expense management

To calculate expense allocations, maintain group balances and enable collaboration between authorised users.

Legal basis: performance of a contract, where applicable.

Security and technical maintenance

To protect accounts, prevent unauthorised access, resolve technical incidents and maintain application reliability.

Legal basis: legitimate interests and, where applicable, compliance with legal obligations.

Customer support

To respond to enquiries and requests submitted by users.

Legal basis: performance of a contract or legitimate interests, as appropriate.

Legal compliance

To comply with applicable statutory and regulatory obligations.

Legal basis: compliance with a legal obligation.

Where consent is legally required for a particular processing activity, BLINKAP will request it before carrying out that activity.

BLINKAP uses OpenAI technology to support the automated reading of uploaded invoices and receipts.

The purpose of this processing is to identify relevant expense information, particularly the amount of an invoice or receipt, and facilitate its registration within the application.

The current functionality does not specifically extract payment methods, banking credentials or payment card information.

However, because users may upload documents containing additional information, the document content may be transmitted to the technology provider for processing.

BLINKAP does not use the extracted information to make automated decisions producing legal effects or similarly significant effects on users.

The processing is limited to providing the requested document-reading functionality, subject to applicable contractual, security and data protection safeguards.

BLINKAP uses the following technology providers to operate its services:

Google Firebase

Firebase is used for application infrastructure, including user authentication, database management and data storage.

Depending on the service configuration, Firebase may process account information, application records and technical information required for these functions.

Microsoft Azure

Microsoft Azure is used to support BLINKAP's technical infrastructure and related operational services.

The categories of information processed depend on the infrastructure components used.

OpenAI

OpenAI provides artificial intelligence technology used for processing uploaded invoices and receipts and extracting relevant expense information.

The information transmitted for OCR processing may include the contents of uploaded documents.

These providers act under their respective contractual and data protection arrangements.

BLINKAP requires appropriate safeguards when personal data is processed by service providers acting on its behalf.

BLINKAP does not sell users' personal data to third parties.

BLINKAP allows users to create groups and share expense information with other participants.

Within a shared group, authorised members may view information necessary for the operation of the group, including:

• Participant names.

• Shared expenses.

• Expense allocations.

• Amounts owed or receivable.

• Group balances.

Users should only share information that is relevant to the group and should ensure that they are entitled to disclose any third-party information they enter.

When a user leaves a group or deletes their account, certain expense records may need to be preserved for the legitimate operation of the group, subject to applicable data protection requirements. Where appropriate, identifying information will be removed or anonymised.

BLINKAP retains personal data only for as long as necessary to provide the Services or fulfil applicable legal obligations.

Account information is retained while the account remains active.

Expense information, uploaded documents and group records are retained as necessary to provide the requested functionalities.

Following account deletion, personal data will be erased or anonymised unless continued retention is necessary and legally justified, including for legal compliance, security, the establishment or defence of legal claims, or the legitimate preservation of shared expense records.

Technical logs and backup copies may be retained temporarily in accordance with applicable security and backup procedures.

Data that is no longer required will be securely deleted or anonymised.

BLINKAP users may delete their account directly through the mobile application using the account deletion functionality.

Users may also request account deletion or assistance with the erasure of their personal data by contacting:

dpo@blinkap.com

Upon account deletion, BLINKAP will take appropriate steps to delete or anonymise personal data associated with the account, subject to any lawful retention exceptions.

Information contained in shared expense records may be retained where necessary to preserve the legitimate interests and records of other participants, applying appropriate data minimisation measures.

Users may also submit an account deletion request through the information provided at:

https://www.blinkap.com/delete-account

BLINKAP will handle erasure requests in accordance with applicable data protection legislation.

BLINKA LTD is incorporated in the United Kingdom and provides digital services that may be accessed by individuals located in the European Economic Area.

Personal data may be processed in the United Kingdom, the European Economic Area or other jurisdictions where authorised technology providers operate.

Where applicable law requires safeguards for international transfers, BLINKAP will use an appropriate legal mechanism, such as:

• An applicable adequacy decision.

• Standard Contractual Clauses approved by the European Commission.

• UK international data transfer mechanisms, where applicable.

• Other lawful transfer mechanisms permitted by data protection legislation.

BLINKAP will apply appropriate safeguards to international transfers where legally required.

BLINKAP implements technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration or unlawful disclosure.

These measures may include:

• Secure user authentication.

• Access restrictions.

• Encryption mechanisms provided by the relevant infrastructure.

• Secure data transmission.

• Technical monitoring and maintenance.

• Appropriate controls over access to application data.

Access to personal data is restricted to authorised persons and service providers where necessary for legitimate operational purposes.

Although BLINKAP takes reasonable measures to protect personal information, no digital service can guarantee absolute security.

Subject to applicable data protection legislation, users have the right to:

• Access their personal data.

• Request rectification of inaccurate information.

• Request erasure of personal data.

• Request restriction of processing.

• Object to processing in applicable circumstances.

• Request data portability where legally applicable.

• Withdraw consent where processing is based on consent.

• Exercise applicable rights relating to automated decision-making.

Requests may be submitted to:

dpo@blinkap.com

BLINKAP will respond within the time limits established by applicable legislation, generally within one month, subject to permitted extensions.

Users may also lodge complaints with the competent supervisory authority, including:

United Kingdom

Information Commissioner's Office (ICO) https://ico.org.uk

Spain

Agencia Española de Protección de Datos (AEPD) https://www.aepd.es

Users located elsewhere in the European Economic Area may contact their competent supervisory authority.

For privacy-related matters, users and competent authorities may contact BLINKAP at:

dpo@blinkap.com

This contact address is designated for:

• Personal data protection enquiries.

• Requests to exercise data protection rights.

• Requests for account deletion.

• Privacy complaints.

• Communications concerning personal data processing.

BLINKA LTD remains responsible for compliance with applicable data protection legislation.

Where designation of a representative in the European Union is legally required under Article 27 GDPR, the identity and contact details of the appointed representative will be made available as required by law.

BLINKAP does not use cookies for advertising, behavioural tracking or marketing analytics. The BLINKAP website does not currently deploy cookies.

The mobile application may use technical authentication mechanisms, application identifiers and other functionality necessary to operate the Services. Such mechanisms are not used for advertising or behavioural profiling.

If BLINKAP introduces cookies or other non-essential tracking technologies in the future, this Privacy Policy will be updated and consent will be obtained where legally required.

BLINKAP is intended exclusively for adults aged 18 years or older.

Individuals under the age of 18 are not permitted to register for or use the Services.

BLINKAP does not knowingly collect personal data from minors.

If we become aware that an account has been created by a person under 18, we will take appropriate steps to delete the account and associated personal data, subject to applicable legal requirements.

BLINKAP is an expense-management application.

Its current expense-management functionalities do not involve holding users' funds, maintaining payment accounts or executing regulated payment transactions on their behalf.

Where external payment links or independent payment providers are made available, any payment processing is performed by the relevant external provider under its own applicable terms and privacy policy.

BLINKAP does not require payment card credentials to provide its current expense- management functionality.

BLINKAP may update this Privacy Policy to reflect changes in:

• Applicable legislation.

• Application functionalities.

• Data processing activities.

• Technology providers.

• Security and privacy practices.

Updated versions will be published at: https://www.blinkap.com/privacy-policy

The date of the latest revision will be indicated at the beginning of this document.

Where required by law, users will be notified of material changes.

For questions concerning this Privacy Policy or the processing of personal data:

BLINKA LTD

71–75 Shelton Street Covent Garden, London WC2H 9JQ United Kingdom

General enquiries: info@blinkap.com

Data protection: dpo@blinkap.com

Website: https://www.blinkap.com