Homer App Privacy Policy
HOMER PRIVACY POLICY
Table of Contents
Effective Date: [●] Last Updated: [●] Version: 2.0
This Privacy Policy explains how Daniel Bitton, trading as“Homer” (“Homer”, “we”, “us”, “our”), processes personal data when you use the Homer apps, websites, online shop, AR experiences, Homer+ membership and related services (the “Platform”), and what rights you have. It provides the information required by Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”).
This Privacy Policy is provided for your information. It is not a contract and does not require your agreement. Where we rely on your consent, we ask for it separately. Capitalised terms not defined here have the meaning given in the Homer Terms of Service (the “Terms”).
Your right to object. Where we process your data on the basis of legitimate interests (Article 6 (1) (f) GDPR), you have the right to object at any time on grounds relating to your particular situation. You can object to direct marketing at any time without giving reasons. See Section 21.5.
This summary is for convenience only; the full text below is authoritative.
|
Topic |
Summary |
|
Who is responsible |
Daniel Bitton, trading as “Homer”, Germany (Section 2) |
|
What we collect |
Account data, camera/AR data (mostly processed on your device), location (with permission), device data, payment data (via payment providers), usage data, content you submit (Section 4) |
|
Why |
To provide and secure the Platform, process payments, personalise recommendations, communicate with you, and comply with law (Section 5) |
|
Sharing |
Service providers acting on our instructions, payment providers, app stores, sign-in providers, Venues (limited), authorities where required (Section 17) |
|
Transfers outside the EU |
Only with appropriate safeguards (Section 18) |
|
Retention |
Only as long as necessary or legally required (Section 20) |
|
Your rights |
Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, complaint (Section 21) |
|
Age |
Only for persons aged 18 and over (Section 25) |
|
Contact |
homerartsapp@gmail.com (Section 33) |
This Privacy Policy applies to personal data we process (a) when you use the Platform; (b) when you contact us; (c) when you receive our communications; and (d) when we process data about representatives of Business Accounts and Venues.
It does not cover processing by third parties for their own purposes, such as Venues, Apple, Google or payment providers acting as independent controllers, or third-party websites linked from the Platform. Their own privacy policies apply.
2. CONTROLLER; CONTACT; REPRESENTATIVES
The controller within the meaning of Article 4 (7) GDPR is:
Daniel Bitton, trading as “Homer”
[Street and house number]
[Postcode and city]
Germany
E-mail: homerartsapp@gmail.com
We have not appointed a data protection officer because the legal requirements for a mandatory appointment (Article 37 GDPR, § 38 BDSG) are not currently met. We will appoint one and publish the contact details if this changes. Please send all data protection enquiries to the contact address above.
Homer is established in the European Union, so no EU representative is required. [Where Homer offers the Platform to persons in the United Kingdom and the exemption for occasional, low-risk processing does not apply, Homer’s UK representative under Article 27 UK GDPR is: [name, address, e-mail]].
2.4 Competent Supervisory Authority
The supervisory authority competent for Homer is [the data protection authority of the German federal state in which Homer’s business address is located, e.g. “Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf” if the business is based in North Rhine-Westphalia]. You may also complain to the authority in your own country (Section 21.10).
“Personal data” means any information relating to an identified or identifiable natural person (Article 4 (1) GDPR), and includes “personal information” within the meaning of other applicable laws.
“Special categories of personal data” means the data listed in Article 9 (1) GDPR (for example health data or biometric data for uniquely identifying a person).
“Processor” means a provider that processes personal data on our behalf and on our instructions (Article 4 (8) GDPR).
4. CATEGORIES OF PERSONAL DATA
Name or username, e-mail address, date of birth (for age verification), hashed password (if you register by e-mail), and the information received from Apple or Google if you use their sign-in (Section 13).
Information you choose to add, such as profile picture, bio, favourites, public Reviews and collected Digital Collectibles.
Image data from your camera when you use AR Experiences, image recognition or QR code scanning (Section 11).
Precise location (if you grant permission) or approximate location derived from your IP address or settings (Section 10).
Device model, operating system, app version, language, time zone, IP address, app instance identifiers, crash and diagnostic data, and, with your consent, advertising identifiers (Section 12).
Products purchased, prices, dates, subscription status, billing name and address, payment status and payment method type (e.g. “Visa ending 1234”). Full card details are processed by the payment provider, not by us (Section 14).
4.7 Content and Communications
UGC you submit (Reviews, photos, comments), messages exchanged through community features, and your communications with us (support requests, notices, complaints).
Features used, screens viewed, AR Experiences completed, Venues visited or checked into, Rewards earned and redeemed, Promotion entries and session information (Section 15).
Business name, legal form, address, tax and VAT numbers, names and business contact details of authorised representatives, and payout information processed by the payment provider (Section 26).
Preferences and interests inferred from your usage to personalise recommendations (Section 27).
4.12 Is Providing Data Required?
Providing Account data (Section 4.1) is required to conclude the contract for the use of the Platform; without it, we cannot create an Account. Providing purchase data is required for paid contracts, and certain data is required by tax law. Granting camera or location permissions, consenting to analytics or marketing, and adding profile data are voluntary; if you do not, only the dependent features are unavailable.
|
Purpose |
Data |
Legal basis |
|
Creating and managing your Account |
Account, profile |
Art. 6 (1) (b) GDPR (contract) |
|
Sign-in with Apple/Google |
Account |
Art. 6 (1) (b) GDPR |
|
Providing AR Experiences, image recognition, QR scanning |
Camera/AR, location, device |
Art. 6 (1) (b) GDPR; access to device functions under § 25 (2) No. 2 TDDDG (strictly necessary for a service you request); OS permission as technical control |
|
Location-based features (maps, nearby Venues, location-triggered Rewards) |
Location |
Art. 6 (1) (b) GDPR; § 25 (2) No. 2 TDDDG |
|
Paid purchases, invoicing, accounting |
Purchase/payment, account |
Art. 6 (1) (b) GDPR; Art. 6 (1) (c) GDPR with § 147 AO, § 14 UStG (tax records) |
|
Rewards Program and Promotions |
Usage, location, account |
Art. 6 (1) (b) GDPR |
|
Service communications (receipts, security notices, notices of changes) |
Account, purchase |
Art. 6 (1) (b) and (c) GDPR |
|
Personalised recommendations |
Usage, derived data, location |
Art. 6 (1) (b) GDPR where personalisation is part of the feature you use; otherwise Art. 6 (1) (f) GDPR (interest: relevant content); you can switch personalisation off in settings |
|
Analytics (non-essential) |
Usage, device |
Consent: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG |
|
Marketing e-mails, push and SMS |
Account, usage |
Consent (Art. 6 (1) (a) GDPR; § 7 (2) UWG); for e-mail to existing customers about similar own products, Art. 6 (1) (f) GDPR with § 7 (3) UWG |
|
Security, fraud and abuse prevention (incl. location spoofing, multiple Accounts, card testing) |
Account, device, usage, location, purchase |
Art. 6 (1) (f) GDPR (interest: integrity of the Platform, preventing fraud); access to device information under § 25 (2) No. 2 TDDDG where strictly necessary for security of the requested service |
|
Content moderation, notices, reports to authorities |
Content, communications, account |
Art. 6 (1) (c) GDPR (Art. 16–18 DSA); Art. 6 (1) (f) GDPR (safe platform, enforcing the Terms) |
|
Improving the Platform and developing new features |
Usage (pseudonymised or aggregated) |
Art. 6 (1) (f) GDPR (interest: product improvement) |
|
Legal claims and compliance |
Any relevant data |
Art. 6 (1) (f) GDPR; Art. 6 (1) (c) GDPR |
|
Emergencies |
Location, account |
Art. 6 (1) (d) GDPR (vital interests), in rare cases |
We process data for a purpose other than the one for which it was collected only where the new purpose is compatible with the original one (Article 6 (4) GDPR), where you have consented, or where the law permits it. We inform you before any such further processing.
We ask for your consent in particular for (a) non-essential cookies, SDKs and similar technologies (Cookie Policy); (b) marketing communications (except Section 5.1, existing-customer e-mail); (c) cross-app tracking where your operating system requires a tracking permission; and (d) any processing of special categories of data, should a future feature require it (Section 8).
Consent is voluntary, specific, informed and unambiguous, and given by a clear affirmative act. Refusing consent does not affect your ability to use the Platform’s core features, except where the consent relates to the feature itself.
You can withdraw consent at any time with effect for the future: for permissions, in your device settings; for marketing, via the unsubscribe link or in-app settings; for cookies, in the cookie settings; or by message to us. Withdrawal does not affect the lawfulness of processing before withdrawal.
Where we rely on Article 6 (1) (f) GDPR, we have weighed our interests against your interests and fundamental rights, taking into account your reasonable expectations. Our interests are those stated in Section 5.1. You can object at any time (Section 21.5). On request, we will provide information about the balancing of interests.
8. SPECIAL CATEGORIES; NO FACIAL RECOGNITION
Our image recognition recognises predefined markers, artworks, storefronts and environmental features, not human faces. We do not perform facial recognition, create face templates or identify persons from images.
Images may incidentally show information that could reveal special categories of data (for example a religious symbol). We do not analyse images for such information.
If we ever introduce a feature that processes biometric data to identify a person, we will update this Privacy Policy in advance, obtain your explicit separate consent (Article 9 (2) (a) GDPR and any applicable biometric privacy law), publish a retention and deletion schedule, carry out a data protection impact assessment, and keep the rest of the Platform usable without that feature.
Where technically feasible, camera data is processed transiently on your device and discarded immediately after use.
9. COOKIES AND SIMILAR TECHNOLOGIES
We use cookies, SDKs, local storage and similar technologies. Access to information on your device that is not strictly necessary for a service you explicitly requested requires your consent under § 25 (1) TDDDG. Details are in the Homer Cookie Policy.
Displaying nearby Venues and AR Experiences; maps; location-triggered Rewards and Digital Collectibles; location-based notifications (if enabled); localisation (language, currency, regional terms); detecting location spoofing; and aggregated, anonymised statistics on Venue popularity.
We collect precise location only while needed for the feature you use (“while using the app” permission is sufficient for all current features). We do not sell location data and do not share precise location with Venues or advertisers.
You can grant, limit or withdraw location permission at any time in your device settings.
Precise location used for real-time features is not stored beyond the session, except (a) where a location is needed to record a Reward, check-in or Promotion entry, in which case we store the event (Venue, time) rather than a continuous track; and (b) location signals used for fraud detection, which we keep for up to ninety (90) days. Statistics are anonymised.
11. CAMERA, AR AND IMAGE RECOGNITION
We request camera permission only when you first use a camera-based feature and explain the purpose at that time.
11.2.1 AR rendering takes place on your device. The live camera feed is not transmitted to our servers.
11.2.2 Image recognition. To recognise a marker or artwork, the app may send a compact feature representation (or, where unavoidable, a single cropped frame) to our server for comparison with our marker database. It is deleted immediately after the comparison and is not used to identify persons.
11.2.3 Your captures. Photos or videos you choose to capture and save or share using the app are stored as UGC (Article 11 of the Terms) until you delete them.
Images may incidentally show other people. We do not use such images to identify them. If you save or share images showing identifiable people, you are responsible for having any required consent.
If you upload an existing photo (e.g. profile picture), we access only the photos you select, where your operating system supports this.
12. DEVICE IDENTIFIERS AND IP ADDRESSES
We process app instance identifiers and technical device information to operate and secure the Platform. We process advertising identifiers (IDFA, Google Advertising ID) only with your consent and, on iOS, only if you grant tracking permission.
12.2 IP Addresses and Server Logs
When you use the Platform, our hosting provider automatically processes your IP address, date and time, requested resource, referrer, user agent and status codes in server log files to deliver the Platform and ensure its security (Article 6 (1) (f) GDPR). Log files are deleted after [seven (7)] days, unless a security incident requires longer retention for its investigation.
You can reset your advertising identifier or limit tracking in your device settings.
13. SIGN-IN WITH APPLE OR GOOGLE
If you use Sign in with Apple or Google Sign-In, we receive the information you authorise: typically your name, e-mail address (or an Apple relay address) and a unique identifier.
We do not receive your Apple or Google password or other data in your Apple or Google account.
Apple (Apple Distribution International Ltd., Ireland) and Google (Google Ireland Limited) process data relating to their sign-in services as controllers under their own privacy policies.
Direct payments are processed by Stripe Payments Europe, Ltd., Dublin, Ireland (“Stripe”) and, for our online shop, by the payment services integrated into Shopify (Shopify International Limited, Dublin, Ireland, and its payment partners). Card details are entered directly with the payment provider. We receive payment status, the payment method type and limited card information (e.g. last four digits).
14.2 Payment Providers as Controllers
Payment providers process certain data as independent controllers for their own legal obligations (anti-money-laundering, fraud prevention, regulatory reporting), in accordance with their own privacy policies.
For purchases through Apple or Google, the Marketplace processes payment data as controller. We receive only the information needed to provide the purchased benefits (e.g. subscription status, transaction identifier, country).
Payouts to Business Accounts are processed by a licensed payment provider (e.g. Stripe Connect), which carries out the required identity and know-your-customer checks as controller.
We and the payment providers exchange transaction and device data where necessary to prevent payment fraud (Article 6 (1) (f) GDPR).
We use analytics to understand how the Platform is used, measure performance, find errors and improve features.
Analytics that requires access to information on your device and is not strictly necessary is only used with your consent (§ 25 (1) TDDDG; Article 6 (1) (a) GDPR). Crash reports and technically necessary stability monitoring are processed on the basis of Article 6 (1) (f) GDPR and § 25 (2) No. 2 TDDDG, to the extent strictly necessary.
Where possible, we use aggregated or pseudonymised data. Analytics provided to Business Accounts is aggregated or anonymised so that individual Users cannot be identified.
The analytics providers we use are listed in Section 31 and in the Cookie Policy.
16.1 Newsletter and Marketing E-mails
We send marketing e-mails only with your consent, which we confirm using a double opt-in procedure (you receive an e-mail asking you to confirm your subscription), and log your consent (time, IP address, consent text) to be able to prove it (Article 6 (1) (c) and (f) GDPR). Where you are an existing customer, we may send e-mails about our own similar products under § 7 (3) UWG; you can object at any time, and we tell you so in each e-mail.
Push notifications require your permission in your operating system. You can switch them off at any time. Marketing push notifications are sent only if you have enabled them in the app settings.
16.3 Advertising for Homer on Third-Party Services
If we advertise the Platform on third-party services using pixels or SDKs, we do so only with your consent (Cookie Policy). We do not display third-party personalised advertising in the Platform. Sponsored Venue placements in the Platform are not based on profiling of you by advertisers.
We measure opening and click rates of marketing e-mails only with your consent, which you can give when subscribing.
We disclose personal data only as necessary for the purposes described:
We do not sell personal data.
We may share anonymised, aggregated statistics (e.g. visitor trends) that do not allow the identification of any person.
We prefer providers that process data within the European Economic Area (EEA). Where data is transferred to a country outside the EEA, we ensure an adequate level of protection by: (a) an adequacy decision of the European Commission (Article 45 GDPR), including, for certified U.S. recipients, the EU-U.S. Data Privacy Framework; or (b) Standard Contractual Clauses adopted by the European Commission (Article 46 (2) (c) GDPR, Decision (EU) 2021/914), supplemented by additional measures where necessary.
18.2 United Kingdom and Switzerland
Transfers from the UK or Switzerland are protected by the UK International Data Transfer Addendum or the Swiss adaptations of the Standard Contractual Clauses, or by adequacy regulations, as applicable.
You can request a copy of the relevant safeguards from us (Section 33).
19.1 We implement technical and organisational measures appropriate to the risk (Article 32 GDPR), including encryption in transit (TLS), encryption at rest where supported by our providers, access control and multi-factor authentication for administrative access, regular updates, backups, and careful selection of service providers.
19.2 No method of transmission or storage is completely secure. Please protect your credentials and inform us immediately of any suspected misuse.
19.3 Please report security vulnerabilities to homerartsapp@gmail.com. Do not access data of other Users or impair the Platform when testing. Good-faith reports are welcome (Acceptable Use Policy, Section 5.6.4).
We store personal data only as long as necessary for the purposes for which it was collected, or as required by law, and then delete or anonymise it.
20.3 Restriction Instead of Deletion
Where statutory retention obligations prevent deletion, we restrict the processing to those purposes.
Under the GDPR you have the following rights, subject to the statutory conditions and exceptions.
You may request confirmation of whether we process your data, a copy of it, and the information listed in Article 15 GDPR.
21.3 Rectification (Article 16 GDPR)
You may request the correction of inaccurate data. You can correct most data yourself in the settings.
21.4 Erasure (Article 17 GDPR)
You may request deletion where the statutory requirements are met, for example where the data is no longer necessary or you have withdrawn consent, unless an exception applies (e.g. retention obligations, legal claims).
21.5 Objection (Article 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to processing based on Article 6 (1) (e) or (f) GDPR, including profiling based on these provisions. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where we process data for direct marketing, you have the right to object at any time to such processing, including profiling related to direct marketing. We will then no longer process your data for this purpose.
21.6 Restriction (Article 18 GDPR)
You may request restriction of processing, for example while the accuracy of the data is being checked.
21.7 Portability (Article 20 GDPR)
You may receive data you provided to us, which we process on the basis of consent or contract by automated means, in a structured, commonly used and machine-readable format, or have it transmitted to another controller where technically feasible.
21.8 Withdrawal of Consent (Article 7 (3) GDPR)
Section 6.3.
21.9 Automated Decisions (Article 22 GDPR)
Section 27.
21.10 Complaint (Article 77 GDPR)
You may lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement, or with the authority competent for us (Section 2.4).
Contact us at the address in Section 33 or use the privacy settings in the app. We respond within one month; this period may be extended by two further months where necessary, in which case we inform you. Where we have reasonable doubts about your identity, we may request additional information to confirm it. Requests are free of charge unless manifestly unfounded or excessive (Article 12 (5) GDPR).
22.1 Homer is a small business established in Germany. Based on its size and revenue, Homer does not currently meet the applicability thresholds of the California Consumer Privacy Act (CCPA/CPRA) or comparable comprehensive state privacy laws. Should this change, we will provide the required notices.
22.2 Regardless of applicability, U.S. residents may request access to, correction of or deletion of their personal data using the contact details in Section 33, and we will respond in accordance with this Privacy Policy. We do not sell personal information and do not share it for cross-context behavioural advertising without consent. Our websites honour the Global Privacy Control (GPC) signal as a refusal of non-essential cookies.
22.3 We do not knowingly collect personal information from children under 13 (or under 18); see Section 25.
23.1 For Users in Canada, we process personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law, including Québec’s Act respecting the protection of personal information in the private sector.
23.2 Daniel Bitton is responsible for compliance and can be reached at the contact details in Section 33.
23.3 You may access and correct your personal information, withdraw consent subject to legal or contractual restrictions, and complain to the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d’accès à l’information.
23.4 Your personal information is processed in Germany and other countries described in Section 18, where it may be accessible to authorities under local law.
24.1 France: you may complain to the CNIL and give instructions regarding the processing of your data after your death (Article 85 of the French Data Protection Act).
24.2 Greece: you may complain to the Hellenic Data Protection Authority.
24.3 United Kingdom: references to the GDPR include the UK GDPR; you may complain to the Information Commissioner’s Office (ICO).
24.4 Other countries: we honour requests in accordance with this Privacy Policy and mandatory local law.
25.1 The Platform is intended only for persons aged 18 and over. We do not knowingly collect personal data of minors.
25.2 We ask for your date of birth at registration. Where we have concrete indications that a User is under 18, we may request proof of age.
25.3 If we learn that we have collected data of a person under 18, we close the Account and delete the data, subject to statutory retention obligations. Please inform us if you believe this has happened.
26.1 We process the business contact data of representatives of Business Accounts to manage the business relationship, on the basis of Article 6 (1) (b) GDPR (where the representative is the contracting party) or Article 6 (1) (f) GDPR (interest in communicating with business partners).
26.2 A Business Account is an independent controller for data it collects outside the Platform. Where we process personal data on behalf of a Business Account, or vice versa, the Homer Data Processing Agreement applies.
26.3 Business Accounts receive only aggregated or anonymised analytics and must not attempt to re-identify Users.
27. AUTOMATED DECISIONS AND PROFILING
We personalise recommendations based on your usage, preferences and location. This is profiling within the meaning of Article 4 (4) GDPR, but does not produce legal effects or similarly significant effects. You can switch off personalisation in the settings.
27.2 No Solely Automated Decisions with Legal Effect
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).
Automated fraud detection (e.g. detecting location spoofing) may flag an Account for review. Any restriction of an Account is decided or confirmed by a human (Daniel Bitton or a person instructed by him). You may present your point of view and contest the decision (Article 26 of the Terms).
Where we use third-party AI services to provide AI Features, they act as our processors, and we contractually prohibit them from using your data to train their own models. We do not use the content of private messages or Content marked as private to train AI models. We may use pseudonymised or aggregated usage data to improve our own recommendation features on the basis of Article 6 (1) (f) GDPR; you may object (Section 21.5).
28.1 We disclose personal data to authorities only where we are legally obliged to do so (e.g. under a court order or a legally binding order of a competent authority), where Article 18 DSA requires it, or where necessary to protect life or physical integrity.
28.2 We check requests for their legal basis and, where legally permitted, inform the affected User.
28.3 We do not respond to requests from non-EU authorities that are not based on an international agreement recognised under Article 48 GDPR, unless another legal basis applies.
29.1 We notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons (Article 33 GDPR).
29.2 Where a breach is likely to result in a high risk to you, we inform you without undue delay (Article 34 GDPR).
29.3 For Users outside the EU, we comply with mandatory breach notification laws applicable to us.
Before introducing VR Experiences, wearables, new AI Features or other features that involve new categories of data (e.g. spatial mapping, hand or eye tracking), we will update this Privacy Policy, carry out a data protection impact assessment where required (Article 35 GDPR), and obtain your consent where required.
31. PROCESSORS AND OTHER SERVICE PROVIDERS
We use the following service providers. Processors act under data processing agreements (Article 28 GDPR). [This list must be completed with the actual providers before publication.]
|
Category |
Provider |
Location / Safeguard |
|
Hosting, database, storage |
[Provider name, address] |
[EU/EEA region; or DPF/SCCs] |
|
Online shop and membership area (where used) |
Shopify International Limited, Dublin, Ireland |
Ireland; onward transfers: DPF/SCCs |
|
Payments |
Stripe Payments Europe, Ltd., Dublin, Ireland (independent controller for its regulatory purposes) |
Ireland; onward transfers: DPF/SCCs |
|
Sign-in; app distribution; in-app purchases |
Apple Distribution International Ltd.; Google Ireland Limited (independent controllers) |
Ireland; DPF/SCCs |
|
Analytics and crash reporting |
[Provider name] |
[Location / safeguard] |
|
Push notifications |
[Provider name] |
[Location / safeguard] |
|
E-mail delivery |
[Provider name] |
[Location / safeguard] |
|
Maps |
[Provider name] |
[Location / safeguard] |
|
AI services |
[Provider name] |
[Location / safeguard; no training on customer data] |
|
Customer support tool |
[Provider name] |
[Location / safeguard] |
32.1 We update this Privacy Policy when our processing or the law changes. The current version is always available on the Platform.
32.2 We inform you of material changes in advance by e-mail or in the app. Where a change requires your consent, we will ask for it and will not apply the change to you without it.
Daniel Bitton – Homer
[Street and house number]
[Postcode and city]
Germany
E-mail: homerartsapp@gmail.com
This Privacy Policy must be checked against the Platform’s actual data flows (records of processing activities under Article 30 GDPR, actual SDKs and providers, actual retention settings) before publication. Statements that do not match actual practice are a breach of the GDPR’s transparency obligations and may be challenged by competitors and consumer associations. Highlighted items must be completed.
— END OF HOMER PRIVACY POLICY —