Social Media Privacy Policy
Last updated: October 08, 2026 | GDPR (EU 2016/679) & Spanish LOPDGDD 3/2018 Compliance
This Social Media Privacy Policy governs the processing of personal data of users who visit, follow, or interact with official Tredi profiles and pages across social networks and digital platforms (hereinafter, the "Official Channels").
Tredi is a proprietary brand and platform operated by Perk Drop SL (hereinafter, "Tredi" or the "Controller"). Perk Drop SL is committed to safeguarding user privacy and digital rights by providing rigorous, clear, and transparent information regarding data collection, processing, and protection within social media environments.
1. Data Controller and Official Channels
In compliance with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), the data controller for our Official Channels is:
Datos Registrales
Corporate Name: Perk Drop SL
Tax ID (CIF): B05620273
Registered Office: Carrer de Provença, 62, Eixample, 08029 Barcelona, Spain
Commercial Registry of Barcelona: Volume 45892, Folio 112, Page B-501234
Data Protection Officer (DPO) / Legal: legal@tredi.app
Verified Official Profiles & Channels:
- Instagram: @tredi.app (consumers and community) and @tredipartner (merchants and hospitality)
- TikTok: @tredi.app
- LinkedIn: Tredi (Perk Drop SL)
- X (formerly Twitter): @trediapp
- YouTube: @trediapp
Tredi will never request passwords, credit card numbers, redemption PINs, or wire transfers via social media direct messages. If you detect suspicious or unverified accounts claiming to represent Tredi, please report them immediately to soporte@tredi.app.
2. Joint Controllership Framework with Platforms (Art. 26 GDPR)
Pursuant to the jurisprudence of the Court of Justice of the European Union (Judgment of 5 June 2018, Wirtschaftsakademie, C-210/16; Fashion ID C-40/17) and Article 26 of the GDPR, Perk Drop SL and the operators of social media platforms act as joint data controllers with respect to page statistics and aggregated analytics generated from user engagement on corporate profiles.
Meta Platforms Ireland Ltd. (Instagram / Facebook)
Joint controllership formalised via the Page Insights Controller Addendum. Meta assumes primary responsibility for providing information and enabling the exercise of GDPR data subject rights regarding aggregated analytics.
LinkedIn Ireland Unlimited Company
Joint controllership governed by the Page Analytics Joint Controller Addendum for business interaction metrics and professional visitor profiles.
TikTok Technology Limited
Joint controllership regarding the collection and processing of engagement events, reach, and performance metrics for multimedia content on the platform.
Google Ireland Limited (YouTube)
Joint controllership for metrics, impressions, and views on Tredi's official channel under Google's platform terms.
Independent Platform Processing: Beyond aggregated page analytics, platforms process user data according to their own independent privacy policies (cross-site ad profiling, behavioral tracking, international transfers). Perk Drop SL does not determine, access, or bear liability for such independent platform operations.
3. Categories of Personal Data Processed
The data accessible or processed by Tredi on its official profiles depends strictly upon the privacy settings and permissions configured by each user on the respective platform:
Public Profile Data
Username (handle), full name (if public), avatar/profile picture, biography, and any information made publicly accessible by the user.
Community & Engagement Data
Following actions, likes, emoji reactions, comments, public mentions, saves, and shared publications.
Direct Messages & Support
Direct messages (DMs) voluntarily sent to Tredi regarding service inquiries, Tred voucher redemption support, merchant onboarding, or general feedback.
Contests & Giveaways Data
Identification and delivery contact details (name, email, phone number, shipping address) provided voluntarily for prize distribution in Tredi promotions.
4. Processing Purposes and Legal Bases (Art. 6 GDPR)
| Processing Purpose | Data Processed | Legal Basis (GDPR) |
|---|---|---|
| Corporate social presence management, promoting hourly Drops, partner merchant offers, and platform updates. | Public profile details, followership, and engagement signals. | Consent (Art. 6.1.a GDPR) granted by voluntarily following the profile or interacting with content. |
| Handling user and hospitality merchant support requests and resolving redemption discrepancies. | Direct messages (DMs), supplied identity, and contact information. | Performance of contractual/pre-contractual steps (Art. 6.1.b GDPR) and legitimate interest (Art. 6.1.f GDPR). |
| Organizing and running social giveaways, contests, and prize fulfillment. | Participant and winner identification details. | Execution of contest legal terms accepted by the participant (Art. 6.1.b GDPR). |
| Aggregated statistical performance analysis and optimization of brand communications. | Anonymized statistical metrics provided by the platforms. | Legitimate interest of Tredi (Art. 6.1.f GDPR) in evaluating campaign effectiveness. |
| Content moderation, anti-fraud enforcement, and safeguarding community safety. | Public comments, user reports, and moderation logs. | Compliance with legal obligations (DSA, LSSI-CE) and legitimate interest (Art. 6.1.c and 6.1.f GDPR). |
5. Code of Conduct, Moderation, and Community Guidelines
To maintain a safe, welcoming, and constructive community celebrating local gastronomy and commerce, users agree to abide by the following standards:
Civility and Respect: Insults, hate speech, threats, harassment, defamatory remarks, or discrimination on any basis are strictly prohibited.
No Spam or Unauthorized Commercial Solicitation: Posting fraudulent links, pyramid schemes, external business promotions, or repetitive spam is prohibited.
Third-Party Privacy: Disclosing third-party personal or sensitive information (phone numbers, private addresses, non-consensual photos) is strictly forbidden.
Illicit Content: Content violating copyright, commercial confidentiality, or applicable EU laws will not be tolerated.
Moderation Powers & DSA Enforcement: Perk Drop SL reserves the right to hide, delete, or report comments violating these rules and to block repeat offenders, in strict accordance with the Digital Services Act (Regulation EU 2022/2065).
6. User-Generated Content (UGC) and Image Reposting
When users tag or mention Tredi (@tredi.app or @tredipartner) in public posts, Stories, or Reels showcasing dining experiences or QR redemptions, Tredi may reshare such content exclusively through native platform features (e.g. Story reposts).
Tredi will never download or reuse user media outside of native social platforms (such as external advertising banners or printed collateral) without prior explicit written consent from the copyright and image rights holder.
Users may withdraw consent or request immediate removal of any repost or mention at any time by sending a direct message to the official account or emailing legal@tredi.app.
7. Data Retention Schedules
Interacciones Públicas
Public engagement data: Persists on the social network as long as the user follows the profile or until the user deletes their own likes, comments, or posts.
Mensajes Directos y Soporte
Direct messages and support: Kept only as long as needed to resolve the inquiry and subsequently for statutory limitation periods (3 to 5 years under Spanish civil and commercial law).
8. International Data Transfers
Social media platforms utilized by Tredi operate global infrastructures with servers located outside the European Economic Area (primarily in the United States). Such transfers are legitimized by:
- The European Commission's Adequacy Decision of 10 July 2023 on the EU-U.S. Data Privacy Framework (DPF), under which Meta, Google, LinkedIn, and X Corp are certified.
- Standard Contractual Clauses (SCCs) adopted by the European Commission, reinforced by technical encryption safeguards in transit and at rest.
9. Exercise of Rights and Supervisory Authority Complaints
Users may exercise their rights of access, rectification, erasure, restriction of processing, data portability, and objection (ARCO-POL):
Ante Perk Drop SL
Directly with Perk Drop SL: Email your request with proof of identity to legal@tredi.app or dpo@tredi.app specifying your social media handle.
Configuración en Plataformas
Platform-Specific Actions: Certain operations (such as unfollowing, deleting historical likes, or adjusting profile visibility) must be performed directly by the user within their platform account privacy settings.
Reclamación ante la Autoridad de Control
Right to Lodge a Complaint: If you believe your data protection rights have been infringed, you are entitled to submit a complaint to the Spanish Data Protection Agency (AEPD) at www.aepd.es or at its headquarters in C/ Jorge Juan, 6, 28001 Madrid, Spain.