Loco | Privacy Policy

PRIVACY POLICY

Last updated: 19 June, 2026

Loco Streaming Ltd (“We/Us”) operates the Loco application as a free-to-use mobile application, along with the website at loco.com (collectively referred to as the “Platform”), and the offered content therein, which is provided to users (“You”) and is intended for use as is. This page is used to inform website visitors regarding our policies in relation to the collection, use, and disclosure of personal information of anyone using our Services through the Platform (“Personal Information or Personal Data”).

If You choose to use any of our Services, then You acknowledge that we may collect and use Your information in accordance with this policy. The Personal Information that We collect is used for providing and improving the Service. We shall not use or share Your information with anyone except as described in this Privacy Policy.

The terms used in this Privacy Policy have the same meanings as in our Terms of Use, which are accessible at the Loco application and website, unless otherwise defined in this Privacy Policy. The capitalised terms used but not defined herein shall have the same meaning as ascribed to them under the Terms of Use.

This Privacy Policy shall apply to all the persons using the App or the Services.

Data Controller

For the purposes of applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 where applicable, the data controller responsible for the processing of your personal data is:

Controller name: Loco Streaming Ltd (HE 480909)

DPO: privacy@loco.gg.

Personal Data Collection

Type of personal data collected

We may collect, use, store and transfer different categories of Personal Information about You, depending on how you use the Platform and Services:

identification information, such as: name, e-mail address, date of birth, telephone number, taxpayer identification number;
transactional information, such as: details related to transactions made on the Platform, including Loco Diamond purchases, reward redemption history, transaction amount, subscription feature payments;
Payments received by you (if you are a streamer), pursuant to Loco Diamonds received, subscription payments and/or creator monetization payments.
location data, including geolocation that we or our third-party providers may derive from your IP address;
if you are a streamer, the address of your digital assets wallet.
communication information, such as information You provide directly to us in communications, feedback and correspondences with us;
usage information, such as: your interests, streamer chat data, preferences, and comments, other usage data/ information, including Your usage of the Platform and/or any of its specific functions or Services; and
log data, such as: Your device Internet Protocol (“IP”) address, device name, operating system version, the configuration of the app when utilizing our Service, the time and date of Your use of the Service, and other statistics.

We do not intentionally collect special categories of personal data, such as information about your health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation. However, if you choose to include such information in comments, chat messages, uploads, profile information or other user-generated content, we may process that information in accordance with this Privacy Policy and applicable law. You are advised not to disclose such information in the Platform.

Mode of collection of personal data

We collect personal data about you in the following ways:

Personal data collected directly from you

This may include personal data collected:

when you provide information to us directly;
when you use the Platform or Services;
when you search for queries, complete forms or register for an account;
when you upload content;
when you report an issue; and
when you use any products or Services offered through the Platform.

Personal data collected automatically

This may include personal data collected:

when you access or use the Platform; and
through cookies or similar technologies.

Personal data collected from third parties

This may include personal data collected from third parties appointed or authorised by us, where permitted by applicable law.

Accuracy of personal data information: We endeavour to keep personal data collected as accurate, complete, and current taking into consideration the purposes for which it was collected and is being used.

We rely on you to maintain the accuracy and completeness of the personal data provided by you and so you should inform us if your personal details change, including the context in which the personal data was provided, e.g. in connection with promotion of a specific product or service or employment application.

Sharing of personal Data

We may share your personal data with third-party service providers, partners and other recipients where this is necessary to provide, operate, secure, verify, analyse, improve and support the Platform and Services, or where otherwise required or permitted by applicable law.

This may include sharing personal data with the following categories of recipients:

Recipient / category	Description of services	Personal data shared	Purpose of sharing
Analytics, attribution and engagement providers	Providers supporting product analytics, user behaviour analysis, attribution, campaign performance measurement, segmentation, retention analysis and user engagement communications across mobile and web.	Email address, phone number, account identifiers, device and session data, usage events, analytics identifiers and engagement information.	To understand Platform usage, measure attribution and engagement, improve the Platform, support user communications and assess service performance.
Authentication and verification providers	Providers supporting password-less login, OTP-based authentication, phone, email or social login verification, session management and account security.	Phone number, email address where applicable, verification status, authentication confirmation and session or verification metadata.	To verify your identity or contact details, authenticate your account and maintain account security.
Payment processors	Providers supporting online and in-app payments, billing, transaction processing, payment confirmation and related payment services.	Email address, payment-related information, transaction identifiers and purchase status.	To process purchases, including Diamonds, subscriptions and other paid features.
KYC, monetisation and payout providers	Providers supporting identity verification, KYC checks, compliance screening, creator monetisation, withdrawals, payout processing, fiat or digital asset settlement and related financial compliance services.	Name, email address, mobile number, address, government ID or other identity document, KYC information, bank details, payout method details and withdrawal information.	To carry out KYC checks, support creator monetisation, verify payout eligibility, process withdrawals and manage payouts.
Wallet infrastructure providers	Providers supporting the creation, management and operation of embedded wallets, wallet identifiers, wallet onboarding and withdrawal-related functionality.	Name, email address, wallet creation information, wallet identifiers, external wallet address and withdrawal-related information.	To manage payouts for streamers.

We may also collect, use and share Your streaming related data to produce and share aggregated insights that do not identify You.

If you are a streamer that has been enrolled by an operator (the “Identified Operator(s)”), we may collect and share data relating to your streaming data with the Identified Operator(s).

Where a third party processes personal data on our behalf, we require it to process such personal data only in accordance with our instructions, maintain confidentiality, apply appropriate security measures and not use the personal data for its own purposes.

In some cases, a third party may act as an independent controller in relation to certain processing activities. Where this applies, its own privacy notice may also apply to the processing of your personal data.

Purposes for use of personal data

We will process and use your personal data where we have a lawful basis to do so under applicable data protection laws, in the following circumstances:

Where we need to perform the contract or arrangement we have entered into with you (Article 6(1)(b) GDPR)

Processing is necessary for us in order to provide the Services to you under our Terms of Use or any other contract we may have with you, including in order to:

provide the Services;
provide customer management;
provide content;
provide functionality; and
maintain security in connection with the Services.

Where we need to comply with a legal or regulatory obligation (Article 6(1)(c) GDPR)

We may process your personal data where this is necessary for us to comply with legal or regulatory obligations which involve the processing of personal data.

Such obligations and requirements may impose on us necessary personal data processing activities for compliance with applicable laws, regulations, court orders, regulatory requirements, lawful requests from public authorities, tax, accounting, reporting, electronic commerce, consumer protection, platform safety and other legal obligations relevant to the operation of the Platform and Services, including:

verify your identity and the information you share with us, where required by law;
supervise, prevent, investigate or report fraudulent or illegal activities where legally required; and
comply with any other legal or regulatory obligation.

Where we have appropriate legitimate interests to use your personal data (Article 6(1)(f) GDPR)

We may process your personal data where this is necessary for our legitimate interests or those of a third party, provided that your interests and fundamental rights do not override those interests, including in order to:

verify your identity and the information you share with us, where necessary to protect the Platform, our users or our business and where this is not required by law;
carry out analytics with our third-party vendors and partners, where consent is not required;
maintain the security, integrity and proper functioning of the Platform and the Website; and
prevent and respond to fraud, misuse, illegal activity or security incidents on the Platform.

Where you have given us your consent (Article 6(1)(a) GDPR)

We may process your personal data where you have given us valid consent for a specific purpose, including in order to:

carry out analytics where you consent to it;
send periodic communications, including emails and messages; and
promote programmes organised by third parties through the Platform;

You may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

If you wish to withdraw your consent, you may contact our Data Protection Officer or privacy contact in writing at Floor 1,1,Georgiou Gennadiou Larnaca,6031, Larnaca, Cyprus or by email at privacy@loco.gg.

Retention Period of Personal Data

We will retain your personal data only for as long as necessary for the purposes for which it was collected, including for the purpose of providing the Platform and Services, complying with legal or regulatory obligations, resolving disputes, enforcing our Terms of Use, and protecting our legal rights. We will retain your Personal Data for a period of 6 years after we stop providing You our Services, unless there is a court case involved or a criminal investigation. Please note that we might not be able to restore the full data of your account after its deletion in our Platform.

User Contributions

Any Personal Information You may submit, display, or publish in or through the Platform shall be publicly available and may be read, collected, used, and disclosed by others. We encourage You to exercise discretion and caution with respect to Your Personal Information.

As our user, You agree not to host, display, upload, modify, publish, transmit, store, update or share any information that:

belongs to another person and to which You do not have any right or consent;
includes bodily privacy, insulting or harassing, that is libellous, racially or ethnically objectionable, relating or encouraging money laundering or gambling, or otherwise inconsistent with or contrary to the laws in force;
is harmful to children;
infringes any patent, trademark, copyright, or other proprietary rights;
violates any law for the time being in force;
deceives or misleads the addressee about the origin of the message or knowingly and intentionally communicates any information which is patently false or misleading in nature but may reasonably be perceived as a fact;
impersonates another person;
threatens the unity, integrity, defence, security or sovereignty of any country, friendly relations with foreign states, or public order, or causes incitement to the commission of any cognisable offence or prevents investigation of any offence or is insulting other nation; and/or
contains software virus or any other computer code, file or program designed to interrupt, destroy, or limit the functionality of any computer resource.

Cookies

The Service shall use “cookies” explicitly.

Cookies are small text files placed on your device when you visit or use a website, app or online service. They help the Platform recognize your device, keep you logged in, maintain security, remember basic settings and provide features that you request. More general information about cookies is available at www.allaboutcookies.org.

Essential cookies are cookies or similar technologies that are necessary for the Platform to work properly. These may be used for purposes such as login, authentication, session management, account security, fraud prevention, remembering basic preferences and enabling core Platform functionality.

Non-essential cookies are cookies or similar technologies that are not strictly required for the Platform to function. These may include cookies used for analytics, attribution, advertising, tracking, personalisation, engagement measurement or similar purposes.

We currently use only essential cookies, including third party cookies and similar technologies that are necessary to operate the Platform, provide login and session functionality, maintain security and remember basic user preferences.

You have the option to either accept or refuse these cookies and know when a cookie is being sent to Your device. If You choose to refuse our cookies, You may not be able to use or access certain portions of the Services.

You may also accept or refuse cookies through the cookie settings or consent tool made available on the Platform or website. You can withdraw your consent at any time.

If we introduce non-essential cookies in the future, we will update this Privacy Policy and, where required, provide a cookie banner, settings tool or consent mechanism allowing you to accept, reject or manage such cookies and withdraw your consent at any time.

Cookie Categories

Cookie / technology category	Description
Authentication and session cookies	These cookies are necessary for the operation and security of the platform. They authenticate users, maintain active login sessions, facilitate secure access to user accounts and platform features, and help prevent unauthorized access and fraudulent activity. Without these cookies, users may be unable to sign in or access requested services.
Functional / preference cookies	These cookies remember user preferences and settings to provide a more personalized experience.

Third Party Service Providers

We may employ third-party companies and individuals to:

facilitate our Service;
provide the Service on our behalf;
perform Service-related services; and/or
assist us in analysing how our Service is used.

These third parties may have access to Your Personal Information for performing the tasks assigned to them on our behalf. However, they are obligated to not disclose or use the information for any other purpose.

International data transfer

Personal Information that We hold about You may be transferred to countries outside of your country for any of the purposes mentioned in this Privacy Policy.

Some of the third-party service providers, partners or other recipients listed above may be located outside your country, including outside the European Economic Area, or may access personal data from outside the European Economic Area. Where this involves an international transfer of personal data, we will take steps required by applicable data protection laws, including relying on an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism under the GDPR, where required.

You may contact us using the details set out in this Privacy Policy if you would like further information about the safeguards used for international transfers of your personal data.

Security

We implement appropriate technical, organisational and administrative measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction.

These measures may include physical, electronic and administrative safeguards appropriate to the nature of the personal data we process and the risks involved.

Where you choose to post, upload, display or share personal data through the Platform, you acknowledge that such information may be visible to other users or third parties, depending on the functionality used and your settings and you accept the risk that We cannot guarantee absolute security.

We encourage you to use caution when sharing personal data through the Platform and to keep your account credentials confidential.

Your Rights

Receive access to your personal data. This enables you to receive a copy of the personal data we hold about you and to be informed on how we are lawfully processing it.
Request correction (rectification) of the personal data we hold about you. This enables you to have any incomplete, inaccurate, or out of date information we hold about you corrected.
Request erasure of your personal data. This enables you to ask us to erase or remove your personal data where there is no good reason for us continuing to process it. However, we may continue to retain your information if we are entitled or required to retain it under applicable law or if there is legitimate interest (e.g. there is a claim against you or Loco Streaming Ltd).
Object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. In such a case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interest, rights, and freedoms.
Request the restriction of processing of your personal data. This enables you to ask us to restrict the processing of your personal data if:
- it is not accurate;
- it has been used unlawfully but you do not want us to delete it;
- it is not relevant anymore, but you want us to keep it for use in possible legal claims concerning you;
- you have already asked us to stop using your personal data, but you are waiting for us to confirm if we have legitimate grounds to use your data.
Request to receive a copy of the personal data concerning you in a format that can be easily re-used or request the transfer of such data to other organisations.
Withdraw the consent you gave us regarding the processing of your personal data for certain purposes, such as to allow us to promote our products and services to you.
Right to complain. If you have exercised any or all of your data protection rights, or otherwise still feel that your concerns about the use of your personal data have not been adequately addressed by us, you have the right to complain by contacting our Data Protection Officer using the contact details set out in Section 1 of this Privacy Policy or visiting the Data Protection section on our website.

You also have the right to complain to the Data Protection Authority of your country of residence, or country of work, or country where the alleged infringement of applicable data protection laws occurred.

Exercise of Your Rights: To exercise any of your rights, or if you have any other questions about our use of your personal data, please contact our Data Protection Officer using the contact details set out in Paragraph 1 of this Privacy Policy. We are legally obliged to reply within one month of you making the request. Should we require more time to complete your request, we will let you know how much longer we need and provide reasons for the delay.

In certain cases, we may deny your request. If it is legally permitted, we will let you know in due course why we denied it. We endeavour to address all requests promptly. Should you not be satisfied with the way we have responded to your concerns you have the right to lodge a complaint to the relevant Data Protection Authority of your country of residence, or country of work, or country where the alleged infringement of applicable data protection laws occurred.

You may exercise your rights by emailing us at privacy@loco.gg.

Links to Other Sites

This Service may contain links to other sites. If you click on a third-party link, You will be directed to that site. We strongly advise You to review the privacy policy of these websites before proceeding to avail any services or engaging in a transaction with such third-party websites. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Children’s Privacy

These Services do not address anyone under the age of 13 (thirteen). We do not knowingly collect personally identifiable information from children under 13 (thirteen). In the event that We discover that a child under 13 (thirteen) has provided us with Personal Information, We shall immediately delete such Personal Information from our servers. If You are a parent or guardian and You are aware that Your child has provided us with Personal Information, please contact us so that We are able to take necessary actions.

Automated Decision Making

We do not use automated decision making. Automated decision making means a decision that produces legal effects concerning you or which significantly affects you and which is based solely on automated processing of data (i.e. no human intervention in the process).

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. Thus, You are advised to review this page periodically for any changes. We will notify You of any changes by posting the new Privacy Policy or amendments to the Privacy Policy on this page. These changes are effective immediately after they are posted on this page. Your continued use of this Platform, our Services or providing Us with your Personal Information shall signify acceptance of the terms of the updated Privacy Policy.

Contact Us

If You have any questions or suggestions about our Privacy Policy, do not hesitate to contact us at privacy@loco.gg.