ACCEPTABLE USE POLICY (AUP)

1. PURPOSE AND GENERAL PRINCIPLES

1.1. Policy Objective: This Acceptable Use Policy establishes the mandatory rules of conduct required to safeguard the technical integrity, cybersecurity, data accuracy, and fair competition of the SWOOPP ecosystem.

1.2. Scope of Application: Access to and use of the Application, website, and APIs entails an express commitment to strictly adhere to the provisions set forth herein. Any breach of this AUP constitutes a material breach of the Consumer Terms of Service (B2C) and the Merchant Commercial Agreement (B2B).

2. PROHIBITED CONDUCT FOR USERS AND THE GENERAL PUBLIC

Users and visitors are strictly prohibited from engaging in:

• (a) Automated Scraping and Mass Extraction: Using bots, spiders, scrapers, automated scripts, or crawler tools to harvest, extract, or index exchange rate data, merchant listings, or map coordinates in bulk, except where expressly and non-derogably permitted by applicable law (e.g., text and data mining exceptions under Article 4 of EU Directive 2019/790) or authorized in writing by SWOOPP;
• (b) Reverse Engineering and Decompilation: Decompiling, disassembling, reverse engineering, or attempting to derive the source code of the mobile application, API protocols, or backend infrastructure, except to the non-derogable extent permitted by law for software interoperability;
• (c) Cyberattacks and Infrastructure Overloading: Conducting Denial of Service (DoS / DDoS) attacks, unauthorized vulnerability scanning, breach attempts, or submitting API requests at rates that breach configured rate limits or degrade platform stability;
• (d) Geolocation Falsification (GPS Spoofing): Transmitting altered or simulated GPS coordinates via emulators or software spoofing tools to distort search volumes or falsify traffic metrics;
• (e) Illegal or Defamatory Content: Publishing comments, reviews, or reports containing hate speech, threats, obscenities, or manifestly false and damaging assertions against exchange operators or other users;
• (f) Circumvention of Security Controls: Tampering with, disabling, or circumventing cryptographic certificates, API signatures, authentication tokens, or in-app anti-tampering defenses.

3. CONDUCT REQUIREMENTS FOR COMMERCIAL MERCHANTS (MERCHANT PARTNERS)

Accredited business operators (currency exchange kiosks and ATM deployers) must adhere to the following professional standards:

• (a) Prohibition of Bait-and-Switch Tactics: Publishing promotional exchange rates or favorable terms on the Platform that are not faithfully honored at the physical counter is strictly prohibited. Displayed rates must accurately reflect real counter conditions;
• (b) Mandatory Transparency on Fixed Commissions: Merchants must disclose in advance on their SWOOPP profile any mandatory transaction fee, minimum commission, or card payment surcharge;
• (c) Compliance of Counter Receipts (AML and Tax Laws): Merchants must provide every customer with an official transaction receipt detailing the applied rate and exchanged currency, in strict compliance with applicable accounting and Anti-Money Laundering (AML) laws;
• (d) Prohibition of Anticompetitive Practices (Price Fixing): Merchants are strictly prohibited from using SWOOPP channels, benchmark indicators, or the "Spy Competitor" module to coordinate prices, fix spreads with competitors, or engage in collusive practices prohibited under Articles 101 and 102 TFEU and Spanish Competition Law (Ley 15/2007);
• (e) Operating Authorizations and Licenses: Merchants represent and warrant that they maintain all necessary municipal, administrative, or central bank licenses required for currency exchange in their operating jurisdiction, and must promptly notify SWOOPP of any regulatory suspension or revocation.

4. ENFORCEMENT, MODERATION, AND REMEDIAL POWERS

4.1. Knowledge of Illegal Content and Graduated Enforcement: Where SWOOPP obtains knowledge of potentially illegal information or activity pursuant to the DSA or applicable law, it will implement proportionate and diligent measures:

• (a) Issuance of a formal written cease-and-desist warning;
• (b) Correction, restriction, or prompt removal of non-compliant listings, rates, or content;
• (c) Revocation or suspension of promotional badges, contract termination, and enforcement of contractual penalties where stipulated in the B2B Agreement;
• (d) Temporary suspension or permanent closure of the user account or merchant profile;
• (e) Restriction or blocking of technical identifiers or IP ranges in a targeted, proportionate manner avoiding indiscriminate disruption.

4.2. Statement of Reasons (DSA Art. 17): Where required under Regulation (EU) 2022/2065 (Digital Services Act), decisions imposing restrictions or content moderation will be accompanied by an adequate statement of reasons outlining available internal and external redress mechanisms.

4.3. Cooperation with Law Enforcement: Where evidence indicates financial fraud, organized scams, money laundering, or sanctions evasion, SWOOPP will cooperate fully with competent authorities within the boundaries of the law.

5. REPORTING VIOLATIONS AND ABUSES

The reporting mechanisms under this section are dedicated to identifying illegal content or activity under the DSA. Routine data updates may be addressed through general support channels.

Reports may be submitted via:

• The in-app "Report" button on any profile;
• Written notice sent directly to: abuse@swooppapp.com | legal@swooppapp.com.