• Identification data: first name, last name, passport number.
• Contact data: email address, telephone number.

1. Performance of a contract between you and/or the company you represent and HBX Group, or the implementation of pre-contractual measures:
   • Manage the contractual relationship with you and ensure the provision of the contracted products and services, including service management, quality control, invoicing, collection, and withdrawal of services.
   • Manage commercial relationships with prospective customers by responding to requests for information regarding the products and services offered by HBX Group.
   • Manage and process any legal, extrajudicial, or insurance claims received by HBX Group in relation to you.
2. HBX Group's legitimate interest:
   • Send commercial communications regarding products and services similar to those contracted by you. In this case, HBX Group's legitimate interest is to carry out direct marketing activities aimed at its customers, in accordance with Recital 47 of the General Data Protection Regulation.
   • Conduct surveys and market research to assess the quality of our products and services and understand customer preferences. HBX Group's legitimate interest is to improve its commercial offering and customer experience.

• Identification data: first name, last name, passport number.
• Contact data: email address, telephone number.

1. Performance of a contract between you and HBX Group or implementation of pre-contractual measures:
   • Manage commercial relationships with prospective suppliers by responding to information requests.
   • Formalize contractual relationships, including supplier onboarding and contract execution.
   • Manage contractual relationships with HBX Group's suppliers, including monitoring the relationship and processing payments.

• Identification data: first name, last name.
• Contact data: email address, telephone number.
• Data relating to the relationship established with HBX Group.

1. HBX Group's legitimate interest arising from corporate contact with data subjects, expressly recognized by privacy regulations where applicable:
   • Maintain relationships of any kind with the company, entity, or organization for which you work or collaborate, or with you if you are a self-employed professional, when contact is made through the Website, any form, communication channel, email mailbox, or by providing business cards to HBX Group personnel.

• Identification data: first name, last name.
• Contact data: email address, telephone number.
• Data relating to the relationship established with HBX Group.

1. HBX Group's legitimate interest arising from corporate contact with data subjects, expressly recognized by privacy regulations where applicable:
   • Maintain relationships of any kind with the company, entity, or organization for which you work or collaborate, or with you if you are a self-employed professional, when contact is made through the Website, any form, communication channel, email mailbox, or by providing business cards to HBX Group personnel.

Data obtained directly from the data subject:

• Identification data: first name, last name, passport number.
• Contact data: email address, telephone number.
• Any personal data you provide and that is generated during the relationship.

Data obtained from third parties:

• Data used to identify individuals, such as names and identification documents.
• Information relating to business activities, including company affiliations, ownership details, and employment/function information.
• Where permitted by law, information regarding judicial rulings and criminal activity.
• Where permitted by law, sanctions lists, watchlists, politically exposed persons (PEP) lists, including information regarding inclusion on such lists and affiliations with government officials.
• Public media information, including published news sources that may reveal links to suspected criminal activity.
• Family circumstance information (for example, marital status and dependents) where you are a Politically Exposed Person or a close associate of one.
• Professional and personal affiliations.

1. HBX Group's legitimate interest when HBX Group is considering entering into a business relationship with a third party:
   • Screen individuals to prevent and detect fraud, terrorism, money laundering, bribery, corruption, and other crimes by conducting checks using databases such as WorldCompliance and Accuity provided by LexisNexis or similar service providers.

• Browsing data.
• Technical data.
• IP address.

1. Explicit consent provided through the cookie banner made available by HBX Group:
   • Personalize and segment Website content through the use of cookies or similar technologies when consented to by the user.
2. Withdrawal of consent You may withdraw your consent at any time in accordance with the information provided in our Cookie Policy. However, HBX Group may process information obtained through cookies or similar technologies without your consent when such information is anonymous or aggregated and cannot directly or indirectly identify you.

• Personal data available according to the privacy settings and privacy policy of the social network where you hold an account or user profile.

1. Compliance with obligations arising from your status as a registered user of the relevant social network and its terms of use:
   • Interaction between your profile and HBX Group on the relevant social media platform, including responses to inquiries and comments published on public profiles.

• Personal data you provide and that is generated during the relationship.

1. Compliance with legal obligations:
   • Compliance with civil, commercial, tax, accounting, and legal obligations, including obligations related to personal data protection regulations and any other applicable legislation.

• Identification data (first name and last name).
• Contact data (email address and telephone number).

1. Performance of an accommodation contract to which the data subject is a party, under the data processing agreement executed between the hotel and Civitfun:
   • Receive and register on the Civitfun platform the personal data of guests uploaded by the travel agency, replacing file exchanges between the agency and the hotel.
   • Synchronize such data with the hotel's Property Management System (PMS).
   • Send guests personalized access to complete online check-in before arrival via email and/or WhatsApp message, depending on the hotel's service configuration.
   • Allow an agent to carry out assisted check-in through a mobile device.
   • Send operational notifications related to the stay.
2. The hotel and the travel agency act as data controllers and must ensure an appropriate legal basis for communicating personal data to Civitfun and for sending pre-arrival communications. Civitfun acts solely as a data processor on behalf of the hotel.
3. Guest consent may only be recorded by Civitfun when the guest completes the check-in process through the platform. Guests receiving pre-arrival communications without completing the check-in process fall outside Civitfun's consent-recording scope, and the hotel remains responsible for ensuring the appropriate legal basis for processing and, where applicable, for the deletion of their personal data.

• Guest identification data (first name and last name).
• Contact data (email address and mobile phone number).
• Data derived from interactions through WhatsApp.

1. Performance of the accommodation contract and related services provided by the hotel:
   • Send guests access links to the online check-in process by email or WhatsApp.
   • Send operational notifications related to the stay, such as check-in reminders, pre-arrival instructions, informational documentation, or links required to complete reservation-related processes.
   • Manage guest interactions through WhatsApp when related to check-in, arrival, or the stay.
2. Explicit consent of the data subject for informational communications that are not strictly necessary for the provision of accommodation services.
   • Use of the WhatsApp channel involves the participation of Meta Platforms Ireland Ltd. as a sub-processor, with potential international data transfers to the United States under the European Commission's Standard Contractual Clauses.
   • For communications through this channel, the hotel must have a valid legal basis and, where applicable, an approved Meta message template (HSM) before the first message is sent.
   • Where communications are based on consent, consent may be withdrawn at any time through the mechanisms provided in the communication or by contacting the hotel directly. This shall not affect communications that are strictly necessary for the provision of accommodation services where another valid legal basis applies.

Provider / Channel

For communications through WhatsApp, Civitfun uses specialized technology providers, including Twilio, Inc. and Meta group companies, particularly Meta Platforms Ireland Ltd., which participate in channel infrastructure management, sender onboarding and validation, template management, and message delivery. These providers will act in the role applicable to the specific service configuration and agreements entered into with the hotel and/or Civitfun.

• Identification data (name).
• Contact data (email address, company).
• Content of the query or message submitted by the user.
• Session technical data.

1. Consent of the data subject provided when initiating a conversation with the virtual assistant available on the Civitfun website:
   • Respond to inquiries, requests for information, and technical support requests from users and prospective customers.
   • Route inquiries to the appropriate internal team when necessary.
2. Implementation of pre-contractual measures at the request of the data subject, where the inquiry relates to the contracting of Civitfun services.

Legitimate interest note: Where the legal basis is legitimate interest, we ensure that your interests, rights, and fundamental freedoms do not override our legitimate interests through a balancing assessment. You may request further information by contacting our Data Protection Officer (Section 9).

5.1. Public Authorities, Courts, and Tribunals

Who and why:

Public authorities, including tax authorities, law enforcement agencies, and judicial bodies, where required by applicable legal obligations.

Legal basis:

Compliance with a legal obligation.

5.2. Service Providers
(a) Screening and Compliance Database Providers

Who and why:

Specialized service providers that help prevent and identify fraud, terrorism, money laundering, bribery, corruption, and other crimes.

Legal basis:

Legitimate interest.

5.2. Service Providers
(b) Communication and Messaging Technology Providers

Who and why:

Providers supporting operational guest communications by email and WhatsApp, including sender management, templates, messaging services, and technical infrastructure. These providers include, among others, Twilio, Inc. and Meta group companies.

Legal basis:

Legitimate interest.

5.3. Audit Firms and Corporate Transactions
(a) Audit Firms

Who and why:

Accounting and auditing firms to ensure compliance with legal accounting and auditing obligations.

Legal basis:

Legal obligation.

5.3. Audit Firms and Corporate Transactions
(b) Corporate Restructuring / Business Transfers

Who and why:

Third parties and their advisers involved in any corporate restructuring transaction or in the contribution or transfer of a business or business unit within HBX Group, where such disclosure is necessary for those purposes.

Legal basis:

Contractual necessity.

Legitimate interest.

Consent.

5.3. Audit Firms and Corporate Transactions
(c) Intra-group Communications (HBX Group Entities)

Who and why:

HBX Group entities for internal administrative and centralized management purposes.

Legal basis:

Legitimate interest.