HIBISCUS EXPERIENCE S.L. Tax ID: B26770958 C/ Zenobia Camprubí, 19, Estepona, 29688, Málaga, Spain Email: hello@hibiscusholiday.com

2.1. Data provided directly by you: - Full name - Email address and telephone number - Passport or national identity document number (required for the legal registration of guests under Spanish public security regulations and Andalusian tourism regulations) - Billing information when making a direct reservation - Payment information processed through Stripe, Inc. HIBISCUS EXPERIENCE S.L. does not store credit or debit card details on its own systems.

2.2. Data collected automatically: - IP address - Browser information - Device information - Website usage data collected through cookies and similar technologies 2.3. Data Received from third-party platforms:

When a booking is made through Airbnb, Booking.com, or other Online Travel Agencies (OTAs), these platforms may transfer to HIBISCUS EXPERIENCE S.L. the information strictly necessary to manage the reservation and guest stay. Such transfers are governed by the respective privacy policies of each platform.

3.1. Reservation and contract management

Legal basis: Performance of a contract (Article 6.1(b) GDPR)

This includes:

- Reservation management - Property management through Hostaway PMS/CRM - Guest communications before, during, and after the stay - Payment processing through Stripe

3.2. Compliance with Legal Obligations

Legal basis: Compliance with a legal obligation (Article 6.1(c) GDPR)

This includes:

- Mandatory guest registration with the Spanish Police or Civil Guard - Compliance with tax and accounting obligations:

3.3. Marketing Communications

Legal basis: Consent (Article 6.1(a) GDPR) or legitimate interest for existing customers.

Users may withdraw their consent at any time.

3.4 Website Analytics and Improvements

Legal basis: Legitimate interest (Article 6.1(f) GDPR), subject to consent where required for analytics cookies.

HIBISCUS EXPERIENCE S.L. works with the following service providers:

Hostaway: Property management and CRM services. Provider located in Finland / Ireland and subject to GDPR requirements.

Stripe, Inc.: Payment processing services. Where personal data is transferred outside the European Economic Area, such transfers are protected through Standard Contractual Clauses approved by the European Commission.

Airbnb, Booking.com and Other OTAs: These companies act as independent data controllers regarding the personal data collected through their own platforms.

Google LLC: Google Workspace services, including email, calendar, and document management. Transfers outside the EEA are safeguarded through Standard Contractual Clauses.

HIBISCUS EXPERIENCE S.L. will not disclose personal data to third parties except where required by law or where the user has given explicit consent.

- Reservation and contractual data: for the duration of the contractual relationship and subsequently during applicable limitation periods (5 years for civil obligations and 4 years for tax obligations). - Guest registration records: 3 years in accordance with Spanish law enforcement regulations. - Marketing data: until consent is withdrawn. - Cookies and browsing data: as specified in the Cookies Policy.

You may exercise the following rights at any time by contacting hello@hibiscusholiday.com and providing proof of identity:

- Right of access - Right to rectification - Right to erasure - Right to restriction of processing - Right to data portability - Right to object to processing, including direct marketing

If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Authority (AEPD): https://www.aepd.es

The Website is not intended for individuals under 14 years of age.

HIBISCUS EXPERIENCE S.L. does not knowingly collect personal data from minors under this age. Any such information identified without parental consent will be deleted immediately.

HIBISCUS EXPERIENCE S.L. has implemented appropriate technical and organisational measures to ensure the security, confidentiality, integrity, and availability of personal data and to prevent unauthorized access, alteration, loss, or disclosure.