HIBISCUS EXPERIENCE S.L. Tax ID: B26770958 C/ Zenobia Camprubí, 19, Estepona, 29688, Málaga, Spain Email: hello@hibiscusholiday.com

2.1. Data provided directly by you: - Full name - Email address and telephone number - Passport or national identity document number (required for the legal registration of guests under Spanish public security regulations and Andalusian tourism regulations) - Billing information when making a direct reservation - Payment information processed through Stripe, Inc. HIBISCUS EXPERIENCE S.L. does not store credit or debit card details on its own systems.

2.2. Data collected automatically: - IP address - Browser information - Device information - Website usage data collected through cookies and similar technologies 2.3. Data Received from third-party platforms:

When a booking is made through Airbnb, Booking.com, or other Online Travel Agencies (OTAs), these platforms may transfer to HIBISCUS EXPERIENCE S.L. the information strictly necessary to manage the reservation and guest stay. Such transfers are governed by the respective privacy policies of each platform.

3.1. Reservation and contract management

Legal basis: Performance of a contract (Article 6.1(b) GDPR)

This includes:

- Reservation management - Property management through Hostaway PMS/CRM - Guest communications before, during, and after the stay - Payment processing through Stripe

3.2. Compliance with Legal Obligations

Legal basis: Compliance with a legal obligation (Article 6.1(c) GDPR)

This includes:

- Mandatory guest registration with the Spanish Police or Civil Guard - Compliance with tax and accounting obligations:

3.3. Marketing Communications

Legal basis: Consent (Article 6.1(a) GDPR) or legitimate interest for existing customers.

Users may withdraw their consent at any time.

3.4 Website Analytics and Improvements

Legal basis: Legitimate interest (Article 6.1(f) GDPR), subject to consent where required for analytics cookies.