PRIVACY POLICY

PREAMBLE

Apricot & Sea Private Capital Company holds as its highest priority the protection of your personal data. We make every effort to carefully store and process the information you share with us. We have created this Privacy Policy to inform you about how we collect, use, and share your information. The collection, use, and disclosure of your information is based on your consent and the provisions of applicable law. Apricot & Sea Private Capital Company protects your personal data through technical data security measures, internal management procedures, and physical data protection measures. We continually strive to improve our systems and procedures so that they stand out above all others.

PRIVACY POLICY

Consent “Personal data” means any information that is collected or recorded in a way that may allow direct (e.g. surname) or indirect (e.g. phone number) identification of a natural person. We recommend that you read this text, which describes the privacy policy, before providing us with personal data. This “Customer Personal Data Protection Charter” is a part of the terms and conditions that govern our hotel services. By accepting these terms and conditions, you explicitly accept the provisions of this Charter. Scope At Apricot & Sea, we know how important it is to protect the privacy of our customers; we try to be as clear as possible about the way in which we collect, use, share, transfer, and store your information. This Privacy Policy summarises the practices we follow regarding your data. This Privacy Policy applies to all hotels operated by Apricot & Sea. This Privacy Policy also applies to this website, all websites, online applications, and online and offline promotional actions by ΒΟΗΕΜΕ PCC as well as any Service or function provided by us that refers to this Privacy Policy or provides a link hereto (collectively referred to as our “Services”). Please note that the Privacy Policy applies to your use of our Services, regardless of whether you use a computer, mobile phone, tablet, TV, or any other device to access our Services. Additionally, this privacy policy applies to Services that are provided without the use of electronic means. It is important that you carefully read this Privacy Policy because with every use of our Services you agree to the practices described herein. If you do not agree with the practices described in this Privacy Policy, you should not use our Services. Purposes of collect personal data. We collect and use personal data to manage your relation with Apricot & Sea and to offer our Services to you. Certain personal data is collected to provide you with personalised and improved services. We collect personal data with the following purposes: 1) To manage reservations and other hospitality services Create and store legal documents in accordance with applicable law. Collect data to meet requests relating to your stay (e.g. room preferences). 2) To manage of your hotel stay Monitor the use of services (room telephone, mini bar, online room service, Wi-Fi access, etc.) for billing. Manage lists with customers’ personal data for operational purposes, e.g. daily customer arrival and departure lists and a list of special category customers. 3) To improve our hotel services Tailor products and Services to better meet your requirements. Process your personal data using marketing programs for marketing and promotional purposes. Provide you with useful information for offers or other promotional messages. Inform you about special offers and new Services. 4) To manage our relations with you before, during, and after your stay Manage the preferences of new and recurring customers. Send newsletters, promotion products and offers. Manage requests for deletion from update lists. 5) To improve our services Manage customers’ claims and complaints. 6) To improve system security Record data to ensure security and to prevent fraud. 7) To comply with Greek and European law 8) To ensure safe use of services provided by our spas and massage facilities 9) For quality research reasons 10) For advertising campaigns reasons

PERSONAL DATA THAT WE COLLECT

Information provided directly by you We are obliged to request the following details about you and/or your family members: Contact details (e.g. surname, given name, father’s name, passport number, ID-card details, telephone, home address, email) Personal data (e.g. date of birth, nationality, place of birth) Information regarding your children (e.g. given name, date of birth, passport number) Billing details (e.g. credit card number, VAT number) Date of arrival and departure, flight number, and room number Preferences and interests (e.g. non-smoking room, preferred floor, type of bed, sports, cultural interests) Data about your health, such as medicine reports and certifications, medical test results, data on pathological diseases, etc. Questions and comments submitted during or after your stay in one of our Hotels. The data we collect on persons under the age of 16 are restricted to given name, surname, nationality, and date of birth. This data can only be provided by an adult or guardian. We thank you for your efforts to ensure that children do not send us personal data without your consent, especially through the internet. Should any information of this type be sent to us, you can communicate with the ΒΟΗΕΜΕ PCC to arrange for the deletion of such information. Moreover, information such as your passport number, recreational activities, hobbies, health issues, or whether you are a smoker or not can be described as sensitive. We retain such information only if we are obliged to do so by applicable law or if you have explicitly given us your consent (e.g. to provide you with an appropriate Service, such as a special diet).Information on your use of our Services Apart from the information you provide directly, we may collect information on your use of our Services through the software of your device or by other means. For example, we may collect: Device information, such as hardware model, MAC address, IP address, operating system issue, and setting of the appliance you use to access our Services. Connection information, such as the time and duration of use of the Service, search commands entered in the Services, as well as information that may be stored in cookies we have placed on your device. Location information. Audiovisual information, such as audiovisual information collected through closed circuit television (CCTV) for security reasons.

PERIOD TIME OF COLLECT PERSONAL DATA

We collect personal data in various cases, such as: 1) Hotel activities Room reservation Check-in and payment Reservation of seat and/or use of hotel services, such as catering, spa, and massage services Various requests, complaints, and/or disputes 2) Participation in marketing programs or events Participation in online and offline surveys (for example, customer satisfaction survey) Subscription to mailing lists in order to receive offers and other promotions by email 3) Transmission of information from third parties Tourist agencies, tourist offices, GDS reservation systems, online reservation systems (e.g. booking.com, expedia.com, etc.), and other reservation systems 4) Actions through electronic devices Login on our websites Connection to our Wi-Fi network of our hotels Completion of online forms (e.g. reservation forms)

THIRD PARTY ACCESS TERMS TO YOUR PERSONAL DATA

Apricot & Sea do not disclose your information to third parties for their own business or marketing purposes without prior your consent. However, we may disclose your information to the following entities: Service providers and/or any third parties that may process information on our behalf. We may also share your information with companies that provide services on our account or behalf, such as IT contractors, bulk mailers, banks, credit card institutions, law firms, mail service companies, printing services companies, etc. Other third parties, if so required by law or in order to protect our Services. Situations may arise in which we share your information with other third parties: – To comply with the law or mandatory legal procedure (such as search warrants or other court orders) – To confirm or implement our compliance with the policies governing our Services – To protect the rights, ownership or security of ΒΟΗΕΜΕ PCC or any of our business partners, or customers Other third parties with your consent or at your command. In addition to the disclosures described in this Privacy Policy, we may share information about you with third parties if you give your consent or if you request us to do so. To provide you the best possible service, we allow access to your personal data or to certain categories to competent, authorized members of our personnel. This includes: Hotel staff Reservations departments IT department Marketing department Legal Services department, if and when required Medical Services, if and when required

PROTECTION OF PERSONAL DATA

We have taken organisational and technical measures to protect the information that we collect in relation to our Services, especially sensitive personal data. Our IT department implements international standards and practices to ensure the safety of networks and the encryption of data. However, please bear in mind that despite the reasonable measures that we take to protect your information, no website, internet transmission, computer system or wireless connection is ever completely safe.

DATA STORAGE

We take reasonable measures to ensure that your personal information will be stored no longer than needed for the purpose which it has been collected and no longer than required by the contract or the applicable legislation.

COOKIES, AND SIMILAR TECHNOLOGIES

We and certain third parties who provide content, advertisements, or other features for our Services may use cookies and other technologies in certain parts of our Services.

COOKIES

Cookies are small files that store information on your computer, mobile phone, or other device. They allow the entity who places these files on your device to identify you across different websites, services, devices, and/or browsing times. Cookies serve a range of useful purposes. When you use a website to access our Services, you can make settings in your browser to accept all cookies, reject all cookies or notify you when cookies are sent. Each browser is different. Refer to the “Help” menu of your browser to find out how you can change your cookie preferences. The operating system of your device may offer more control settings for cookies. However, please note that certain Services may have been designed to work with cookies and that deactivating cookies may affect your ability to use those Services or part of those Services.

OTHER LOCAL STORAGE

We and certain third parties may use other kinds of local storage technologies, such as Local Shared Objects (commonly called “Flash cookies”) and local HTML5 storage (HTML5 Web Storage) in conjunction with our Services. These technologies are similar to the cookies mentioned above as they employ storage on your device and can be used to store information concerning your activities and preferences. However, these technologies may use different parts of your device than typical cookies, and therefore may not be controlled with the standard tools and browser settings.

ACCESS AND CORRECTION OF YOUR DATA – RIGHT TO ERASURE (‘RIGHT TO BE FORGOTTEN’)

In addition to existing lawful user rights, according to the legislation, you may also be entitled to request details on the information that we collect and to correct any inaccuracies that may be contained in such information. If permitted by law, we may charge you a small fee for the provision of this possibility. If you wish to submit a request for access to your data, please contact Apricot & Sea. You have the right to obtain the erasure of your personal data from the controller.

UPDATES

This policy may be amended from time to time. To ensure that you are aware of any changes, please check this policy on a regular basis, especially before submitting a reservation request with one of our hotels. By accessing or using our Services after we have posted an updated version of the Privacy Policy, you agree with the new practices contained in the update. A printed version of this Privacy Policy can be found at the reception desk at all our hotels. You may also request a copy by contacting Apricot & Sea.

QUESTIONS AND CONTACT

If you have any questions regarding this policy or the protection of data at Apricot & Sea, please contact Apricot & Sea at the following address: infο@apricotandsea.com