PRIVACY POLICY FOR SOSTRAVEL.COM CUSTOMERS AND APP USERS

1- WHAT INFORMATION DO WE OBTAIN ABOUT YOU? AND FOR WHAT PURPOSE?

Within the context of the services offered, in its capacity as Data Controller pursuant to art. 26 of the Regulation (EU) no. 2016/679 (hereinafter also referred to as the "Regulation"), our company, Sostravel.com S.p.A., may obtain the following information about you:

a) For registration in the APP

• User name and password;
• Contact details (home address, date of birth, telephone, and e-mail);

2- HOW DO WE HANDLE YOUR DATA, AND FOR HOW LONG?

The processing of your personal data is carried out via the operations indicated under art. 4 of Reg. (EU) no. 2016/679, and specifically include: the collection, recording, organisation, retention, consultation, editing, processing, modification, selection, extraction, comparison, use, combination, blockage, restriction, communication, deletion, and destruction of the data.

Your personal data are processed in both paper and electronic format. The Data Controller will process your personal data for as long as necessary to achieve the purposes for which they were collected or subsequently processed, in accordance with art. 5(e) of Reg. (EU) 2016/679. In particular:

• The data acquired within the context of the management of reimbursements are retained for a maximum of 10 years from the date of the fulfilment of the request, and are then automatically deleted;
• The PW is deactivated after six months of inactivity on the app, and the data acquired under the same is also deleted after one year. The history is retained as long as the user remains active.
• The recordings of the calls to the Contact Centre are retained for a maximum of 6 months;
• Contact data used for promotional purposes is kept for a maximum of two years after consent is given, or until consent is revoked;
• Data acquired through profiling cookies are stored for a maximum of 90 days, and then automatically deleted.
• The user's contact list, which is obtained with prior consent and exclusively for the activation of the "Share Your Itinerary" service, is saved neither on the app nor the back end. The information is only used for the purpose of sending the itinerary to the user's selected contact, and is then deleted.

Should you decide to terminate the relationship, Sostravel.com will only retain the data expressly required or stipulated by law, and only for the time indicated by law.

3- WHO COULD HAVE ACCESS TO YOUR DATA?

Your data could be made accessible for the purposes indicated under point 1 of this policy:

• To employees and collaborators of the Data Controller, in their capacities as data handlers and/or Data Processors, including: consultancy companies; IT companies tasked with the maintenance of the IT system, the website, and any management systems present; professional firms providing accounting, tax, and fiscal services; law firms; quality certification bodies; Contact Centres;
• To companies and third parties acting as independent Data Controllers, such as: banks; credit institutions; insurance companies; inspection bodies in the case of audits.

The data collected for the activation of the Dr. Travel service are sent to the platform of the partner company that manages the service.

The user also had possibility of sharing his or her health-related documents directly with the doctor.

With your express consent, your personal data may be provided to our business partners who provide Fast Track, VIP Lounge, medical insurance coverage, luggage wrapping and warranty, and Dr. Travel services.
Our business partners will process the data in their capacities as Data Processors, pursuant to art. 26 of the GDPR.

The data will not be disclosed to third parties in any way.

4- COULD YOUR DATA BE TRANSFERRED TO COUNTRIES OUTSIDE THE EU?

YES. Some of our suppliers who act as Data Processors (the Contact Centre) are based in non-EU countries (Moldova). The transfer of data to such countries is carried out with adequate safeguards established in accordance with art. 46 of EU Regulation 2016/679.

The data subject can request the contractual clauses governing the guarantees established with the suppliers and partners using the contact information provided under point 7 of the Policy.

5- IS THE PROVISION OF YOUR DATA NECESSARY? WHAT HAPPENS IF YOU DO NOT GRANT YOUR CONSENT?

Your express consent is required to authorise us to transfer your personal data to our business partners for the activation of the services they offer. If your consent is not given, we will not be able to proceed with the activation of the services they offer.

Your consent for the profiling of your preferences is strictly necessary to access the APP's functions and to provide targeted communications based on your needs and interests.

If consent is not given, the APP's functions may be limited.

This will not, however, affect your access to the app and your ability to view the activated services.

The granting/denial of consent for promotional purposes is optional, and in no way limits access to the services provided by the APP.

6- WHAT RIGHTS DOES THE LAW GRANT YOU?

According to EU Reg. 2016/679 - Sec. III:

1. Data subjects shall have the right to obtain confirmation as to whether or not personal data concerning them exist, even if the data have not yet been recorded, and communication of such data in intelligible form.
2. Data subjects shall have the right to information on : the source of the personal data; the purposes and modes of processing; the logic applied when the data is processed with the use of electronic instruments; the identity of the Data Controller, Data Processors, and the designated representative pursuant to Article 5.2; the entities or categories of entities to which the personal data can be transferred or which can gain knowledge of them as designated representatives of the State, Data Processors, or data handlers.
3. Data subjects shall have the right to obtain:
   1. the updating, correction or, should they be interested, additions to the data. With regard to the modification of the data entered into the Dr. Travel app, the user must contact the Data Controller's Contact Centre, by sending an e-mail to customercare@sostravel.com. The Contact Centre will notify the partner company of the changes to be made.
   2. the deletion, transformation into anonymous form, or blocking of data processed in violation of law, including those that need not be retained for the purposes for which the data were collected or subsequently processed.
      Within the context of the Dr. Travel service, the user has the right to request the deletion of documents uploaded to the partner's platform;
   3. certification that the parties to which the data have been transferred or disseminated have been notified of the operations specified in points a) and b), also regarding their content, except for the case where notification proves impossible or requires the use of means clearly disproportionate to the right being protected;
   4. a copy of the information in our possession, in a common, interoperable format;
   5. the restriction of the processing of personal data concerning him or her or to object, in whole or in part: on legitimate grounds, to the processing of personal data concerning him or her, even if pertinent to the purpose of their collection.

The data subject also has the right to withdraw their consent at any time, without affecting the lawfulness of the consent-based processing carried out prior to their withdrawal;

Data subjects who believe that the personal data concerning them is being processed via the website or app in violation of the provisions of the Regulation have the right to lodge a complaint with the Data Protection Authority, as stated under art. 77 of the Regulation itself, or to take legal action (art. 79 of the Regulation).

The Data Controller may be asked to provide a statement certifying that the requests made have actually been resolved and brought to the attention of those to whom the data were previously disclosed and communicated.

As a data subject, you may also delegate a third person with a copy of the power of attorney or proxy signed in the presence of an authorised party, or signed and submitted together with a non-authenticated photocopy of an identify document belonging to the data subject.

The Data Controller is obliged to reply to the request within 15 days from the date of submission, or 30 days if the issue is problematic. In this latter case, however, you will receive written notification of the reasons for the delay by the 15th day.

HOW CAN I EXERCISE THESE RIGHTS?

You can exercise your rights at any time using the following contact information:

Personal Data Controller: SOS Travel.com S.p.A. - Viale Europa 98 - 00144 Roma, Italy - e-mail sostravel@pec.net - Tel. +3903311587117 - Fax +3903311582452.

Personal Data Protection Officer: Dr. Vincenzo Pacelli, Viale Europa 98 - 00144 Roma, Italy - e-mail privacy@sostravel.com and dpo@sostravel.com

PRIVACY POLICY UPDATES

This policy was last updated on 31 July 2023, and may be revised from time to time, even in with regard to the relevant legislation and case law.

In the event of any significant changes, appropriate notice will be provided on the homepage of the website or by e-mail.

The data subject is nevertheless invited to consult this Policy periodically.