Holiday Bilbao & San Sebastian, Spain - august 2025

1. Purpose and Scope of this Notification

Eturia respects your privacy and is committed to protecting your personal data. This notification regarding the processing of personal data (hereinafter referred to as "Notification") aims to provide you with relevant

information about how we process your personal data when you:

• Access the www.sejureuropa.ro website.

• Book travel packages.

• Provide us with your personal data through any other means (such as phone, email, WhatsApp, Facebook, Instagram, or other social media accounts).

• Subscribe to newsletters.

• Travel with us.

This website is intended for adults only, and the only situations in which we collect data regarding children are when you book travel packages for your children.

This Notification informs you about the processing operations of personal data (as defined by the relevant legislation, including the General Data Protection Regulation 2016/679 - hereinafter referred to as "GDPR") carried out by Eturia, considering its status as a data controller.

The data controller for your personal data is ETURIA S.R.L. and is responsible for your personal data (hereinafter referred to as "Eturia," "we," or "our" in this Notification).

2. Data Controller and Contact Details of the Data Protection Officer

The data controller for your personal data is ETURIA S.R.L., with its registered office in Mun. Piatra Neamț, str. 1 Decembrie 1918, nr. 58, jud. Neamț, registered under the Trade Registry number J27/908/2007, unique registration code RO 22067680 (hereinafter referred to as "Eturia," "we," or "our" in this Notification).

In accordance with applicable legal provisions, Eturia has appointed a Data Protection Officer. If you have any questions regarding this Notification, including any requests regarding the processing of your personal data or the

exercise of your legal rights, please contact the Data Protection Officer using the following contact details:

• (1) Email: dpo@eturia.ro

 • (2) Mailing address: Mun. Piatra Neamț, str. 1 Decembrie 1918, nr. 58, jud. Neamț, Romania. It is important that the personal data we hold about you is accurate and current. Please inform us if any of the details you provide us with should change during your relationship with us.

3. External Links

This website may include links to third-party websites or applications. If you access those links or activate those applications, third parties may collect or share data about you.

We do not control these third-party websites and are not responsible for their policies regarding the processing of personal data. When you leave the www.sejureuropa.ro website, please read the policies of each site you visit.

4. Personal Data We Collect About You

According to the applicable legislation, "personal data" means any information concerning an identified or identifiable natural person. An identifiable natural person is a person who can be identified, directly or indirectly,

especially by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific elements specific to his physical, physiological, genetic, mental, economic, cultural, or social identity.

When you access the www.sejureuropa.ro website, communicate with us, or receive tourist services or any other type of services from us, we may process the following categories of personal data:

• Contact and/or identification details, including: first and last name, address (residence or domicile), phone number, email, series and number of identification document (ID card/identity card/passport), personal identification number, as well as information contained in these documents, voice, call history.

• Details related to requested services, including: details of reserved or provided services, payment details to and from you, including bank account, contact and identification details for individuals traveling with you, WhatsApp

conversation history, or social media accounts (Facebook, Instagram).

• Data related to candidates (in recruitment processes), including: candidate details, email address, address, current employer, employment history, education, licenses/certificates, study-related information, and other information included in the curriculum vitae.

• Data used for advertising, marketing, and publicity purposes, including: name, first name, image, voice, transmitted feedback, ID (username/name used on the social network) and social media account images (in the case of ID and images published on social media accounts, Eturia will mention the presence of the respective person in the photos and videos published on social media accounts or Eturia-owned websites).

• Special categories of personal data, such as: dietary requirements that may reveal your religious or philosophical beliefs and health-related data.

We collect and process the above data only when strictly necessary to provide the tourist services you have purchased. Additionally, we will collect and process the special categories of personal data only if you have provided your explicit consent for this purpose.

You are under no obligation to give your consent to process your special categories of personal data, except when these are necessary for the provision of reserved tourist services. However, without your consent, we will not be able to take the necessary measures to provide the tourist services you have reserved or are trying to reserve. Only if this information is necessary for the provision of tourist services, if you do not provide such data, and we do not have your consent, we will not be able to provide the reserved tourist services.

5. Source of Personal Data

Personal data can be obtained from the following sources:

• Directly from you when you book a travel package on the www.sejureuropa.ro website, subscribe to

newsletters or other publications, submit testimonials, provide feedback,

participate in organized contests.

• Through activities you perform during the period you benefit from the offered tourist services, such

as photos, WhatsApp conversation history.

• From third parties, such as when we receive your personal data from third parties who request the

provision of tourist services (individuals traveling with you).

6. Purpose of Processing Personal Data

Eturia collects, processes, and uses personal data for the following purposes:

• For purposes that enable the provision of reserved tourist services on the www.sejureuropa.ro website;

• For purposes that allow Eturia to fulfill its objectives related to its activity and legal obligations;

• To allow the initiation or execution of a contractual relationship with you;

• For advertising, marketing, and publicity purposes;

• For purposes that allow your participation in contests and events organized by Eturia for the www.sejureuropa.ro project;

• To exercise the rights and obligations of the parties arising from the contracts signed by the parties or in connection with the services provided;

• To protect the interests of the parties in promoting legal actions and defending against any claims and lawsuits;

• To ensure compliance with legal provisions regarding the retention and archiving of data/documents;

• To exercise Eturia’s rights in accordance with legal provisions and comply with legal obligations;

• For purposes subsumed under the general purpose of providing tourist services.

To avoid any doubt, Eturia will not use your personal data for advertising, marketing, and publicity purposes unless you expressly consent to do so.

7. Disclosure of Personal Data

Your personal data will be disclosed within Eturia only to the management personnel and to other individuals who need access to your personal data on a "need to know basis" to fulfill their specific duties for the purposes listed in point 6 above or where this is necessary or permitted by applicable law.

Eturia may also provide your personal data to third parties providing services related to reserved tourist services, IT support services, or technical and organizational services (related to Eturia’s activities) or to legal, audit, or other consultants or providers of Eturia, solely for the purposes mentioned in this Notice.

Eturia will exercise due diligence in selecting third-party service providers and will request these providers to maintain appropriate technical and organizational security measures to protect your personal data and process them in accordance with applicable legal provisions.

Eturia may also disclose your personal data to authorities, as necessary or permitted by legal provisions, insurance entities, external consultants, and/or courts. Your personal data will be disclosed to such third parties only to the

extent necessary in connection with the execution of contracts, Eturia’s activities, and/or the purposes listed in point 6 above.

8. Transfer of Personal Data Outside the EU or EEA

Many of the external providers of tourist services are located outside the European Union (EU) or the European Economic Area (EEA), so the processing of your personal data will involve a transfer of data outside the EU or EEA.

If you have booked a package of tourist services that are located or are to be performed outside the EU or EEA, we are obligated and authorized to transfer your personal data to the service provider outside the EU or EEA to fulfill the contract we have with you.

In cases where personal data is processed for advertising, marketing, or publicity purposes and is posted on social networks or transmitted via WhatsApp, the transfer of personal data will take place on the servers of social networks that may be located outside the territory of the European Union, including in the United States of America.

Please contact us if you want additional information about the specific mechanism we use when transferring your personal data outside the EU or EEA.

9. Legal Basis for Processing Personal Data

The legal bases for the processing operations of personal data described in this Notice are:

• the execution of a contract to which you are a party or to take steps at your request before entering into a contract;

• our legitimate interests and/or the necessity of entering into or performing a contract, in accordance with legal provisions regarding data confidentiality;

• your consent.

Our legitimate interests or those of a third party include our requirements to use your personal data in legal disputes, authorities’ investigations, processing data for advertising, marketing, or publicity purposes, or for other legal purposes involving Eturia.

10. Data Security

Eturia maintains physical, technical, and organizational security measures to protect personal data against destruction, loss, alteration, disclosure, restriction, or unauthorized access, whether processed domestically or internationally.

Our security policy outlines how we safeguard your personal data. A copy of this security policy can be obtained from the Data Protection Officer.

11. Duration of Processing/Storage of Personal Data

We intend to keep your personal data accurate and up-to-date. Additionally, we strive to retain your personal data no longer than necessary to fulfill the purposes outlined in this Notice or as required by law.

In this regard, please be informed that Eturia retains your personal data for the entire duration of your contract with Eturia, as well as for a period stipulated by applicable law after the termination of your relationship with Eturia.

Furthermore, please note that certain personal data may be included in certain accounting documents of Eturia, thus an extended retention period must be observed, in accordance with applicable law.

If you are a candidate for a position offered by Eturia (without any formalized relationship with Eturia), your personal data provided to Eturia will be retained for a period of 1 year.

Regarding personal data obtained through video surveillance means, they will be retained for a maximum duration of 30 calendar days from the date of recording, except in situations where compelling reasons exist to store them for a longer period.

In certain circumstances, we may anonymize your personal data (rendering them no longer associable with you) for research or statistical purposes, in which case we may use this information for an unlimited period without prior notice.

12. Processing of Personal Data for Advertising, Marketing, and Publicity Purposes

Capturing images (photography, video) or using images (photography, video) is only allowed with your prior consent, and in the case of minors, only with the prior consent of their parents. It is important to note that the right to one’s image is not an absolute right, and photographing and using a person’s image are permitted even without prior consent when done in good faith in the exercise of other fundamental rights, such as the right to freedom of expression or our legitimate interest in ensuring the security and protection of individuals and property.

In case consent is granted, Eturia will limit the use of the image only on its website(s) and only on major social media platforms, such as Facebook, Twitter, Instagram, WhatsApp, or on Eturia’s associated web pages, or within the scope of advertising, marketing, and publicity at Eturia’s premises, events, or presentations.

There are situations, such as during trips, where such image or video collections are possible, and these will be announced in advance. If you do not wish for the collection and processing, you can inform the event organizer or the Data Protection Officer in advance.

If you no longer wish for us to process your personal data for advertising, marketing, or publicity purposes, you can unsubscribe from receiving newsletters by accessing the link provided at the end of the newsletter. Alternatively, you can request this from the Data Protection Officer or leave the WhatsApp group to which you belonged.

13. Your Rights Regarding Personal Data

In accordance with applicable regulations regarding personal data, we inform you that you have the following rights, which can be exercised by submitting a request using the contact details provided in Section 2 above:

• The right to access processed personal data: This means your right to obtain confirmation from Eturia whether personal data concerning you is being processed, and if so, access to that data and the conditions under which it is processed (including the purpose of processing, categories of processed data, recipients of the data).

• The right to request rectification or erasure of personal data: This means your right to request the correction of inaccurate personal data or the completion of incomplete data. Additionally, the right to erasure of your personal data can be exercised in certain circumstances provided by applicable law, including situations where personal data is no longer necessary for the purposes for which it was processed, the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or the personal data has been unlawfully processed.

• The right to request restriction of processing: This means your right to obtain from Eturia restriction of processing in the following cases: (i) you contest the accuracy of the data (restriction will last for the period during which Eturia verifies the accuracy of the personal data); (ii) the processing is unlawful, and you oppose the erasure of the data and instead request the restriction of their use; (iii) Eturia no longer needs the personal data for the purposes stated above, but you require the data for the establishment, exercise, or defense of legal claims; or (iv) you have objected to processing, pending the verification whether the legitimate grounds of Eturia override yours.

• The right to object to processing: This means your right to object to processing based on Eturia’s legitimate interests or a third party, or, where applicable, to processing for direct marketing purposes, including profiling.

• The right not to be subject to automated decision-making, including profiling.

• The right to data portability: This means your right to request the moving, copying, or transferring of your existing data in Eturia’s database to another database in a structured, commonly used, machine-readable format, where the processing is based on a contract and is carried out by automated means.

• The right to lodge a complaint with the National Authority for the Supervision of Personal Data Processing and to address competent courts.

14. Changes to the Notification

If we substantially change our practices regarding personal data or this Notification, we will issue a revised Notification and/or take other measures to notify you of the changes, in accordance with applicabl