PALOMA TOURS SRL, the owner of the website www.palomatours.com, with its registered office in Bucharest, Preot Vasile Lucaciu Street, no. 60, sector 3, and correspondence address: Cluj-Napoca, Someșului Street, no. 34-36, Scala Center, Office no. 7, Cluj county, registered at the National Trade Register Office under no. J40/3790/2006, Tax Code RO 3801712, office1@palomatours.com, as the Data Controller, in accordance with Regulation 2016/679/EU and national laws on the protection of natural persons regarding the processing of personal data and the free movement of such data. The Privacy Policy describes the types of personal data processed by the Data Controller, the processing methods, and the purposes for which they were collected, situations in which they are transferred to third parties, and your rights regarding personal data. Please also refer to the Cookie Policy available on our website www.palomatours.com for a better understanding of how various microprograms, such as cookies, work within our website.

1. Personal data
   Personal data represents any information related to an identified or identifiable natural person. An identifiable natural person is someone who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, online identifier, or one or more specific factors relating to their physical, physiological, genetic, mental, economic, cultural, or social identity.

2. Categories of processed data
   The personal data we process may include:
   • Contact details, such as name, surname, address, phone number (landline/mobile);
   • General information regarding the services ordered/purchased;
   • Identity documents when required for booking services;
   • Data necessary for preparing legal documents (invoices, quotes, etc.);
   • Information about your preferences, as far as they are relevant to us.

3. Methods of collecting personal data
   Personal data may be collected directly from the data subject when entering into a contract or through the website www.palomatours.com, via actions such as filling out online forms.

4. Purposes of processing personal data
   We process personal data generally for the following purposes:
   • Preparing a contract;
   • Making reservations at hotels, transport companies, restaurants, leisure packages, and others;
   • Completing necessary border crossing formalities;
   • For various business activities aimed at developing and managing sales;
   • Performing post-sales activities (e.g., assistance);
   • Managing business relationships with customers;
   Page 2 of 3
   • Ensuring the security of our IT systems, communication systems, online platform, website, preventing and detecting security threats, fraud, or other malicious activities;
   • Identifying individuals authorized to operate purchased programs on behalf of our clients, beneficiaries, suppliers, and/or service providers;
   • Exercising and defending our legitimate rights;
   • Conducting surveys, research, market studies, and statistics to improve the quality of services provided by the Operator;
   • Sending specific offers, advertising and marketing messages about products or services provided by PALOMA TOURS SRL, assessing the success of our advertising campaigns, or personalizing services according to the needs of our customers;
   • Storing information on remote storage media such as the cloud;
   • For any purpose related and/or ancillary to any of the above or any other purpose for which your personal data has been provided;
   • Registering potential complaints for resolving them.

5. Legal grounds for processing personal data
   Any processing of personal data will be done based on one of the following grounds, in accordance with Article 6(1) of GDPR:
   • Based on your freely given consent;
   • For the execution of a contract or in the process of concluding a contract to which you are a party or the organization you represent is a party;
   • To comply with a legal obligation;
   • For the legitimate interests pursued by the Operator, except where your rights and freedoms may be affected.

6. Recipients of personal data
   In the context of processing operations, personal data may be transferred, depending on necessity, to the following categories of recipients:
   • Hotels, transport companies, restaurants, and, in general, any entity providing services ordered by clients, to complete any necessary reservation or personalization formalities;
   • Other similar entities;
   • Authorities of the Romanian state or abroad;
   • Authorized agents directly/indirectly involved in providing services (e.g., IT service providers, billing/accounting service providers, marketing service providers, newsletter providers, customer satisfaction evaluators);
   • Financial institutions;
   • Courts or arbitration tribunals or other administrative-jurisdictional entities;

PALOMA TOURS SRL will always maintain control over your personal data and will ensure that authorized service providers have implemented appropriate personal data protection measures, in accordance with applicable laws, to ensure the integrity and security of your data.

1. Transfer of personal data abroad
   For one or more of the purposes mentioned above, your data may be transferred to countries outside the EU/EEA, which have different personal data protection legislation. In such cases, the Operator will require the respective recipients to implement sets of measures designed to protect personal data, in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 or other applicable EU laws.

2. Data retention period
   Personal data collected by PALOMA TOURS SRL will be processed:
   • For the entire period necessary to execute the contract;
   • For a period of 3 years after the contract ends, for resolving potential disputes;
   • After the 3-year period, if the retention of personal data is required in accordance with national legislation, respecting the indicated retention periods.

3. Your rights concerning personal data processing
   • The right to be informed
   • The right to rectification
   • The right to data erasure ("right to be forgotten")
   • The right to restrict processing
   • The right to object
   • The right to data portability
   • The right to file a complaint
   • The right to withdraw consent
   • Additional rights related to automated decisions

4. Contact methods
   • To exercise the above-mentioned rights, you can send a written request to the postal address: Cluj-Napoca, Someșului Street, no. 34-36, Scala Center, Office no. 7, Cluj County, or via email at office1@palomatours.com
   • For complaints or clarifications regarding data protection, contact the Data Protection Officer (DPO) at: adrian.magda@gdprservicii.ro

5. Final provisions
   By reading this document, you acknowledge and understand how personal data is processed on the website www.palomatours.com, as well as your rights regarding data protection.
   These provisions may be modified/updated occasionally. We recommend checking the terms each time you use the website www.palomatours.com to stay informed.
   By accessing the website, you are deemed to have accepted the provisions contained in the Privacy Policy.