1. WHO WE ARE

The data controller is:

ALTER EGO CONCIERGE SERVICE LLC (ТОВ «АЛЬТЕР ЕГО КОНСЬЄРЖ СЕРВІС»)

Data protection contact: support@alterego.travel

In this Policy, "we", "us", and "our" refer to the Company named above, and "User" means any individual who visits or uses the AlterEgo Travel Concierge website (the "Website").

We operate in accordance with Ukrainian law and, where applicable, Regulation (EU) 2016/679 (GDPR) with respect to Users located in the EU/EEA.

---

2. SCOPE OF THIS POLICY

This Policy applies to:

• visiting and browsing the Website;
• sending us enquiries by phone, email, messenger or other means of communication;
• requests relating to travel and ancillary services;
• electronic communications with us (email, messengers, etc.);
• all other instances in which we receive personal data from you in the course of our activities.

---

3. KEY DEFINITIONS

Personal data — any information relating to an identified or identifiable natural person.

Processing — any operation or set of operations performed on personal data (collection, recording, storage, adaptation, alteration, transmission, access, erasure, etc.).

Controller — the Company, which determines the purposes and means of processing personal data.

Processor — a natural or legal person that processes personal data on behalf of the Controller under a contract (e.g. cloud services, analytics platforms).

Cookies — small text files stored in the User's browser that allow the Website to remember information between sessions.

---

4. DATA PROCESSING PRINCIPLES

We process personal data in accordance with the following principles:

• lawfulness, fairness and transparency;
• purpose limitation — data is collected for specified, explicit and legitimate purposes;
• data minimisation — we collect only what is necessary;
• accuracy — we strive to keep data up to date and correct;
• storage limitation — data is not kept longer than necessary;
• integrity and confidentiality — we protect data against unauthorised access;
• accountability — we are able to demonstrate compliance with these principles.

---

5. DATA WE COLLECT

5.1. Data you provide directly

When contacting us using the contact details on the Website (phone, email, messenger) you may provide:

• first and last name;
• phone number;
• email address;
• information about desired services (destinations, dates, preferences);
• any other information you voluntarily include in your enquiry.

5.2. Data collected automatically

When you browse the Website, we automatically receive:

• IP address and approximate geographic location (country/region level);
• browser and device information (type, version, language, operating system);
• aggregated statistics on page views and the websites visitors come from;
• the data held in the cookie and browser storage described in Section 6;
• error information and Website performance metrics.

Such data is generally used in aggregated or anonymised form for statistics and service improvement.

---

6. COOKIES AND SIMILAR TECHNOLOGIES

6.1. What are cookies

Cookies are small text files stored in your browser. Similar technologies include browser storage (for example, sessionStorage).

6.2. What we store on your device

The Website uses only what it needs to work correctly. We do not use advertising, marketing, tracking or third-party cookies. The Website does not show a cookie consent banner, because none of the technologies below requires consent.

6.3. Visit statistics without cookies

We use Vercel Web Analytics for overall visit statistics. It stores nothing on your device and uses no cookies. We see only aggregated figures: pages viewed, the website visitors came from, country, device type, browser and operating system. Visits are counted with a temporary technical identifier derived from the request, which is deleted automatically after 24 hours and does not allow us to identify you.

6.4. Fonts, images and content

The Website's fonts, video and images are served from our own domain. To keep page content up to date, your browser connects to the servers of our content management system, Sanity (Section 9). This connection carries your IP address and browser details, but no cookies.

6.5. External links

When you follow a link to WhatsApp, Telegram, Instagram, Facebook, TikTok, the App Store, Google Play or Google Maps, you leave the Website, and that service's own privacy rules apply.

6.6. Mobile app

The ALTEREGO TRAVEL mobile app, including its use of analytics, is covered by the separate app privacy policy.

6.7. Managing cookies

You can view or delete cookies in your browser settings. If you delete alterego_locale_detected, the Website will choose the language automatically once more on your next visit.

---

7. PURPOSES AND LEGAL BASES FOR PROCESSING

7.1. Performance of a contract / provision of services (GDPR Art. 6(1)(b))

We process your data because it is necessary to:

• process and respond to your enquiries about travel services;
• prepare, agree and fulfil bespoke travel proposals;
• communicate with you by email, phone or messenger.

7.2. Legitimate interests of the Company (GDPR Art. 6(1)(f))

We may process your data to:

• protect the rights and interests of the Company in the event of disputes;
• prevent fraud and abuse;
• conduct internal analytics, including analysis of aggregated and anonymised data;
• improve the Website and quality of service.

We always assess that our legitimate interests do not override your fundamental rights and freedoms.

7.3. Compliance with legal obligations (GDPR Art. 6(1)(c))

We may process data where necessary to:

• fulfil accounting and tax obligations;
• respond to lawful requests from public authorities.

7.4. Consent (GDPR Art. 6(1)(a))

Where the legal basis for processing is your consent (for example, certain marketing communications), we:

• request consent clearly;
• explain the purpose of the processing;
• provide the ability to withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

---

8. DISCLOSURE TO THIRD PARTIES

We may share your personal data with the following categories of recipients:

• airlines and their reservation systems;
• hotels, apartments and other accommodation providers;
• tour operators and other travel service providers;
• insurance companies;
• transfer and ground transportation providers;
• visa centres and other involved organisations.

We act as a technical and service intermediary: you provide the data and we pass it to the relevant provider. You are responsible for the accuracy and completeness of the data you supply.

---

9. TECHNICAL SERVICE PROVIDERS (PROCESSORS)

To operate the Website we engage external service providers:

• Vercel (Vercel Inc., USA) — hosting and delivery of the Website, protection against attacks, country detection for the Website language, and cookieless visit statistics (Vercel Web Analytics);
• Sanity (Sanity US Inc., USA) — the content management system that stores and delivers the Website's content.

All engaged providers operate under contracts that require them to process personal data only on our instructions, maintain confidentiality, and implement appropriate security measures.

---

10. INTERNATIONAL DATA TRANSFERS

Your data may be stored and processed on servers located in Ukraine and in other countries (including the USA, via the providers listed in Section 9). Where data is transferred to third countries in which the level of data protection may differ from European standards, we apply appropriate safeguards, including EU Standard Contractual Clauses (SCCs).

---

11. DATA RETENTION

We retain personal data for as long as necessary for the purposes for which it was collected, or to fulfil legal obligations. As a guide:

• enquiry and contact data — for the duration of the business relationship and a reasonable period thereafter;
• visit statistics (Vercel Web Analytics) — kept in aggregated form only; the temporary technical identifier of a visit is deleted after 24 hours;
• financial and accounting data — for the periods required by law (generally not less than 3–5 years);
• cookies and browser storage — for the periods set out in Section 6.

---

12. DATA SECURITY

We implement technical and organisational measures to protect personal data, including:

• encryption of data in transit (HTTPS/TLS);
• access controls based on the principle of least privilege;
• employee access control and authentication;
• backups and access monitoring;
• internal privacy policies and staff training.

No online service can guarantee absolute security; however, we make every reasonable effort to protect your data.

---

13. YOUR RIGHTS

You have the right (to the extent provided by applicable law) to:

• know whether we process your personal data;
• access your data and receive a copy;
• request correction of inaccurate or outdated data;
• request erasure of your data ("right to be forgotten");
• request restriction of processing in certain circumstances;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• lodge a complaint with a competent data protection authority.

To exercise your rights, please contact: support@alterego.travel

---

14. CHILDREN

The Website is intended for adults only (18+). We do not knowingly collect data from persons under 18 years of age. If we become aware that we have received such data, we will take steps to delete it.

---

15. CHANGES TO THIS POLICY

We may update this Policy from time to time. The new version takes effect upon publication on the Website. We recommend reviewing this page periodically.

---

16. CORPORATE CHANGES

In the event of a reorganisation, merger, acquisition or sale of the Company's business, personal data may be transferred to the successor entity, provided it maintains a level of data protection equivalent to or higher than that set out in this Policy.

---

17. CONTACT

For any questions relating to the protection of personal data, please contact:

Email: support@alterego.travel