Privacy Policy

Allotsys Consulting Llc., a Hungarian corporation with its operational headquarters located at Aba 3, 3531 Miskolc, Hungary, together with its subsidiaries and corporate affiliates (hereinafter referred to as "we," "us," "our," "Allotsys" or "Tipptour"), hereby acknowledges your right to privacy and affirms our commitment to safeguarding your private information. Allotsys Consulting Llc. is the operator of Tipptour websites (collectively, our "Service Sites") and the Allotsys or Tipptour mobile applications (collectively, the "App"). As defined by the General Data Protection Regulation ("GDPR"), we are the data 'controller'. We can be contacted at tippour@tipptour.com and our data protection officer can be reached at tipptour@tipptour.com. If the Service Sites or the App connect you with third-party online services, you are advised to carefully review the privacy policies of such third-party sites as they are not governed by our privacy policy.

We hereby provide you with information on how we collect and process your personal data in compliance with the GDPR and the National Authority for Data Protection and Freedom of Information.

I. What kind of data do we collect?

1. Automatically generated website visitor information

We hereby notify you that we collect information and data that are automatically transmitted or generated by your browser each time you visit our website, in compliance with applicable laws and regulations. Such information includes, but is not limited to, the Internet Protocol (IP) address, Uniform Resource Locators (URLs) of the website you visited before accessing our Service Sites ("referrer"), the browser used, the browser language, the operating system and user interface, the access device used, the date and time of your access, the pages viewed on our website, and the time you spend on the Service Sites. We store such data for a period of two years and delete it automatically thereafter, in accordance with our data retention policy.

We may use this information to investigate errors, improve the stability and functionality of the Service Sites and the App, and assist you in completing any interrupted bookings. By using our Service Sites and App, you acknowledge and agree that we may collect and process such information as described above.

2. Data provided by you / user accounts

We hereby disclose that we collect and utilize information provided by you regarding yourself, your travel companions, and your trip planning through the use of our Service Sites or App, in accordance with applicable laws and regulations.

When you book a travel product through our Service Sites, we request that you provide personal data, such as your name, email address, phone number, government-issued identification numbers, emergency contact information, billing address, payment method or credit card information, your preferred travel connection, and, where applicable, information about your loyalty, bonus, or discount cards (e.g. mileage or frequent-flyer programs). We collect and ask for the data that the relevant transportation provider requires to complete the booking process, as indicated on our forms. We are unable to process your booking without the required information. Credit card information will be immediately passed on to the respective payment provider, and we never store credit card data.

When you make a booking for someone else, such as a travel companion or a business associate, through the Service Sites or App, we will request personal information about such individuals. Prior to providing their information to us, you must obtain the consent of all such individuals as they may not be able to independently view their information themselves if it is provided to us under your account. To the extent that your companion(s) may need to amend or delete their information, they can reach out to us using tipptour@tipptour.com.

By using our Service Sites and App, you acknowledge and agree that we may collect and process the personal data described above.

Please rephrase the followings in US legal wording: We store booking-related data for a period of 10 years and thereafter keep the information required by trade and tax law for the statutory retention periods (usually ten years after the conclusion of the contract / booking). b) Should you opt to additionally register for a personal profile with Tipptour by creating a user account, this data will be stored with us for your future bookings. We keep your account data as long as you keep up your user account with us. If you decide to delete your account, we delete the associated data. However, potential booking data and related basic data (e.g. your name and address) will be kept as described above. c) If you contact us or our customer support (e.g. by email, telephone or contact form on the Service Sites), we use the data you provided (usually your contact information and your inquiry) to respond. We keep your inquiries for a period of five years after answering except, where required by trade or tax law, we keep such correspondence for the statutory retention periods (usually six years). d) Call recording: When you make calls to our customer service team, you may be required to confirm that you have an existing reservation with us. Calls to our customer service team may be recorded for quality control and training purposes, which includes using the recordings to process claims and for fraud detection purposes. Though not every call is recorded, call recordings are kept for a limited amount of time and automatically deleted after three (3) months, unless we have a legitimate interest to keep such recording for a longer period, including for fraud investigation or another legal purpose. You can opt-out from the call recording at any time during your conversation with our customer service team by notifying one of our agents.

b) In addition to the data collected during the booking process, you may choose to register for a personal profile with Tipptour and create a user account. If you do so, the data you provide will be stored by us for future bookings. Your account data will be retained as long as your user account is active. Should you decide to delete your account, we will delete your associated data. However, we will retain potential booking data and related basic data (such as your name and address) as described above.

c) If you contact us or our customer support team (e.g., by email, phone, or contact form on our Service Sites), we will use the information you provide (usually your contact information and inquiry) to respond to your request. We will retain your inquiries for a period of five years after responding, unless we are required by trade or tax law to retain such correspondence for longer periods, in which case we will retain them for the statutory retention periods (usually six years).

d) Call recording: When you contact our customer service team by phone, you may be required to confirm your reservation with us. Please note that calls to our customer service team may be recorded for quality control and training purposes. These recordings may also be used for processing claims and fraud detection purposes. While we do not record every call, recordings are kept for a limited time and automatically deleted after three (3) months, unless we have a legitimate interest in retaining such recordings for a longer period, including for fraud investigation or other legal purposes. If you wish to opt-out from call recording at any time during your conversation with our customer service team, you may notify one of our agents.

e) From time to time, we may request your participation in surveys. Such surveys may assist us in conducting market research, analyzing ways to enhance your experience on the Service Sites and App, and improving the functionality and quality of our products. We will collect the data you provide when you submit your survey responses. If you object to our data processing as outlined in this section and there is no direct opt-out mechanism available to you (such as in your account settings), please send your objection to us at tipptour@tipptour.com. The Service Sites and App are intended for use by adults only. We do not knowingly collect personal information from children under the age of 13. In the event that we become aware that a child under the age of 13 has submitted personal information to us via the Service Sites or App, we may use the email address or other contact information provided by the child for the sole purpose of responding to the child's inquiry or fulfilling his or her request on a one-time basis only. We will not use the email address provided by such child for any other purpose, and we will delete such information from our records after responding to the inquiry or fulfilling the request. If we discover that we have inadvertently collected personal contact information other than an email address from a child under the age of 13, we will delete the information immediately.

3. Logging in with Facebook Connect

It is possible to access our Service Sites by logging in through Facebook Connect. By doing so, you are not required to create a separate user account with us. Instead, you can use your existing Facebook account to log in. During the registration process, Facebook will transmit certain pieces of your personal data to us, and will inform you about the data to be transmitted ("Facebook Data"). You will have the opportunity to consent or refuse the transmission of such Facebook Data. Facebook will not transmit any of your personal Facebook Data to us without your express permission. Once you have logged in, we will be able to see your Facebook username and public profile, and we may use this information solely for the purposes detailed in our privacy policy or for purposes that we explain to you when we collect your personal information. Conversely, Facebook will be able to see when you log into our site using Facebook Connect.

You have the option to stop using Facebook Connect to log in to our Service Sites at any time and create your own user profile account with us if desired. Please note that it is also possible to use our Service Sites without creating a user account at all.

  1. Newsletter and marketing emails

If you choose to subscribe to our newsletter (for example, by subscribing via the Service Sites or when creating a user account), we will send you promotional emails and newsletters containing information about Tipptour, as well as offers and services provided by us or third parties.

If you have agreed to receive our newsletter, you can withdraw your consent by using the "unsubscribe" link included in each of our promotional emails.

Once you have withdrawn your consent or unsubscribed from the newsletter, we will delete your contact information unless it is still stored for another purpose described elsewhere in this privacy policy, such as in your user account or in relation to your bookings, as described above.

  1. Cookies, web beacons and similar technology

As is common with most website operators, we utilize Tracking Facilities such as cookies, web beacons, and similar technology when you access or use our Service Sites. Cookies refer to small text files that are stored by your browser on your computer or mobile device. These files allow for potential re-identification of your computer or mobile device, including when visiting numerous websites, including our Service Sites. Please note that these cookies do not contain any personal data. Some of the cookies we use are automatically deleted upon the expiration of your session, i.e., when you close your browser (these are known as session cookies). Other cookies remain stored on your device and permit us, or our business partners, to recognize your browser during subsequent visits (persistent cookies).

In accordance with industry standards, we employ Tracking Facilities such as cookies and web beacons on our Service Sites to collect certain information from our users. These Tracking Facilities allow us to provide simplified and more convenient access to our Service Sites and services, and enable us to provide certain services at all.

We use Tracking Facilities for the following specific purposes:

• To save your user settings such as language and currency, both during and between visits to the Service Sites.

• To store your login status as a registered user (optional), so that you do not have to log in again when you return to the Service Sites.

• For the technical assignment of your visit to certain servers, to ensure a safe transition between pages and search queries.

• To monitor the performance of our systems, without any user-based evaluation of data.

Additionally, we may engage service providers for website analysis, retargeting, and conversion tracking, who may also use Tracking Facilities (as further detailed below).

If you click a link on the Service Sites that takes you to a provider's website (such as when making a booking or purchasing a ticket), it is possible that such provider's website may also store cookies on your computer. We have no control over these providers' cookies or the data collected through them, and cannot accept any responsibility for their websites or tracking practices. We encourage you to carefully review the privacy policies of any website that you visit.

How do we use cookies? We use various categories of cookies for different purposes, as explained below:

Mandatory for Use: We use strictly necessary cookies that are essential for you to browse the website properly and use its core features. These cookies do not require your consent and will generally be first-party cookies. o Category: Infrastructure Purpose: Infrastructure cookies are first-party cookies that are necessary for you to browse the website properly and use its core features. They are essential for us to provide you with the services you expect, such as using our platform to search and book travel services. o Category: Security Purpose: Security cookies are necessary to ensure an adequate level of security of our website, such as user authentication for secure payment and fraud prevention. These may include third-party cookies, e.g., security cookies from the payment provider you selected when you are redirected to the payment page. o Category: Functionalities Purpose: Core functionality cookies are necessary to ensure the proper functioning of our website and its essential features, such as travel service bookings and ticket issuance. These may include third-party cookies from our transportation providers when you are redirected to their website to finalize your booking.

Non-necessary cookies: We also use cookies and similar technologies that help us understand how you use our website and to improve your user experience. These cookies may include third-party cookies for marketing and personalization purposes. These cookies will be stored in your browser only with your consent. You can choose to reject such cookies under "Settings," which might affect your experience with our website. o Category: Performance and Statistics Purpose: Performance & Statistics cookies are used to help understand personal and statistical use of our website to improve your user experience. As such, they may include third-party cookies and similar technologies like analytics services. It allows us to gain important insights about the use of our websites and how different settings affect your user experience. o Category: Marketing Purpose: Marketing cookies are used to assist our marketing efforts and improve online advertising performance. They allow us to track your online activity to place personalized and relevant advertisements from third-party Ads partners. We may upload your user identifiers received from these cookies to our Ads partner platform, such as Facebook, Google, and others, to help improve the personalization of the advertisements.

6. Retargeting

Our Service Sites may use retargeting tags to present interest-related advertising on third-party websites. A retargeting tag is a JavaScript element that is placed in our Service Site's source code. If you visit a page on our Service Site that contains a retargeting tag, a Retargeting Provider (such as Google or Facebook) places a cookie on your computer and allocates it to the corresponding retargeting target group lists. The Retargeting Provider uses the cookie to gather data related to your interests, such as the pages visited on the Service Sites or search queries, using pseudonymous identifiers. Based on that information, the Retargeting Provider displays interest-based ads on third-party websites. No directly personally identifying data is stored or transmitted, and the usage profiles will not be merged with your personal data. However, the Retargeting Provider can potentially identify you and track your visits on our website, particularly if you are a registered user of the particular Retargeting Provider (e.g., if you have a Google or Facebook account).

We use the following Retargeting Providers:

To learn more about this type of targeted advertising and your options for preventing it, please visit youronlinechoices.com. If you are a resident of Canada, please visit https://youradchoices.ca/.

You can object to usage-based online advertising by all or some providers on the same website. To access the preferences manager, click here: http://www.youronlinechoices.com/de/praferenzmanagement. If you are a resident of Canada, please click here: http://optout.aboutads.info/?c=3&lang=en.

You may also prevent data transfer to all Retargeting Providers by Tipptour at any time by clicking the following link:

[Insert opt-out link]

By clicking the opt-out link above, we will set a persistent cookie that allows us to recognize and observe your opt-out upon later visits to the Service Sites. Please note that you must reset the cookie when you delete all cookies in your browser. Opt-out cookies prevent tracking when you visit the Service Sites with a specific device, browser, and domain. To prevent cookies on different devices or browsers, you must set the opt-out cookie by clicking the opt-out button on all devices/browsers. The same applies if you visit the Service Sites under different top-level domains (e.g., Tipptour.com / Tipptour.it, etc., when it becomes available). To prevent tracking in the App, please use the App's opt-out function (see below).

Note that the above information does not constitute an offer or a contract, and it does not impose any obligations or rights on either party.

7. Conversion tracking

We employ advertising partners to promote our offerings on third-party websites, and also employ marketing tools to assess the effectiveness of our advertising activities ("Conversion Tracking"). Our aim is to display advertising relevant to your interests, optimize our website, and achieve a fair calculation of advertising costs.

For this purpose, our advertising partners use cookies and web beacons (as described above) to measure specific parameters related to the success of an advertising campaign, such as the display of an ad or user clicks. The cookies are not intended to personally identify you. During the cookie's lifespan, the advertising partner may identify your clicks on an advertisement and your redirection to a specific landing page (e.g. form input, confirmation page, newsletter subscription). Using this data, the advertising partner generates conversion statistics, which indicate the number of users who have clicked on one of our ads and the number of users who have reached a specific target page marked with a "conversion tag" (remarketing tag, as described above). These statistics do not include data that can personally identify you.

We do not gather or utilize personal information in our advertising campaigns. Our advertising partners only supply us with statistical data, which allows us to recognize effective advertising campaigns. We do not receive any additional data, specifically no data that could help us identify our users.

Due to the Conversion Tracking tools, your browser automatically connects to the server of the advertising partners. We have no control over the extent and further use of data collected by the Conversion Tracking tools of our advertising partners. The advertising partners receive the information that you have visited certain pages on the Service Sites or clicked on one of our ads. If you are a registered user of the advertising partner (e.g. if you have a Google or Facebook account), the advertising partner can relate your visits to such account data. Even if you are not a registered user with the advertising partner, or are not logged into your account, the advertising partner may collect and store your IP address.

We use Conversion Tracking with the following advertising partners:

To learn more about this type of targeted advertising and your options for preventing it, follow this link: youronlinechoices.com.

If you are a resident in Canada, you can follow this link: https://youradchoices.ca/.

You can object to usage-based online advertising by all or some providers on the same website. To access the preferences manager, click here: http://www.youronlinechoices.com/de/praferenzmanagement.

If you are a resident in Canada, you can follow this link: http://optout.aboutads.info/?c=3&lang=en.

You can also prevent data transfer to all conversion tracking providers by Allotsys at any time by clicking the following link:

You have opted out of tracking for advertising purposes. Click below to change that: Allow tracking for advertising purposes Don't track me for advertising purposes

By clicking the link above, we will set a persistent cookie that enables us to recognize and monitor your opt-out upon subsequent visits to the Service Sites. Please be aware that the cookie must be reset if you delete all cookies in your browser. Opt-out cookies prevent tracking when you visit our website with a specific device, browser, and domain. To prevent cookies on different devices or browsers, you must set the opt-out cookie by clicking the opt-out button on all devices/browsers. The same applies if you visit our website under different top-level domains (e.g., Tipptour.com / Tipptour.it when it becomes available). To prevent tracking in the App, please use the App's opt-out function (see below).

8. Web analytics and statistics / Google Analytics

The Service Sites utilize Google Analytics, a web analytics service provided by Google LLC ("Google"). Google uses cookies, which are stored on the user's computer and allow us to analyze the use of the Service Sites. The information generated by the cookie about the use, including the user's current, but truncated EU IP addresses are transmitted to a Google server in the USA and stored there. IP anonymization is activated, and therefore, Google will truncate the user's IP address within a European Union member state or a member state of the European Economic Area before transmission to the USA, except in exceptional circumstances where the full IP address may be transferred and truncated in the USA. Google will use this information on our behalf to evaluate the use of the Service Sites, compile reports on user activities, and provide other internet-related services. Google may transfer this information to third parties if required by law or where such third parties process the information on Google's behalf. The IP address sent by the user's browser to Google Analytics will not be merged with other Google data.

Users may prevent the installation of cookies by changing the settings of their browser. However, this may prevent some features of the services from working correctly. Alternatively, users may prevent the collection of cookie data and website usage data (including their IP address) by Google and the processing of such data by downloading and installing a browser plugin available at http://tools.google.com/dlpage/gaoptout or by clicking on the "Deactivate Google Analytics" link to set an opt-out cookie that prevents the future collection of their data when visiting the Service Sites. Note that the opt-out cookie must be reset when users delete all cookies in their browser.

This website uses Google Analytics with the extension "_anonymizeIP()", which ensures the processing of truncated IP addresses to prevent direct personal identification via IP addresses. Personal data associated with cookies, user identifiers (e.g., User-ID) and advertising identifiers (e.g., DoubleClick cookies, Android's Advertising ID, Apple's Identifier for Advertisers) will be automatically deleted after 14 months.

The use of Google Analytics is in accordance with the requirements agreed between the National Authority for Data Protection and Freedom of Information and Google. Additional information can be found at Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Usage terms: http://www.google.com/analytics/terms/en.html, Privacy information: http://www.google.com/intl/en/analytics/learn/privacy.html, Privacy policy: http://www.google.de/intl/en/policies/privacy. Google has incorporated the EU Standard Contractual Clauses, https://policies.google.com/privacy/frameworks?hl=en-US.

9. Social Plugins

The Service Sites utilize social plugins provided by various social media providers. We implement a 2-click solution to ensure that no personal data is automatically transmitted to the plugin provider upon your visit to the Service Sites. The plugin provider is identifiable by their label or logo on the button, and we provide the option for you to communicate directly with the plugin provider via the button. Only if you choose to click on the button and activate the plugin, will the plugin provider receive the information that you have visited the corresponding page of the Service Sites. Additionally, your browser will transmit the information specified in Section 1 of this agreement to the plugin provider. If you have an account with the plugin provider and are logged in, the provider may connect your visit to the Service Sites and your interaction with the social plugin (e.g., clicking the "Like" button) to your user account (e.g., your Facebook account). We are not liable for the data collected or processed by the plugin provider, nor are we privy to the full extent of the data processing, purposes, retention terms, or deletion of data by the plugin provider. For more information about data processing by the plugin provider, please refer to their respective privacy policies, which are linked above. These policies also outline your rights and privacy-related configuration options.

  1. Data Breaches

In the event of any unauthorized access or acquisition of personal data or a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data, where such breach poses a significant risk of harm to your rights and freedoms, we will notify you without undue delay and, where possible, within 72 hours of becoming aware of it. We will also comply with applicable laws and inform governmental authorities of such a breach.

II. Tipptour app

The Tipptour applications, referred to as the "App," provide an alternate means of accessing offers and services provided by Allotsys. The App records, processes, and utilizes data in a similar manner as the Service Sites, for the same purposes and on the same legal basis. The information presented in this section of the privacy policy pertains to the App.

1. Additional use of app-specific data

In using the App, Tipptour may collect additional data related to the App and your mobile device, including but not limited to the device name, device manufacturer, model, operating system version, app version or SDK version, device number (IMEI), advertising identifiers (such as Android's Advertising ID and Apple's Identifier for Advertisers), and, for Android devices, information on Google services subscribed to by the user. Additionally, the App may prevent your device from entering standby mode while the App is running.

The App requires your explicit permission in order to access this additional data and function properly. If such permission is granted, the App may also collect your device's geolocation data, which may be used for purposes such as filling in location information in search forms, providing location-based services, or suggesting relevant content based on your location. All geolocation data transmitted through the App is encrypted. If GPS is enabled, precise location data will be detected by the App, but such data will only be used to fill in search forms and will not be stored beyond that purpose. You retain the right to disable location data collection at any time by accessing your device's settings menu.

2. Statistics and analytics

We utilize data analytics services to gather statistics and analytics on your usage of the App, the Service Sites, and our services. The IP address and device identifier of your mobile device are used for such purposes, as well as to facilitate the transition to our partner's websites or services. Additionally, we may create pseudonymous usage profiles via cross-device tracking using this information. The analytics functionality can be disabled in the App preferences at any time.

We use "Google Analytics" and "Firebase Analytics" as analytics services provided by Google LLC ("Google") in our apps. Google's SDKs are stored on the user's device to analyze their App usage, transmitting information about such use, including the user's truncated IP address, to a Google server in the USA for storage. IP anonymization is activated so that, if collected in the EU, the IP address will be truncated by Google within a European Union or European Economic Area member state before transmission to the USA. Google will use this information to evaluate App usage, compile reports on user activity, and provide other internet use-related services. Google may also transfer this information to third parties as required by law or where those third parties process the information on Google's behalf. The IP address sent to Google Analytics or Firebase will not be combined with other Google data.

App users can disable data processing by Google Analytics or Firebase by using the switch at the bottom of the page. This app employs Google Analytics with the "_anonymizeIP()" extension to process truncated IP addresses, preventing direct personal identification via IP addresses. Further information on Google Analytics can be found in the usage terms, privacy information, and privacy policy linked in this section. Google has included the EU Standard Contractual Clauses in its policies.

3. Push messages

In the event that your mobile device has been configured to allow it, the App may transmit push notifications to you, which could include updates about Tipptour, status updates, marketing campaigns, and other news, or notifications about new services, products, and features. These push notifications may also contain advertisements for Tipptour or third-party offers, such as travel offers.

You may revoke your consent to receive marketing push notifications at any time, at no cost, by disabling marketing push notifications within the App's settings or by disabling push notifications in the preferences of your device's operating system.

To send newsletters and push notifications based on your searches, we utilize Braze, which is located at 114 Sansome St Suite 1200, San Francisco, CA 9410. Additional information regarding Braze's handling of your personal data, as well as your rights and options concerning data protection, can be found at the following website: https://mailchimp.com/legal/

4. Retargeting

You can find more information about retargeting above (Sec. I.6).

We use the following retargeting and attribution providers:

PROVIDER CONTACT FURTHER INFORMATION

Adjust adjust Inc. 500 Montgomery Street, Suite A, San Francisco, CA 94111, USA Your Adjust ID (a unique identifier) and the routes you have searched for will be sent to Adjust (an attribution tool). These are solely used for pseudonymous analytics and are not related to a natural person. You can find additional information regarding data processing by Adjust and your rights and options with regard to protecting your personal data here: https://www.adjust.com/privacy-policy/

Liftoff Mobile, Inc 555 Bryant Street, Suite 133, Palo Alto, CA 94301, USA Collects anonymous information when you interact with the app for the purpose of optimization of our marketing measures (conversion optimization).

Criteo SA 32,Rue Blanche, 75009 Paris

Click Tech Limited (Yeahmobi) Room 1907, 19/F, Lee Garden One, 33 Hysan Av, Causeway Bay, Hong Kong Collects anonymous information when you interact with the app for the purpose of optimization of our marketing measures (conversion optimization).

Taptica LTD 121 Ha´chashmonaim street, Tel Aviv - Israel 6713328 Collects anonymous information when you interact with the app for the purpose of optimization of our marketing measures (conversion optimization).

Inmobi Pte. Ltd 30 Cecile Street, 19-08 Prudential Tower Singapore, 049712 Collects anonymous information when you interact with the app for the purpose of optimization of our marketing measures (conversion optimization).

AppNext Ltd Intershore Chambers, Road Town, Tortola, British Virgin Island Collects anonymous information when you interact with the app for the purpose of optimization of our marketing measures (conversion optimization).

Jampp LTD Studio 103, 242 Acklam Road, London, UK 110 5 JJ Processes information in order to display interest-based advertising based on inferred interests or preferences. Also processes information in aggregated form for the purposes of performance and service improvement and fraud prevention.

TIRBURTINA S.A. /Lemmonet Avda. Rivera 7043 - Montevideo, Uruguay, 11500 Collects anonymous information when you interact with the app for the purpose of optimization of our marketing measures (conversion optimization).

Adperio 2000 S. Colorado Blvd Tower 1 Suite 7000, Denver, CO 80222, USA Collects anonymous information when you interact with the app for the purpose of conversion optimization.

Remerge GmbH Oranienburger Straße 27, 10117 Berlin Processes information in order to display interest-based advertising based on inferred interests or preferences. Also processes information in aggregated form for the purposes of performance and service improvement and fraud prevention.

Stroeer Mobile Performance GmbH Erftstraße 19 a, 50672 Cologne Collects anonymous information when you interact with the app for the purpose of conversion optimization.

Branch 1400 Seaport Blvd Building B, 2nd Floor Redwood City, CA 94063 USA Branch collects your phone number when you interact with the "text me the ticket" feature. This feature will make sure you receive an SMS showing how to download the app with the ticket pre-loaded. This happens on mobile web or on desktop web interfaces.

Myappfree S.R.L. Via Selice 84/A, Imola, 40026 (BO) Italy Collects anonymous information when you interact with the app for the purpose of conversion optimization.

Sojern Corporate Headquarters: 255 California Street, Suite 1000, San Francisco, CA 94111 Sojern Privacy Policy: https://www.sojern.com/privacy/

Travel Audience travel audience GmbH, Elsenstraße 106 12435 Berlin Please find travel audience privacy policy here: https://travelaudience.com/website-privacy-policy/

Adara Adara Inc, 1070 E Meadow Circle, Palo Alto, 94303, California, USA You will find more information regarding data protection and cookies here: https://adara.com/privacy-promise/

Sojern Corporate Headquarters: 255 California Street, Suite 1000, San Francisco, CA 94111 Sojern Privacy Policy: https://www.sojern.com/privacy/

Travel Audience travel audience GmbH, Elsenstraße 106 12435 Berlin Please find travel audience privacy policy here: https://travelaudience.com/website-privacy-policy/

Adara Adara Inc, 1070 E Meadow Circle, Palo Alto, 94303, California, USA You will find more information regarding data protection and cookies here: https://adara.com/privacy-promise/

Forter Forter Ltd, 7 Tozeret Haaretz Street, Tel Aviv, 6780104 Israel We are using the services of our trusted service provider in order to help us prevent online frauds. Our service provider may use and process your personal information in accordance with applicable privacy and data protection laws. You can read about the ways by which our service provider may use and process your personal information in this regard at : https://forter.com/privacy-policy/

If you are using the app, you have the option to prevent the transfer of data to all retargeting providers at any time by using the switch provided at the bottom of the page. By clicking the opt-out switch, the software development kits (SDKs) that enable us to identify you will be disabled. Please note that the opt-out will only become effective after you restart the App for the first time following the opt-out. The opt-out switch only prevents tracking while you are using the App. To prevent tracking or retargeting on the Service Sites, you must set the opt-out cookie by clicking the opt-out button in your browser settings.

III. With whom do we share your Data?

1. Data processing by Our subsidiaries

Allotsys Consulting LLC engages Tipptour.com, located at Aba 3, 3531 Miskolc, Hungary, as a service provider to operate computer systems, handle order processing, and provide customer service, among other things. We may share your information with our affiliates to enhance the products and services we offer. Our affiliates will follow practices that are at least as restrictive as those set forth in this privacy policy, to the extent they have access to your information.

Tipptour.com is a brand of Allotsys Consulting LLC, and it collects and forwards your personal data to Allotsys Consulting LLC for processing. Tipptour.com will process your data in compliance with this privacy policy for the purposes of providing services for Allotsys Consulting LLC, running the Service Sites, the App, related platforms, and associated services. This privacy policy applies to data processing by Tipptour.com as well. You may contact our data protection officer at tipptour@tipptour.com.

We have a contractual obligation with Tipptour.com to observe the provisions of this privacy policy, process your data for the aforementioned purposes only, and comply with all applicable data protection and data security laws and regulations.

a) Transportation provider

When you make a booking through the Service Sites or App, we will transmit your personal data, including loyalty program membership information, to the relevant transportation provider, such as an airline. This is necessary for the transportation provider to process your booking and issue personalized tickets. The transportation provider will process your personal data under its own responsibility and in accordance with its own privacy policies. It is recommended that you carefully review the privacy policy of each transportation service provider prior to making a booking.

For bookings in certain countries, our partner Amadeus IT Group SA and its affiliates handle the booking process. In such cases, we may transfer your booking data to Amadeus, which processes the data under its own responsibility and in accordance with its own data protection policy. We urge you to carefully review Amadeus' data protection policy before making any such booking. Your explicit consent is required for each booking process in accordance with Art. 6(1)(a) GDPR.

In the event that we participate in a corporate transaction, divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy, we will inform the buyer that it may only use your personal information for the purposes disclosed in this privacy policy. We may also share aggregate or anonymous information with third parties, including advertisers and investors, from time to time. For example, we may provide information on the number of visitors that the Service Sites receive on a monthly basis to our investors or share information on popular travel destinations with advertisers.

b) Payment providers

When you make a booking directly on the Service Sites or through the App, your payment details including credit card information will be processed by a trusted internet payment processor. The payment processor will transmit your data directly to the relevant credit card company. To ensure that the credit card is being used by its legitimate owner and to prevent online fraud, your encrypted credit card information may be transferred to an external payment security service for auditing purposes. This transfer may also include additional personal data.

We use trusted and reliable internet payment processors to process your credit card data. Your credit card details are encrypted using the SSL protocol or equivalent method before transmission to the payment processor. We will not have access to your credit card data, as it will not be disclosed to us by the payment processors.

3. Other service providers

We may engage third-party service providers, including but not limited to technical and business services, tax advisors, and legal counsel. Such service providers may include hosting providers, content delivery networks, analytics providers, service desk and support data handlers, CRM systems providers, mailing and newsletter senders, spam and fraud prevention providers, and IT service and development providers. We only disclose personal data to these service providers for the purpose of carrying out their services on our behalf. They are required to comply with contractual obligations to not use personal data for any other purposes.

4. Recipients outside of the EU

The data processing activities described in Sections I2a, I6-9, II2,3, and III2,3 may involve the transfer of personal data to recipients located outside of the European Union (EU). Such data transfers shall be conducted in accordance with the EC model contracts (http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index\_en.htm).

Personal data may also be transferred to third-party transportation providers located in non-EU countries, where the travel is scheduled to take place. Allotsys is unable to provide further information regarding the level of data protection offered in non-EU countries. Such data transfers do not require an adequacy decision under Art. 45 para. 3 GDPR or appropriate safeguards under Art. 46 GDPR since they are necessary for:

• the performance of a contract between you and Allotsys or the implementation of pre-contractual measures taken at your request (Art. 49(1)(b) GDPR); or

• the conclusion or performance of a contract in your interest between Allotsys and another natural or legal person (Art. 49(1)(c) GDPR).

We shall only process personal data in a manner consistent with the purposes outlined in this Privacy Policy (or any subsequent authorizations granted by you). We process your personal data for the following purposes and on the following legal basis:

a) Pursuant to Art. 6(1)(b) GDPR, to enter into, perform, modify, or terminate a contractual relationship with you, specifically for the following:

• To allow access and usage of the Service Sites and the App,

• To facilitate your search queries and bookings,

• To fulfill our contractual obligations,

• To personalize your ticket or booking and contact you concerning the booking process or your user account, for instance, to send you travel documents,

• To facilitate your login to your account on the Service Sites or the App (user account functionality), recognize you as a user and save you from re-entering your data when you revisit the Service Sites or the App.

b) Pursuant to Art. 6(1)(f) GDPR based on our legitimate interests, specifically for the following:

• To improve the Service Sites, Apps, and our other services and customize them to the needs of our users,

• To perform internal quality checks,

• To prevent, detect, process and investigate malfunctions, incidents, fraudulent or other illegal activities, or mitigate the risk of occurrence of the aforementioned events,

• To ensure network and information security,

• To create statistics on access channels, the use of the Service Sites and App, and the frequency of transition to our partner's websites and services,

• For internal accounting and invoicing purposes with respective transportation providers, accommodation or other partners and service providers,

• To personalize the Service Sites, the App, and our offers,

• To display advertisements and special offers that may match your interests (or reduce your exposure to advertising and special offers which you may find uninteresting),

• For marketing purposes and to optimize our marketing measures,

• To enable your interaction with social networks and other users to enhance our offers and make them more interesting for our users, to contact you, if requested by you or as necessary to fulfill the contract, or as otherwise allowed by law,

• For the purpose of business process outsourcing to affiliated companies,

• Enforcing obligations owed to us, and contractual terms and conditions,

• Accounting, risk management, and record-keeping.

When using personal data to serve the legitimate interests mentioned above, we will always balance your rights and interests in protecting your personal data against the rights and interests of our company, our affiliates, and trusted third-parties.

c) Pursuant to Art. 6(1)(a) GDPR based on your consent, specifically for the following:

• To send you newsletter emails or other marketing push messages (see above),

• To transfer data for certain bookings to our partner Amadeus and to transfer Facebook Data (see above).

d) Pursuant to Art. 6(1)(c) GDPR to comply with legal obligations, for instance, to observe retention periods required by trade or tax law or to comply with obligations to disclose data based on a legally binding court decision or official order.

V. Rights of the data subject, right to complaints, right to object; Changes to this policy

In accordance with applicable law, you have various rights with respect to the processing of your personal data. These rights include the right to request access to (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), or restriction of processing (Art. 18 GDPR) of your personal data, the right to object to processing (Art. 21 GDPR), and the right to data portability (Art. 20 GDPR).

If we process your personal data pursuant to Art. 6(1)(f) GDPR for direct marketing purposes, you may object to such processing at any time without providing a reason. Additionally, you have the right to object to all processing described in this privacy policy that is based on Art. 6(1)(f) GDPR, provided that the grounds relate to your particular situation (Art. 21(1) GDPR).

You have the right to lodge a complaint with the National Authority for Data Protection and Freedom of Information, which is the competent supervisory authority for Allotsys. If you have any inquiries, complaints, or questions about this policy or your personal information, you should contact our Data Protection Officer at tipptour@tipptour.com.

If you have previously opted out of tracking for advertising purposes, you can change your preferences by clicking on the appropriate option below.

We reserve the right to make changes or updates to this privacy policy as necessary to respond to changing legal, technical, or business developments. When we update this policy, we will take appropriate measures to inform you of the changes, in accordance with applicable law. You can view the "last updated" date displayed at the top of this privacy policy to see when it was last revised.