OYSTEO LIMITED DATA PROTECTION AND PRIVACY POLICY

DEFINITIONS

• OYSTEO: OYSTEO means Oysteo Limited, a company registered in England and Wales under company number 12523542, with its registered office at 86-90 Paul Street, London, England, EC2A 4NE.

• Personal Data: Information relating to an identified or identifiable living person.

• Data Controller: The person or organisation that decides why and how Personal Data is processed.

• Data Processor: A person or organisation that processes Personal Data on behalf of a Data Controller.

• Data Subject: Any identified or identifiable living person whose Personal Data is processed.

• Partner: A hotel, brand, retailer, travel advisor, destination management company or other independent provider available through or introduced by OYSTEO.

1. INTRODUCTION

This Global Data Protection and Privacy Policy (“Policy”) explains how OYSTEO collects, uses, shares, stores and protects Personal Data when you use oysteo.com, its sub-sites, OYSTEO accounts, search and recommendation services, communications, Partner introductions, booking and purchase referrals, O Rewards and any other service that links to this Policy (together, the “Services”).

Oysteo Limited is the Data Controller of Personal Data used for OYSTEO’s own purposes.

A Partner will normally be a separate Data Controller of the information it receives to handle a booking, purchase, enquiry or service. The Partner’s own privacy notice will apply to its processing.

This Policy applies globally. Local privacy rights may also apply according to where you live. We may provide a separate privacy notice or consent form where a particular activity requires more detail.

We may update this Policy to reflect changes in law, the Services or our practices. Changes will be published on this page. Earlier versions are available on request.

2. PRINCIPLES FOR PROCESSING PERSONAL DATA

Our principles for processing Personal Data are:

• Fairness and lawfulness. We process Personal Data lawfully, fairly and transparently.

• Purpose limitation. We collect and process Personal Data only for clear and legitimate purposes.

• Data minimisation. We use only the Personal Data reasonably required for those purposes.

• Accuracy. We take reasonable steps to keep Personal Data accurate and current.

• Security. We use reasonable measures designed to protect Personal Data.

• Retention. We retain Personal Data only for as long as reasonably necessary.

• Transparency. We explain how Personal Data is collected, processed and used.

3. WHAT PERSONAL DATA WE COLLECT AND PROCESS

Depending on how you use the Services, we may collect:

• Identity, contact and account information, such as your name, email address, telephone number, postal address, username and account settings.

• Search, enquiry and communications information, including travel interests, destination and accommodation preferences, dining, shopping and style preferences, accessibility needs, dietary requirements, feedback and communications history.

• Booking, purchase and referral information, such as the Partner involved, enquiry or referral details, booking or transaction status, stay or purchase dates, stated benefits and information needed to resolve a query.

• O Rewards information, such as eligible purchase value, points, adjustments, redemption records and payment details required to make a redemption payment.

• Technical and usage information, such as IP address, device and browser information, pages or features used, referral source, approximate location derived from an IP address, identifiers, security logs and cookie or similar-technology data.

• Marketing and preference information, including your communication choices and how you respond to OYSTEO messages.

• Professional or business information where you deal with OYSTEO for a company or Partner.

• Inferences and preference indicators created from your interactions with OYSTEO and used to make recommendations and content more relevant.

Please do not provide sensitive information unless it is necessary for a request.

If you provide information about health, accessibility, dietary needs or another person, you confirm that you are entitled to provide it. We process special category data only where applicable law permits and where an additional legal condition, such as explicit consent, applies.

4. HOW WE COLLECT PERSONAL DATA

We may collect Personal Data:

• directly from you when you create an account, search, send a message, make an enquiry, join O Rewards, redeem points or otherwise use the Services;

• automatically through the Services, cookies and similar technologies;

• from Partners where needed to confirm a referral, booking, purchase, benefit, reward or service issue;

• from service providers that support communications, security, analytics, payments, rewards and service delivery; and

• from public or other lawful sources where relevant to a business relationship or request.

5. HOW WE USE PERSONAL DATA

OYSTEO may use Personal Data:

• to provide, operate and secure the Services;

• to respond to searches, enquiries, messages and support requests;

• to provide relevant recommendations, content and Partner introductions;

• to refer booking and purchase requests to Partners and support available Partner benefits;

• to administer O Rewards, confirm eligible transactions, prevent misuse and make redemption payments;

• to maintain accounts, preferences and records of our interactions;

• to analyse and improve the Services, content, performance and user experience;

• to send service and marketing communications where permitted by law;

• to detect fraud, misuse, security incidents and unlawful activity;

• to establish, exercise or defend legal rights and comply with legal obligations; and

• to manage OYSTEO’s business, contracts, audits and corporate transactions.

6. COMMUNICATIONS, PERSONALISATION AND AUTOMATED TOOLS

OYSTEO may collect and process information shared through email, WhatsApp, SMS, telephone calls, video meetings, social media messaging platforms, contact forms, live chat and other communication channels used in connection with the Services.

The information collected through these channels may include identity and contact information, travel interests, destination and accommodation preferences, dining, shopping and style preferences, accessibility needs, dietary requirements, booking or purchase information, feedback and communications history.

We use this information to:

• provide and manage the Services;

• respond to enquiries and requests;

• provide relevant recommendations, content and experiences;

• introduce users to Partners;

• maintain records of customer interactions;

• improve the Services and user experience;

• identify trends and service opportunities;

• prevent fraud, misuse and unauthorised activity; and

• comply with legal and regulatory obligations.

OYSTEO may use automated tools to help interpret a request, organise information, identify stated preferences and produce or rank recommendations.

These tools may consider information you provide, previous interactions, availability and relevant commercial relationships. They support the Services but do not make decisions about you that produce legal or similarly significant effects solely by automated means.

We provide meaningful information about the Personal Data used, the purpose and the likely effect where required by law. You may contact us if you have a question about a recommendation or the use of your Personal Data.

We do not use hotel or Partner operational information to create advertising profiles about individual guests.

Where possible, we use aggregated, anonymised or de-identified information for analysis, service improvement, product development, trend analysis and business planning. This information will not be used to identify individual users.

7. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies for security, account functions, preferences, analytics, referral attribution and, where permitted, advertising.

We may use:

• Strictly necessary cookies. These are required for the operation, security and essential functions of the Services.

• Analytical or performance cookies. These help us understand how people use the Services and improve their performance.

• Functionality cookies. These remember choices and preferences to support a more relevant experience.

• Targeting or advertising cookies. Where permitted, these help measure campaigns and make advertising more relevant.

Strictly necessary technologies may operate without consent where the law allows. We ask for consent before using non-essential technologies where required.

You can manage available choices through our cookie controls and browser settings. Withdrawing consent does not affect processing carried out before withdrawal.

Blocking some technologies may affect account functions, referral attribution, Partner benefits or O Rewards tracking.

Our Cookie Notice gives further details, including the technologies used, their purposes and duration.

8. OUR LAWFUL BASES

OYSTEO’s lawful basis for collecting and using Personal Data depends on the information and purpose.

We may rely on:

• Contract, where processing is needed to provide a service you request or take steps at your request before entering into a contract.

• Legitimate interests, where processing is reasonably necessary to operate, secure, improve and promote OYSTEO, provide relevant recommendations, manage Partner relationships, prevent fraud or protect legal rights, and those interests are not overridden by your rights.

• Consent, where we ask for it, including for certain marketing, non-essential cookies or special category data. You may withdraw consent at any time.

• Legal obligation, where processing is required by law.

Where information is needed to provide a requested service, complete a redemption or meet a legal requirement, we will explain this where it is not apparent.

If you do not provide the required information, we may be unable to provide the relevant service.

9. WHEN WE SHARE PERSONAL DATA

We may share Personal Data with:

• Partners where you ask for an introduction, booking, purchase, benefit or related support;

• Service providers acting on our instructions for hosting, communications, support, security, analytics, payments, rewards, professional services and business operations;

• Payment and banking providers where needed to make an O Rewards payment or manage a transaction;

• Professional advisers, auditors, insurers and authorities where reasonably necessary;

• A buyer, investor or successor in connection with a proposed or completed corporate transaction; and

• Other persons where you direct us to share information, consent to sharing, or the law requires or permits it.

We require Data Processors to protect Personal Data and use it only for the agreed service.

Partners generally process the information they receive as independent Data Controllers under their own privacy notices.

10. INTERNATIONAL TRANSFERS

OYSTEO serves users and works with Partners and service providers globally. Personal Data may therefore be accessed or stored outside the United Kingdom or the country where you live.

Where UK transfer rules apply, we use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another permitted safeguard or exception.

You may contact us for further information about the safeguards relevant to your Personal Data.

11. RETENTION OF PERSONAL DATA

We retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected, including to provide the Services, maintain security, administer O Rewards, meet legal, tax and accounting duties, resolve disputes and enforce agreements.

The retention period depends on:

• the type of record;

• the purpose for which it was collected;

• the length of our relationship with you;

• whether an account or transaction remains active;

• applicable limitation periods;

• legal, tax and accounting requirements; and

• the need to prevent fraud or maintain evidence.

Marketing information is retained until you opt out or it is no longer needed.

Cookie durations are described in the Cookie Notice.

We may retain aggregated, anonymised or de-identified information where it no longer identifies you.

12. SECURITY

We use reasonable technical and organisational measures designed to protect Personal Data against unauthorised access, loss, misuse, alteration or disclosure.

No online service or transmission is completely secure. You are responsible for protecting your account credentials and should tell us promptly if you suspect unauthorised access.

13. DATA PROTECTION RIGHTS

Depending on applicable law and the circumstances, you may have the right:

• to access your Personal Data and receive a copy of certain Personal Data we hold about you;

• to correct your Personal Data where it is inaccurate or incomplete;

• to request deletion of your Personal Data where the applicable legal conditions are met;

• to restrict the processing of your Personal Data in certain circumstances;

• to object to processing based on legitimate interests, including profiling based on those interests;

• to object to direct marketing at any time;

• to receive certain Personal Data in a portable form;

• to withdraw consent at any time where processing is based on consent; and

• to complain to a data protection authority.

THE RIGHT TO OBJECT TO DIRECT MARKETING IS ABSOLUTE. YOU MAY OPT OUT AT ANY TIME USING THE METHOD IN THE MESSAGE OR BY CONTACTING US.

These rights are subject to legal conditions and exceptions. We may need to verify your identity and may ask for information needed to handle your request.

You will not normally have to pay a fee, but the law may allow a reasonable fee or refusal where a request is manifestly unfounded or excessive.

If you are in the United Kingdom, you may complain to the Information Commissioner’s Office:

• Website: https://ico.org.uk/

• Telephone: +44 (0)303 123 1113

If you live elsewhere, you may also have the right to complain to your local data protection authority.

14. CHILDREN

The Services are not directed specifically at children. If you are under 18, you should use the Services with the permission and appropriate supervision of a parent or legal guardian. A parent or guardian should complete any transaction that the child is not legally able to enter into. If you believe a child has provided Personal Data without appropriate permission, contact us.

15. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in law, the Services or our practices.

We will publish the updated version and date. We will give reasonable notice of material changes where practicable or where required by law.

Earlier versions are available on request.

16. HOW TO CONTACT US

You can send any request concerning OYSTEO’s use of Personal Data by emailing [email protected] or writing to:

Privacy Lead

Oysteo Limited

86-90 Paul Street

London

England

EC2A 4NE

01 September, 2026