TICKETS & ROUTES GDPR PRIVACY NOTICE

Tickets & Routes GDPR Privacy Notice at a glimpse

• Who we are
• How we process your personal data
• How we protect your personal data
• How we transfer your personal data between countries
• Your privacy rights
• With whom we share your personal data
• How long we keep your personal data
• Amendments to this Privacy Notice

• Who we are?

Tickets & Routes OÜ (“Tickets & Routes”), as the data controller of personal data collected and processed within the European Union (“EU”), provides this GDPR Privacy Notice (the “Privacy Notice”) to inform you about its processing activities in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”). Postal address: Veskiposti 2-1002 Tallinn 10138 Harju maakond Estonia Tickets & Routes places great emphasis on the legality of personal data processing, ensuring that all processing activities align with the principles below:

1. 1. • lawfulness, fairness, and transparency,
      • purpose limitation,
      • data minimization,
      • accuracy,
      • storage limitation,
      • integrity and confidentiality,
      • control of personal data by data subjects, and
      • accountability.

• What personal data is being processed by Ticket & Routes?

When you use Tickets & Routes or interact with us via our website, mobile application (the “Platform”) or other channels, we collect data either directly from you or through your interactions.

1. 1. • Data provided by you

        Identity information	:	Your full name, your identity and passport details where necessary.
        Contact details	:	Your phone number, postal adress, and e-mail adress.
        Potential customer transaction information	:	Information about the tours or activities you wish to book such as, the type, date, and location of the

        		experience, your country of residence, preferred dates or times, and, if applicable, your pick-up address.
        Purchase information	:	Details about the tours or activities you have booked, such as the type, date, and location of the experience, your country of residence, preferred dates or times, and, if applicable, your pick-up address, along with information regarding any modifications, cancellations, or feedback you provided about those bookings.
        Payment information	:	Type of payment method used, payment details such as credit card or bank account numbers, and payment verification information. Please keep in mind that we do not process or store your all credit card details in our systems. Instead, we rely on authorized intermediary payment service providers to securely handle payments in compliance with legal regulations.
        Account information	:	Your full name, username, password, email, phone number, membership history.
        Direct interest information	:	Details about your interactions and the tours or activities saved in your wishlist.
        Communication preference	:	Your consent to receive marketing communications, newsletters, or promotional materials, as well as your preferences for communication channels (e.g., email, SMS, or push notifications).
        Reviews or other user provided content	:	Any pictures or video content you share with us, as well as your public social media information if you choose to communicate with us through social media platforms.
        Supplier information	:	Identity and contact details of authorized persons, commercial trade name, invoice details, payment details, complaint and request data (if any), additional data you may provide us.

      • Data obtained directly from you or from your device

        Device Data	:	Details such as your operating system, IP address, location data, advertising and device IDs, device type, and browser details.
        Cookie data	:	When you browse our website or apps and you consent to their use, we place cookies or similar technologies on your device to understand your use of our website. For more information on the use, you can look at our consent banner.

      • Data obtained from others about you

        In certain exceptional cases, we may obtain information about you from sources other than directly from you. For suppliers, this may include details about owners, majority shareholders, and top-level management or executives, as well as data about consumers gathered from our suppliers or trusted publicly available sources. These sources may also include regulatory bodies or law enforcement authorities. The types of data obtained from these sources vary depending on the origin and may include contact details and other relevant information.

• How we process your personal data

To find out more about the specifics of the processing, please select the processing activities listed below that you believe you are involved in, or feel free to explore them for your own curiosity.

1. 1. • Receiving an offer

        In order to request an offer for any services provided on the Platform, you do not need to be a member. You can simply fill out the “Get Offer” form available on the Platform to receive an offer. When you fill the “Get Offer” form on the Platform, we process your identity information, contact details, potential customer transaction information, for the following purposes:
        • to evaluate your request in order to prepare and deliver tailored offers for the services you are interested in;
        • to contact you regarding your inquiry or to provide the offer, information, clarifications, or updates related to the offer;
        • to maintain the functionality of the “Get Offer” feature and optimize the user experience on the Platform; and
        • to fulfill any legal or regulatory requirements associated with preparing and delivering offers, such as record-keeping for transparency or audits.Please keep in mind that Tickets & Routes will contact you regarding your offer request only once. Any further communication will be conducted based on your communication preferences.

          Reason: Tickets & Routes processes your data for the aforementioned purposes because they are necessary in order to execute a service contract with you and to take pre-contractual steps at your request. If you do not provide the data that is required for the above purposes, we are unable to deliver you an offer.

      • Creating a membership

        If you would like to take additional advantage for our services, such as managing your purchased and wishlist tours through a dashboard, you can create a membership account on the Platform. Please keep in mind that creating a membership is not mandatory to deliver the service you requested; therefore, it is possible for you to shop and purchase services on the Platform without having a membership. When you create a membership account on the Platform, we process your identity information, contact details, and account information, for the following purposes:
        • to create, access, and manage your membership account on the Platform;
        • to enable you to manage your purchased and desired tours on the Platform;
        • to offer additional benefits, such as coupon promotions;
        • to enhance your experience on the Platform by personalizing your interaction and allowing seamless management of your preferences and activities; and
        • to simplify the booking process by saving your preferences and historical interactions for quicker and more convenient future transactions.
        You can delete your account at any time. To do so, you should navigate to the “Delete My Profile” option in your account settings on the Platform and follow the instruction, or contact our customer support team at in**@ti**************.com to request account deletion. We will then destruct your account and any data associated to, unless we are required by law to keep certain data.

        Reason: Tickets & Routes processes your data for the aforementioned purposes because they are necessary in order to fulfill the membership contract that we have with you. If you do not provide the data that is required for the above purposes, we are unable to deliver you additional advantage for our services.

      • Subscribing to the communication lists

        If you would like to receive messages, calls, and emails from Tickets & Routes stay up to date about Tickets & Routes’ products, services and promotions. This means that if you give us your consent, we will provide you with promotional communication– or if you are a business customer, we will engage with you about commercial opportunities – that are relevant and interesting to you. When you consent to receive promotional communication via our dedicated forms published on the Platform, we process your identity information, contact details, direct interest information, and communication preference, for the following purposes:
        • to keep you informed about Tickets & Routes’ latest products, services, and promotions that may be of interest to you;
        • to connect with business customers regarding relevant commercial opportunities and partnerships;
        • to maintain and strengthen our relationship with you by providing personalized and engaging communication tailored to your preferences;
        • to ensure you are aware of new and existing services, special offers, and exclusive promotions that enhance your experience with Tickets & Routes; and
        • to send messages, calls, and emails based on your preference, ensuring all communication aligns with your chosen preferences and applicable legal requirements.
        Please keep in mind that you can change your communication preferences at any time in the “Preferences” section of your account or simply unsubscribe.

        Reason: Tickets & Routes processes your data for the aforementioned purposes when you have provided your prior consent. Of course, you can withdraw your consent to receive our tailored promotional communications at any time. You can do so by clicking the unsubscribe button at the bottom of the promotional email that you have received from Tickets & Routes, in the “Preferences” section of your account.

        If you are a business customer, Tickets & Routes processes your data for the aforementioned purposes as it is necessary to pursue our legitimate interests, specifically our need to protect fundamental rights such as the freedom to conduct business.

      • Purchasing services on the Platform

        You can purchase services offered on the Platform. As a consumer, you can either log in to your account or proceed as a guest. When you purchase services on the Platform, we process your identity information, contact details, account information (if you are logged in), purchase information, payment information, for the following purposes:
        • to process your purchase, confirm your booking, and ensure successful payment and service delivery;
        • to provide you with confirmation, invoices, and updates related to your purchase or booking;
        • to process payments securely and verify transactions through authorized payment service providers;
        • to share necessary details with the supplier of the services you have purchased, enabling them to fulfill your booking and provide the requested services;
        • to safeguard your account and transactions by detecting and preventing fraudulent or unauthorized activity;
        • to associate your purchase with your account, enabling you to access purchase history and manage bookings through the Platform, (if you are logged in); and
        • to fulfill legal requirements, such as tax documentation, record-keeping, and responding to regulatory authorities when necessary.
        Please keep in mind that if you complete your purchase while logged in, the purchase process will be facilitated using your membership information; however, you can make any changes to the information as needed during the checkout process.If you complete your purchase while not logged in, your purchase history will not be processed to offer additional services to you. It will only be processed to deliver the purchased services, fulfill legal requirements, and achieve the aforementioned purposes.

        Reason: Tickets & Routes processes your data for the aforementioned purposes because: (i) it is necessary to fulfill the service contract (and membership contract, if applicable) we have with you; (ii) it is required to pursue our legitimate interests, particularly the necessity to conduct business responsibly and in compliance with local laws and regulations, as well as to protect fundamental rights such as the right to defense, the right to property, and the freedom to conduct a business. This is applicable, for instance, when we perform fraud checks; and (iii) it is essential to comply with legal obligations to which we are subject, such as processing your purchase details for tax purposes.

      • Submitting a complaint/request/suggestion

        If you require assistance or support from Tickets & Routes, or if you would like to submit a complaint or suggestion, you can contact our support team through the Platform (via email or web form), phone, or social media. Our team will do their best to address your questions and provide the necessary support. When you submit a complaint, request, or suggestion to Tickets & Routes, we process your identity information, contact details, account information (if you are logged in), purchase information (if it is relevant to your inquiry), and payment information (if it is relevant to your inquiry), for the following purposes:
        • to address your complaint, request, or suggestion promptly and effectively;
        • to offer appropriate assistance and resolve any issues related to your inquiry, such as booking or payment concerns;
        • to ensure the authenticity of your inquiry and verify related transactions or bookings;
        • to analyze feedback and inquiries to enhance our services and user experience;
        • to maintain a record of communications for quality control, auditing, or follow-up purposes
        • to fulfill legal or regulatory requirements, such as documenting and handling complaints or disputes.

        Reason: Tickets & Routes processes your data for the aforementioned purposes because: (i)

        it is necessary to take pre-contractual steps at your request or fulfill the service contract (and membership contract, if applicable) we already have with you; (ii) it is required to pursue our legitimate interests, particularly the necessity to conduct business responsibly and in compliance with local laws and regulations, as well as to protect fundamental rights such as the right to defense, the right to property, and the freedom to conduct a business; and (iii) it is essential to comply with legal obligations to which we are subject to.

      • Making a privacy request

        If you wish to exercise your privacy rights, inquire about our privacy practices, submit a privacy complaint, or you can contact our customer support team at in**@ti**************.comor use any other applicable method provided under data privacy regulations to reach the data controller. We will make every effort to address your request. When you submit a privacy request to Tickets & Routes, we process your identity information, contact details, and any other relevant information, for the following purposes:
        • to address and resolve your privacy-related inquiry, request, or complaint effectively;
        • to confirm your identity and ensure the security of your personal data during the request process;
        • to document your privacy request and our response for compliance and accountability purposes;
        • to fulfill our obligations under applicable data protection laws and regulations; and
        • to analyze privacy requests to enhance our data protection policies and processes.

        Reason: Tickets & Routes processes your data for the aforementioned purposes because it is essential to comply with the privacy and data protection laws and regulations we are subject to.

      • Providing ratings and reviews for TICKETS & ROUTES services

        You have the option to provide ratings and reviews for the services or experiences offered by Tickets & Routes. By doing so, you contribute to fostering an open platform where customers can share genuine and insightful feedback about our services. When you provide ratings and reviews, we process your identity information, contact details, and reviews or other user provided content, for the following purposes:
        • to display your ratings and reviews on our platform, helping other customers make informed decisions;
        • to evaluate your feedback and use it to enhance our services and customer experience;
        • to verify that reviews are genuine and come from actual users of our services; and
        • to follow up on your feedback if needed, such as clarifying details or addressing concerns raised in your review.Please keep in mind that you are not required to provide ratings and reviews using your full name; you have the option to do so anonymously. If you proceed anonymously, your identity details will not be displayed, and your consent will not be required for processing thereafter; however, we remain bound by other legal grounds for processing as applicable.

          Reason: Tickets & Routes processes your data for the aforementioned purposes because: (i) it is based on your consent, where required; and (ii) where consent is not applicable, (a) it is necessary to fulfill our obligations under the Terms and Conditions, or (b) it is required to pursue our legitimate interests, including conducting business responsibly, complying with local laws and regulations, and protecting fundamental rights such as the right to defense, the right to property, and the freedom to conduct a business.

      • Participating in surveys (e.g., customer satisfaction)

        If you have a relationship with us (e.g., as a business customer) or if you purchase services or book tours through Tickets & Routes, we may invite you to participate in our customer survey within a reasonable time frame after using our services. When you decide to participate and fill-in the survey, we process your identity information, contact details, account information (if you are logged in), and purchase information, for the following purposes:
        • to collect your opinions and feedback regarding our services and overall customer experience;
        • to analyze survey responses and use the insights to enhance our customer satisfaction;
        • to confirm that the responses are genuine and associated with actual interactions with our services; and
        • to maintain records of survey participation for internal evaluation.

          Reason: Tickets & Routes processes your data for the aforementioned purposes because: (i) it is necessary to take pre-contractual steps at your request or fulfill the service contract (and membership contract, if applicable) we have with you and (ii) it is required to pursue our legitimate interests, particularly the necessity to conduct business responsibly and in compliance with local laws and regulations, as well as to protect fundamental rights such as the right to defense, the right to property, and the freedom to conduct a business.

      • Becoming a supplier on Tickets & Routes

        If you have a commercial relationship with Tickets & Routes—whether as a (prospective) supplier, business customer, or partner—we are committed to ensuring that our relationship is built on transparency, clear accountability, and mutual trust. When you decide to commence commercial relationship with Tickets & Routes, we process your supplier information, for the following purposes:
        • to facilitate effective communication and coordination regarding orders, deliveries, and other business-related activities;
        • to process payments, invoices, and related financial operations;
        • to comply with applicable legal and regulatory requirements, such as tax and audit obligations;
        • to maintain accurate and organized records of our commercial relationship for accountability and future reference; and
        • to detect and prevent fraudulent or unauthorized transactions and ensure the security of our business operations.

          Reason: Tickets & Routes processes your data for the aforementioned purposes because: (i) it is necessary to take pre-contractual steps at your request or fulfill the contract we already have with you; (ii) it is required to pursue our legitimate interests, particularly the necessity to conduct business responsibly and in compliance with local laws and regulations, as well as to protect fundamental rights such as the right to defense, the right to property, and the freedom to conduct a business. This is applicable, for instance, when we perform fraud checks; and (iii) it is essential to comply with legal obligations to which we are subject, such as processing your payment details for tax purposes.

      • Complying with applicable legislation and fulfilling legal purposes

        As a company established in the European Union, we are subject to various regulatory obligations, including but not limited to those related to consumer protection, competition law, and data protection; therefore, we may process all your personal data outlined in Section 2, for the following purposes:
        • to fulfill our responsibilities under applicable laws and regulations;
        • to provide required information to regulatory authorities as mandated by law;
        • to ensure compliance with applicable leigslation and address any related inquiries or disputes.

          Reason: Tickets & Routes processes your data for the aforementioned purposes because: (i) it is required to pursue our legitimate interests, particularly the necessity to conduct business responsibly and in compliance with local laws and regulations, as well as to protect fundamental rights such as the right to defense, the right to property, and the freedom to

          conduct a business. This is applicable, for instance, when we perform fraud checks; and (iii) it is essential to comply with legal obligations to which we are subject to.

• How we protect your personal data

We prioritize the security of your personal data and implement robust technical and organizational measures to safeguard it, taking into account the nature of the personal data and the processing as well as the potential threats posed. These measures include:

1. 1. • Encryption for sensitive data.
      • Regular audits and updates to security protocols.
      • Limited access to your data by authorized personnel only.
      • Secure storage systems with firewalls and intrusion detection systems.

• How we transfer your personal data between countries

Due to the services provided by global suppliers on the Platform and the nature of our business operations, your personal data may be transferred to or accessed by suppliers or trusted third parties worldwide. Rest assured, we ensure full compliance with applicable laws governing the transfer of personal data between countries. When we transfer personal data from the European Economic Area, the United Kingdom, and Switzerland to suppliers or trusted third parties:

1. 1. • If the processing occurs in countries recognized by the European Commission as providing an adequate level of data protection, such transfers are governed by adequacy decisions adopted by the European Commission;
      • If the processing occurs in countries not recognized by the European Commission as providing an adequate level of data protection, such transfers are governed by the Standard Contractual Clauses to ensure appropriate safeguards.

• Your privacy rights

Under the GDPR, you have specific rights regarding your personal data. Here, we aim to inform you about these privacy rights and how you can exercise them.

1. 1. • Right to access

        You have the right to request access to the personal data we process about you. This includes obtaining copies or specific information regarding your personal data.

      • Right to rectification

        If you believe the personal data we hold about you is inaccurate or incomplete, you can request that we rectify or update it. Please provide details of the inaccuracies and how you would like the information corrected.

      • Right to erasure (right to be forgotten)

        You can request that we delete the personal data we process about you. However, in certain situations—such as when we are legally required to retain your data—we may not be able to comply fully with your request.

      • Right to restriction of processing

        The right to restrict processing allows you to limit how your personal data is used in certain circumstances. When you exercise this right, we may store your data but will not use or process it further without your consent, unless it is required for legal reasons or to protect the rights of others.

      • Right to data portability

        You have the right to request the transfer of the personal data you provided to us to another organization or to receive it in a structured, commonly used, and machine-readable format. This right applies only in specific cases, such as when the processing is based on your consent or a contract and conducted using automated means.

      • Right to restrict processing

        In certain circumstances, you can request that we restrict the processing of your personal data. This means we will limit how your data is used, for example, while verifying the accuracy of the data or handling an objection you have raised.

      • Right to object

        You can object to the processing of your personal data in specific situations, including processing for direct marketing purposes or based on our legitimate interests.

      • Exercising your privacy rights

        At Tickets & Routes, we strive to provide you with control over your personal data. Depending on the activity, you can manage your data and exercise your rights directly, for example:
        • By logging into your Tickets & Routes account to update, modify, or delete your personal data.
        • By unsubscribing from promotional communications through the unsubscribe link included at the bottom of our emails.
        • For other privacy-related requests, complaints, please contact our customer support team at in**@ti**************.com or use any other applicable method provided under data privacy regulations to reach the data controller.Please keep in mind that there may be situations where we are legally permitted to deny or restrict your privacy rights. For example, this may occur when processing your data is necessary to establish, exercise, or defend legal claims or when your request is manifestly unfounded or excessive, particularly due to its repetitive nature.

      • How we handle your requests

        We will make every effort to address your request promptly and free of charge. In some cases, we may ask you to verify your identity to ensure the security of your data. If you are dissatisfied with how we handle your request, you have the right to file a complaint with the supervisory authority responsible for your country or region. We value your privacy and are committed to helping you exercise your rights effectively.

• With whom we share your personal data

Unless otherwise stated in this Privacy Notice, the following are the categories of third parties with whom we may share your personal data for the purposes outlined in each processing activity, depending on the reason for processing your personal data and applicable laws:

1. 1. • Service Providers – Entities that assist us in providing our services, such as payment processors, IT service providers, customer support services, accountants, and legal professionals.

      • Suppliers and Partners – Trusted partners involved in delivering the services or products you have purchased through the Platform, such as tour operators or activity providers.

      • Regulatory and Legal Authorities – Authorities to whom we are legally required to disclose data, such as tax authorities, regulators, or law enforcement agencies.

• How long we keep your personal data

Tickets & Routes retains personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Notice or to comply with legal and regulatory obligations. Unless stated otherwise in this Privacy Notice, the criteria we use to determine retention periods include:

1. 1. • whether your personal data is required to safeguard our legitimate interests, fulfill a contract involving you, respond to your inquiries, or provide the requested service or support;
      • whether we are subject to a legal obligation requiring retention; or
      • whether retention is advisable considering our legal position, such as with respect to applicable statutes of limitations, ongoing or potential litigation, or regulatory investigations.Below are the retention periods for specific categories:

      • Customers without a membership: Personal data related to customers who are not registered as members will be retained for 10 years from the date of their last interaction.

      • Suppliers: personal data related to suppliers will be retained for 10 years following the termination of the legal relationship.

      • Active member accounts: Personal data for active member accounts will be retained for 10 years following the termination of the legal relationship.

      • Inactive member accounts: If you create a member account but do not use it for 1 year, your account will be marked as inactive and personal data associated with inactive member accounts will be retained for 3 years from the date the account becomes inactive.

For details on the retention periods applicable to personal data processed through cookies, please refer to our Cookie Policy.

• Amendments to this Privacy Notice

We reserve the right to modify this Privacy Notice at any time and will provide a revised version if significant changes are made. Additionally, we may inform you through the Platform and other channels (if necessary) about updates or specific details regarding the processing of your personal data. Last modified: 13/12/2024