Privacy Policy — Ocean Perfect Day

The controller responsible for the processing of personal data collected through this page is:

CORPORACIÓN H10 HOTELS, S.L. (hereinafter, "H10 Hotels" or "we") NIF: B‑62116942 Address: C/ Numància, 185, 1ª – 08034 Barcelona (Spain) Phone: +34 93 430 41 47

"Ocean Perfect Day" is a brand/product of H10 Hotels.

The operational management of this landing page and of the lead-generation campaigns is entrusted, as data processor, to:

NextHub Digital AG — c/o TAX PRO Fiduciaria Sagl, Via Giovan Battista Pioda 8, 6900 Lugano (Switzerland) — CHE‑332.633.398 Privacy contact: privacy@nexthubdigital.com Data Protection Officer (DPO): Dr. Gabriel Mercas — gabriel@pgstudiolegale.it You may contact the DPO regarding any matter relating to your personal data.

NextHub Digital AG processes the data solely in accordance with the controller's instructions and for the purposes set out in this Policy.

This Policy applies to personal data collected through the quotation request page https://oceanperfectday.hubvantia.com/ and is addressed to users in the following markets, with reference to their respective laws:

Mexico — Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), its Regulations and the Lineamientos del Aviso de Privacidad. Supervisory authority: INAI. United States — in particular the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), together with the privacy laws of other states (Virginia, Colorado, Connecticut, Utah, Texas and others), the Children's Online Privacy Protection Act (COPPA) and the CAN‑SPAM Act. Canada — Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti‑Spam Legislation (CASL). Supervisory authority: OPC (Office of the Privacy Commissioner of Canada). Because the controller is established in the European Union (Spain), the processing is also subject to the General Data Protection Regulation (EU) 2016/679 (GDPR) and to Spanish law (LOPDGDD). H10 Hotels' general privacy policy is available at https://www.oceanhotels.com/es/politica-privacidad.

a) Data you provide through the quotation request form:

• First and last name
• Phone number
• Email address
• City of residence
• Information about the event for which you are requesting a quote (e.g., date and type of event/wedding, number of guests, preferences and other details you choose to share with us)

b) Data collected automatically when you browse the page:

• IP address, device and browser identifiers
• Browsing and usage data, collected through cookies and tracking technologies (see section 7)

We do not intentionally collect sensitive categories of personal data. Please do not include sensitive data in the free-text fields of the form.

c) Categories of data under the CCPA/CPRA (U.S. residents): For the purposes of California law, the categories of personal data processed are as follows:

The business purposes of the processing are those set out in Section 5. The categories of third-party recipients are set out in Sections 8 and 10.

Primary purposes (necessary to provide the service you requested):

• To handle and respond to your quotation request
• To contact you (by phone, email or messaging) to provide the requested information and finalize the offer
• To comply with legal obligations and manage related liabilities

Secondary purposes (not necessary for the service, subject to your consent and revocable at any time):

• Sending commercial, promotional communications and newsletters about offers, services and events
• Carrying out statistical analysis and marketing activities, including profiling and personalized advertising on third-party platforms (see section 8)

If you do not wish your data to be processed for the secondary purposes, you may tell us at any time by writing to privacy@nexthubdigital.com; refusal will not be a condition for receiving the requested service.

Depending on the market, the processing is based on:

• your consent, given by submitting the form and accepting this Policy (and, for non-essential cookies, through the cookie banner);
• the performance of pre-contractual measures requested by you (handling of the quotation request);
• the legitimate interest of the controller and/or legal obligations, where applicable.

For direct marketing and profiling purposes, the basis is consent, which you may withdraw at any time without affecting the lawfulness of processing based on consent before its withdrawal.

This page uses cookies and similar technologies (pixels, web beacons, identifiers). Technical cookies necessary for operation are always active; analytics and marketing/advertising cookies are activated only with your prior consent through the cookie banner on the site, where you can accept, reject or customize your preferences at any time.

Durations are indicative and may vary depending on the individual provider. You can change your choices at any time through the cookie banner.

We use third-party analytics and advertising tools to measure campaign effectiveness and to display relevant ads:

• Google Analytics (statistical traffic analysis)
• Google Ads (advertising and conversion measurement)
• Meta Pixel (Facebook/Instagram — advertising and remarketing)
• TikTok Pixel (advertising and remarketing)

These tools may set cookies and receive data about your device and your browsing. Their use is subject to the consent expressed through the cookie banner. You can manage advertising preferences directly with the respective providers and through industry opt-out tools.

Notice for California residents (U.S.): sharing data with these advertising platforms for cross-context behavioral advertising may constitute a "sale" or "sharing" within the meaning of the CCPA/CPRA. See section 11.

Profiling and automated decision-making. We use profiling for marketing purposes and to show you relevant advertising. We do not make decisions based solely on automated processing that produce legal effects or significantly affect you. You may object to profiling for marketing purposes at any time (see sections 5 and 15).

Messaging channels. Where used to contact you (for example, WhatsApp or other messaging services), such channels may involve the processing of your data by the respective providers, in accordance with their own policies.

Commercial communications and newsletters are sent using the controller's own technology, without relying on third-party email marketing providers. Each message includes a free and immediate unsubscribe mechanism.

• United States (CAN‑SPAM Act): every email includes an identifiable sender, a non-deceptive subject line, a valid physical address and an unsubscribe system, which we honor promptly.
• Canada (CASL): we send commercial electronic messages only with your consent, clearly identifying the sender and always offering the option to unsubscribe.

We may disclose your personal data to:

• Processors/service providers acting on our behalf and under our instructions (e.g., NextHub Digital AG for campaign management, IT and hosting providers);
• Companies of the H10 Hotels group, where necessary for the purposes described;
• the advertising and analytics platforms indicated in section 8;
• competent authorities, where required by law or to protect rights, safety and property.

We do not disclose your data to third parties for their own independent purposes without an appropriate legal basis.

In the past 12 months we may have "shared" (and, under the CCPA/CPRA definitions, "sold") certain categories of data — such as identifiers and internet activity data — with advertising platforms for cross-context behavioral advertising purposes.

California residents have the right to opt out of such sale/sharing. To exercise this right, you may write to privacy@nexthubdigital.com.

We also honor browser-level opt-out preference signals, in particular the Global Privacy Control (GPC), which we treat as a valid request to opt out of the sale/sharing of data. We will not discriminate against users who exercise their privacy rights.

Your data may be processed and stored in countries other than your country of residence, including Spain and the European Union (controller's location), Switzerland (location of the processor NextHub Digital AG) and the United States (location of certain analytics and advertising providers).

Where data is transferred to countries that do not ensure an equivalent level of protection, we adopt appropriate safeguards provided by applicable law, in particular:

• Standard Contractual Clauses approved by the European Commission;
• adequacy decisions where available (for example, for Switzerland) or recognized transfer frameworks;
• additional technical and contractual measures suitable to protect the data.

You can request further information about the mechanisms adopted at the contacts indicated in Section 19.

We retain your personal data for as long as necessary to achieve the purposes for which it was collected and, in any event, until you withdraw your consent.

As a guideline, contact data and data relating to the quotation request (lead) are retained for a maximum of [INSERT — e.g., 24] months from the last meaningful contact, unless you withdraw consent earlier; after that period the data is deleted or anonymized. Longer retention periods imposed by legal, accounting or legal-defense obligations remain unaffected.

We adopt appropriate technical and organizational measures to protect personal data against unauthorized access, use, alteration, loss or disclosure. However, no system can guarantee absolute security.

In the event of a personal data breach that may pose a risk to your rights, we undertake to notify the competent authorities and, where required by applicable law, the affected individuals, within the timeframes and in the manner provided by the laws of each market.

15.1 Mexico (LFPDPPP) — ARCO Rights You have the right to:

• Access — to know what data of yours we process and for what purposes;
• Rectification — to correct inaccurate or incomplete data;
• Cancellation — to request its deletion when you believe it is not being processed in accordance with the law;
• Opposition — to object to processing on legitimate grounds.

You may also withdraw consent and limit the use or disclosure of your data. To exercise ARCO rights, send a request to privacy@nexthubdigital.com indicating your name, the means to receive a reply, and documentation evidencing your identity. If you are dissatisfied, you may contact INAI (www.inai.org.mx).

15.2 United States — California (CCPA/CPRA) You have the right to:

• Know/access the categories and specific personal information collected, the sources, purposes and recipients;
• Delete the personal information concerning you;
• Correct inaccurate information;
• Opt out of the sale or sharing of your data (see section 11);
• Limit the use of sensitive personal information;
• Not be discriminated against for exercising your rights.

You may exercise these rights, including through an authorized agent, by writing to privacy@nexthubdigital.com. We will respond within the timeframes provided by law (generally within 45 days, extendable). If you believe your rights have not been respected, you may lodge a complaint with the California Privacy Protection Agency (CPPA) or the California Attorney General.

15.3 United States — Other States If you reside in Virginia, Colorado, Connecticut, Utah, Texas or another state with applicable law, you may have the right to access, correct, delete and obtain portability of your data, as well as to opt out of targeted advertising, the sale of data and certain forms of profiling. To exercise them, contact privacy@nexthubdigital.com.

15.4 Canada (PIPEDA) You have the right to access your personal data and to request its correction, as well as to withdraw consent to processing (subject to legal or contractual obligations). To exercise these rights, write to privacy@nexthubdigital.com. If you believe your rights have not been respected, you may file a complaint with the Office of the Privacy Commissioner of Canada (OPC) (www.priv.gc.ca).

15.5 European Union / Spain (GDPR) Because the controller (H10 Hotels) is established in the European Union, the processing is also subject to the General Data Protection Regulation (EU) 2016/679 (GDPR). In that context you have the right to:

• Access to your personal data;
• Rectification of inaccurate or incomplete data;
• Erasure ("right to be forgotten");
• Restriction of processing;
• Portability of data;
• Objection to processing, including direct marketing and related profiling;
• Withdrawal of consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, you may write to privacy@nexthubdigital.com or to the contacts in Section 19. You also have the right to lodge a complaint with a supervisory authority, in particular the Spanish Data Protection Agency, Agencia Española de Protección de Datos (AEPD) (www.aepd.es).

For any request relating to your personal data or to exercise the rights described above, contact our DPO: Dr. Gabriel Mercas — gabriel@pgstudiolegale.it (or write to privacy@nexthubdigital.com) We will verify your identity before acting on the request and will respond within the timeframes provided by applicable law.

This page and the related services are intended for an adult audience and are not directed to minors. In accordance with COPPA (U.S.), we do not knowingly collect personal data from children under 13; more generally, we do not knowingly collect data from minors under 18. If you believe a minor has provided us with personal data, please contact us for its removal.

We may update this Policy from time to time. The current version is the one published on this page, with an indication of the effective date. In the event of material changes, we will provide appropriate notice.

Controller: CORPORACIÓN H10 HOTELS, S.L. — C/ Numància, 185, 1ª – 08034 Barcelona (Spain) Controller's DPO: Belén Arribas — dpo@h10hotels.com

Campaign management (processor): NextHub Digital AG — c/o TAX PRO Fiduciaria Sagl, Via Giovan Battista Pioda 8, 6900 Lugano (Switzerland) DPO: Dr. Gabriel Mercas — gabriel@pgstudiolegale.it Privacy: privacy@nexthubdigital.com

Effective date: April 2025.