Crete Island, Greece, September 2025

1. Purpose and scope of this Notice

Eturia respects your privacy and is committed to protecting your personal data. This notice regarding the processing of personal data (hereinafter referred to as "Notice") is intended to provide you with relevant information on how we process your personal data when:

• you access the circuiterra.net Website.

• you book travel packages.

• you provide us, in any other way, with your personal data (such as phone number, e-mail, WhatsApp, Facebook, Instagram, or other accounts on social networks).

• you subscribe to our newsletter.

• you travel with us

This Site is intended for adults only and the only situations in which we collect data relating to minors are when you book travel and children’s packages.

This Notice informs you about the processing operations of personal data (as defined by the relevant legislation, including the General Data Protection Regulation 2016/679 - hereinafter referred to as "GDPR") carried out by Eturia, in the capacity of the personal data controller.

The controller of your personal data is ETURIA S.R.L. and is responsible for your personal data (hereinafter referred to as "Eturia", "we" or "our" in this Notice).

2. The controller of your personal data and the contact details of the Data Protection Officer

The operator of your personal data is ETURIA S.R.L., having its registered office in Piatra Neamț, str. 1 Decembrie 1918, nr. 58, Neamț, having the serial number in the Trade Register J27/908/2007, unique registration code RO 22067680 (hereinafter referred to as "Eturia", "we" or "our" in this Notification).

Given the applicable legal provisions, Eturia has appointed a Data Protection Officer.

If you have any questions about this Notice or any other request regarding the processing of your personal data or the exercise of your legal rights, please contact our Data Protection Officer using the following contact details:

• (1) Email: dpo@eturia.ro

• (2) Mailing address: Piatra Neamț Municipality, str. 1 Decembrie 1918, nr. 58, Neamț, Romania.

The personal data we hold must be accurate and current. Please let us know if any of the details you provide us will change during your relationship with us.

3. External links

This Site may include links to third-party websites or applications. If you click on those links or enable these apps, third parties may allow data about you to be collected or shared. We do not control these third-party websites and are not responsible for their Personal Data Processing Policies. When you leave circuiterra.net Site, please review the Policies of each site you visit.

4. Personal data collection

According to the legislation in force, "personal data" means any information relating to an identified or identifiable person. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more elements specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

When you access the circuiterra.net Site or communicate with us or we provide travel or any other type of services for you, we may process the following categories of personal data:

• Contact and/or identification data, including name and surname, address (domicile or residence), telephone number, e-mail, series and the number of the identification document (ID card/passport), personal numerical code as well as the information contained in these documents, voice, call history.
• Data related to the services requested, including details of services booked or provided, details of payments to and from you, including bank account, contact details and identification for people who travel with you, chat history on WhatsApp or social media accounts (Facebook, Instagram, etc.).
• Data regarding candidates (in case of recruitment processes), including candidate details, e-mail address, address, current employer, job history, education, licenses/certifications, information regarding studies as well as other information included in the curriculum vitae.
• Data used for advertising, marketing, and publicity purposes, including name, surname, image, voice, feedback transmitted, ID (username/name used on the social network), and social network account images (in case of ID and images published on social media accounts, Eturia will mention the presence of that person in pictures and videos published on social media accounts or websites belonging to Eturia).
• Special categories of personal data, such as dietary requirements that may reveal your religious or philosophical beliefs and health data

We collect and process the above data only if it’s strictly necessary to provide the travel services you have purchased. In addition, we will collect and process the special categories of personal data mentioned above, only if you have provided us with your explicit consent in this regard. 

You have no obligation to give your consent to process your special categories of personal data unless it is necessary for the provision of booked tourist services. However, without your consent, we cannot take the necessary steps to provide the travel services you have booked or are trying to book. Only if this information is necessary for the provision of tourist services, if you do not provide us with that data and we do not have your consent, we will not be able to provide the booked tourist services

5. Source of personal data

Personal data can be obtained from the following sources:

• directly from you when: you book a package of travel services on circuiterra.net Site, when you subscribe to newsletters or other publications, send testimonials, communicate feedback, and participate in organized contests.

• through the activities you carry out during the period you benefit from the travel services offered, such as photos, WhatsApp chat history

• from third parties, such as when we receive your personal data from third parties requesting the provision of travel services (people traveling with you).

6. Purpose of personal data processing

Eturia collects, processes, and uses personal data:

• for purposes that allow the provision of tourist services booked on the circuiterra.net Website;

• for purposes that enable Eturia to fulfill its purposes relating to its business and its legal obligations;

• to enable the initiation or performance of a contractual relationship with you;

• for advertising, marketing, and publicity purposes;

• for purposes that allow you to participate in competitions and events organized by Eturia for the circuiterra.net project;

• to exercise the rights and obligations of the parties resulting from the contracts signed by the parties or in connection with the services provided;

• to protect the interests of the parties in promoting legal actions and defending against any claims and lawsuits;

• to ensure compliance with the legal provisions regarding the storage and archiving of data/documents;

• to exercise Eturia’s rights in accordance with the legal provisions and comply with legal obligations;

• for purposes subsumed to the general purpose of providing tourist services.

To avoid doubt, Eturia will not use your personal data for advertising, marketing, and publicity purposes unless you expressly consent to do so.

7. Disclosure of personal data

Your personal data will only be disclosed within Eturia to managers and other persons who need access to your personal data ("need to know basis") to perform their specific duties for the purposes listed in point 6 above or where required or permitted by applicable law.

Eturia may also provide your personal data to third parties providing services in connection with booked travel services, IT support services, or technical and organizational services (in connection with activities related to Eturia’s activity) or to legal, audit consultants, or other consultants or suppliers of Eturia, only for the purposes mentioned in this Notice

Eturia will exercise due diligence in selecting third-party service providers and will require that such providers maintain appropriate technical and organizational security measures to protect your personal data and process it in accordance with applicable legal provisions.

Eturia may also disclose your personal data to authorities as required or permitted by law, insurance entities, external consultants, and/or courts. Your personal data will only be disclosed to such third parties to the extent necessary in connection with the performance of contracts, Eturia’s activities, and/or the purposes listed in point 6 above

8. Transfer of personal data outside the EU or EEA

Many of our external travel providers are located outside the European Union (EU) or the European Economic Area (EEA), so the processing of your personal data will involve a transfer of data outside the EU or EEA.

If you have booked a package travel that is located or to be fulfilled outside the EU or EEA, we are obliged and authorized to transfer your personal data to the service provider outside the EU or EEA, in order to fulfill the contract we have with you.

If personal data is processed for advertising, marketing, or advertising purposes and is posted on social networks or transmitted via WhatsApp, the transfer of personal data will take place on servers of social networks that may also be located outside the territory of the European Union, including the United States of America.

Please contact us if you would like further information on the specific mechanism used by us when transferring your personal data outside the EU or EEA.

9. Legal basis for processing personal data

The legal bases of the personal data processing operations described in this Notice are:

• performance of a contract to which you are a party or to take steps before concluding a contract;

• our legitimate interests and/or the need to enter into or execute a contract, in accordance with the legal provisions on data confidentiality.

• your consent

Our legitimate interests or those of a third party include our requirements to use your personal data in litigation, investigations by authorities, data processing for advertising, marketing, or advertising purposes, or for other lawful purposes involving Eturia.

10. Data security

Eturia maintains physical, technical, and organizational security measures to protect personal data against accidental, unlawful, or unauthorized destruction, loss, alteration, disclosure, restriction, or access, wherever processed.

Our security policy governs how we protect your personal data. A copy of this security policy can be obtained from our Data Protection Officer.

11. Duration of personal data storage

We intend to keep your personal data accurate and up to date. We also strive to retain your personal data no longer than necessary to fulfill the purposes listed in this Notice or as required by law.

In this regard, we inform you that Eturia keeps your personal data for the entire duration of your contract with Eturia, as well as a period provided by applicable law after the date of termination of the relationship between you and Eturia.

In addition, please note that certain personal data may also be included in certain accounting documents of Eturia, therefore an extended retention period must be observed in accordance with applicable law.

If you are a candidate for a position offered by Eturia (without formalizing any relationship with Eturia), your personal data made available to Eturia will be kept for a period of 1 year.

As for personal data obtained by means of video surveillance, they will be maintained for a maximum of 30 calendar days from the date of registration, unless there are good reasons to store them for a longer period.

In certain circumstances, we may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without prior notice to you.

12. Processing of personal data for advertising, marketing, and publicity purposes

Image capture (photography, video) or image use (photo, video) are allowed only with your prior consent, and in the case of minors only with the prior consent of their parents. It should be mentioned that the right to image is not absolute, and photographing and using a person’s image is allowed even in the absence of prior consent when they are done in good faith in exercising other fundamental rights such as, for example, the right to freedom of expression or our legitimate interest in ensuring the security and security of persons and property.

In case of consent, Eturia will restrict the use of the image only on its website(s) and only on its main social media, such as Facebook, Twitter, Instagram, WhatsApp, or on websites associated with Eturia, or when displayed for advertising, marketing and advertising purposes at premises, events or presentations.

There are situations or trips where such collections of images or videos are possible, to be announced in advance and if the collection and processing is not desired, the event organizer or the Personal Data Protection Officer can be notified.

If you no longer want us to process your personal data for advertising, marketing or advertising purposes, you can unsubscribe from receiving the newsletter by clicking on the link at the end of the newsletter or you can request this from the Data Protection Officer or leave the WhatsApp group to which you belonged.

13. Your rights regarding personal data collection

Following the applicable provisions regarding personal data, we inform you that you have the following rights, which can be exercised by addressing a request to this effect using the contact details indicated in Section 2 above:

• The right of access to processed personal data, meaning your right to obtain from Eturia a confirmation of whether or not personal data concerning you are processed and, if so, access to such data and the conditions under which they are processed (including the purpose of the processing, the categories of data processed, the recipients of the data).
• The right to request the rectification or deletion of personal data, meaning your right to request the rectification of inaccurate personal data or the completion of incomplete data.
• The right to the erasure of your personal data may be exercised in certain circumstances provided by applicable law, including the situation in which the personal data are no longer necessary for the purposes of the processing, the situation in which the data subject opposes the processing and no other legitimate interests are prevailing for the processing, the situation where personal data have been processed unlawfully.
• The right to request the restriction of processing, meaning your right to obtain from Eturia restriction of processing in the following cases: (i) you dispute the accuracy of the data (the restriction will last as long as Eturia must verify the accuracy of the personal data); (ii) the processing is unlawful and you oppose the erasure of the data by requesting instead the restriction of their use; (iii) Eturia no longer needs the personal data for the purposes mentioned above, but you request the personal data to establish, exercise or defend a right in court; or (iv) you have objected to the processing, for the time during which Eturia verifies whether Eturia’s legitimate rights prevail over your rights.
• The right to object to processing, meaning your right to object to processing on grounds relating to your particular situation, when the processing (i) is based on the legitimate interests of Eturia or a third party, or (ii) to the extent applicable, is carried out for direct marketing communications, involving profiling.
• The right not to be subject to an automatic decision, including profiling.
• The right to data portability, meaning your right to request the move, copying, or transfer of your existing data in Eturia’s database to another database, in a structured, commonly used, and machine-readable format, if the processing is based on a contract and is carried out by automated means.
• The right to file a complaint with the National Supervisory Authority for Personal Data Processing and to address the competent courts.

14. Changes to the Notice

If we drastically change our personal data practices or this Notice, we will issue a revised Notice and/or take other steps to notify you of the changes, in accordance with applicable law.