Privacy policy

C O S T A R I C A T R A V E L P A S S Privacy Policy OneTwoTrail S.R.L. · cédula jurídica 3-101-710189 San José, Costa Rica Effective date: September 30, 2026 This document governs the collection, use, and protection of personal data by the Costa Rica Travel Pass platform. It has been prepared for review by qualified legal counsel admitted in Costa Rica before publication. It does not constitute legal advice.

1. Who We Are Costa Rica Travel Pass is a service operated by OneTwoTrail S.R.L., a company duly incorporated under the laws of the Republic of Costa Rica (cédula jurídica 3-101-710189), with registered offices in San José, Costa Rica ("we", "us", "our", or "the Company"). We operate the website at costaricatravelpass.com and all associated web and mobile applications (collectively, "the Platform"). The Costa Rica Travel Pass ("the Pass") is a travel discount product that provides users with access to partner discounts at tourism businesses across Costa Rica. For questions about this Privacy Policy or our data practices, contact us at: privacy@costaricatravelpass.com or via WhatsApp at our published concierge number. 2. Scope of This Policy This Privacy Policy applies to: • All visitors to costaricatravelpass.com and its subdomains • All registered users of the Platform, including pass holders and partner members • All individuals who interact with us via email, WhatsApp, or social media in connection with the Platform This Policy does not apply to third-party websites, services, or applications that may be linked from our Platform. We are not responsible for the privacy practices of those third parties. 3. Information We Collect 3.1 Information You Provide Directly When you create an account, purchase a Pass, or interact with our Platform, we collect:

• Identity information: full name, email address • Account credentials: email and password (passwords are encrypted and never stored in plain text) • Payment information: we do not store credit card numbers or bank account details. All payment processing is handled by PayPal. We receive only a transaction reference ID and confirmation of payment status. • Trip profile information (optional): travel dates, party size, country of origin, regions visited — collected to improve our service and contribute to Costa Rica tourism statistics • Communications: messages sent to us via WhatsApp, email, or contact forms • Partner business information: if you register as a tourism partner ("aliado"), we collect your business name, contact information, business type, location, and promotional offer details 3.2 Information Collected Automatically When you use our Platform, we automatically collect: • Usage data: pages visited, time on page, search queries, member profiles viewed, itineraries created, and QR code redemption events • Device information: browser type, operating system, screen resolution, and device type • Session data: a randomly generated session identifier stored in your browser for up to 24 hours, used to analyze browsing patterns without identifying you personally • IP address: used for geographic analytics and fraud prevention, not stored linked to individual profiles • Cookies: see Section 9 (Cookie Policy) for full details 3.3 Information from Third Parties We receive information from the following third-party services: • PayPal: transaction confirmation, order reference numbers, and payment status upon successful pass purchase • Meta (Facebook/Instagram): aggregate advertising performance data when you interact with our advertisements. If you click an ad and purchase a Pass, our Meta Pixel records this conversion event. • Google Maps: location data you provide when using map features within the Platform

• Supabase: our database and authentication provider processes your account data on our behalf as a data processor 4. How We Use Your Information 4.1 To Provide the Service • Creating and managing your account • Processing your Pass purchase and generating your QR code • Validating your Pass at partner locations • Sending purchase confirmation emails and receipts • Sending rating request emails after a QR redemption event • Enabling itinerary creation and collaboration features • Providing WhatsApp concierge support 4.2 To Improve the Platform • Analyzing usage patterns to understand which features are most valuable • Measuring conversion rates and purchase funnel performance • Generating anonymous aggregate tourism statistics for internal use and potential contribution to Costa Rica's Instituto Costarricense de Turismo (ICT) • Conducting A/B tests and user experience improvements 4.3 To Communicate With You • Sending transactional emails (purchase confirmation, rating requests, collaboration invitations) • Responding to your support inquiries via email or WhatsApp • Sending service updates and important account notifications

• With your explicit consent: sending marketing communications about new partners, promotions, and travel content 4.4 For Marketing and Advertising • Delivering targeted advertisements on Meta (Facebook and Instagram) platforms using the Meta Pixel • Building retargeting audiences of website visitors for Meta advertising campaigns • Creating lookalike audiences based on anonymized purchaser data to find new potential customers • Measuring the effectiveness of our advertising spend 4.5 For Legal and Compliance Purposes • Complying with applicable Costa Rican law, including the Ley de Protección de la Persona frente al tratamiento de sus datos personales (Law 8968) • Responding to lawful requests from government authorities • Enforcing our Terms of Service and preventing fraud • Resolving disputes and protecting our legal rights 5. Legal Basis for Processing (GDPR) For users in the European Union and European Economic Area, we process your personal data under the following legal bases established by the General Data Protection Regulation (GDPR): • Contract performance (Article 6(1)(b)): processing necessary to provide the Pass service you have purchased or requested • Legitimate interests (Article 6(1)(f)): analytics, fraud prevention, and improving our service, where these interests are not overridden by your rights • Consent (Article 6(1)(a)): marketing communications and the use of non-essential cookies, where we have obtained your explicit consent

• Legal obligation (Article 6(1)(c)): where processing is required by applicable law You have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. 6. How We Share Your Information 6.1 Service Providers (Data Processors) We share your information with the following third-party service providers who process data on our behalf and under our instruction: • Supabase Inc.: database hosting, authentication, and file storage (servers located in the United States) • Vercel Inc.: website hosting and content delivery (servers in multiple regions) • Resend Inc.: transactional email delivery • PayPal Holdings Inc.: payment processing • Google LLC: Maps API integration and Google Analytics • Meta Platforms Inc.: advertising pixel and conversion tracking • PassKit / Wallet pass provider: Apple Wallet and Google Wallet pass generation All service providers are bound by data processing agreements and are required to process data only for the purposes we specify. 6.2 Partner Businesses (Aliados) When you redeem your Pass QR code at a partner location, we share the following information with that partner at the time of redemption: • Your full name • Your Pass validity status (active, expired, or invalid)

• Your Pass expiry date We do not share your email address, payment information, or any other account details with partner businesses. 6.3 Legal Disclosure We may disclose your information to government authorities, courts, or law enforcement agencies where required by applicable law, court order, or governmental regulation, or where we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with a legal obligation. 6.4 Business Transfers If OneTwoTrail S.R.L. is involved in a merger, acquisition, asset sale, or restructuring, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Platform before your information is transferred and becomes subject to a different privacy policy. 6.5 We Do Not Sell Your Data We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We do not allow third-party advertisers to collect your personal information directly from our Platform. 7. International Data Transfers Our Platform is operated from Costa Rica. If you access the Platform from the European Union, Germany, France, or other regions outside Costa Rica, your information will be transferred to and processed in Costa Rica and potentially in the United States (where our service providers are based). Costa Rica has been recognized by the European Commission as providing an adequate level of protection for personal data. For transfers to the United States, we rely on Standard Contractual Clauses and, where applicable, the service provider's participation in applicable data transfer frameworks.

8. Data Retention We retain your personal information for the following periods: • Account information: for the duration of your account, plus 3 years after account deletion or last login, whichever is later • Pass purchase records: 7 years from the date of purchase, as required by Costa Rican commercial and tax law • QR redemption logs: 3 years from the date of redemption • Analytics and usage events: 2 years from the date of collection • Marketing communications consent records: until you withdraw consent, plus 3 years • Support communications: 2 years from the date of last contact When retention periods expire, we securely delete or anonymize your data. Anonymized aggregate data (from which you cannot be identified) may be retained indefinitely for statistical and research purposes. 9. Cookie Policy 9.1 What Are Cookies Cookies are small text files stored on your device when you visit our Platform. We use cookies and similar technologies (local storage, session identifiers) to operate the Platform and understand how it is used. 9.2 Cookies We Use Essential cookies (no consent required): • crtp_session: maintains your login session. Expires when you close your browser or after 30 days of inactivity.

• crtp_language: stores your language preference (EN/ES/FR/DE). Expires after 1 year. • crtp_welcomed: records that you have seen the welcome modal. Expires after 1 year. • crtp_onboarded: records that you have completed the onboarding tour. No expiry. Analytics and performance cookies (consent required for EU users): • crtp_session_id: a random session identifier used to analyze browsing patterns. Expires after 24 hours. • crtp_banner_dismissed: records that you dismissed the promotional banner. Session duration. Marketing cookies (consent required): • Meta Pixel cookies (_fbp, _fbc): set by our Meta Pixel to track conversions and build advertising audiences. Controlled by Meta Platforms Inc. Expires after 90 days. Meta's privacy policy applies: facebook.com/privacy/policy/ • Google Analytics cookies (_ga, _gid): used to analyze website traffic. Controlled by Google LLC. Expires after 2 years (_ga) or 24 hours (_gid). 9.3 Cookie Consent When you first visit our Platform, we display a cookie consent banner. If you are located in the European Union or another jurisdiction with cookie consent requirements, we will only activate marketing and analytics cookies after you have clicked "Accept". You may withdraw consent at any time by clearing your browser cookies and re-visiting the site. 9.4 Managing Cookies Most browsers allow you to control cookies through their settings. Disabling essential cookies will prevent the Platform from functioning correctly. Disabling marketing cookies will not affect your ability to use the Platform but will mean you may see less relevant advertising on third-party platforms. 10. Your Rights 10.1 Rights Under Costa Rican Law (Law 8968)

• Right of access: to know what personal data we hold about you • Right of rectification: to correct inaccurate personal data • Right of cancellation: to request deletion of your personal data • Right of opposition: to object to processing of your personal data 10.2 Additional Rights Under GDPR (EU/EEA Users) • Right to data portability: to receive your personal data in a structured, commonly used, machine- readable format • Right to restrict processing: to request that we limit how we use your data • Right to object to automated decision-making: we do not make solely automated decisions that significantly affect you • Right to lodge a complaint: with your national data protection supervisory authority 10.3 How to Exercise Your Rights To exercise any of these rights, send a written request to privacy@costaricatravelpass.com with the subject line "Data Rights Request". Include your name and the email address associated with your account. We will respond within 30 days. We may need to verify your identity before processing your request. 11. Children's Privacy Our Platform is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@costaricatravelpass.com and we will delete that information promptly. 12. Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include: • Encryption of data in transit using TLS 1.2 or higher • Encrypted storage of passwords using industry-standard hashing • Row-Level Security policies on our database restricting access to authorized users only • Regular security reviews of our database access policies • Access controls limiting employee access to personal data on a need-to-know basis No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authorities as required by applicable law. 13. Links to Third-Party Services Our Platform contains links to partner websites and third-party services including but not limited to Google Maps, Instagram, Facebook, WhatsApp, and partner business websites. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party service you visit. 14. Changes to This Policy We may update this Privacy Policy from time to time. When we make material changes, we will: • Update the "Last reviewed" date at the top of this Policy • Send an email notification to all registered users

• Display a prominent notice on our Platform for at least 30 days Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Policy. If you do not agree with any changes, you should stop using the Platform and may request deletion of your account. 15. Contact Us OneTwoTrail S.R.L. cédula jurídica 3-101-710189 San José, Costa Rica Privacy inquiries: privacy@costaricatravelpass.com General contact: hello@costaricatravelpass.com Platform: costaricatravelpass.com For EU/EEA residents: you also have the right to lodge a complaint with your national data protection authority. A list of EU supervisory authorities is available at edpb.europa.eu. ATTORNEY REVIEW REQUIRED This document is a well-structured starting point. Before publication, it must be reviewed by a qualified attorney licensed in Costa Rica, with particular attention to: (1) Ley 8968 data protection obligations; (2) PRODHAB registration requirements; (3) GDPR adequacy for EU/EEA users; and (4) IVA and e-commerce compliance under Ley 8454.